We tested 6 popular apps to see what data they collect and share. Here’s what we found

Whether you are buying a coffee, groceries, checking the weather or unwinding with an online video, there’s a free mobile app for just about everything.

But a Marketplace investigation shows the cost of this convenience is your privacy – and the data you’re sharing goes far beyond what you might realize.

Marketplace tested six of the most popular Android and iOS apps in Canada — Tim Hortons, PC Optimum, the Weather Network, Facebook, Amazon and YouTube — to find out what data they collect and where it goes.

To do so, Joel Reardon, an associate professor in the department of computer science, and his team at the University of Calgary scanned the network traffic of the apps on an Android device. Privo, an organization that evaluates apps to ensure they comply with U.S. child privacy laws, also did a scan of the apps on iOS, Apple’s operating system.

While doing scans to see the network traffic of mobile apps on Android, some apps appeared to be sending information to outside companies around the world. The network scan above shows the activity from all the apps on someone’s phone, not necessarily the apps Marketplace tested. (CBC)

In their user policies, the apps we tested explicitly disclose that they collect or share certain data and that when you use the app, you accept their terms.

But Reardon and Celeste Rollason, an independent analyst who used to work with Privo, are concerned some apps collect more than they need and are sharing what they learn with others around the world.

That data ranges from your name and email address to your exact whereabouts.

“To me, this is not the internet we wanted. This is not the internet we deserve. It's turned into a monstrous data collection surveillance system,” Reardon said.

Here’s what we learned about each app we tested, and what you can do to protect your data.

Tim Hortons

(CBC)

The scan showed that the Tim Hortons app appeared to be sending data to third-party companies as soon as you launch it. 

Reardon said one overseas third-party company built into the app appeared to be receiving enough information to create the equivalent of a digital fingerprint for each device, so it can be identified in the future.

“This was beyond the pale,” he said.

Some of those details include:

• The name given to the device (for example, Bob’s iPhone).
• An identifier unique to the device.
• A list of many of the sensors on the device.
• The details of the device’s camera (for example, the size of your lens).
• The names of the ringtones and alarm sounds used.
• The names of Wi-Fi routers near you, which Reardon said can be used to determine your location.

Rollason said the third party brands itself as a fraud protection service. She noted the amount of data collected “seems quite excessive” to validate the purchase of a cup of coffee.

Marketplace isn’t identifying any of the third-party companies or their locations because accountability rests with the app developer.

In a statement, Tim Hortons’ director of communications Michael Oliveira said this third party only collects this information for “fraud prevention, account protection, and payment abuse prevention, not for marketing or advertising … or to work around guests’ choices regarding those activities.”

Oliveira said the information collected can help detect if a never-before-seen device is being used on a customer’s account or if a “threat actor” is pretending to be a customer.

He also said the third party is not allowed to sell the data and that Tim Hortons does not sell users’ personal information to third-party companies or data brokers.

PC Optimum

(CBC)

The test showed the PC Optimum app appeared to be sending 10 outside companies information about which products users are searching for — even if the product was sensitive like a search for prenatal vitamins. 

One third-party company appeared to be receiving a user’s latitude and longitude and an identifier unique to the device.

The scan also showed the app sending different details to an overseas third-party including:

• The first name of the user.
• Their unredacted email address.
• Their PC Optimum member number.
• An identifier unique to the device.
• How the user interacts with the app, like when they open the app and what they do in the app.

Reardon and Rollason said the data collection seemed to be more than what was necessary for the app to work properly. Based on their experience, they say they didn’t understand why the app needed 10 outside companies to know what users were searching for.

In a statement, Loblaw, the company behind PC Optimum, said the company has never sold personal information and continually reviews and strengthens its systems to protect people.

It said the information collected through Loblaw apps supports everyday features for customers such as shopping online and finding nearby stores.

The Weather Network

(CBC)

The scan showed that when users allowed the Weather Network app access to their location, it appeared to be sending a third-party company those details for targeted advertising, including:

• A user's precise latitude and longitude.
• The user’s local weather conditions.
• The device’s advertising ID (unique to each device).

Reardon said it could allow the app to send you advertisements based on where you are or “so you could get ads for a rainy day.”

He also noted it creates a “location history, because all of [the data sent] are bridged by this one thing that doesn't change — this device identifier.”

Rollason said understanding a user’s behaviours is key to advertisers.

“Are you using your phone more when it's raining or you're in the house, perhaps, versus going out on a nice day?” she said.

Pelmorex, the parent company of the Weather Network, said in a statement that the Weather Network does not sell any user data to third parties and data brokers. It said the app only uses location data when a user allows it and uses that data to provide the local weather and show relevant ads. It also said users can access the weather without giving the app their location.

Facebook

(CBC)

The scan showed when users give the Facebook app access to their camera roll to post one image, the app appeared to collect the metadata of other images and videos on the device that were not uploaded.

Metadata contains details like the name of the file, the date and time it was taken and the camera settings. 

For whatever image or video is actually posted to Facebook, the scan appeared to show the app also collected the latitude and longitude of where the image was taken.

The app also tracked what users do while using Facebook, including every scroll and how long you linger on something.

Reardon and Rollason noted Facebook didn’t appear to share any data with third-party companies during the scan.

Meta, the parent company of Facebook, had no comment on Marketplace’s findings; however, its privacy policy does state it collects this data. The policy also says “we don't sell any of your information to anyone.”

Amazon

(CBC)

The scan showed Amazon appeared to be collecting what users searched for, even if the product was sensitive, along with the device’s advertising ID.

It didn’t show Amazon sending data to any third-party companies during the scan.

“This is to be expected with these very large companies because they have the resources to have their own ad network,” Reardon said.

Amazon said in a statement it never sells customers’ personal data. It also said it designs products and services to “protect their privacy and to put them in control of their experience."

YouTube

(CBC)

The scan didn’t show YouTube sending data to any third-party companies at the time of the test. The data appeared to only be going to the U.S.

Marketplace also tested if YouTube would follow the rules of its parent company, Google, and not play targeted advertising while a user was watching children’s content.

The test found no targeted ads while watching a children’s video.

Google said in a statement it doesn’t sell personal information.

‘You lack total control’ 

Ann Cavoukian, the former privacy commissioner of Ontario, said Canada’s current privacy laws aren’t strong enough, and the country's privacy commissioners also need to step up.

Speaking generally, she also said companies should be prioritizing people’s privacy by only collecting what they need and deleting data when they don’t need it anymore.

“You lack total control,” Cavoukian said. “It can be used in a variety of unorganized ways. It can come back to haunt you.”

Ann Cavoukian served as the privacy commissioner of Ontario from 1997 to 2014. (CBC)

The Office of the Federal Privacy Commissioner of Canada declined an interview, but a spokesperson said Marketplace’s findings raise “a number of concerns.”

Speaking generally, the office of Canada’s AI Minister Evan Solomon said in a statement that Canadians need privacy protections that “keep pace with changing technology and the ways companies collect, use and share their data.”

His office also noted the government introduced Bill C-36 to give people more control over their information and to force companies to be more transparent and accountable about how they handle people's data. The bill is still before the House of Commons and has received praise and criticism from privacy experts.

How can you protect your data?

Cavoukian said people should ask companies what data is being collected, why it’s being collected and ask that it be deleted as soon as the company doesn’t need it anymore.

Reardon and Rollason said there’s little you can do to stop the transmission of data because apps on your device, and the third parties in those apps, may be sending or collecting information even when your device is out of reach.

They said deleting apps if you’re not using them and only keeping what you need is the best protection.