Are free apps compromising our privacy?

Be careful before you push the 'accept' button next time while downloading a free app that asks for permission to share your personal information with a third party. A new study reports a number of smartphone users finding the frequency of information sharing by these apps as "scary" and "unexpected".

An experiment at Carnegie Mellon University showed that when people learn exactly how many times these apps share that information they rapidly act to limit further sharing. In one phase of a study that evaluated the benefits of app permission managers software that gives people control over what sensitive information their apps can access 23 smartphone users received a daily message, or "privacy nudge", telling them how many times information such as location, contact lists or phone call logs had been shared.

The study used a permission manager for Android 4.3 called AppOps. Some nudges were alarming. One notable example: "Your location has been shared 5,398 times with Facebook, Groupon, GO Launcher EX and seven other apps in the last 14 days."

In interviews, the research subjects repeatedly said the frequency of access to their personal information caught them by surprise. "It felt like I'm being followed by my own phone. It was scary. That number is too high," one participant said. "The number (356 times) was huge, unexpected," another participant said.

"The vast majority of people have no clue about what's going on," said professor Norman Sadeh who supervised the study.The findings would be presented at CHI 2015 in April in Seoul, South Korea. When the participants were given access to AppOps, they collectively reviewed their app permissions 51 times and restricted 272 permissions on 76 distinct apps.

Sadeh said when people download an Android app, they are told what information the app is permitted to access, but few pay much attention, and fewer understand the implications of those permissions. "The fact that users respond to privacy nudges indicate that they really care about privacy, but were just unaware of how much information was being collected about them," Sadeh said.