These are not estimates. These are not based on privacy labels or developer declarations. Every number in this post comes from scanning the actual APK bytecode, matching compiled classes against verified tracker signatures, and counting what we find.

The AppXpose corpus contains over 3,745 scanned apps. The tracker counts below come directly from that dataset. If you are not sure what a tracker SDK actually is and how it ends up in your apps, start there.

Here are the 15 apps with the highest tracker counts we have found so far.

1. Match Masters

41 trackers. Risk score: LOW.

The highest tracker count in our entire corpus belongs to a casual puzzle game. Match Masters ships with 41 distinct tracking SDKs: attribution platforms, ad mediation networks, analytics providers, and crash reporters. The reason the risk score is still LOW is that the trackers are almost entirely advertising SDKs. The app does not request dangerous permissions beyond what a game needs.

This is an important distinction. Tracker count is not the same as risk. A game loaded with ad SDKs is different from a health app with 15 trackers and microphone access.

2. Doc Scanner

35 trackers. Risk score: HIGH.

A document scanner with 35 tracking libraries is harder to justify than a game. Scanners handle sensitive content: contracts, IDs, medical records. The combination of high tracker density and access to your camera and storage pushes this into HIGH risk territory.

3. BestPlay

34 trackers. Risk score: HIGH.

A video streaming app packed with 34 SDKs, most of them advertising and analytics trackers. HIGH risk comes from the combination of tracker count, broad permissions, and limited developer transparency.

4. Canva

31 trackers. Risk score: MEDIUM.

Canva is a mainstream design tool used by millions. It ships with 31 tracker SDKs, including analytics, attribution, and advertising libraries. The MEDIUM risk score reflects that most of these serve legitimate product functions, but the sheer number means your usage patterns are shared with dozens of third parties.

5. AI Browser - Safe & Fast

30 trackers. Risk score: HIGH.

The name promises safety. The bytecode delivers 30 tracking SDKs. This is one of the starkest examples in our corpus. A browser has access to every URL you visit, every search query, every form you fill out. Combining that access level with 30 tracker libraries makes the name read more like irony than marketing.

6. Samsung Health

29 trackers. Risk score: MEDIUM.

A health app from a major manufacturer. Samsung Health ships with 29 trackers, including analytics, advertising, and attribution SDKs. Health apps collect some of the most sensitive data on your phone: heart rate, sleep patterns, exercise habits, weight. That data flowing through 29 third-party libraries is worth knowing about.

7. Angel (The Chosen)

27 trackers. Risk score: HIGH.

A streaming app for a religious media franchise. 27 trackers is aggressive for a content consumption app. The HIGH risk score comes from the tracker count combined with broad permission requests that go beyond what a video player needs.

8. Plague Inc.

26 trackers. Risk score: MEDIUM.

A popular simulation game with 26 advertising and analytics SDKs. The pattern is similar to Match Masters: heavy ad monetization means heavy tracker density. MEDIUM risk because the permissions stay within expected bounds for a game.

9. Musicstre.am

25 trackers. Risk score: HIGH.

A music streaming app with 25 tracking libraries and a HIGH risk assessment. The combination of tracker count, permission scope, and limited developer information drives the score.

10. TikTok

14 known trackers. Risk score: HIGH.

TikTok’s tracker count is lower than the apps above, but it makes this list because of what those trackers do in combination with the app’s permissions. TikTok requests access to camera, microphone, contacts, location, and clipboard. ByteDance’s data handling practices have been the subject of multiple government investigations across the US, EU, and Australia. The HIGH risk score is not about tracker count alone. It is about the combination of access, data volume, and jurisdiction.

11. Instagram

Multiple Meta trackers. Risk score: HIGH.

A 2022 Oxford study found Instagram collects 79% more data than it needs to function. Our scan results for Instagram confirm multiple analytics and advertising SDKs from Meta’s ecosystem. As with all Meta apps, the tracking infrastructure is deeply integrated into the app’s core functionality, not bolted on as an afterthought.

12. Facebook

Most tracked social app in our corpus. Risk score: HIGH.

Facebook’s scan results show the densest tracking profile of any social media app we have analyzed. Multiple ad networks, analytics providers, and Meta’s own behavioral tracking infrastructure. The app has been documented by Mozilla, Oxford, and multiple independent audits as one of the most data-intensive consumer applications on Android.

13. AliExpress

Aggressive shopping tracker profile. Risk score: MEDIUM.

Shopping apps are the second most tracker-dense category in our corpus, averaging 11.3 trackers per app. AliExpress sits above that average with a combination of advertising, analytics, and attribution SDKs. The app requests location access, which is common for delivery apps but also feeds geotargeted advertising.

14. Spotify

Analytics heavy. Risk score: MEDIUM.

Spotify’s scan results show multiple analytics and attribution SDKs. For a music app, the tracker density is notable. Every song you play, every playlist you create, every skip and repeat becomes a data point shared across multiple third-party analytics providers.

15. Amazon Shopping

Shopping category leader. Risk score: MEDIUM.

In our corpus, 94% of shopping apps request camera access. Amazon Shopping follows this pattern. The combination of purchase history, browsing behavior, and device identifiers flowing through multiple advertising and analytics SDKs makes this one of the more data-intensive apps in the shopping category.

What These Numbers Mean

High tracker count does not automatically mean HIGH risk. Match Masters has 41 trackers and a LOW risk score. The scoring model evaluates context: what the trackers do, what permissions they combine with, whether the developer is transparent, and whether there is breach history.

A game with 41 ad SDKs is annoying but relatively low-stakes. A health app with 15 trackers and microphone access is a different calculation entirely. A browser with 30 trackers has access to everything you do online. The same number means different things in different apps.

You can explore the full research data covering 3,745 analyzed apps to see how tracker counts distribute across categories. You can also read about how the detection pipeline and scoring model works to understand what goes into each risk assessment.

If you want to check where your own apps rank, AppXpose scans the bytecode directly. No estimates, no self-reported labels, no guesswork. You can also find hidden trackers with a detailed walkthrough if you prefer a manual approach.

AppXpose is free on Google Play. Five scans a week, full results, no account required.