The average Android phone has 80 apps installed. According to a 2018 study by Reuben Binns and colleagues at Oxford, over 90% of free apps on the Play Store contain at least one third-party tracker. That means somewhere between 60 and 75 of the apps on your phone are reporting data to companies you have never heard of.

Google Play does not tell you this. The privacy labels that appeared in 2022 are self-reported by developers and, as Mozilla found in their 2023 audit, inaccurate in roughly 80% of cases. You are left to figure it out yourself. Here is how.

What Is a Tracker SDK?

A tracker is a chunk of code bundled inside an app that collects data about you and sends it to a third party. Not to the developer who built the app. To someone else entirely.

Developers do not usually add them out of malice. They import pre-built libraries that solve real problems: crash reporting, analytics, ad attribution, push notifications. Each library comes from a company. Firebase from Google. Adjust from Adjust GmbH. Facebook SDK from Meta. When that library runs on your phone, it phones home. It collects device identifiers, usage patterns, sometimes location. It does this quietly, in the background, using whatever permissions the host app already has.

These libraries fall into categories. Analytics trackers measure what you do inside the app. Advertising trackers build profiles for targeted ads. Attribution trackers figure out which ad made you install something. Location trackers sell geofencing data. Crash reporters collect device state when something breaks. Most apps bundle several of these at once. For a deeper explanation of what a tracker actually is and how it ends up in your apps, we wrote a dedicated piece.

Why Google Play Does Not Tell You This

Google introduced Data Safety labels in 2022. Every app listing now includes a section where the developer declares what data they collect and share. The problem is enforcement, or rather the lack of it.

Mozilla’s “Privacy Not Included” team compared privacy labels to actual app behavior across hundreds of apps in 2023. Their finding: the labels were inaccurate or misleading in roughly 80% of cases. Developers declare “no data shared with third parties” while bundling six advertising SDKs that do exactly that.

The Oxford study from Binns et al. (2018) found that the median free app contained five trackers, with Alphabet subsidiaries present in over 88% of apps examined. This was before Google added privacy labels at all. The labels did not fix the problem. They added a layer of self-reported assurance on top of it. We wrote about what independent studies actually say about app store claims in more detail.

Which Apps Have the Most Trackers?

We have scanned over 3,745 apps through the AppXpose corpus. The numbers vary by category, but some patterns are consistent.

Finance apps are the worst. They average 13.5 trackers per app. That is not a typo. Your banking app likely contains more tracking code than a social media app. Shopping apps come in at 11.3 on average. Weather apps, which should be among the simplest, can hit 20 trackers.

Individual outliers go further. Match Masters, a casual game, ships with 41 trackers. An app called “AI Browser - Safe & Fast” contains 30 tracking SDKs despite the name promising safety. These are not obscure apps. They sit on the Play Store with millions of downloads.

Even apps you trust are not clean. Instagram’s privacy scan shows multiple analytics and advertising SDKs bundled into the app. Facebook’s scan results are worse. You can explore the full research data covering 3,745 analyzed apps to see the category breakdowns, distribution charts, and the most tracker-heavy apps in the corpus.

How to Scan Your Android Apps for Trackers

There are two approaches to finding trackers. Dynamic analysis watches network traffic while an app runs, recording what it sends and where. This works but requires technical setup, a VPN or proxy, and patience. It also only catches trackers that fire during your testing window.

Static analysis reads the app’s compiled code directly, looking for known class names, package prefixes, and code patterns that match tracker libraries. It does not need the app to be running. It checks what is in the code, not what happens to fire at a given moment.

AppXpose uses static analysis on your device. It reads DEX bytecode from installed APKs, matches against over 270 verified tracker signatures, and reports what it finds. No upload, no cloud processing, no account. The scan runs locally on your phone and takes about three seconds per app. You can read about how the detection pipeline and scoring model works in full detail.

This is the same approach academic researchers use to audit apps at scale. The difference is that you can do it on your own phone, on the apps you actually use, without a PhD or a packet sniffer.

What the Risk Score Means

Every AppXpose scan produces a risk score from 0 to 100. The score is not a single number pulled from a hat. It combines deterministic factors, things that are objectively measurable, with AI-assisted analysis of the overall picture.

The thresholds are straightforward. 0 to 29 is LOW risk. 30 to 59 is MEDIUM. 60 to 79 is HIGH. 80 to 100 is CRITICAL. Deterministic factors include tracker count, dangerous permission count, known data breaches, and APK integrity. The AI component evaluates context: is this tracker count normal for this category? Does the app need these permissions for its stated function?

You can see how scores distribute across the full corpus in our research data. About 42% of apps score LOW. Nearly 45% land in MEDIUM. The remaining 13% are HIGH or CRITICAL. Only a handful cross the CRITICAL threshold, but they exist.

What to Do When You Find Trackers

Finding trackers is the first step. Deciding what to do with that information is the second.

Start with permissions. Go to your phone’s Settings, then Privacy, then Permission Manager. Check which apps have access to Location, Microphone, Camera, and Contacts. If an app has permissions that do not match its function, revoke them. A weather app does not need your microphone.

Then compare. If two apps serve the same purpose but one has 3 trackers and the other has 12, the choice is clear. WhatsApp’s scan results show it is possible to build a messaging app used by billions without stuffing it full of advertising SDKs. Not every app takes that path, but alternatives exist, and knowing the tracker count makes the comparison possible.

For apps you cannot replace, at least be informed. Knowing that your banking app has 14 trackers does not mean you should delete it. It means you should not give it location permission, should not leave it running in the background when you do not need it, and should check your settings after every update.

The Bigger Picture

The privacy label system is broken. It relies on developers accurately reporting their own data collection, which most do not. Independent audits repeatedly confirm this, but the system has not changed.

Static analysis is not a perfect replacement. It catches known tracker signatures but cannot detect novel tracking methods or server-side data collection. It tells you what code is present, not necessarily what that code does at every moment.

But it is real. It is verifiable. And it puts information in the hands of the person who needs it most: the person whose phone is being tracked.

The AppXpose corpus has grown past 3,745 scans and continues to expand with every user who runs the app. Every scan adds another data point. Every new tracker signature improves detection for everyone. The trackers rely on nobody checking. The fix starts with checking.

If you want to see what is running on your own phone, AppXpose is free on Google Play. Five scans a week, full results, no account required.