The cybersecurity firm’s definition sounds authoritative: spyware is software that collects personal information without user consent and transmits it to third parties. Clean, simple, prosecutable.

Except this definition now describes approximately 80 percent of free apps in the Play Store.

The word “spyware” used to mean something specific. It described programs that secretly logged keystrokes, recorded your screen, or tracked your location while hiding their presence. The malicious intent was obvious. The infection vector was usually deceptive. You knew it when you saw it.

That classification system died sometime around 2019, and we’re all pretending it still works.

When legitimate apps do illegitimate things

TikTok reads your clipboard every few seconds when the app is open. This behavior triggered warnings in iOS 14 and caused a brief scandal. Security researchers called it “aggressive” and “concerning.” But TikTok never stopped doing it. Neither did dozens of other apps that exhibited the same behavior.

Under the old definition, reading clipboard contents without explicit user action qualifies as spyware behavior. The clipboard often contains passwords, credit card numbers, personal messages, and authentication codes. Accessing it constantly is surveillance by any reasonable standard.

Yet TikTok has 1.5 billion users and sits comfortably in every major app store. Nobody calls it spyware in official channels. The word feels too strong, too criminal, too liable to invite lawsuits.

The same logic applies to location tracking. An app that constantly reports your GPS coordinates to unknown servers would have been classified as spyware in 2015. Today it’s called “location-enabled advertising” and it’s in the terms of service you clicked through.

The technical definition of spyware hinges on one word: consent. If the user agrees to data collection, even buried in paragraph 47 of a EULA nobody reads, the app escapes the spyware label.

This loophole has become so large you could drive the entire surveillance economy through it.

Weather apps that sell your location history to data brokers get consent via a 12,000-word privacy policy. They are not legally spyware. Flashlight apps that share your contact list with marketing firms get consent through pre-checked boxes during installation. Also not spyware. Shopping apps that build psychological profiles and sell them to insurance companies get consent through “legitimate interest” clauses that require a law degree to understand.

None of this is technically spyware, but all of it meets the functional definition: software that collects personal information and transmits it to third parties for purposes the user would object to if they understood what was happening.

What spyware actually means now

If we’re honest about how apps behave in 2026, the old categories are useless. What matters is not whether an app meets some legal definition of spyware. What matters is what the app does and who benefits.

Here’s a better framework: spyware is any software where the primary beneficiary of data collection is not the user. By this standard, most free apps qualify.

A navigation app that uses your location to provide directions benefits you. The same app selling your movement patterns to hedge funds benefits someone else. The first use case is a feature. The second is spyware dressed in corporate clothing.

A fitness tracker that stores your health data locally and uses it to improve your workouts benefits you. The same app uploading that data to pharmaceutical advertisers benefits them. Same code, different purpose, different classification.

This distinction makes people uncomfortable because it would reclassify huge swaths of mainstream software. Instagram would be spyware. So would most weather apps, nearly all free VPNs, and a solid majority of mobile games. The surveillance is the product, not a side effect.

Why the semantics matter

Calling something spyware has consequences. It gets removed from app stores, flagged by antivirus software, and investigated by regulators. The label carries weight.

Which is exactly why the industry has worked so hard to make the label meaningless.

By expanding “consent” to include anything a user might have technically agreed to under any circumstances, the definition of spyware has been narrowed to near uselessness. Now it only applies to the most blatant malware, the stuff that hides its presence entirely or uses actual exploits to gain access.

Everything else gets reclassified as “aggressive data practices” or “privacy concerns” or “areas for improvement.” These are PR terms, not technical classifications. They describe the same behavior with softer language.

The result is a massive blind spot. Users scan for spyware and find nothing, while 30 apps on their phone are doing exactly what spyware does. The scan comes back clean because the definition is rigged.

The new mental model

Stop asking whether an app is technically spyware. Start asking what it does with your data and who profits.

Does the app collect information you wouldn’t share with a stranger? Does it send that information somewhere you can’t see? Would you be angry if you knew the full scope of what was being recorded and sold?

If the answer to these questions is yes, you’re running spyware. It doesn’t matter what the app store calls it or what the privacy policy says. The behavior is what counts.

The old classification system assumed good faith. It assumed that legitimate companies would respect boundaries and that malware would be obviously malicious. Both assumptions are wrong now.

We need new language that describes what actually happens: mainstream apps engaging in continuous surveillance because the business model demands it. Call it corporate spyware, call it surveillance software, call it privacy-hostile apps. The label matters less than the recognition that normal and acceptable are not the same thing.