5,820 Android Apps Analyzed. 62% Carry Real Privacy Risk.
The Q3 2026 edition of the AppXpose privacy report. Every number below comes from real device scans and verified tracker detections in our production corpus. No estimates, no marketing numbers.
What Kinds of Trackers Hide in Android Apps?
274 verified tracker signatures: 136 known industry prefixes plus 138 discovered and confirmed by AppXpose community scans
Analytics and advertising still dominate. 87 of 274 signatures exist to measure you or to sell your attention. The fastest-growing group is community-discovered: 138 signatures were found in real APK code by AppXpose scans, 49 of them so new they are still awaiting categorization.
Which App Categories Track You Most?
Average trackers detected per app by Play Store category, after transitive-dependency deduplication
Shopping apps now lead the tracker race. The apps you use to spend money average 5.1 trackers each, ahead of news (4.0) and social media (3.6). Note the methodology change: since our v6.3.4 deduplication update, bundled SDK dependencies are no longer double-counted, so these averages are deliberately conservative and not directly comparable to the Q2 2026 edition.
How Risky Are Your Apps?
Risk score distribution across 5,055 fully scored apps
1 in 8 scanned apps scores HIGH risk. That is 613 apps actively putting user data at risk, and for the first time the MEDIUM bracket alone covers half of everything we scan.
The Most Tracker-Loaded Apps We've Found.
Highest verified tracker count per app in our corpus, bar color shows risk level
Your smart light bulb is a surveillance hub. Smart home companion apps Geeni (39 trackers) and Cync (32 trackers) sit near the top of the list, and Google's own Analytics app ships 40 tracker SDKs. High tracker counts don't always mean high risk scores, but they always mean your data flows to dozens of third parties.
What Permissions Do Risky Apps Request?
Found in the 613 HIGH-risk apps only
62% of HIGH-risk apps carry the advertising ID permission, and 58% track where you installed them from. The top four permissions in risky apps are all advertising infrastructure. Camera, location, and microphone follow close behind. These aren't features. They're surveillance infrastructure.
Permission Risk Heatmap.
% of apps per category requesting each permission
Swipe sideways to see all permissions →
How This Data Was Collected.
Corpus. 5,820 unique Android apps scanned by real AppXpose users between launch and July 2026. Tracker detections come from on-device DEX bytecode extraction matched against 274 verified signatures, not from static package lists.
Deduplication. Since v6.3.4, transitively bundled SDKs (for example Firebase pulled in by AdMob) count once, not twice. Tracker averages in this edition are therefore lower and more accurate than in the Q2 2026 report. Growth numbers between editions compare corpus size, not per-app averages.
Risk scores. 5,055 of the 5,820 apps have a complete AI-assisted risk assessment (0 to 100) combining trackers, permissions, data-sharing declarations, and breach history. Thresholds: LOW under 30, MEDIUM 30 to 59, HIGH 60 to 79, CRITICAL 80 plus. Details on how scoring works.
Community discovery. Suspicious SDK code signatures found during scans are confirmed as trackers once they appear in 3 or more independent apps. 138 signatures were confirmed this way, growing daily.
Scan Your Own Apps.
See what's really running on your phone. Takes 30 seconds. No sign-up needed.
GET IT ON JETZT BEI Google Play