Mobile App Privacy Lawyer

A mobile phone can reveal an unusually detailed picture of its owner. It travels with the person throughout the day, connects to online accounts, stores photographs and communications, records location information, and interacts with applications used for everything from banking and shopping to healthcare and fitness.

Mobile apps can access some of this information directly. They can also incorporate technology from outside companies that collects data about users behind the scenes.

Many of these practices serve legitimate functions and are not automatically unlawful. Privacy concerns can arise, however, when an app collects more information than users reasonably understand, accesses sensitive device features without appropriate authorization, continues gathering data in the background, or sends personal information to third parties for purposes that were not adequately disclosed.

Net Law Advocates represents individuals nationwide in matters involving mobile applications, digital data practices, and other areas of cyber law.

Mobile Apps Can Collect Data Beyond What Users Enter

Some information collected through an app is obvious.

A banking app needs account information. A navigation app may need a destination. A fitness app may ask a user to enter information about workouts.

Other collection occur through the device itself.

Depending on the application and the permissions granted, mobile apps can potentially access or generate information involving:

• Precise or approximate location
• Device and advertising identifiers
• Photographs and media
• Camera or microphone access
• Contacts
• Bluetooth devices
• Motion and fitness activity
• Health information
• Browsing or app activity
• Device characteristics
• IP addresses
• Purchase and transaction information
• Information about how the app is used

The FTC has advised app developers to limit permissions to information actually needed for an application’s functionality. Its guidance uses the example of a running app that may have a legitimate reason to use location information but not necessarily a reason to access all of a user’s contacts.

The privacy implications therefore depend not simply on whether an app collects data, but on the relationship between the information collected and the service the user expected to receive.

App Permissions Do Not Tell the Whole Story

Modern smartphones allow users to grant or deny applications access to features such as location, photographs, contacts, cameras, and microphones.

Those permission requests are an important privacy control, but clicking “Allow” does not necessarily explain everything that may subsequently happen to the information.

A user might allow a shopping app to access location because the app explains that doing so will identify nearby stores. That does not necessarily mean the user understands that location information could also be combined with information from other sources and used to create advertising profiles.

The FTC’s action involving InMarket addressed a similar distinction. According to the agency, users of InMarket’s apps were told location access would support functions such as earning store rewards or receiving shopping reminders, while the company allegedly also combined location information with other data for targeted advertising. The FTC finalized an order restricting InMarket’s sale and sharing of precise location data.

This illustrates why the purpose communicated to a user can matter alongside the technical permission itself.

Software Development Kits Can Send Information to Other Companies

Many apps contain software written by companies other than the app developer.

These packages are often called software development kits, or SDKs.

An SDK can provide useful functionality without requiring the developer to build everything from scratch. Apps may use SDKs for advertising, analytics, crash reporting, social media integration, maps, payment processing, notifications, and other features.

Some SDKs can also collect information from the people using the app.

The FTC has specifically examined location-data companies that obtained information through SDKs embedded in third-party applications. In enforcement matters involving InMarket and X-Mode, the agency alleged that SDKs installed in other developers’ apps collected precise location information from users whose understanding of those practices was inadequate.

This can create a data relationship the consumer may never see.

The user intentionally downloads one app, but information generated through that app may be transmitted to a completely different company whose technology is operating inside it.

That can raise separate issues involving data sharing without consent when personal information is disclosed to outside parties without appropriate authorization.

Location Data Can Reveal Far More Than Where a Phone Has Been

Location is among the most sensitive categories of information available through a mobile device.

One location point may reveal relatively little. A continuing history of precise locations can tell a much more detailed story.

It may indicate where someone lives and works, along with visits to medical facilities, religious institutions, shelters, schools, political gatherings, and other places associated with private aspects of a person’s life.

Federal regulators have repeatedly focused on these risks.

In 2025, the FTC finalized an order prohibiting data broker Mobilewalla from selling sensitive location information after alleging that the company tracked and sold data revealing visits to places including healthcare facilities and places of worship.

In 2026, the FTC announced an order resolving its litigation against Kochava that prohibits the company and its subsidiary from selling, sharing, or disclosing sensitive location data without consumer consent under the terms of the order. The FTC’s allegations involved location information from hundreds of millions of mobile devices.

These cases do not mean that every application collecting location information violates the law. They demonstrate why what happens to location data after collection can be as important as the initial permission to access it.

Background Data Collection Can Be Difficult for Users to Recognize

Opening an app and actively using it is only one opportunity for data collection.

Depending on the operating system, permissions, and application configuration, some apps can perform functions while they are not actively displayed on the screen.

Location provides a familiar example. An application designed to provide navigation or location-based services may request access while the app is in use, while other functionality may involve access at additional times.

Background activity can create a different privacy expectation because users may not realize information continues to be generated after they stop actively interacting with the application.

An analysis of a potential privacy issue may therefore consider not only what data an app can access but also when the collection occurs and whether that timing was adequately explained.

Mobile Advertising Identifiers Can Help Connect Activity to a Device

Smartphones can contain identifiers used by the advertising ecosystem.

These identifiers do not necessarily display someone’s name, but they can allow activity associated with the same device to be recognized over time.

The FTC’s X-Mode matter described raw location information associated with mobile advertising IDs and alleged that such data was capable of connecting an individual device to locations its user visited.

The distinction between an identifier and a person’s name can therefore be misleading if the identifier allows a company to repeatedly recognize the same device or can be connected with additional information.

This broader practice of connecting behavior across services overlaps with online tracking and privacy, while mobile privacy focuses more specifically on the information and capabilities available through smartphones and applications.

Health and Fitness Apps Can Hold Particularly Sensitive Information

People increasingly use mobile applications to track highly personal aspects of their lives.

Health-related apps can collect information concerning medications, medical conditions, exercise, sleep, diet, fertility, menstrual cycles, mental health, addiction, heart rate, and other aspects of a person’s physical or emotional well-being.

The FTC explains that federal privacy and security requirements can apply to health apps depending on how the application operates and what information it maintains. The FTC Act also prohibits unfair or deceptive practices involving the privacy and security of personal information collected or shared by apps.

An important misconception is that every health-related application is automatically governed by HIPAA. That is not the case.

HIPAA applies to specified covered entities and business associates. Other health applications may instead fall under different federal and state privacy frameworks, including the FTC’s Health Breach Notification Rule in qualifying circumstances. The FTC states that the Rule can apply to many health apps that are not covered by HIPAA and that meet the Rule’s requirements.

The legal analysis therefore depends on the app, the information involved, how it is collected or shared, and which law applies.

Children’s Apps Can Present Additional Privacy Concerns

Apps directed toward children can be subject to additional privacy protections.

The federal Children’s Online Privacy Protection Act and its implementing rule, commonly referred to as COPPA, regulate certain collection, use, and disclosure of personal information involving children under 13.

Third-party software does not necessarily remove those responsibilities.

In a 2025 enforcement matter involving Apitor Technology, the FTC alleged that a children’s app incorporated a third-party SDK that allowed collection of children’s geolocation information without the required parental notice and consent. The FTC emphasized that covered companies can have responsibilities when third-party software collects information through their services.

The rules governing children’s information are specialized, but the example demonstrates a broader mobile-privacy issue: an app developer’s choice to incorporate outside technology can affect what information leaves the user’s device.

Privacy Policies Should Match What the App Actually Does

Consumers often rely on privacy policies and app-store disclosures to understand what information an application collects.

Those disclosures can become important when actual practices differ from what users were told.

An app might state that it collects location to provide a particular feature while its underlying technology also sends that information to advertising or analytics companies. A privacy policy might promise limited use of information even though outside software receives the data for additional purposes.

The FTC Act prohibits unfair or deceptive acts or practices, and the agency has applied that authority to privacy and security representations involving mobile applications.

The relevant question is not merely whether the app has a privacy policy. The content of that policy and whether the company’s actual practices are consistent with its representations can matter.

Deleting an App Does Not Necessarily Delete Previously Collected Data

Removing an application from a phone generally prevents the installed app from continuing to operate on that device, but it does not necessarily erase information the company already collected.

Data may remain on company servers or with outside providers that previously received it.

Whether a user has the right to request deletion depends on the applicable law, type of information, organization involved, and circumstances.

Some state privacy statutes provide qualifying consumers with deletion and other rights concerning personal information held by covered businesses. Those rights and their limitations are addressed more broadly through Net Law Advocates’ discussion of consumer data privacy rights.

This distinction matters because control over an application and control over data already transmitted from that application are not the same thing.

A Mobile Privacy Issue Does Not Require a Data Breach

Privacy incidents and security breaches are related but distinct.

An app developer might intentionally configure an application to collect information and send it to an advertising provider. The transmission could raise privacy concerns even though no hacker entered the company’s systems.

A data breach, by contrast, generally involves unauthorized access to or exposure of information through a security incident.

An app can also experience both problems. It may collect sensitive information through questionable practices and later suffer a breach that exposes the information to unauthorized parties.

When personal information is exposed because of a security incident rather than the company’s intentional data practices, the matter may implicate data breach litigation in addition to mobile privacy issues.

When Can Mobile App Data Collection Become a Legal Issue?

The presence of an application on someone’s phone does not give the developer unrestricted authority to collect or use every category of information available from the device.

At the same time, unexpected collection does not automatically create a private lawsuit.

Potential legal issues can depend on:

• What information the app collected
• Whether the information was necessary for the requested service
• What permissions the user granted
• What the app and privacy policy disclosed
• Whether sensitive information was involved
• Whether third-party SDKs received information
• How the information was subsequently used
• Whether the user exercised an applicable privacy choice
• Where the affected individual lives
• Which federal or state laws apply
• Whether the applicable law permits an individual claim

These questions can become particularly important when location, health information, children’s data, communications, biometric information, or other sensitive information is involved.

The FTC has emphasized that companies should limit mobile-app access to information actually needed for their services and provide effective notice concerning sensitive or unexpected data collection.

Whether particular conduct violates the law requires a fact-specific analysis.

Evidence Can Help Show What an App Was Allowed to Access

Mobile privacy disputes can be difficult because much of the relevant activity occurs in the background.

Users may nevertheless have information that helps establish how an application operated.

Useful materials can include:

• Screenshots of permission requests
• App-store privacy disclosures
• Privacy policies
• Account privacy settings
• Location-permission settings
• Emails or notices from the developer
• Screenshots showing unexpected activity
• Records of privacy requests
• Information identifying advertising or analytics partners
• The version of the application installed when the issue occurred

Technical analysis can sometimes provide additional information about network communications, embedded SDKs, device identifiers, and the outside services contacted by an application.

Together, those materials can help determine what the user was told, what permission was granted, and what information may actually have left the device.

Mobile Privacy Connects Several Digital Privacy Issues

Mobile applications sit at the intersection of many privacy concerns.

An app may collect information through device permissions, use identifiers to observe behavior over time, transmit information through an SDK, and allow outside companies to use that information for advertising or profiling.

Each stage presents a different question.

Unauthorized data collection focuses on whether information was improperly obtained. Online tracking and privacy addresses the broader observation and profiling of digital behavior. Data sharing without consent focuses on disclosure to other parties.

Mobile app privacy brings those concepts together within the uniquely data-rich environment of a smartphone.

Speak With Net Law Advocates About Mobile App Privacy

Mobile privacy concerns can be difficult to identify because users may see only a permission request while the more complicated collection and sharing occurs behind the application’s interface.

Determining whether a potential claim exists can require examining the information collected, app permissions, disclosures, third-party SDKs, how the information was used or shared, and the federal or state laws that apply.

Net Law Advocates represents plaintiffs nationwide in cyber and privacy matters. If you believe a mobile application improperly collected, tracked, used, or shared your personal information, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.