Study: 88% of health apps secretly track users across platforms without consent

Tim Cook has spent years positioning Apple as a champion of health and wellness, betting that wearables and fitness tracking will become central to how people manage their lives. Mark Zuckerberg has made similar claims about virtual reality—that devices like the Oculus Quest 2 could help users exercise and improve their overall fitness. The market has responded. Apple Watches are everywhere. Fitness trackers have become ordinary. People now routinely hand over intimate details about their bodies—heart rate, sleep patterns, menstrual cycles, calorie intake—to apps on their phones, trusting that these companies will handle that information responsibly.

A new study from Macquarie University in Australia suggests that trust may be misplaced. Researchers analyzed more than 20,000 health apps available on Google's Play Store, examining everything from symptom checkers to step counters to period trackers. What they found was sobering enough to warrant publication in The British Medical Journal: nearly nine out of ten of these apps are using tracking tools to monitor what users do—not just within the app itself, but across multiple platforms and devices—often without the user's knowledge or explicit permission.

The scale of the health app market makes this finding particularly urgent. As of 2021, nearly 2.87 million apps existed on the Google Play Store alone. Health apps represent a booming sector, targeting not just sick people seeking medical guidance but anyone interested in fitness or wellness. The apps themselves serve legitimate purposes: they help people manage chronic conditions, check symptoms, count steps, track calories, monitor their menstrual cycles. The problem is not the apps' stated function. The problem is what happens to the data they collect.

According to Muhammad Ikram, a lecturer at Macquarie University's Cyber Security Hub, 88 percent of the apps studied employ tracking identifiers and cookies to follow user behavior across devices and platforms. In 87 percent of cases, this data collection was done on behalf of advertisers and similar third parties. The data itself becomes a commodity. Tracking companies and advertisers use it to build profiles of users—their habits, their health concerns, their vulnerabilities—a process Ikram describes as data mining. This profiling happens both explicitly and implicitly, and crucially, it happens without users consenting to it.

The business model underlying many health apps makes this inevitable. Some apps generate revenue by selling subscriptions. Others rely on advertising. Still others sell access to user data itself. When a health app's survival depends on monetizing user information, privacy becomes a secondary concern. The researchers note that health apps face no uniform global standard for privacy protection. A company operating in multiple countries can follow the loosest rules available to it, leaving users in stricter jurisdictions still vulnerable to exploitation.

Google, which operates the Play Store where these apps are distributed, said it is reviewing the study's findings and will take action where warranted. But the company has made similar promises before. The real issue is structural: there is no enforcement mechanism that would prevent a health app from continuing to track users and sell their data to advertisers, provided the app's terms of service—which almost no one reads—technically disclose the practice. Users believe they are sharing health information with a doctor or a fitness coach. In reality, they are sharing it with an advertising network.

For anyone who has downloaded a health app in the past few years, the implications are direct. Your step count, your calorie intake, your sleep data, your symptom searches—all of it may be flowing to advertisers and data brokers who are building a detailed profile of your health and habits. You probably agreed to this when you tapped "accept" on a terms-of-service screen. But agreement and informed consent are not the same thing. The question now is whether regulators will treat them as such.