Apps That Collect or Share Data: What to Check
Every app collects something. The useful question is what, for which purpose, and who else receives it. This guide shows where to find those answers before an app reaches your students or staff.
App Store data privacy labels, explained
Scroll down any App Store page to App Privacy. The label groups what the developer says the app collects, and the summary on the product page splits it into a few clear blocks.
What sits inside each block
Apple's label uses fixed data types, so labels can be compared across apps:
Each data type is tied to one or more purposes:
What the label tells you
- Answers come from the developer, entered in App Store Connect before new apps and updates are accepted.
- Developers must include what their third-party partners collect, such as analytics tools, advertising networks and SDKs.
- Developers can change their answers at any time without releasing an update.
How to read it quickly
- Any data in the tracking block is a red flag for student devices.
- Location, Contacts and User Content linked to the user deserve a second look.
- "Data Not Collected" is a claim, not a test result. Compare it with the permissions the app requests.
Google Play Data safety, explained
On Android, open the app's Play listing and find Data safety. It is built from the Data safety form that developers fill in through Play Console, and it answers three questions: what is collected, what is shared, and how it is protected.
| Part of the section | What it means | What to look for |
|---|---|---|
| Data collected | Data sent off the device by the app. Data processed only on the device does not count. | Whether collection is optional or required for the app to work |
| Data shared | Data passed to other companies. Transfers to service providers working for the developer are generally excluded. | Any sharing of location, contacts, messages or IDs |
| Security practices | Whether data is encrypted in transit and whether users can request deletion. | Both should be yes for any school or work app |
| Badges | Optional independent security review, and a Families policy commitment for apps aimed at children. | The Families commitment for apps used by young students |
| No data statement | Shown when the developer declares no collection or sharing. | Check it against the permissions list |
Google Play data types
Developers complete the form themselves, including data collected by SDKs in their app. Google reviews it as part of app review but says it does not verify the answers, and it can act when it finds discrepancies.
App Store privacy labels vs Google Play Data safety
Both stores ask similar questions, but the answers are shaped differently. When you vet an app that runs on both platforms, read both versions; they do not always match.
| Question | App Store (App Privacy) | Google Play (Data safety) |
|---|---|---|
| Who fills it in? | The developer, in App Store Connect | The developer, in Play Console |
| Covers SDKs? | Yes, third-party partners must be included | Yes, libraries and SDKs must be included |
| Tracking shown separately? | Yes, data used to track you has its own block | No separate block; look at Data shared |
| Linked to identity? | Yes, linked and not linked are split | Not split this way |
| Security practices? | Not part of the label | Encryption in transit and deletion requests shown |
| Children's apps | Kids category and age rating | Families policy commitment badge |
To compare the two listings you need both IDs. The App Store ID lookup returns the bundle ID and, when we know it, the matching Android package.
Permissions show what the app can touch
Labels describe intent. Permissions are what the operating system actually allows. Ask whether each permission makes sense for what the app does.
Location
Precise location reveals homes and schools. Approximate location is enough for most apps.
HighContacts
Uploads other people's details, who never agreed to the app's terms.
HighMicrophone
Needed for calls and voice notes. Questionable for a calculator or game.
HighCamera
Common and often fine, but photos of classrooms can include other students.
MediumPhotos
Full library access exposes every photo. Limited access shares only chosen ones.
MediumKeyboard full access
A third-party keyboard with full access can send what is typed off the device.
HighVPN configuration
An app that adds a VPN can route all device traffic through its servers.
HighAccessibility service
On Android this can read the screen and act for the user. Rarely needed outside assistive apps.
HighBluetooth and local network
Lets an app find nearby devices, which can reveal location indirectly.
MediumTracking request
On iPhone, apps must ask before tracking across other companies' apps and sites.
MediumNotifications
Low data risk, but a common route for engagement prompts and ads.
LowUsage access
On Android, shows which other apps are used and when.
MediumCheck what apps really did, not only what they asked for. On iPhone, the App Privacy Report under Privacy and Security settings lists data access and contacted domains per app. Android's privacy dashboard shows recent permission use.
Which apps tend to collect the most data
The type of app predicts a lot. These kinds see the most personal data because of what they do, so they deserve the closest reading. Always check the specific app; type is a starting point, not a verdict.
Free apps funded by ads
Games and utilities that earn from advertising usually include ad and analytics SDKs.
Social networks
Posts, photos, contacts, messages and often location, all linked to a profile.
Free VPN apps
All device traffic passes through the provider, whatever the label says.
AI chat apps
Prompts, uploaded files and photos of worksheets are stored by the service.
Keyboards
A keyboard sits under every text field on the device.
Photo and face editors
Faces and photos are often processed on remote servers.
Location sharing apps
Continuous location is the product, shared with a circle of people.
Shopping and coupon apps
Purchase history, browsing and identifiers support marketing.
"Cleaner" and booster utilities
Simple tools that ask for photos, contacts or usage access they do not need.
"Privacy apps" on managed devices
Searches for privacy and security apps turn up three kinds that behave very differently on a school or work device. Decide on each kind before a user asks.
Privacy browsers
Block trackers in web pages, which is good, but they are also a second browser outside your managed one.
Consumer VPNs
Sold as privacy tools, yet they move all traffic to a third party and past your filter.
Photo and app vaults
Hide photos or apps behind a second passcode, sometimes disguised as a calculator.
Privacy policy for educational apps: what it should say
For school apps, the store label is only the start. The privacy policy and the district's data agreement carry the commitments that matter. Use this list when you read one.
Should be stated clearly
- Exactly which student data is collected, and why
- No sale of student data and no targeted advertising to students
- How long data is kept, and how the school can delete it
- Which sub-processors receive data, and where it is stored
- How parents and schools can access and correct records
- Security measures and a breach notification commitment
- How the app handles users under 13 and consent rules such as COPPA in the US
Warning signs
- "We may share data with partners" with no list of partners
- Rights to use student content for any purpose
- Policy changes take effect without notice
- No contact for privacy questions
- A consumer policy only, with nothing for schools
- Store label and policy that contradict each other
For the full district process, read our guides to edtech app vetting and student data privacy and apps. Approved apps belong on a published approved apps list.
Writing a policy for your own app instead? There is no shortcut template: your policy has to match what you declare in App Store Connect and Play Console. Have it reviewed by someone qualified in your markets.
MDM controls that limit data sharing
Labels help you choose apps. MDM limits what the apps you allow can do with work and school data. These controls are the ones most worth turning on.
| Goal | iPhone and iPad | Android Enterprise |
|---|---|---|
| Keep work files in work apps | allowOpenFromManagedToUnmanaged set to false: managed documents open only in managed apps | Work profile separation, plus limits on copying between profiles |
| Keep personal files out | allowOpenFromUnmanagedToManaged set to false | Restrict sharing into the work profile |
| Protect contacts | allowManagedToWriteUnmanagedContacts left at its default of false | Limit cross-profile contact access |
| Reduce ad tracking | forceLimitAdTracking set to true, which also stops apps asking to track | Approve only vetted apps in Managed Google Play |
| Control permissions | Users answer prompts; block apps whose requests do not fit | A default runtime permission policy (deny or prompt); names vary by console |
| Stop diagnostics to Apple | allowDiagnosticSubmission set to false | Device policy settings; check the current admin console |
| Preconfigure apps | Managed app configuration pushed by MDM | Managed configurations for supported apps |
Managed app configuration lets you sign apps into school or company accounts and turn off features, where the developer supports it. It is often the cleanest way to keep data inside an approved account. Work profile details are in our guide to Android work profile app blocking.
MDM data privacy on personal phones
Staff often ask what IT can see. On personal phones, the honest answer is less than people fear, provided you enroll them the right way.
What the organization manages
- Work apps, work accounts and their data
- Security settings such as passcode rules
- Removal of work data when someone leaves
What stays personal
- With Apple User Enrollment or an Android work profile, personal apps and content stay outside the organization's view
- Personal photos, messages and browsing
- Anything else, per your MDM's own privacy statement
Write these limits into your BYOD app policy. Apps staff install on their own, and the data they hold, are covered in our guide to shadow IT mobile apps.
App data review checklist
Work through this list for any app a teacher, department or team asks to add. Tick as you go; the boxes are for your own use on this page.
What our app database includes, and what it does not
We are clear about this because it matters for your review. Our data identifies and categorizes apps; it does not grade their privacy.
Included for 1.87 million iPhone and iPad apps
- App Store ID, bundle ID, name and developer
- Developer website domain
- App Store genre, age rating and content advisories
- Rating count
- Our categories, from 58 web filtering categories, plus an IAB Content Taxonomy 3.0 category
- Google Play package names for 670,000+ apps on both stores
Not included
- App Store privacy labels
- Google Play Data safety answers
- Privacy or security risk scores
- Permission lists
Use the store listings and this checklist for privacy. Use our categories to block whole groups of apps at once, and the mobile app database if you build products on app data.
Apps and data: frequently asked questions
How can I see what data an app collects?
Read the App Privacy section on the App Store page and the Data safety section on Google Play, then check the permissions the app asks for and its privacy policy. On iPhone, the App Privacy Report shows which apps actually used sensitive data and which domains they contacted.
Does Apple or Google verify privacy labels?
Developers fill in both themselves. Apple makes developers responsible for keeping their answers accurate and current. Google reviews Data safety forms during app review but says it does not verify their accuracy, and it can take action when it finds discrepancies.
What is the Google Play Data safety form?
It is the form developers complete in Play Console to describe what data their app collects and shares, why, and their security practices such as encryption in transit and deletion requests. Google shows the answers as the Data safety section on the app's store listing.
Which apps collect the most data?
Apps funded by advertising, social networks, free VPNs, AI chat apps, third-party keyboards, photo and face editors and location sharing apps tend to see the most personal data because of what they do. Always check the specific app's label and permissions rather than relying on its type.
Can MDM see personal data on a phone?
On a personal device enrolled with Apple User Enrollment or an Android work profile, the organization manages only work apps and data and does not see the personal side's content. Check your MDM's own privacy statement for exactly what it collects.
Does your app database include privacy labels or risk scores?
No. Our mobile app database contains app IDs, developer, developer website domain, App Store genre, age rating, content advisories, rating count and our categories. It does not contain privacy labels, Data safety answers or risk scores.
Vetted the apps? Block the rest by category
Keep approved apps, and block whole categories such as VPN, AI chat, social media and 17+ apps with files for your MDM, updated monthly.
See school plans Talk to usApple, App Store, App Store Connect and iPhone are trademarks of Apple Inc. Google Play, Play Console and Android are trademarks of Google LLC. IAB is a trademark of the Interactive Advertising Bureau.
Names are used only to identify the products discussed. AppBlockList is not affiliated with, sponsored or endorsed by these companies.