Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps
Capture of arXiv:2610.23851 (submitted 16 Oct 2026, cs.HC/cs.CR/cs.CY; authors Ethan Myers, Lorenzo De Carli, Shantanu Sharma, Ritwik Banerjee, Joel Reardon, Indrakshi Ray — Colorado State, NJIT, U. Calgary, Stony Brook), the first large-scale (10,000+ app) measurement of consent and permission practices across mHealth apps on the Google Play Store. Two of the paper's own motivating footnote citations (a 2024 FTC enforcement action and a 2025 federal jury verdict) were chased to their primary documents rather than left on the paper's tinyurl mirrors, per the assignment's instruction to follow a genuine hook outside the paper itself.
Claim: Across 10,036 analyzed mHealth apps, 69.15% request at least one Android permission their stated purpose does not justify, most often location, camera, or microphone access
"69.15% of apps request at least one permission unrelated to their stated purpose, with over 52.9% apps requesting location data, and 50.5% and 34.9% apps requesting camera and microphone access, respectively—despite no functional justification based on app descriptions and stated purposes."
"Among the 10,036 analyzed apps, 69% (6,936 apps) exhibit permission gaps, requesting at least one permission their descriptions do not justify."
The paper calls this "PT1" (permission overreach), operationalized by fine-tuning a BERT classifier (99% ROC-AUC on its test set) to predict which permissions an app's Play Store description justifies, then diffing that prediction against the permissions actually declared in the app's manifest. source_url: https://arxiv.org/abs/2610.23851 — source_title: "Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps" — source_author: Ethan Myers, Lorenzo De Carli, Shantanu Sharma, Ritwik Banerjee, Joel Reardon, Indrakshi Ray — source_date: 2026-10-16 — source_venue: arXiv:2610.23851 [cs.HC] — source_tier: 1 — source_sha: a7c5df5a76dba20d93e4bc3f4a381edb5816b664c575d29e6b2e9c36d07b621c.
Claim: Of 3,599 analyzed mHealth apps, only 253 (7%) show users any immediate consent mechanism on first launch — the remaining 93% collect without ever presenting a consent screen
"Of the 3,599 analyzed apps, only 253 (7%) displayed any consent mechanism to the user. The remaining 93% mHealth apps lack immediate consent acquisition."
The paper frames this as "PT2" (absence of consent mechanism), detected by automatically launching each app on a rooted test device, capturing its first screen, and OCR-matching that screenshot against an extended privacy-language dictionary (manual validation found one false positive across 254 candidate consent forms, a claimed 99.6% accuracy). The paper frames the 93% figure as a direct violation of consent-based regulatory regimes such as GDPR. source_url: https://arxiv.org/abs/2610.23851 — source_title: "Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps" — source_tier: 1 — source_sha: a7c5df5a76dba20d93e4bc3f4a381edb5816b664c575d29e6b2e9c36d07b621c.
Claim: Among the minority of mHealth apps that do show a consent form, 1 in 14 (18 of 253, 7.1%) still collect personally identifiable information the consent form never disclosed
"Of the 253 apps displaying consent forms to the user, we find that 18 apps (7.1%) collect PII not disclosed in their consent agreements, with violations limited to one undisclosed PII category per app."
The paper labels this "PT3" (abuse of consent), detected by comparing PII types mentioned in a consent dialog (via a fine-tuned sentence-transformer classifier, 91.1% F1 on its test set) against PII types actually observed in the app's network traffic and system logs. The paper notes this 7.1% violation rate among consent-showing apps is comparatively low next to the 93% that show no consent mechanism at all, and reads this contrast as evidence that "when developers implement consent, they generally align data collection with disclosure" — i.e., the dominant failure mode is absence of consent, not abuse of consent once given. source_url: https://arxiv.org/abs/2610.23851 — source_tier: 1 — source_sha: a7c5df5a76dba20d93e4bc3f4a381edb5816b664c575d29e6b2e9c36d07b621c.
Claim: The paper's own motivating example — the FTC's 2024 case against telehealth app Cerebral — checks out against the FTC's primary press release: Cerebral was required to pay more than $7 million over sharing sensitive mental-health data with advertisers without consent
"Cerebral will also be required to pay more than $7 million over charges that it disclosed consumers' sensitive personal health information and other sensitive data to third parties for advertising purposes and failed to honor its easy cancellation promises."
Bad Diagnosis's introduction cites this case (via a tinyurl link, footnote [1]) only as scene-setting motivation, not as part of its own measurement. Followed to the FTC's own April 15, 2024 press release (recovered via a Wayback Machine capture after the live ftc.gov URL 404'd to both WebFetch and archive_page): the proposed order — filed by the DOJ, pending U.S. District Court (S.D. Fla.) approval — breaks the $7M+ down as nearly $5.1 million in consumer refunds plus a $10 million civil penalty (suspended to $2 million given the company's inability to pay the rest), triggered by findings that Cerebral shared data including mental-health diagnoses and treatment histories with LinkedIn, Snapchat, and TikTok via tracking tools, for roughly 3.2 million consumers, while publicly promising "safe, secure, and discreet" services. source_url: https://www.ftc.gov/news-events/news/press-releases/2024/04/proposed-ftc-order-will-prohibit-telehealth-firm-cerebral-using-or-disclosing-sensitive-data — source_title: "Proposed FTC Order will Prohibit Telehealth Firm Cerebral from Using or Disclosing Sensitive Data for Advertising Purposes, and Require it to Pay $7 Million" — source_author: Federal Trade Commission (Office of Public Affairs) — source_date: 2024-04-15 — source_venue: Federal Trade Commission press releases — source_tier: 1 — source_sha: 553b3b22419534806376ba02cd6fd5b66f16d4e14fde52aff9d9fb7fd93ac193 (Wayback capture of the FTC original; live URL 404's as of 2026-10-20).
Claim: The paper's other motivating example — a 2025 jury verdict against Meta over the Flo period-tracking app — also checks out against the court's own order: a federal jury found Meta liable for intercepting users' menstrual and ovulation data without consent
"The jury concluded that Meta had violated the California Invasion of Privacy Act (CIPA), Cal. Pen. Code § 632, by obtaining highly personal ovulation and menstrual period information communicated by women who used the Flo Period and Ovulation Tracker app."
"This privacy class action was tried to a jury over the course of two weeks."
Bad Diagnosis's introduction also cites this case (footnote [2], again via a tinyurl link) as motivation only. Followed to the U.S. District Court for the Northern District of California's own amended order (Frasco v. Flo Health, Inc., Case No. 21-cv-00757-JD, Doc. 776, filed 2025-09-17, recovered via GovInfo's U.S. Courts Opinions PDF mirror): co-defendants Google and Flurry settled before trial and Flo Health settled during trial, leaving Meta as the sole defendant at verdict; the jury's finding was unanimous, and the court denied Meta's post-trial motions for decertification, judgment as a matter of law, and a new trial, finding "[n]othing in the evidence adduced at trial or the record as a whole justifies disturbing" the class or verdict. source_url: https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_21-cv-00757/pdf/USCOURTS-cand-3_21-cv-00757-9.pdf — source_title: "Amended Order Re Post-Trial Motions" (Frasco v. Flo Health, Inc.) — source_author: Hon. James Donato, U.S. District Court, N.D. Cal. — source_date: 2025-09-17 — source_venue: U.S. District Court, N.D. Cal., via GovInfo — source_tier: 1 — source_sha: 709813e118e987951b4b32a7b679777e4a6d2dfc291a923b310464b5cdfbc339.
Further leads
- The paper's "LINDDUN" threat-modeling framework (Deng et al., 2011) is the categorical ancestor its three privacy-threat types (PT1-PT3) are explicitly mapped onto — unread as a primary source in this capture; worth its own fetch if the vault wants the LINDDUN framework itself as a concept note.
- The paper's consent-detection pipeline is an explicit, acknowledged modification of Nguyen et al.'s prior UI-fuzzing + screenshot methodology ("Freely Given Consent," CCS 2022; "Share First, Ask Later," USENIX Security 2021) — primaries not independently fetched here.
- Tangari et al.'s 2021 BMJ study of 15,000+ mHealth apps is named by the authors as "the work closer in spirit to us" among prior large-scale studies — unread primary, flagged as the single closest methodological predecessor by scale.
- Settlement figures reported by secondary sources for the non-Meta Frasco defendants (Google $48M, Flo $8M, Flurry $3.5M) were surfaced by WebSearch only, not independently verified against a primary settlement filing —
[unverified-quant — needs primary]. - The paper's own claim that the mHealth market is "projected to be worth $86 billion by 2030" rests only on its footnote [3] (a tinyurl market-report link), not independently checked —
[unverified-quant — needs primary]. - The paper states its full dataset is released at a tinyurl link (tinyurl.com/bdcn9ta5) — not fetched or verified in this capture.
- Example apps named for permission overreach and consent absence: com.transsion.healthlife (163M+ downloads, requests call-log/contacts access despite describing itself as a fitness tracker) and sixpack.sixpackabs.absworkout (177M+ downloads, collects Google Advertising ID with no consent dialog at all) — both drawn from the paper itself, not independently verified against the live Play Store listings.
Entity candidates
- Mariam Deng et al. — person/concept — originated the LINDDUN privacy threat-modeling framework (2011), the foundational framework this paper's entire PT1–PT3 taxonomy is explicitly derived from and measured against; the ancestor behind the paper's own contribution claim.
- T. T. Nguyen et al. — person/group — authored the prior UI-fuzzing/screenshot consent-detection methodology ("Freely Given Consent," CCS 2022; "Share First, Ask Later," USENIX Security 2021) that this paper explicitly extends and patches ("Critical modification: We identified several critical issues in the pipeline [11]").
- G. Tangari et al. — person/group — authored the 2021 BMJ cross-sectional study of 15,000+ mHealth apps, named by the authors as the closest prior large-scale mHealth privacy measurement.
- Joel Reardon — person — co-author (University of Calgary); independently known in Android privacy/data-leak measurement research, worth checking for a standing entity page given recurring appearance across this literature.
- Ethan Myers, Lorenzo De Carli, Shantanu Sharma, Ritwik Banerjee, Indrakshi Ray — persons — remaining co-authors of this paper (Colorado State, NJIT, Stony Brook).
- Lina M. Khan — person — FTC Chair quoted in the Cerebral settlement press release, calling it "a first-of-its-kind prohibition."
- James Donato — person — U.S. District Judge (N.D. Cal.) who presided over Frasco v. Flo Health and issued the post-trial order cited above.
- Federal Trade Commission — organization — issued the Cerebral proposed order.
- LINDDUN — concept — the seven-category privacy threat modeling framework underlying this paper's method.
- Cal. Pen. Code § 632 (California Invasion of Privacy Act) — concept/term — the statute Meta was found to have violated in Frasco v. Flo Health.