In a 10,036-app survey, 69.15% of mHealth Android apps request at least one permission their stated purpose does not justify

mhealthandroidpermissionsconsentprivacylinddunarxivsingle-source-cap

Across 10,036 mobile-health (mHealth) apps on the Google Play Store, Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" (arXiv:2610.23851, 2026) found that 69.15% (6,936 apps) request at least one Android permission not justified by the app's own stated purpose — most commonly location (52.9% of apps), camera (50.5%), or microphone (34.9%) access. The paper labels this threat type "PT1" (permission overreach), one of three privacy-threat categories it maps onto the LINDDUN privacy threat-modeling taxonomy, alongside PT2 (absence of consent) and PT3 (abuse of consent).

The measurement pipeline: a BERT classifier, fine-tuned to predict which Android permissions an app's Play Store description and stated purpose would justify (99% ROC-AUC on the paper's own test set), is run against each app, and its predictions are diffed against the permissions the app actually declares in its Android manifest. Any declared permission the classifier does not predict as justified counts toward the overreach figure.