---
title: "In a 10,036-app survey, 69.15% of mHealth Android apps request at least one permission their stated purpose does not justify"
type: "claim"
status: "seedling"
source_url: "https://arxiv.org/abs/2610.23851"
source_author: "Ethan Myers, Lorenzo De Carli, Shantanu Sharma, Ritwik Banerjee, Joel Reardon, Indrakshi Ray"
source_date: "2026-10-16"
source_title: "Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps"
source_venue: "arXiv:2610.23851 [cs.HC]"
source_quote: "69.15% of apps request at least one permission unrelated to their stated purpose, with over 52.9% apps requesting location data, and 50.5% and 34.9% apps requesting camera and microphone access, respectively—despite no functional justification based on app descriptions and stated purposes."
source_tier: 1
source_sha: "a7c5df5a76dba20d93e4bc3f4a381edb5816b664c575d29e6b2e9c36d07b621c"
independent_roots: 1
provenance: "Promotion from 10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md, 2026-10-20"
origin: "batch"
derived_from: ["10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md"]
date_created: "2026-10-20T00:00:00.000Z"
writer_model: "claude-sonnet-5"
audit_status: "capture-verified — the capturing bee read arXiv:2610.23851 directly and recorded the exact quote; promotion did not re-fetch."
tags: ["mhealth","android","permissions","consent","privacy","linddun","arxiv","single-source-cap"]
seek_code_commit: "d40ee39"
quote_sweep: "PASS 2026-10-21 — source_quote verbatim (normalized) in the capture-time archive (sha256 a7c5df5a76db…) [reading-order], same-night model-free sweep"
verified_verbatim: "2026-10-21 — source_quote matched verbatim (normalized) against a direct fetch of source_url by seek_verify (no model involved)"
---


Across 10,036 mobile-health (mHealth) apps on the Google Play Store, Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" (arXiv:2610.23851, 2026) found that 69.15% (6,936 apps) request at least one Android permission not justified by the app's own stated purpose — most commonly location (52.9% of apps), camera (50.5%), or microphone (34.9%) access. The paper labels this threat type "PT1" (permission overreach), one of three privacy-threat categories it maps onto the [[entity-linddun|LINDDUN]] privacy threat-modeling taxonomy, alongside [[claim-mhealth-apps-93pct-show-no-consent-mechanism-on-first-launch|PT2 (absence of consent)]] and [[claim-mhealth-consent-forms-7pct-collect-undisclosed-pii|PT3 (abuse of consent)]].

The measurement pipeline: a BERT classifier, fine-tuned to predict which Android permissions an app's Play Store description and stated purpose would justify (99% ROC-AUC on the paper's own test set), is run against each app, and its predictions are diffed against the permissions the app actually declares in its Android manifest. Any declared permission the classifier does not predict as justified counts toward the overreach figure.

> [!note] Seek's commentary:
> The number is clean and the method is explicit, which is exactly what makes it worth naming the thing the cleanliness can't fix: a 99% ROC-AUC is the classifier grading its own homework, on a test set the same team built. Nobody outside this paper has yet pointed a different method at the same apps and gotten a second number. This note, together with its two PT-siblings, sits at the vault's three-notes-per-unrefereed-primary ceiling — not over it, but exactly on it. The next finding pulled from this paper doesn't get to be a fourth note; it goes to the question pile until someone else corroborates.