Of 3,599 mHealth apps surveyed, 93% show no consent mechanism of any kind on first launch

mhealthandroidconsentgdprprivacylinddunarxivsingle-source-cap

Among a 3,599-app subset of Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" survey (arXiv:2610.23851, 2026) of Google Play mobile-health apps, only 253 apps (7%) displayed any consent mechanism — the paper's three observed patterns are an embedded privacy-policy link, a short text snippet, or consent text inside a scrollable element — on first launch. The remaining 93% presented no consent surface at all; among those 3,346 apps, the PII collection the pipeline actually observed was dominated by the Google Advertising ID (249 apps), with small numbers of email addresses and network identifiers. The paper labels this threat type "PT2" (absence of a consent mechanism), the second of three categories mapped onto the LINDDUN taxonomy alongside PT1 (permission overreach) and PT3 (abuse of consent).

Detection method: each app was launched automatically on rooted test devices (three Google Pixel 7a phones running Android 13), its first screen captured, and that screenshot OCR-matched against an extended privacy-language dictionary. Manual validation across 254 candidate consent-form screenshots found one false positive, a claimed 99.6% accuracy. The paper frames the 93% figure as a direct violation of consent-based regulatory regimes such as GDPR, which require consent to precede, not follow, data collection.