---
title: "Of 3,599 mHealth apps surveyed, 93% show no consent mechanism of any kind on first launch"
type: "claim"
status: "seedling"
source_url: "https://arxiv.org/abs/2610.23851"
source_author: "Ethan Myers, Lorenzo De Carli, Shantanu Sharma, Ritwik Banerjee, Joel Reardon, Indrakshi Ray"
source_date: "2026-10-16"
source_title: "Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps"
source_venue: "arXiv:2610.23851 [cs.HC]"
source_quote: "Of the 3,599 analyzed apps, only 253 (7%) displayed any consent mechanism to the user. The remaining 93% mHealth apps lack immediate consent acquisition."
source_tier: 1
source_sha: "a7c5df5a76dba20d93e4bc3f4a381edb5816b664c575d29e6b2e9c36d07b621c"
independent_roots: 1
provenance: "Promotion from 10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md, 2026-10-20"
origin: "batch"
derived_from: ["10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md"]
date_created: "2026-10-20T00:00:00.000Z"
writer_model: "claude-sonnet-5"
audit_status: "capture-verified — the capturing bee read arXiv:2610.23851 directly and recorded the exact quote; promotion did not re-fetch. 2026-10-21 cross-model audit (claude-fable-5): independently re-fetched the arXiv PDF — sha256 identical (a7c5df5a…) — and verified the source_quote verbatim by direct read (§5.2), plus the 254-screenshot/one-false-positive/99.6% validation detail (§2.4). Three body corrections applied, status history preserved: (1) 'a rooted test device' → the paper's three rooted Google Pixel 7a phones (§4.2); (2) the consent-mechanism examples ('privacy-policy screen, cookie-style banner, explicit opt-in dialog') → the paper's own three observed patterns (embedded privacy-policy link / short text snippet / scrollable element, §4.3); (3) 'The remaining 93% began collecting data with no consent surface' overstated the finding — the paper's PT2 figure is absence of a consent mechanism, and observed PII collection among those 3,346 apps was AAID n=249 plus small counts of other identifiers (§5.2), not all apps; body now says so. Commentary's 'one test device' adjusted to 'one test harness' for the same device-count reason."
tags: ["mhealth","android","consent","gdpr","privacy","linddun","arxiv","single-source-cap"]
seek_code_commit: "d40ee39"
quote_sweep: "PASS 2026-10-21 — source_quote verbatim (normalized) in the capture-time archive (sha256 a7c5df5a76db…) [reading-order], same-night model-free sweep"
verified_verbatim: "2026-10-21 — source_quote matched verbatim (normalized) against a direct fetch of source_url by seek_verify (no model involved)"
---


Among a 3,599-app subset of Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" survey (arXiv:2610.23851, 2026) of Google Play mobile-health apps, only 253 apps (7%) displayed any consent mechanism — the paper's three observed patterns are an embedded privacy-policy link, a short text snippet, or consent text inside a scrollable element — on first launch. The remaining 93% presented no consent surface at all; among those 3,346 apps, the PII collection the pipeline actually observed was dominated by the Google Advertising ID (249 apps), with small numbers of email addresses and network identifiers. The paper labels this threat type "PT2" (absence of a consent mechanism), the second of three categories mapped onto the [[entity-linddun|LINDDUN]] taxonomy alongside [[claim-mhealth-apps-69pct-request-unjustified-android-permissions|PT1 (permission overreach)]] and [[claim-mhealth-consent-forms-7pct-collect-undisclosed-pii|PT3 (abuse of consent)]].

Detection method: each app was launched automatically on rooted test devices (three Google Pixel 7a phones running Android 13), its first screen captured, and that screenshot OCR-matched against an extended privacy-language dictionary. Manual validation across 254 candidate consent-form screenshots found one false positive, a claimed 99.6% accuracy. The paper frames the 93% figure as a direct violation of consent-based regulatory regimes such as GDPR, which require consent to precede, not follow, data collection.

> [!note] Seek's commentary:
> Ninety-three percent is the kind of number that should make you check the denominator before the headline, and here the denominator checks out: 3,599 apps, one test harness, one OCR dictionary, one unrefereed paper. The method is clever — launch, screenshot, OCR, done — and clever methods are exactly where a single unreplicated run earns the most suspicion, not the least. Filed at the same cap as its PT1 sibling, for the same reason.