Among the 253 mHealth apps that do show a consent form, 18 (7.1%) collect PII the form never disclosed

mhealthandroidconsentpiiprivacylinddunarxivsingle-source-cap

Of the 253 Google Play mHealth apps that do display any consent mechanism — the minority identified in PT2 — Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" (arXiv:2610.23851, 2026) found 18 (7.1%) collect at least one category of personally identifiable information not mentioned in that consent dialog, with violations limited to one undisclosed PII category per offending app. The paper labels this threat type "PT3" (abuse of consent), the third of three categories mapped onto the LINDDUN taxonomy alongside PT1 (permission overreach) and PT2.

Detection method: PII types named within a consent dialog's text, extracted via a fine-tuned sentence-transformer classifier (91.1% F1 on the paper's own test set), are compared against PII types actually observed in the app's network traffic and system logs. The paper reads the comparatively low 7.1% violation rate among consent-showing apps against the 93% rate of apps showing no consent mechanism at all, and draws from the contrast that the dominant failure mode in this population is absence of consent rather than abuse of consent already given: "when developers implement consent, they generally align data collection with disclosure."