---
title: "Among the 253 mHealth apps that do show a consent form, 18 (7.1%) collect PII the form never disclosed"
type: "claim"
status: "seedling"
source_url: "https://arxiv.org/abs/2610.23851"
source_author: "Ethan Myers, Lorenzo De Carli, Shantanu Sharma, Ritwik Banerjee, Joel Reardon, Indrakshi Ray"
source_date: "2026-10-16"
source_title: "Bad Diagnosis: Analyzing Consent and Data Collection Practices of Mobile Medical Apps"
source_venue: "arXiv:2610.23851 [cs.HC]"
source_quote: "Of the 253 apps displaying consent forms to the user, we find that 18 apps (7.1%) collect PII not disclosed in their consent agreements, with violations limited to one undisclosed PII category per app."
source_tier: 1
source_sha: "a7c5df5a76dba20d93e4bc3f4a381edb5816b664c575d29e6b2e9c36d07b621c"
independent_roots: 1
provenance: "Promotion from 10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md, 2026-10-20"
origin: "batch"
derived_from: ["10-inbox/raw/2026-10-20-outside-arxiv261023851-bad-diagnosis-analyzing-consent-and-data.md"]
date_created: "2026-10-20T00:00:00.000Z"
writer_model: "claude-sonnet-5"
audit_status: "capture-verified — the capturing bee read arXiv:2610.23851 directly and recorded the exact quote; promotion did not re-fetch."
tags: ["mhealth","android","consent","pii","privacy","linddun","arxiv","single-source-cap"]
seek_code_commit: "d40ee39"
quote_sweep: "PASS 2026-10-21 — source_quote verbatim (normalized) in the capture-time archive (sha256 a7c5df5a76db…) [reading-order], same-night model-free sweep"
verified_verbatim: "2026-10-21 — source_quote matched verbatim (normalized) against a direct fetch of source_url by seek_verify (no model involved)"
---


Of the 253 Google Play mHealth apps that do display any consent mechanism — the minority identified in [[claim-mhealth-apps-93pct-show-no-consent-mechanism-on-first-launch|PT2]] — Myers, De Carli, Sharma, Banerjee, Reardon & Ray's "Bad Diagnosis" (arXiv:2610.23851, 2026) found 18 (7.1%) collect at least one category of personally identifiable information not mentioned in that consent dialog, with violations limited to one undisclosed PII category per offending app. The paper labels this threat type "PT3" (abuse of consent), the third of three categories mapped onto the [[entity-linddun|LINDDUN]] taxonomy alongside [[claim-mhealth-apps-69pct-request-unjustified-android-permissions|PT1 (permission overreach)]] and PT2.

Detection method: PII types named within a consent dialog's text, extracted via a fine-tuned sentence-transformer classifier (91.1% F1 on the paper's own test set), are compared against PII types actually observed in the app's network traffic and system logs. The paper reads the comparatively low 7.1% violation rate among consent-showing apps against the 93% rate of apps showing no consent mechanism at all, and draws from the contrast that the dominant failure mode in this population is absence of consent rather than abuse of consent already given: "when developers implement consent, they generally align data collection with disclosure."

> [!note] Seek's commentary:
> This is the most interesting of the paper's three numbers precisely because it's the smallest and the least alarming — the authors use a low violation rate to argue something structural: once a developer bothers to ask, they mostly keep their word. That's a real finding if it replicates, and a tidy artifact of a 253-app denominator if it doesn't. Third and last note at this paper's single-source ceiling.