Android App Privacy: What Testing Reveals

A European social network promising digital sovereignty and a cycle-tracking app recording fertility, symptoms, and sexual health might not seem to have much in common. Yet both raise the same question: How closely does an application’s actual behavior match the privacy commitments made to its users?

At AV-TEST, we investigate this by examining what happens inside applications and what they communicate to the outside world. Our analyses of W Social and 17 Android cycle-tracking apps revealed encouraging examples of privacy-conscious development, alongside problems involving third-party tracking, consent, and transparency.

Looking beyond the privacy policy

In an earlier dotmagazine interview, I explained why a privacy policy alone cannot tell us whether an application protects its users’ information. Our Android Privacy Analysis therefore combines static and dynamic testing. We inspect permissions, integrated software components, and privacy documentation, then run the application and monitor its network traffic to establish which components communicate, when, and with whom.

Finding a tracking component does not necessarily mean it transmits information. Likewise, observing a server connection does not, by itself, establish unlawful processing.

W Social: European privacy promises under the microscope

Developed in Sweden, W Social presents itself as a European alternative to X, with privacy and digital sovereignty at the center of its approach. It states that it does not create personalized advertising profiles or share information with advertising networks.

Our analysis largely supported this positioning. We identified only one third-party component, Sentry, used for crash reporting, and observed no activity from it. W Social requested neither Android’s Advertising ID nor Google’s AdServices. Its privacy policy achieved 82 out of 100 points in our automated assessment.

Network monitoring nevertheless revealed two details worth examining. Communication began before users could read and acknowledge the privacy policy. We also observed requests involving servers outside the European Union and static URLs pointing to US infrastructure. Neither observation automatically establishes a GDPR violation: The data, purpose, legal basis, and safeguards matter. However, a company’s European origin does not guarantee that all its infrastructure or data flows remain within Europe.

Our testing reached only W Social’s waitlist registration. We cannot assess the privacy behavior of the full social network.

Cycle-tracking apps: Sensitive information and familiar technologies

Modern cycle trackers do more than record menstruation dates. Users may enter symptoms, moods, sexual activity, contraception, pregnancy intentions, and fertility information. Combined, these details can reveal much about someone’s private life.

We examined 17 popular Android cycle-tracking apps, looking at permissions, third-party components, network activity, and privacy policies. The differences were substantial.

Advertising technology in 15 of 17 apps

Fifteen applications accessed Android’s Advertising ID or supported Google’s AdServices. Only Premom and Read Your Body avoided both. Lady Cycle and Ada used the older Advertising ID but not AdServices. Neither technology is necessary simply to record a menstrual cycle, making its presence in apps handling sensitive information worth investigating. It does not prove that health data was transmitted to advertisers.

Many apps offer paid subscriptions; Read Your Body requires one. Even so, many of the apps that charge for subscriptions still access an advertising identifier, so payment is not a reliable sign that advertising components are absent.

Location permissions raise further questions

Maya, Read Your Body, Premom, and Ovy requested approximate and precise location permissions. Among them, only Maya mentioned location collection in its privacy policy, without explaining the purpose. We observed no active location tracking, but developers should still explain why these permissions are needed.

Considerable differences in tracking activity

The individual results show how differently developers approach third-party dependencies. MeetYou contained 11 integrated trackers, 10 active; one version of My Period Calendar had 10, 6 active. Lady Cycle had just one integrated component and very limited tracking. Read Your Body and Clue each contained 2 components, while Ada contained 3.

When communication begins before consent

In all 17 cycle-tracking applications, third-party components began communicating and collecting data before users had the opportunity to read and accept the privacy policy. We observed the same in W Social, an app with only one third-party component, which suggests a technical gap in how apps start up and handle consent rather than one developer’s decision.

This does not mean that every app automatically violated the GDPR. Some communication may be necessary for legitimate technical functions, and consent is not the only legal basis for processing personal data. Where consent is required for nonessential tracking, however, that processing must wait. Developers must ensure their components respect users’ choices from the moment the app starts.

Transparency varies as much as tracking

Most cycle-tracking apps provided reasonably detailed privacy information, but several policies omitted integrated trackers, including components whose activity we verified. Maya and Musa were notable because their policies apparently did not mention their integrated trackers. Technical testing cannot tell us whether these omissions were deliberate.

Other apps handled disclosure more thoroughly. Both versions of My Period Calendar, Premom, Ovy, Clue, and Lady Cycle described their tracking components comparatively well. Ovy included several third-party components but disclosed them in its policy. Transparency matters, although developers must also limit collection to what is necessary.

What the findings mean for digital sovereignty

The two studies concern different applications, but both show how privacy depends on software components and infrastructure beyond the app developer’s direct control. European hosting can contribute to digital sovereignty, yet W Social’s connections involving non-EU infrastructure demonstrate why technical verification matters. The cycle-tracking results also recorded connections involving destinations outside the EU. Such observations do not, on their own, establish unlawful international transfers of personal data.

Privacy by Design is an engineering task: Developers need to understand their SDKs, restrict unnecessary permissions, verify network communication, and check that consent mechanisms work. App updates and changing third-party components make repeated testing essential.

What users can learn from these tests

Most users cannot inspect network traffic themselves, but they can review app permissions, look for information about third-party services, and question why a cycle tracker needs location access or advertising technology. A paid subscription should not be mistaken for a privacy guarantee.

Our results also show that privacy-conscious approaches are possible. W Social demonstrated limited tracking within our narrow test scope, while Lady Cycle, Clue, and Ada performed comparatively well among the cycle-tracking apps. These findings are not permanent guarantees: Apps and their components change.

Privacy policies describe what developers say they do. Independent testing helps establish what their software actually does. Detailed results are available through 

AV-ATLAS and AV-TEST’s Android Privacy Analysis.

Eric Clausing has been part of the AV-TEST team since 2015 and is responsible for the conception, implementation and further development of all security and privacy tests and certifications in the area of the Internet of Things.