Topic starter
02/08/2026 12:24 pm
TL;DR: 35% of tested iOS apps failed to disclose collected data, 97% lacked required third-party SDK privacy manifests, and 18% of 183,000 mobile apps used AI, creating hidden data-flow, consent, and compliance risk across mobile ecosystems, according to NowSecure. The governance gap is not visibility alone but accountability for what apps, SDKs, and AI endpoints actually transmit.
Editorial analysis by NHI Mgmt Group, based on content published by NowSecure: “New NowSecure Research Targets Mobile App Privacy Risks: What You Don’t See Is Hurting You”.
By the numbers:
- 35% of the iOS apps failed to disclose the data they collected.
- 18% (33,396 apps) use artificial intelligence.
- 40% of 10,500 Android apps don’t declare that they can support a way to be forgotten.
Key questions
Q: What breaks when mobile apps do not disclose data collection properly?
A: Disclosure gaps break the organisation’s ability to prove purpose, necessity, and accountability.
Q: Why do embedded advertising SDKs create compliance and privacy risk for mobile apps?
A: Embedded advertising SDKs can collect sensitive data outside the developer’s direct control, then transmit it through networks the team may not fully understand.
Q: How should organisations govern private AI apps used on mobile devices?
A: Treat them as governed data-processing tools, not harmless consumer apps.
Practitioner guidance
- Define mobile privacy inventory ownership Assign a named owner for every mobile app, SDK, API, and AI endpoint that can collect or transmit personal data.
- Enforce entitlement minimisation Block apps that request camera, microphone, location, storage, or messaging access without a documented business justification.
- Require privacy manifests before release Make disclosure of data collection and third-party sharing a release gate for both first-party code and embedded SDKs.
Bottom line: Mobile app privacy risk is driven by hidden data collection, third-party components, and AI endpoints that sit outside normal user expectations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:24 pm
Mobile privacy has crossed from disclosure management into access governance. Once an app can collect data through SDKs, background services, and AI endpoints, the real question is who approved that flow and whether it remains within declared purpose. Transparency alone does not stop over-collection, so privacy teams need control ownership, not just notices and policies. The practitioner conclusion is that mobile privacy must be governed as an access problem.
A question worth separating out:
Q: When should privacy teams block a mobile app from release?
A: They should block release when the app requests excessive permissions, lacks required disclosures, or sends regulated data to unapproved third parties. The decision should be based on data sensitivity, purpose limitation, and the ability to evidence control over downstream sharing. If those cannot be shown, the app is not ready for production use.
👉 Read our full editorial: Mobile app privacy risk is now a governance problem, not just a compliance one