These common iPhone apps that millions have downloaded are actually spying on you
It's not just Big Brother that's always watching you, and while the average American is supposedly caught on CCTV 75 times a day, that's nothing compared to what our devices are feeding to bad actors.
There have been complaints about the recent instigation of third-party age verification on pornography sites, with conspiracy theorists suggesting that governments are using this data to spy on us.
In reality, you could be putting yourself at more at risk by downloading dodgy VPNs just to get your kicks.
Apple continues to discover security flaws with apps doing things they're not supposed to be doing, and while the tech giant is praised for keeping us informed, there's a growing list of common apps that could be exposing you to a cybersecurity nightmare.
Advert
Despite Apple boasting about the App Store having an automated system that's supposed to block apps containing malware or malicious code, a 2025 report from NowSecure (via BGR) claims that your data still might not be safe.
The report suggests that 75% of iOS apps tested were found to contain both sensitive data and tracking domains.
BGR goes on to list eight apps that might be spying on us without us even realizing. More than these being obscure Chinese VPNs promising access for nothing, some heavy hitters in here have been downloaded millions of times.
Siri
Anyone who has kept an eye on the news will know that Apple landed itself in some hot water through the use of its Siri virtual assistant.
Numerous court cases have been mounted, with Apple forced to settle a $95 million class-action lawsuit amid allegations that Siri was eavesdropping on users.
Accused of sharing data with third parties, this included suggestions of Air Jordan Sneakers and meals at Olive Garden.
Most recently, French authorities launched an October 2025 investigation when a whistleblower maintained Siri was eavesdropping within the Human Rights League (Ligue des droits de l'Homme).
Google Chrome
Apple isn't the only one of the 'Big Five' in trouble, as Google Chrome's Incognito mode might not be as private as you'd hope.
While it's all well and good for stopping your significant other from finding out you've been looking at engagement rings, April 2024 saw Google delete billions of private browsing records in order to settle a class-action lawsuit that was filed in 2020.
Google has updated its terms and conditions to reiterate that some data is tracked while using Incognito.
In September 2025, a federal jury in San Francisco forced Google to hand over $425 million after it was found guilty of collecting data from mobile devices like iPhones.
Facebook and Instagram
Meta is also a sometimes leaky ship when it comes to Facebook and Instagram, with its infamous "consent or pay" model found to be in breach of E.U. data protection rules by pressuring users to pay a monthly fee in order to browse without ad tracking. This led to Meta being fined €200 million ($231 million) in April 2025.
200 French media outlets have sued over allegations that Meta has been collecting personal data to help with advertising, while other lawsuits have included allowing the contact information of users aged 13 to 17 to be left in the wild, as well as a 2023 lawsuit accusing it of violating child privacy laws under the Children's Online Privacy Protection Act (COPPA).
TikTok
All those hours of late-night scrolling could be costing you dearly, as TikTok remains a major privacy concern. You'll all remember the Biden administration's proposed ban of the short-form video platform, although President Donald Trump has made big steps to try and overhaul it. Privacy concerns cover keystroke patterns, which the company claims help improve security and performance.
Countries including Canada, Australia, Taiwan, and Norway have put restrictions on TikTok being used on government devices, but even at the end of October 2025, the lucrative TikTok deal remains up in the air.
DoorDash
More than just delivering your food on a hungover Sunday, DoorDash supposedly delivers your private data to others. California's attorney general fined DoorDash $375,000 in 2024, deeming that it violated the California Consumer Privacy Act (CCPA) and CalOPPA for sharing everything from home addresses to order histories with marketing companies. It has since improved its privacy disclosures.
VPNs
Given all of the above horror stories, is it any surprise that VPNs in general make the list? Google has its own warnings on how to handle VPNs, but in general, it still refers to the official ones if you're determined to use them.
Looking for your next job might be easier than ever thanks to LinkedIn, but being keen to attract potential recruiters can come at a cost. Even though it makes sense that you're targeted by specific jobs, security researchers at Mysk Inc. discovered how LinkedIn's iPhone app was collecting unnecessary data like your mobile carrier via push notifications in 2024. Ireland's Data Protection Commission fined LinkedIn €310 million ($358 million) in October 2024, concluding that it used personal data in behavioral analysis. If that wasn't enough, it was around this time that LinkedIn was called out for training AI models with user data.
Cleaner Kit
Finally, apps like BPMobile's Cleaner Kit are supposed to clear up some much-needed space by deleting duplicate photos and removing spam emails, but that comes at the cost of it collecting NINE categories of data.
Concerns about why it needs location access have been compounded by a 2025 Surfshark analysis that reveals many of these cleaner apps share similar methods. 70% of cleaner apps allegedly share user data ranging from device IDs to purchase history.