A new study analysing more than 5,000 different mobile apps suggests that some of the world’s most popular platforms are also among the most intrusive when it comes to user data. A rather shocking revelation, to say the least.
According to research from IT Asset Management Group (IT-AMG), Facebook and Instagram rank joint first for privacy intrusion, collecting and linking more sensitive user information than any other apps examined.
The study reviewed privacy disclosures from thousands of iOS apps and assessed them using a bespoke “privacy intrusion index” out of 100. And, rather than focusing solely on how much data apps collect, the index places greater emphasis on how that data is linked to individual users and tracked across activity – these are practices that are generally considered more invasive than mere collection. After all, it’s all about what you actually end up doing with that data at the end of the day.
Why Facebook and Instagram Top the List
According to the findings, Facebook and Instagram each score 61.47 out of 100. Both platforms collect 32 out of 35 possible data types, including physical addresses, device identifiers and unique user IDs.
The study shows that 25 of these data types are directly linked to users, while seven are both linked and tracked. This combination of scale and persistence is what places the two Meta-owned apps at the top of the rankings. Their position reflects not just how much data is gathered, but also how deeply that information is tied back to individual identities – arguably more important than anything else.
Notably, other high-profile entertainment apps rank much lower. According to the report, YouTube sits in 27th place, while TikTok appears far further down the list, suggesting that heavy engagement does not automatically equal maximum data intrusion. This comes as a surprise to many who have been led to believe that just because TikTok’s the loudest, it must also be the most invasive.
Delivery and Shopping Apps Follow Closely
The third most invasive app in the study is Grab: Taxi Ride, Food Delivery, with a score of 55.57. According to the research, the app collects 27 data types, with 15 of them both linked and tracked. As a service built around location, payments and purchase history, its high ranking reflects the operational demands of ride-hailing and food delivery platforms.
Retail apps also feature prominently. Nordstrom Rack and Nordstrom appear in seventh and eighth place, while fashion retailer AE + Aerie completes the top ten. According to the findings, these apps collect fewer categories of data overall, but track and link a high proportion of that data to users, particularly in relation to spending behaviour and marketing activity.
The Meta Ecosystem Extends Beyond Social Feeds
In fourth place, Threads, Meta Business Suite and Messenger are tied with a score of 54.53. The study notes that while these apps collect 32 data types and link all of them to users, none are classified as tracking data under Apple’s definitions. This distinction helps explain why they rank below Facebook and Instagram despite collecting similar volumes of information.
Pinterest also appears in the top ten, collecting 29 data types, 22 of which are linked to the user, reinforcing the idea that visual and social platforms tend to rely heavily on identity-based data.
Which App Categories Are Most Invasive?
Beyond individual apps, the study also assessed entire app categories. According to IT-AMG, Photo and Video apps are the most invasive category on average, followed by Social Networking and Food and Drink apps. Shopping and Travel apps round out the top five.
Although fewer Photo and Video apps qualified for analysis, the category’s high score reflects the depth of access these platforms typically require, including media, metadata, analytics and user-linked information.
So, What Does This Study Really Tell Us About Data More Generally?
The report doesn’t claim that apps are acting unlawfully – all conclusions are based on declared App Store privacy disclosures rather than hidden behaviour. Rather, the findings highlight how normalised extensive data collection has become in everyday digital life.
According to IT-AMG, the key issue here is awareness.
As apps increasingly combine convenience with deep personal insight, understanding what data is collected (and how it’s linked and tracked) may be just as important as deciding which apps to download in the first place.
