Free apps rarely charge money, but most of them are funded by information. The categories they declare in app-store privacy labels and in their own policies read like a dossier: location, contacts, device identifiers, browsing behavior and the record of everything tapped inside the app. Here are nine widely installed services whose own disclosures describe wide-ranging collection.
1. Facebook: The Profile Behind The Feed
Meta’s flagship app declares a long list of collected categories in the App Store privacy section, covering contact information, contacts, location, purchases, search and browsing history, identifiers and diagnostics. Beyond what is typed into it, the Facebook platform records interactions with businesses that install its advertising tools elsewhere on the web, activity the company surfaces in an off-app activity dashboard. Links tapped in the feed open in an in-app browser rather than the phone’s default one.
Controls exist for most of it: off-app activity can be disconnected, ad topics restricted and location permission set to never. The defaults favor collection, though, and the advertising profile keeps compounding unless it is actively pruned.
2. Instagram: Signals Beyond The Grid
Running on the same policy as its parent company, the photo-sharing service declares collected categories including purchases, location, contacts, search and browsing history, usage data and identifiers. The app requests camera, microphone, photo library and contact access, asks for precise location for tagging and advertising, and ties activity to a shared Accounts Center identity once profiles are linked across Meta apps.
Declining contact upload and precise location narrows the picture without leaving the platform. What remains is behavioral: dwell time, saves, follows and shares feed the recommendation and advertising systems, and that engagement record is treated as central to how the feed is assembled.
3. TikTok: Device Fingerprints And Watch Time
Unusually specific about the technical layer, the short-video platform states in its privacy policy that it collects device model, operating system, network type, IP address, keystroke patterns or rhythms, battery state and audio settings, alongside every video watched and how long it held attention. Contact-list and phone-number access is requested to suggest accounts, and approximate location is derived from network information even when precise location is declined.
That behavioral log is the product. The recommendation engine is trained on watch time, replays and skips rather than on who is followed, so the record cannot be switched off while the app is in use, although ad-personalization settings and a data-download tool sit in the app menu.
4. WhatsApp: Encrypted Messages, Visible Metadata
Message contents are end-to-end encrypted, but the envelope around them is not: the messaging service describes collecting phone numbers, profile details, device and connection information, IP address, and usage data such as when the service was last opened and which accounts were contacted. The app also offers to upload a phone’s address book to match contacts, which sweeps in numbers belonging to people who never installed it.
Its policy states that information is shared with other Meta companies for purposes including infrastructure, safety and product improvement. Encryption protects what is said; it does not obscure who talks to whom, how often, and from which device, which is the layer most useful for profiling.
5. Snapchat: Location On A Live Map
Precise location is collected when the permission is granted, including while the app runs in the background, and on the disappearing-message app that position can be broadcast continuously to friends through the Snap Map feature. Camera, microphone and photo access are core to the product, and the company also logs device identifiers, the friends interacted with most often, and how lenses and filters are used.
Ephemeral does not mean uncollected. Delivery records, location history and advertising identifiers persist independently of whether a snap vanishes from a conversation, and the Ghost Mode setting hides live position from other users without halting the collection the policy describes.
6. YouTube: A Watch History That Compounds
Signed-in viewing on the video platform writes to a Google account’s watch and search history, and that log is the direct input to recommendations, home-feed ordering and advertising across Google services. The app’s disclosures cover device information, location derived from IP address and identifiers used for advertising, and the same history accumulates from televisions, tablets and browsers signed in to one account.
Google exposes the record in an account activity dashboard, where watch and search history can be paused, deleted outright or set to auto-delete on a fixed interval. Pausing degrades recommendations, which is the trade the company describes; leaving it running means the profile deepens with every session.
7. Uber: Every Trip, Mapped
Hailing a ride requires location, and the ride-hailing company discloses collecting precise location from a rider’s device while the app is open and, with permission, in the background, along with pickup and drop-off points, routes and trip times. The resulting history is durable, amounting to a dated list of addresses visited, and the account also holds payment details, device identifiers and contacts when that permission is granted.
Permission can be narrowed to while-using-the-app, which limits background collection but not the trip log itself. That log is the sensitive part, because home, workplace, clinic and travel patterns are inferable from timestamps and coordinates alone, with no other data required.
8. Spotify: The Taste Profile
Streaming produces an unusually legible behavioral record, and the audio streaming service logs every track played, skipped, saved and searched, plus playlists, follows and the hours of the day when listening happens. Its policy also describes collecting device and network data, approximate location derived from IP address, and, on the ad-supported tier, sharing information with advertising and measurement partners.
The inference layer is what the company sells against: mood, activity and demographic signals drawn from listening rather than declared by the listener. Settings allow tailored advertising to be limited and voice features disabled, yet play history remains the basis for the personalization the service is built around.
9. LinkedIn: A Career Record, Cross-Referenced
Profiles are volunteered, which makes the rest easy to overlook: the professional network also records messages, search queries, job-post views, time spent on content, and visits to outside pages where its advertising tag is installed. The app offers to sync phone contacts and calendar entries to suggest connections, importing names and email addresses belonging to people who never joined.
Microsoft owns the platform, and the privacy policy describes sharing across affiliates for purposes including personalization and advertising. Professional context raises the stakes, since employment history, skills, endorsements and inferred seniority are precisely the attributes recruiters and advertisers pay to reach.
More from Morning Overview
- A handful of SUVs keep hitting 300,000 miles, and they share one engine trait
- Supplements now rank as the fifth-leading cause of death from liver disease.
- A study names the one SUV most likely to reach 250,000 miles
- More than 60,000 people flee the Spokane area as complex fires overrun 600 structures
