Native Apps Should Be Avoided Whenever Possible

April 12, 2026 · 6 min read

TL;DR: What you should do:

• Openly garbage apps, and vocally advocator for the web instead.
• Try not to instal immoderate apps if you don’t request to.
• If a work has a functioning website, usage it instead.
• Revoke each permissions by default, including inheritance location, microphone, and camera permissions for thing that doesn’t require them to function.
• Audit your installed apps. Uninstall each apps you don’t actively need.
• Treat each “download our app” punctual pinch skepticism.

For much accusation cheque retired my Guide: A Very Basic Framework for Apps to Avoid

Most autochthonal apps cod acold much information than their website equivalents ever could. They petition permissions to hardware, sensors, and inheritance processes that browsers deliberately restrict. The third-party package embedded successful these apps often transmits your location, instrumentality identifiers, and behavioral information to 3rd parties earlier you moreover spot a consent prompt. This information is successful tandem bought, sold, and aggregated by brokers. It has been utilized to retired individuals, way immigrants, and alteration prosecution complete reproductive healthcare.

The White House App

On March 27, 2026, the Trump management released an charismatic White House app for iOS and Android. Within hours, 2 independent information researchers decompiled it and published their findings. [1] The app is simply a textbook illustration of everything incorrect pinch the autochthonal app model.

Apple requires apps to taxable a privateness manifest disclosing what information they collect. The White House app declared an quiet array. Zero information collection. Meanwhile, the existent binary contained 10 analytics frameworks, including the afloat OneSignal SDK pinch a sub-framework specifically for location tracking. [2] The GPS pipeline polled precise coordinates each 4.5 minutes successful the foreground and each 9.5 minutes successful the background, syncing everything to OneSignal’s commercialized servers. A boolean emblem successful OneSignal’s server responses could remotely alteration aliases disable GPS search without an app update and without Apple review.

An Exodus Privacy audit identified 3 embedded trackers, 1 of which was Huawei Mobile Services Core. [3] The app’s privateness policy, past updated January 20, 2025, makes nary mention of GPS tracking, OneSignal, aliases inheritance information collection.

Nearly everything successful the app is disposable connected whitehouse.gov. The app’s unsocial additions are push notifications, a pre-filled matter connection to the President, and an ICE extremity fastener (also disposable connected ice.gov). What it really added astatine standard was a surveillance pipeline: 77% of the app’s web requests spell to 3rd parties, not whitehouse.gov.

The Software Embedded successful Apps

Most group deliberation of apps arsenic products built by a azygous company. In practice, the mean app is simply a bladed wrapper astir dozens of third-party package packages, each pinch its ain information postulation pipeline and commercialized incentives. When you assistance an app support to entree your location, each package embedded successful that app inherits that permission. A azygous package tin look successful hundreds of apps, feeding location information connected millions of group to a azygous aggregator.

In January 2025, a hacker breached Gravy Analytics and leaked astir 30 cardinal location records collected from 3,455 apps — dating, fitness, gaming, and wellness apps among them. [4] The FTC subsequently banned Gravy Analytics from trading Americans’ location data, [5] but by past the information was already circulating connected cybercrime forums.

In a abstracted case, Google paid $391.5 cardinal to settee claims from 40 states for continuing to cod location information moreover erstwhile users explicitly abnormal location tracking. [6]

Why Everyone Should Care

Governments are immoderate of the biggest buyers. Military and intelligence agencies acquisition location information from dream apps, making love apps, and fittingness trackers. [7] Immigration enforcement uses it to find and detain people. Police departments bargain it to surveil suspects, protesters, and full neighborhoods — sidestepping warrant requirements entirely. [8] Courts person issued “geofence” orders demanding records connected each instrumentality adjacent a location astatine a fixed time, sweeping up everyone astatine a governmental rally, a schoolhouse committee meeting, aliases a weapon show alongside immoderate existent suspects. [9] After Roe v. Wade was overturned, rule enforcement utilized location information to way trips to abortion clinics. [10] None of this required a tribunal order, because the information was commercially available.

It’s not conscionable governments. Employers bargain location information to show workers. Stalkers and abusive partners utilization family search apps for illustration Life360. Insurers, landlords, and advertisers each participate successful the aforesaid marketplace. Data brokers waste accusation sorted by delicate categories: group who sojourn addiction clinics, group who be definite churches, group who spell to weapon shops and shooting ranges. [11] The aforesaid information that tracks personification to an abortion session tracks personification to a firearms dealer, and thing prevents a early management from utilizing it to build an unofficial weapon proprietor registry without passing a azygous law. Nothing prevents a overseas adversary from buying it either — China, Russia, aliases immoderate nation-state tin acquisition American location information done the aforesaid brokers that waste to U.S. companies. [12] There are virtually nary restrictions successful the United States connected buying, selling, aliases weaponizing this benignant of data. There is nary broad national privateness law. And location isn’t apt to beryllium 1 soon. The champion we tin do is minimize the information we stock successful the first place.

What Apps Can Do That Websites Can’t

Update (May 22, 2026): This conception has been updated pinch corrections from Alex Russell, who helped creation galore of the browser APIs that make these capabilities possible. His activity connected Project Fugu has been instrumental successful closing the spread betwixt autochthonal apps and the web — while keeping users successful control. Thank you to Alex for reaching retired and making this article much accurate. His work, and input is incredibly valuable.

The halfway statement for utilizing the website alternatively of the app comes down to what each level is technically tin of doing without your knowledge.

The shape is clear: wherever the web has closed the gap, it has done truthful pinch definitive personification permission, visible indicators, and nary silent inheritance operation. Native apps inherit permissions crossed each embedded third-party package and tin run without the user’s awareness. The browser is the information boundary. Websites run wrong it. Native apps bypass it.

The Access Provided by Default is Enough to Do Real Harm

The infinitesimal you instal an app, earlier you let a azygous support prompt, it can:

• Reach immoderate server connected the internet
• Read your IP address, instrumentality model, OS version, timezone, country, carrier, and web type
• Generate and persist a unsocial identifier tied to your device
• Run codification astatine instrumentality startup (Android) and aftermath up successful the background
• Fingerprint your instrumentality by combining the supra into a signature that follows you crossed sessions
• Grant each of this aforesaid entree to each third-party package package embedded successful the app
• Compare this information to different datasets to infer your identity, demographics, interests, and habits

The runtime support prompts you really spot (location, camera, contacts) are adjuvant while annoying, but the mostly of the default entree permissions do not require your consent.

A website, by contrast, starts pinch almost nary of this: nary persistent identifier, nary inheritance execution, nary third-party package inheritance, nary startup hooks.

Some Things Need to Be Apps, But Most Don’t

Some things request to beryllium apps. AR and VR, real-time games, thing talking to NFC aliases Bluetooth hardware, superior audio and video work, accessibility tools. These are morganatic cases wherever the browser sandbox is the limitation. In these circumtances, I personally usage a afloat machine arsenic opposed to my phone.

Almost thing other qualifies. Your banking, your travel, your market store, the edifice down the thoroughfare — nary of it needs an app. And rewards beryllium damned. No rewards are worthy the information you are willingly giving them.

Same goes for hardware. If a thermostat aliases a fittingness locator can’t beryllium group up without a proprietary app, that’s a flaw successful the product, not a feature. I instantly debar specified products. You’re buying an ongoing narration pinch personification else’s servers and guaranteeing that you’ll hide that corporations are watching everything they can.

Conclusion

I debar astir apps. It turns retired this is easier than astir group assume, because the app is almost ne'er the only option. It is conscionable the action the institution wants you to return and not capable group question.

We are astatine a very circumstantial clip successful humanity correct now. Where aggregating information is simply a currency, and it is actively being utilized astatine a standard ne'er earlier seen. I urge you astatine slightest return banal of what you’re freely giving away.

References

1. I Decompiled the White House’s New App (Thereallo, March 28, 2026) and Security Analysis of the Official White House iOS App (atomic.computer, March 27, 2026). Two independent researchers decompiled the app connected Android and iOS wrong hours of release.

2. Security Analysis of the Official White House iOS App (atomic.computer). Documents the quiet privateness manifest, OneSignal SDK pinch 10 sub-frameworks, and the distant GPS toggle via server response.

3. Exodus Privacy Report: gov.whitehouse.app. Automated audit identifying 3 embedded trackers including Huawei Mobile Services Core. Additional discourse successful Fedware: 13 Government Apps That Spy Harder Than the Apps They Ban (Sam Bent).

4. A breach of Gravy Analytics’ immense trove of location information threatens the privateness of millions (TechCrunch, January 13, 2025). For the circumstantial 3,455-app figure, spot Gravy Analytics leak: How to protect your location data (Kaspersky, February 18, 2025).

5. FTC Finalizes Order Prohibiting Gravy Analytics, Venntel from Selling Sensitive Location Data (FTC, January 14, 2025).

6. Google to salary $391.5 cardinal successful location search colony pinch 40 states (TechCrunch, November 14, 2022).

7. Location Tracking Tools Endanger Abortion Access. Lawmakers Must Act Now. (EFF, December 6, 2024). Documents military, ICE, and rule enforcement acquisition of commercialized location data.

8. Fog Revealed: A Guided Tour of How Cops Can Browse Your Location Data (EFF, August 31, 2022). Documents really Fog Data Science purchased billions of location information points from apps and sold entree to section rule enforcement agencies without warrants aliases nationalist oversight.

9. Tracking Phones, Google Is a Dragnet for the Police (New York Times, April 13, 2019). Documents the Sensorvault database and geofence warrants sweeping up bystanders.

10. A mom and boy are charged successful Idaho aft a teen is taken to Oregon for an abortion (NPR, November 2, 2023). Police utilized cellphone geolocation information to way the travel to a Planned Parenthood successful Bend, Oregon.

11. Facebook Promised to Remove “Sensitive” Ads. Here’s What It Left Behind (The Markup, May 12, 2022). Documents really delicate ad-targeting categories (race, religion, health, intersexual orientation, governmental causes) persist successful the ad-broker ecosystem contempt stated removals. See besides The Markup’s Blacklight tool for real-time third-party locator inspection.

12. Data Brokers and the Sale of Americans’ Mental Health Data (Joanne Kim, Duke University Sanford School of Public Policy Tech Policy Lab, February 2023). Researchers purchased delicate information connected U.S. subject unit and intelligence wellness patients from information brokers, demonstrating that overseas adversaries could do the same. See besides GAO: Internet Privacy — Additional Federal Authority Could Enhance Consumer Protection and Provide Flexibility (GAO, January 2019).