These dated cases come from regulator actions and security research. A past finding does not establish what an app on your phone is doing today.
Start by checking recent access and permissions on your device. Then review the apps you still use and remove access you do not want.
Check your phone in two minutes
- iPhone: Open Settings > Privacy & Security > App Privacy Report. Turn it on, then review which apps access data such as your location, camera, and microphone.
- Android: Open Settings > Security and Privacy (or Privacy) > Privacy dashboard. Choose a permission to see which apps accessed it recently.
1. Facebook (2019)
What happened: In 2019, the FTC said Facebook shared users' information with apps used by their friends despite restrictive privacy settings. Facebook agreed to a $5 billion penalty and new privacy restrictions.
What to check: Review Facebook's privacy controls and connected apps. Remove access you no longer want.
2. TikTok (EEA, 2025; US update, 2026)
What happened: In 2025, Ireland's data regulator fined TikTok 530 million euros over transfers of EEA user data to China and transparency failures. A July 2026 US Justice Department opinion said the version operated by the TikTok US Data Security Joint Venture falls outside the federal government device ban.
What to check: Review TikTok's permissions and privacy settings. Disable access you do not need.
3. CamScanner (Android, 2019)
What happened: In 2019, Kaspersky found a malicious module in an advertising library shipped with some Android versions of CamScanner. Kaspersky later reported that the module was removed and Google Play restored the app.
What to check: If you still use CamScanner, update it and review its permissions. Remove any old copy you do not need.
4. Grindr (Norway, 2021)
What happened: In 2021, Norway's data protection authority fined Grindr 65 million Norwegian kroner for disclosing personal data, including special category data, to advertising partners without a valid legal basis.
What to check: Review Grindr's location permission and advertising choices. Reconsider profile details you do not want to share.
5. SpyFone stalkerware (2021)
What happened: In 2021, the FTC alleged that SpyFone sold stalkerware that let purchasers monitor a phone's photos, messages, browsing, and location without its owner's knowledge. The FTC finalized an order banning the provider and its CEO from the surveillance business and requiring deletion of illegally collected data.
What to check: Review installed apps for unfamiliar monitoring tools. If you suspect covert monitoring, seek help from someone you trust.
6. Pegasus spyware (2025 to 2026)
What happened: In 2026, Citizen Lab confirmed a Pegasus infection on a Serbian student activist's iPhone, with indicators from December 2025 through January 2026. Researchers said Apple had patched the suspected exploit by iOS 18.4.1.
What to check: Keep your iPhone updated. If Apple sends you a threat notification, verify it through your Apple Account and seek expert help.
7. iRecorder (Android, 2022 to 2023)
What happened: ESET found that an August 2022 update to iRecorder added code that could record surrounding audio and take files from the device. After ESET reported the app in 2023, Google Play removed it.
What to check: If this specific iRecorder app is installed, remove it. Review microphone permissions for any other recording apps you keep.
8. Flo Period & Ovulation Tracker (2021)
What happened: In 2021, the FTC alleged that Flo shared users' sensitive health data with marketing and analytics firms, including Facebook and Google, after promising to keep it private. The FTC finalized a settlement requiring user consent before such sharing and notice to affected users.
What to check: Review the health information you have entered and Flo's current privacy choices. Decide what information you want to keep adding.
9. Premom (2023)
What happened: In 2023, the FTC alleged that Premom's developer shared sensitive user information with third parties, including Google, AppsFlyer, and two firms based in China. A court entered a settlement order in June 2023.
What to check: Review Premom's permissions and the health details you have stored. Reconsider what you want to enter going forward.
10. GoodRx (2023)
What happened: In 2023, the FTC said GoodRx had shared users' prescription and health condition information with advertising companies, including Facebook and Google, contrary to its privacy promises. A federal court entered an order in February 2023.
What to check: Review the medications and health details saved in your GoodRx account. Keep only information you want there.
11. BetterHelp (2023)
What happened: In 2023, the FTC said BetterHelp shared sensitive health information with advertising companies after promising to keep it private. The FTC finalized an order barring health data sharing for advertising and requiring BetterHelp to pay $7.8 million.
What to check: Review your account details and BetterHelp's current privacy terms before adding more sensitive information.
