Tracing the Potential Flow of Consumer Data: A Network Analysis of Prominent Health and Fitness Apps

Abstract

BackgroundA great deal of consumer data, collected actively through consumer reporting or passively through sensors, is shared among apps. Developers increasingly allow their programs to communicate with other apps, sensors, and Web-based services, which are promoted as features to potential users. However, health apps also routinely pose risks related to information leaks, information manipulation, and loss of information. There has been less investigation into the kinds of user data that developers are likely to collect, and who might have access to it.ObjectiveWe sought to describe how consumer data generated from mobile health apps might be distributed and reused. We also aimed to outline risks to individual privacy and security presented by this potential for aggregating and combining user data across apps.MethodsWe purposively sampled prominent health and fitness apps available in the United States, Canada, and Australia Google Play and iTunes app stores in November 2015. Two independent coders extracted data from app promotional materials on app and developer characteristics, and the developer-reported collection and sharing of user data. We conducted a descriptive analysis of app, developer, and user data collection characteristics. Using structural equivalence analysis, we conducted a network analysis of sampled apps’ self-reported sharing of user-generated data.ResultsWe included 297 unique apps published by 231 individual developers, which requested 58 different permissions (mean 7.95, SD 6.57). We grouped apps into 222 app families on the basis of shared ownership. Analysis of self-reported data sharing revealed a network of 359 app family nodes, with one connected central component of 210 app families (58.5%). Most (143/222, 64.4%) of the sampled app families did not report sharing any data and were therefore isolated from each other and from the core network. Fifteen app families assumed more central network positions as gatekeepers on the shortest paths that data would have to travel between other app families.ConclusionsThis cross-sectional analysis highlights the possibilities for user data collection and potential paths that data is able to travel among a sample of prominent health and fitness apps. While individual apps may not collect personally identifiable information, app families and the partners with which they share data may be able to aggregate consumer data, thus achieving a much more comprehensive picture of the individual consumer. The organizations behind the centrally connected app families represent diverse industries, including apparel manufacturers and social media platforms that are not traditionally involved in health or fitness. This analysis highlights the potential for anticipated and voluntary but also possibly unanticipated and involuntary sharing of user data, validating privacy and security concerns in mobile health.

Fitness Tracking Technologies: Data Privacy Doesn’t Matter? The (Un)Concerns of Users, Former Users, and Non-Users

“…Due to the "mobile and networked nature of fitness trackers […] they automatically and persistently collect data, which companies share with or sell to third parties" [30:230]. Although seemingly anonymous, the collected user data can be more easily re-identified due to the increasing uniqueness of the datasets [12,24].…”

Online Influence and Sentiment of Fitness Tweets: Analysis of Two Million Fitness Tweets

“…Research by Tsoh [ 35 ] explores contextual and psychological factors that may underlie the observed low physical activity levels among mobile fitness app users. Our research is more closely related to that of Grundy et al [ 36 ] on the network analysis of prominent health and fitness apps and work by Haddadi et al [ 37 ] on the integration of shared health and fitness data from mobile fitness apps that are shared over social networks. Although these works are highly relevant to the research presented in this paper, we expand the research by carrying out data analysis including gender and online influence.…”

Internet of things (IoT) platform competition: Consumer switching versus provider multihoming

“…Some platform providers, such as Fitbit, Google Fit, and Samsung Health, allow third parties utilizing their cloud platforms as the primary data storage location. While most of the mHealth platforms are web-based, Apple Health is one of the few exceptions that provide a local platform to store and share the data on the iPhone (Farshchian and Vilarinho, 2017 Despite the high interconnectedness of service and platform providers in the mHealth domain (Grundy et al, 2017), a consumer willing to change a platform still incurs considerable switching costs associated with the device and data. Thus, currently, many platforms are vertically integrated with the device and service, which prevents using the same device with another platform.…”