Researchers have uncovered that smartphone applications record video footage and screenshots of your activity and then send the recordings to third parties.
In some cases, the secretive filming captures personal information of users, including their zip or postcode.
Scientists made the find while investigating the long-held rumour that apps are capable of hijacking microphones in smart devices to secretly record audio to help them better target advertisements displayed online.
Scientists at Northeastern University in Boston ran an experiment that tested 17,260 of the most popular Android apps, including many owned by Facebook.
Of those investigated, more than half had permission to access users’ camera and microphone, allowing them to activate the features any time the app was open.
Researchers used an automated programme to analyse photo, video and audio files sent to and from the apps – which were loaded onto ten Android devices – but found no evidence that any were secretly recording using the built-in microphone.
The latest findings dispel the enduring rumour that apps like Facebook periodically record conversations and send keywords to third parties to help them target adverts.
Paranoid users have complained that after chatting about niche topics or holiday destinations, relevant ads will often appear across their apps or online browsing.
A closer look at the results from the stud shows that while apps were not listening, some do regularly record footage and screenshots of what users are doing.
The software then forwards this information to third-party domains for analysis.
Researchers caught one app – the US Deliveroo-style service GoPuff – recording the screens of users and sending the footage to mobile analytics firm Appsee.
The app, which has been downloaded more than 100,000 times from the Google Play Store, took footage of a screen that asked for a customers to list their zip code.
Most modern smartphones are loaded with AI assistants, which are triggered by spoken commands, like ‘Hey Siri’ or ‘OK, Google’.
These smartphone models are constantly listening out for the designated wake word or phrase, with everything else discarded.
However, keywords and phrases picked-up by the gadget can be accessed by third-party apps, like Instagram and Twitter, when the right permissions are enabled, Dr Henway told Vice.