Installing an app takes two taps, but the consequences of ignoring what you agree to can linger for months. Before hitting Install, users should scrutinize the developer’s identity, the data-safety disclosures, and the permissions requested. Neither Google Play nor the App Store is infallible, and the privacy labels on both platforms are filled out by developers themselves, not verified by Google or Apple.
- Self-reported labels: Data safety sections on Google Play and App Store privacy details reflect developer declarations, not independent audits.
- Massive filtering: Google blocked over 1.75 million policy-violating apps and banned more than 80,000 developer accounts in 2025; Apple rejected over 2 million submissions and closed 193,000 accounts.
- Permissions matter: Both Android and iOS let you revoke permissions after installation, and Play Protect can reset permissions for unused apps after three months.
What the privacy labels actually tell you
On Google Play, the Data safety section expands via “See details” to show what data is collected, how it is used, whether it is shared, if it is encrypted in transit, and how to request deletion. The fine print matters: data processed “ephemerally” is not counted as collected, and data sent to a service provider working for the developer is not counted as shared. Google acknowledges that the independent review some apps display does not verify the accuracy of the declarations.
On the App Store, Apple introduced privacy information on each product page in June 2020, and the company states that developers supply the information. The key blocks are “Data Used to Track You” — data linked with third-party data for advertising or shared with a data broker — and “Data Linked to You.” The tracking block on iPhone and the shared-data block on Android are often the most revealing. A flashlight app that appears there warrants a second look.
Who is behind the app, and why stars mislead
Google notes that most apps on Google Play are created by external developers, not Google itself. The “App support” section shows the developer’s contact, which should be cross-checked against the official website. Your bank’s app must be published by your bank, not a similarly named entity.
Cloned apps are a real problem: in 2025, Apple rejected more than 371,000 submissions that copied other apps, were spam, or misled users, and removed nearly 59,000 apps that were approved as a game or utility but later transformed to commit financial fraud. Google advises checking the rating and download count under the title and reading reviews — with skepticism. Google blocked 160 million fake ratings and reviews in 2025, while Apple blocked nearly 195 million of the more than 1.3 billion it processed.
To report a fraudulent app on Google Play, the help center instructs users to tap “More > Flag as inappropriate” on the app’s listing; Apple directs users to its tool for reporting problems with a download or purchase.
Reviewing and revoking permissions after installation
On Android, go to Settings > Apps > [the app] > Permissions; on iPhone, go to Settings > Privacy & Security and choose each category. Both systems allow revoking a permission at any time without uninstalling the app.
According to Android help, for location, camera, and microphone you can allow access only while the app is in use or require it to ask every time. In Security & privacy > Privacy > Permission manager, you can see which apps access your SMS or calendar. The “Pause app activity if unused” setting revokes permissions from forgotten apps. On devices running Android 6.0 to 10, Google Play Protect can reset permissions for apps unused for three months, according to its support page.
On iPhone, Apple’s user guide explains that you can change what you granted later. The same screen hosts the App Privacy Report, showing each app’s use of permissions and network activity. The practical rule mirrors browser extensions: a permission must make sense for what the app does. A photo editor does not need your SMS. And because some apps change after review, recheck permissions after major updates.
What Play Protect does — and when it is not enough
Play Protect is Android’s built-in antimalware: it scans apps from Google Play before download, analyzes the phone for harmful apps installed from other sources, and can disable or remove them. It is enabled by default. To verify, open the Play Store, tap your profile icon, go to Play Protect > Settings, and confirm “Scan apps with Play Protect” is on. According to its balance, it scans more than 350 billion apps per day and in 2025 identified over 27 million new malicious apps outside Google Play.
It is not enough when you disable it because someone asks you to. That is why Google prevents turning it off during a phone call — a barrier against scammers who convince victims to lower their defenses and install malware, a close cousin of the fake remote-support technician scam.
Sideloading: APKs on Android and alternative stores on iPhone
Android allows installing apps from other sources, but Google warns that doing so risks the device and data, and that the phone may send information about those apps. Its enhanced protection blocks installations from a browser or messaging app when the app requests sensitive permissions: in 2025 it stopped 266 million attempts. For tinkerers, developer verification protections began on September 30, 2026, in Brazil, Indonesia, Singapore, and Thailand, on certified devices running Android 7 or later, and will expand worldwide in 2027, with an advanced flow for expert users to install unverified apps.
On iPhone, Apple has applied changes in the EU since 2024 to comply with the Digital Markets Act. According to its support page on alternative distribution, in the EU you can install alternative stores and apps from a developer’s website if your Apple account is set to an EU country and you are physically there. Those apps undergo notarization, a basic check against known malware, but each store applies its own review. Apple warns that its ability to help with them is limited, including scams and refunds. Parental controls can prevent installation on a family member’s iPhone.
Opening the iPhone to other stores is good for competition, but it shifts to users work that Apple previously did, while Google tightens Android. If an app is only available outside the official store, the question is not how to install it but why it is not inside. And in any store, the most important data point is not the stars but who publishes the app and what permissions it requests.