By Surfshark
Image: Surfshark
Brand new smartphones are packed with pre-installed applications, but this convenience often comes at a hidden privacy cost. From manufacturer utilities to pre-installed third-party apps, many of them may never be used and remain silently active behind the scenes. The reality is that such bloatware increases data harvesting and may collect personal information you never intended to share. This study takes a closer look at what’s really lurking on your home screen.
Each new iPhone comes with up to 50 built-in apps, all developed by Apple. Across the 47 apps available for download on the App Store that disclose their data collection practices, Apple gathers an average of 8 data types per app. This includes location-category data, such as approximate location (19 apps), precise location (8 apps), or physical addresses (5 apps). It also encompasses behavioral data or user content, alongside sensitive information. The apps collecting the most data are the Apple Store app (used for shopping Apple products) and Apple Music, gathering 18 and 17 out of 35 data types respectively — more than double the average for built-in apps.
Most of Apple’s built-in apps can be deleted, though availability varies by region. EU users can remove up to 98% of built-in apps, compared to 88% in other countries. For example, Safari can be uninstalled in the EU or Japan, but not in other regions.¹ In the EU, the Phone app is the only built-in app available for download on the App Store that users cannot delete, meaning that other built-in apps can be replaced with alternatives. Settings cannot be deleted either, although it is unavailable on the App Store. Removing unnecessary apps frees up device storage, makes a cleaner interface, and helps narrow the overall threat scope. Additionally, switching to third-party apps keeps user data from being concentrated in a single ecosystem. This reduces privacy risks and limits user-profiling capabilities.
Samsung smartphones come preloaded with apps from Samsung, Google, mobile carriers, and third-party partners. In Bayton’s database of voluntarily synced Samsung smartphones, a total of 88 user-facing apps were logged as preloaded, and 57% of those were marked as safe to remove by the Universal Debloater Alliance Next Generation project. Across the 35 apps available for download on Google Play that disclose their data collection practices, these apps gather an average of 13 data types per app. This includes location-category data — such as approximate location (14 apps), precise location (12 apps), and physical addresses (11 apps) — among many other types of information. Like Apple, some apps also use sensitive details such as sexual orientation, political or religious beliefs. Facebook and Instagram collect the most data, with each gathering 37 out of 38 data types — accounting for 97% of all data types listed on Google Play. Other third-party apps make the list too, including Netflix, Microsoft OneDrive and Link to Windows, which collect 12, 15, and 6 data types, respectively. Six apps claim they do not collect any user data.
Like Samsung, Xiaomi preloads its smartphones with apps from multiple sources as well. In Bayton’s database of voluntary synced Xiaomi smartphones, a total of 61 user-facing apps were logged as preloaded, and 57% of those were marked as safe to remove by the Universal Debloater Alliance Next Generation project. Across the 33 apps available for download on Google Play, these apps gather an average of 16 data types per app. This includes location information — such as physical addresses (17 apps), approximate location (15 apps), and precise location (11 apps) — among many other data types. The apps collecting the most data are Google Gemini and Google, each gathering 29 out of 38 data types — nearly double the average. Notably, three apps — Weather, File Manager, and Mi Browser — state that they do not collect any user data.
In Bayton’s database of voluntary synced Google smartphones, a total of 71 user-facing apps were logged as preloaded, and 38% of those were marked as safe to remove by the Universal Debloater Alliance Next Generation project. Across the 40 apps available for download on Google Play that disclose their data collection practices, these apps gather an average of 13 data types per app. Beyond other information, this includes location details such as physical addresses (15 apps), approximate location (14 apps), and precise location (11 apps). Three apps — Google Password Manager, Pixel Screenshots and Pixel Studio — declare that they do not collect any user data. The apps collecting the most data are Google Gemini and Google, each gathering 29 out of 38 data types — more than double the average. In fact, Google-owned apps fill every single spot on the list.
To list built-in apps on Apple devices, we used official technical specifications provided by Apple, such as the iPhone 17 Pro.⁴ However, since such documentation was not equivalent for Android devices, data was sourced from the Bayton System app database. Apps were filtered by Original Equipment Manufacturer (OEM), selecting only user-facing packages, then further refined to cover only mobile devices. We recognize that this approach has limitations, as a database built on voluntary contributions may lack completeness and absolute accuracy.
The compiled lists of preloaded apps were enriched with data on whether each app could be safely removed. For Apple devices, this was determined using iPhone User Guide⁵, supplemented by online research. For Android devices, lists were enriched using data provided by the Universal Debloater Alliance Next Generation project, where a “Recommended” tag indicated that an app could be safely uninstalled without causing performance issues.
To evaluate data collection practices of preloaded apps, information on the total number of data types each app may collect was retrieved from the Apple App Store and Google Play on September 2, 2026. Because other app stores lack standardized privacy labels, this analysis focused exclusively on apps available on these two platforms; for apps hosted elsewhere, users must either review complex legal policies or remain uninformed about data handling practices. Notably, developers are required to declare which data their apps collect across 35 data types for the Apple App Store, compared to 38 for Google Play.
For the complete research material behind this study, click here.
Fact-Checked by Irfan Ahmad.
Read next: Online reviews can expose hidden social ties, increasing risks of phishing attacks
Brand new smartphones are packed with pre-installed applications, but this convenience often comes at a hidden privacy cost. From manufacturer utilities to pre-installed third-party apps, many of them may never be used and remain silently active behind the scenes. The reality is that such bloatware increases data harvesting and may collect personal information you never intended to share. This study takes a closer look at what’s really lurking on your home screen.
Each new iPhone comes with up to 50 built-in apps, all developed by Apple. Across the 47 apps available for download on the App Store that disclose their data collection practices, Apple gathers an average of 8 data types per app. This includes location-category data, such as approximate location (19 apps), precise location (8 apps), or physical addresses (5 apps). It also encompasses behavioral data or user content, alongside sensitive information. The apps collecting the most data are the Apple Store app (used for shopping Apple products) and Apple Music, gathering 18 and 17 out of 35 data types respectively — more than double the average for built-in apps.
Most of Apple’s built-in apps can be deleted, though availability varies by region. EU users can remove up to 98% of built-in apps, compared to 88% in other countries. For example, Safari can be uninstalled in the EU or Japan, but not in other regions.¹ In the EU, the Phone app is the only built-in app available for download on the App Store that users cannot delete, meaning that other built-in apps can be replaced with alternatives. Settings cannot be deleted either, although it is unavailable on the App Store. Removing unnecessary apps frees up device storage, makes a cleaner interface, and helps narrow the overall threat scope. Additionally, switching to third-party apps keeps user data from being concentrated in a single ecosystem. This reduces privacy risks and limits user-profiling capabilities.
Samsung smartphones come preloaded with apps from Samsung, Google, mobile carriers, and third-party partners. In Bayton’s database of voluntarily synced Samsung smartphones, a total of 88 user-facing apps were logged as preloaded, and 57% of those were marked as safe to remove by the Universal Debloater Alliance Next Generation project. Across the 35 apps available for download on Google Play that disclose their data collection practices, these apps gather an average of 13 data types per app. This includes location-category data — such as approximate location (14 apps), precise location (12 apps), and physical addresses (11 apps) — among many other types of information. Like Apple, some apps also use sensitive details such as sexual orientation, political or religious beliefs. Facebook and Instagram collect the most data, with each gathering 37 out of 38 data types — accounting for 97% of all data types listed on Google Play. Other third-party apps make the list too, including Netflix, Microsoft OneDrive and Link to Windows, which collect 12, 15, and 6 data types, respectively. Six apps claim they do not collect any user data.
Like Samsung, Xiaomi preloads its smartphones with apps from multiple sources as well. In Bayton’s database of voluntary synced Xiaomi smartphones, a total of 61 user-facing apps were logged as preloaded, and 57% of those were marked as safe to remove by the Universal Debloater Alliance Next Generation project. Across the 33 apps available for download on Google Play, these apps gather an average of 16 data types per app. This includes location information — such as physical addresses (17 apps), approximate location (15 apps), and precise location (11 apps) — among many other data types. The apps collecting the most data are Google Gemini and Google, each gathering 29 out of 38 data types — nearly double the average. Notably, three apps — Weather, File Manager, and Mi Browser — state that they do not collect any user data.
In Bayton’s database of voluntary synced Google smartphones, a total of 71 user-facing apps were logged as preloaded, and 38% of those were marked as safe to remove by the Universal Debloater Alliance Next Generation project. Across the 40 apps available for download on Google Play that disclose their data collection practices, these apps gather an average of 13 data types per app. Beyond other information, this includes location details such as physical addresses (15 apps), approximate location (14 apps), and precise location (11 apps). Three apps — Google Password Manager, Pixel Screenshots and Pixel Studio — declare that they do not collect any user data. The apps collecting the most data are Google Gemini and Google, each gathering 29 out of 38 data types — more than double the average. In fact, Google-owned apps fill every single spot on the list.
Methodology and sources
This study focuses on top mobile brands Apple, Samsung, Xiaomi², as well as Google, the market’s fastest-growing brand by shipment volume³. The objective is to identify preloaded apps on these devices, determine the user’s ability to remove them, and analyze their data collection practices.To list built-in apps on Apple devices, we used official technical specifications provided by Apple, such as the iPhone 17 Pro.⁴ However, since such documentation was not equivalent for Android devices, data was sourced from the Bayton System app database. Apps were filtered by Original Equipment Manufacturer (OEM), selecting only user-facing packages, then further refined to cover only mobile devices. We recognize that this approach has limitations, as a database built on voluntary contributions may lack completeness and absolute accuracy.
The compiled lists of preloaded apps were enriched with data on whether each app could be safely removed. For Apple devices, this was determined using iPhone User Guide⁵, supplemented by online research. For Android devices, lists were enriched using data provided by the Universal Debloater Alliance Next Generation project, where a “Recommended” tag indicated that an app could be safely uninstalled without causing performance issues.
To evaluate data collection practices of preloaded apps, information on the total number of data types each app may collect was retrieved from the Apple App Store and Google Play on September 2, 2026. Because other app stores lack standardized privacy labels, this analysis focused exclusively on apps available on these two platforms; for apps hosted elsewhere, users must either review complex legal policies or remain uninformed about data handling practices. Notably, developers are required to declare which data their apps collect across 35 data types for the Apple App Store, compared to 38 for Google Play.
| Built-in Apps (Apple) | Remove | Remove (EU) |
|---|---|---|
| Apple Store | Y | Y |
| App Store | N | Y |
| Books | Y | Y |
| Calculator | Y | Y |
| Calendar | Y | Y |
| Camera | N | Y |
| Clock | Y | Y |
| Compass | Y | Y |
| Contacts | Y | Y |
| FaceTime | Y | Y |
| Files | Y | Y |
| Find My | Y | Y |
| Fitness | Y | Y |
| Freeform | Y | Y |
| Games | Y | Y |
| GarageBand | Y | Y |
| Health | Y | Y |
| Home | Y | Y |
| Image Playground | Y | Y |
| iMovie | Y | Y |
| iTunes Store | Y | Y |
| Journal | Y | Y |
| Keynote | Y | Y |
| Magnifier | Y | Y |
| Y | Y | |
| Maps | Y | Y |
| Measure | Y | Y |
| Messages | N | Y |
| Music | Y | Y |
| News | Y | Y |
| Notes | Y | Y |
| Numbers | Y | Y |
| Pages | Y | Y |
| Passwords | Y | Y |
| Phone | N | N |
| Photos | N | Y |
| Podcasts | Y | Y |
| Preview | Y | Y |
| Reminders | Y | Y |
| Safari | N | Y |
| Settings | N | N |
| Shortcuts | Y | Y |
| Stocks | Y | Y |
| Tips | Y | Y |
| Translate | Y | Y |
| TV | Y | Y |
| Voice Memos | Y | Y |
| Wallet | Y | Y |
| Watch | Y | Y |
| Weather | Y | Y |
| Apps (Samsung) | User-facing | Remove |
|---|---|---|
| Accessibility | Y | Expert |
| Android Switch | Y | Recommended |
| AR Emoji Editor | Y | Recommended |
| AR-zone | Y | Recommended |
| AT&T Cloud | Y | Recommended |
| Authentication Framework | Y | Recommended |
| Avatar Stickers | Y | Recommended |
| Bixby | Y | Recommended |
| Bixby Vision | Y | Recommended |
| Calendar | Y | Advanced |
| Call | Y | Unsafe |
| Call Filter | Y | Recommended |
| Camera | Y | Recommended |
| Chrome | Y | Advanced |
| Clock | Y | Advanced |
| Cloud | Y | Recommended |
| Contacts | Y | Expert |
| Contacts | Y | Advanced |
| Device care | Y | Advanced |
| Device Help | Y | Recommended |
| Discovery Hub | Y | Recommended |
| Downloads | Y | Advanced |
| Drawing assist | Y | Recommended |
| Y | Recommended | |
| Y | Recommended | |
| Files | Y | Unsafe |
| Files | Y | Unsafe |
| Finder | Y | Advanced |
| Galaxy Avatar | Y | Recommended |
| Galaxy Beta Service | Y | - |
| Galaxy Resource Updater | Y | Expert |
| Galaxy Store | Y | Expert |
| Galaxy Themes | Y | Advanced |
| Gallery | Y | Advanced |
| Gaming Hub | Y | Recommended |
| Gemini | Y | Recommended |
| Gmail | Y | Recommended |
| Y | Advanced | |
| Google Play Store | Y | Expert |
| Health Connect | Y | Advanced |
| Y | Recommended | |
| Interpreter | Y | Advanced |
| Link to Windows | Y | Recommended |
| Live Transcribe and Sound Notifications | Y | Advanced |
| Maps | Y | Recommended |
| Meet | Y | Recommended |
| Messages | Y | Advanced |
| Messages | Y | Advanced |
| Microsoft SwiftKey Keyboard | Y | Advanced |
| Modes and Routines | Y | Expert |
| My Files | Y | Advanced |
| My Galaxy | Y | Recommended |
| My Verizon | Y | Recommended |
| Netflix | Y | Recommended |
| OneDrive | Y | Recommended |
| Phone | Y | Advanced |
| Photos | Y | Recommended |
| Private Share | Y | Recommended |
| Radio | Y | Advanced |
| Reminder | Y | Recommended |
| Samsung Cloud | Y | Recommended |
| Samsung Free | Y | Recommended |
| Samsung Internet | Y | Recommended |
| Samsung Max VPN | Y | Recommended |
| Samsung Notes | Y | Recommended |
| Samsung Pass | Y | Recommended |
| Samsung Wallet | Y | Recommended |
| Secure Folder | Y | Recommended |
| Secure Wi-Fi | Y | Recommended |
| Separated Apps | Y | Advanced |
| Service provider location | Y | Recommended |
| Settings | Y | Expert |
| SFR Jeux | Y | - |
| SFR My Apps | Y | - |
| SIM Toolkit | Y | Expert |
| SIM toolkit | Y | Advanced |
| Smart Switch | Y | Recommended |
| System Tracing | Y | Recommended |
| System UI | Y | Unsafe |
| Tasks | Y | Recommended |
| Terminal | Y | - |
| Verizon Protect | Y | Recommended |
| Video Editor | Y | Advanced |
| Visual Voicemail | Y | Recommended |
| Voice Access | Y | Recommended |
| Wearable Manager Installer | Y | Recommended |
| Weather | Y | Recommended |
| YouTube | Y | Recommended |
| App (Google) | User-facing | Remove |
|---|---|---|
| Settings | Y | Unsafe |
| System UI | Y | Unsafe |
| Google Play Store | Y | Expert |
| Chrome | Y | Advanced |
| Downloads | Y | Advanced |
| Gmail | Y | Recommended |
| System Tracing | Y | Recommended |
| Maps | Y | Recommended |
| YouTube | Y | Recommended |
| Android Switch | Y | Recommended |
| Y | Advanced | |
| Files | Y | Unsafe |
| SIM Toolkit | Y | Advanced |
| Messages | Y | Advanced |
| Meet | Y | Recommended |
| Photos | Y | Recommended |
| Digital Wellbeing | Y | Advanced |
| Health Connect | Y | Advanced |
| Gboard | Y | Advanced |
| Calendar | Y | Recommended |
| Contacts | Y | Advanced |
| Drive | Y | Recommended |
| YouTube Music | Y | Recommended |
| Google TV | Y | Recommended |
| Files by Google | Y | Recommended |
| Calculator | Y | Recommended |
| Phone | Y | Advanced |
| Clock | Y | Advanced |
| Personal Safety | Y | Advanced |
| Switch Access | Y | Recommended |
| Live Transcribe and Sound Notifications | Y | Advanced |
| Voice Access | Y | Recommended |
| Gemini | Y | Recommended |
| Wallpaper and style | Y | Advanced |
| Clock | Y | Advanced |
| Find Hub | Y | Recommended |
| Terminal | Y | - |
| Device Policy | Y | Recommended |
| Contacts | Y | Advanced |
| Android System Angle | Y | Advanced |
| Files | Y | Unsafe |
| Phone | Y | Expert |
| Sound Amplifier | Y | Recommended |
| Camera | Y | Advanced |
| Recorder | Y | Recommended |
| Pixel Tips | Y | Recommended |
| Pixel Weather | Y | Recommended |
| Pixel Studio | Y | Advanced |
| VPN by Google | Y | Recommended |
| Pixel Buds | Y | Recommended |
| Gallery | Y | Advanced |
| Health Connect | Y | Recommended |
| Pixel display services | Y | Advanced |
| Magic Portrait | Y | - |
| Now Playing | Y | - |
| Theme packs | Y | - |
| Calculator | Y | Advanced |
| Android Beta Feedback | Y | Recommended |
| Music | Y | Recommended |
| Calendar | Y | Advanced |
| Health Connect | Y | Advanced |
| Pixel Screenshots | Y | - |
| Thermometer | Y | - |
| Messaging | Y | Advanced |
| Auditor | Y | - |
| App Store | Y | - |
| Camera | Y | - |
| Info | Y | - |
| PDF Viewer | Y | - |
| Vanadium | Y | - |
| Wachtwoorden | Y | - |
| App (Xiaomi) | User-facing | Remove |
|---|---|---|
| Settings | Y | Unsafe |
| System UI | Y | Unsafe |
| Google Play Store | Y | Expert |
| Chrome | Y | Advanced |
| Downloads | Y | Advanced |
| Gmail | Y | Recommended |
| System Tracing | Y | Recommended |
| Maps | Y | Recommended |
| YouTube | Y | Recommended |
| Android Switch | Y | Recommended |
| Y | Advanced | |
| Files | Y | Unsafe |
| SIM Toolkit | Y | Advanced |
| Messages | Y | Advanced |
| Meet | Y | Recommended |
| Photos | Y | Recommended |
| Digital Wellbeing | Y | Advanced |
| Health Connect | Y | Advanced |
| Gboard | Y | Advanced |
| Calendar | Y | Recommended |
| Contacts | Y | Advanced |
| Drive | Y | Recommended |
| YouTube Music | Y | Recommended |
| Google TV | Y | Recommended |
| Phone | Y | Advanced |
| Personal Safety | Y | Advanced |
| Switch Access | Y | Recommended |
| Gemini | Y | Recommended |
| Link to Windows | Y | Recommended |
| Assistant | Y | Recommended |
| Sound Recorder | Y | Advanced |
| Clock | Y | Advanced |
| Terminal | Y | |
| Contacts | Y | Advanced |
| DuraSpeed | Y | Expert |
| Google One | Y | Recommended |
| Camera | Y | Advanced |
| Health Connect | Y | Recommended |
| Themes | Y | Advanced |
| File Manager | Y | Advanced |
| App vault | Y | Recommended |
| Gallery | Y | Advanced |
| Services & feedback | Y | Recommended |
| Music | Y | Recommended |
| Security | Y | Expert |
| Game Centre | Y | Recommended |
| GetApps | Y | Recommended |
| Mi Video | Y | Recommended |
| Messages | Y | Advanced |
| Mi Browser | Y | Recommended |
| FM Radio | Y | Recommended |
| Calendar | Y | Recommended |
| My Apps | Y | Recommended |
| GPay | Y | Recommended |
| Калькулятор | Y | Recommended |
| Компас | Y | Recommended |
| Заметки | Y | Recommended |
| Запись экрана | Y | Recommended |
| Погода | Y | Recommended |
| ShareMe | Y | Recommended |
| Сканер | Y | Recommended |
For the complete research material behind this study, click here.
Fact-Checked by Irfan Ahmad.
Read next: Online reviews can expose hidden social ties, increasing risks of phishing attacks
