Smartphones increasingly arrive with dozens of applications already installed, raising questions about how much data these apps can collect before users download anything themselves.
A recent analysis by Surfshark found that smartphones from major brands can come with between 50 and 88 pre-installed user-facing applications. Samsung recorded the highest number at 88, followed by Google with 71, Xiaomi with 61 and Apple with up to 50. Surfshark also noted that while people may have between 60 and 90 apps installed on their phones, they typically use only around 10 daily and 30 monthly.
The analysis examined the apps preloaded on Apple, Samsung, Xiaomi and Google devices, as well as their disclosed data-collection practices. Surfshark used Bayton’s database for Android devices and Apple’s technical documentation for iPhones. The company acknowledged that Bayton’s database is based on voluntarily synchronised devices and may not represent every configuration.
Samsung devices had 88 pre-installed applications in the study, with 57% classified by the Universal Debloater Alliance Next Generation project as safe to remove. Among 35 Samsung apps available through Google Play that disclosed their data practices, the average was 13 data types per app.
Facebook and Instagram stood out in the Samsung group, with each disclosing the collection of 37 of the 38 data categories listed by Google Play. Other pre-installed third-party services included Netflix, Microsoft OneDrive and Link to Windows, which disclosed 12, 15 and six data types respectively.
Google smartphones had 71 preloaded applications, with 38% classified as safe to remove. Forty of those apps were available on Google Play and disclosed an average of 13 data types collected per application. Google Gemini and the Google app each disclosed 29 of the 38 categories examined. Three apps — Google Password Manager, Pixel Screenshots and Pixel Studio — stated that they did not collect user data.
Xiaomi devices had 61 pre-installed applications, with 57% classified as safe to remove. Of the 33 Xiaomi apps available on Google Play, the average was 16 disclosed data types per application, the highest average among the Android brands studied. Google Gemini and the Google app again appeared among the apps disclosing the most data collection, while Xiaomi’s Weather, File Manager and Mi Browser stated that they did not collect user data.
Apple’s approach differed somewhat. The study identified up to 50 built-in iPhone applications, all developed by Apple. Of the 47 available through the App Store that disclosed privacy information, the average was eight data types per app. Surfshark also found that users in the European Union can remove up to 98% of built-in iPhone apps, compared with 88% in other regions.
Surfshark’s Chief Security Officer, Tomas Stamulis, advised users to regularly review the applications installed on their phones, check permissions and remove or disable apps they do not use. The company noted that the presence of a data category in an app-store disclosure does not necessarily mean the information is collected from every user; collection can depend on how an application is used and the permissions available to it.
The findings highlight a broader privacy issue surrounding smartphone software. Pre-installed applications can provide useful features and services, but users may not always need all of them. Reviewing permissions and removing unnecessary applications can give consumers greater control over the software and data-sharing choices on their devices.
