A test between February and April on five widely used spam call blocker apps showed that two of them, CallApp and Truecaller, had disclosed “personal information such as names, email addresses and even home addresses … and [made them] fully accessible to others,” vice-chairman of the Consumer Council’s publicity and community relations committee, Kenneth Chan Kin-nin, said on Thursday.
He urged residents to read the terms of service and privacy policies of such apps to evaluate their trustworthiness, even as he acknowledged that telemarketing or spam calls users received every day brought significant annoyance.
Chan explained that CallApp, upon accessing the user’s contact lists, automatically uploaded all contact information into its database, allowing other parties to perform a “reverse lookup” by simply entering a phone number.
These parties could then trace the owner’s name and view their personal information, including their full name in both Chinese and English, email address, social media links and other details.
“If a user stores the mobile numbers of friends and relatives in their contact list and permits access when using the app, [those contacts’] personal data can be accessed and uploaded by the app even if [the contacts] never downloaded the app or authorised such use,” Chan said, noting that such actions were “close to impossible to guard against”.
The app’s privacy policy stated that if users granted permission for the developer to collect data from their contacts, it was they, the users, who became responsible for informing their contacts about the developer’s data collection and sharing practices.
“The Council considers this to be tantamount to imposing on the user the responsibility of [notifying others of] the developer’s extraction of data from contacts, which is an unreasonable and impracticable requirement,” Chan said.
The watchdog found that Truecaller accessed and uploaded users’ contact lists in a similar manner, but only when the user downloaded an APK file from its official website, installed the app and enabled the “enhanced search” function.
A trial test by the council confirmed that information of its contacts saved in a new SIM card were found in the databases of both apps, which allowed unrestricted access without consent.
“Some entries even included sensitive details such as previous residential addresses and monthly rent amounts, suggesting data extraction from the contact lists of landlords or real estate agents,” Chan said.
All apps in the study allowed users to apply for the removal of their phone numbers from the databases, but CallApp’s privacy policy indicated that a user’s personal information and data, even when removed, could be retained for up to five years.
“Consumers should think twice before choosing to use this app,” Chan said, adding that developers of CallApp and Truecaller had not replied to the council’s inquiries.