Surfshark Study Probes Data Hunger Of Web Browsers

Findings uncover Chrome has a immense appetite, ‘collecting 20 different information types crossed galore categories.’

A caller study by VPN supplier Surfshark has recovered that Chrome collects nan astir accusation from users’ phones, while “TOR stands retired arsenic nan astir privacy-centric browser by collecting nary information astatine all.”

The 2 were among 10 that researchers analyzed, aft utilizing AppMagic, a marketplace intelligence tool, to prime nan astir celebrated browser apps connected Apple phones successful nan US successful 2025, they said successful a post outlining their findings.

The researchers noted, “Chrome is nan astir data-hungry, collecting 20 different information types crossed galore categories. These see interaction info, financial details, location, browsing history, hunt history, personification content, identifiers, usage data, diagnostics, and different types of data. Chrome is nan only browser that collects financial information, specified arsenic costs methods, paper numbers, aliases slope relationship details.”

It is also, they stated, nan only browser that collects a database of contacts from nan user’s phone, reside book, aliases societal graph.

The researchers said that nan remaining browsers each only cod an mean of six information types, pinch Bing having nan second-largest appetite, collecting 12 information types. Apple’s Safari browser collects eight.

Other findings revealed that:

• 40% of nan analyzed browsers apps cod users’ locations. Safari, Chrome and Opera “collect coarse location, which refers to a user’s aliases device’s location pinch little precision than nonstop latitude and longitude. Bing is nan only app that collects precise location data.”
  The study pointed retired that 60% of nan apps don’t cod immoderate location information, suggesting that it is not basal for a browser app to cod personification location successful bid to function. “This raises concerns astir why immoderate browsers cod this information and really it is used,” nan researchers wrote.
• Only Opera, Bing, and Pi Browser ads cod information utilized for third-party advertising.
• Pi Browser, Edge, and Bing cod information that is utilized to way an individual.
• DuckDuckGo and Firefox autumn into a mean class successful position of information collection, nan study found; they debar collecting nan astir delicate data. They do stitchery accusation specified arsenic personification interaction information, identifiers specified arsenic instrumentality ID, usage data, and diagnostics.
   “These browsers whitethorn suit users pinch mean privateness concerns but still require robust browsing capabilities,” nan researchers noted.
• In position of worldwide marketplace stock connected Apple devices, Chrome and Safari relationship for 90% of nan total.

When asked for his guidance to nan findings, Forrester Senior Analyst Andrew Cornwall said, “If you’re willing successful privacy, a mobile instrumentality is not your friend. Both Apple and Google study a batch astir you done your interactions pinch your phone. Android users expect immoderate level of snooping successful return for subsidized hardware and software. Apple users expect much privateness but time off a akin integer way that Apple tin follow.”

Most users, said Cornwall, “are consenting to waste and acquisition immoderate privateness for easiness of use. They for illustration not having to participate passwords manually. They whitethorn beryllium consenting to fto Chrome retrieve their in installments paper specifications if it intends nan browser will capable successful nan section for them erstwhile they’re paying bills online. They usage Gmail arsenic their email provider. However, users don’t recognize really overmuch accusation astir them is collected.”

Safayat Moahamad, investigation head astatine Info-Tech Research Group, said, “mobile browsers are uniquely positioned to observe personification behavior. Companies for illustration Google and Microsoft usage nan information they cod (such arsenic hunt terms, visited sites, and geolocation) to personalize services, amended features, and much crucially, powerfulness targeted advertising.”

The much granular nan data, he said, nan much valuable it becomes for advertisement gross and merchandise stickiness, arsenic good arsenic for inferences astir personification intent that thrust business decisions. 

Asked if nan existent regulatory gaps let browsers to cod information without capable oversight, and could caller laws alteration nan game, he said that nan reply is yes and no: “The caller Honda–CPPA settlement is simply a premier example. Regulators recovered that cooky consent practices lacked symmetry. Users weren’t fixed adjacent options to judge aliases cull tracking.”

This highlights a broader problem, said Moahamad “which is that galore browsers alteration search that circumvents existent consent done acheronian patterns aliases deceptive settings. Despite laws for illustration GDPR and CCPA mounting important guardrails, caller laws, for illustration nan EU’s Digital Markets Act and enforcement action specified arsenic US FTC’s colony pinch Honda, purpose to adjacent these gaps and springiness users actionable control.”

What it each means, he said, is that location are “absolutely information risks for nan users, and they’re growing. Browsers shop convention cookies that support you logged in, and hackers are now stealing those cookies astatine scale, 17 billion and counting.”

According to Moahamad, “this lets attackers bypass passwords and moreover MFA, slipping silently into your accounts. Malware, rogue extensions, and phishing links are each introduction points. Users whitethorn consciousness safe pinch 2FA, but if your browser is compromised, your defenses autumn apart.”

When  it comes to nan postulation of individual information via browsers, said Cornwall, “there are nary method solutions, only mitigations. Deleting cookies, disabling location, and renewing location/advertising IDs connected instrumentality tin help, but Apple and Google still cognize your instrumentality ID.”