Popular iPhone Apps Secretly Record User Screens, Exposing Sensitive Data
Major iPhone apps use session replay technology to record every tap and swipe without user permission, inadvertently exposing sensitive information like credit card details and passport numbers.
Many major companies, including Air Canada, Hollister, and Expedia, secretly record every tap and swipe users make on their iPhone apps. These companies use session replay technology from analytics firms like Glassbox to capture screenshots of user activity without asking for permission or making their practices clear. This constant surveillance allows app developers to see exactly how users interact with their apps in real time.
This screen recording technology poses a significant privacy risk because several apps fail to properly mask sensitive information during transmission. A mobile expert known as The App Analyst discovers that Air Canada’s app inadvertently exposes unencrypted credit card numbers, passwords, and passport details in the recorded sessions. This leaked data becomes accessible to company employees and anyone else with access to the screenshot database.
None of the examined apps inform users that they record screens or send the data back to the companies or Glassbox's cloud servers. Because this data transmission relies on developers to properly mask sensitive fields, any failure in the process leads to severe privacy breaches. The discovery highlights a widespread lack of transparency and security in how major brands handle user data on mobile devices.