FBI warns that foreign-developed mobile apps may expose user data

The FBI has issued a public service announcement warning U.S. users about data security risks tied to foreign-developed mobile apps, with a particular focus on apps developed and maintained by companies based in China. The advisory, published by the Internet Crime Complaint Center on March 31, 2026, says many of the most-downloaded and top-grossing apps in the United States are run by foreign firms and that some may collect more data than users realize.

FBI says data collection can extend beyond the app itself

According to the IC3 notice, once a user grants permissions, some apps may continue collecting private information from across the device rather than only while the app is open. The FBI says this can include contact data, such as names, phone numbers, e-mail addresses, user IDs, and physical addresses stored in a user’s address book. The bureau also warns that this can affect both users and non-users whose details are stored on the device.

The advisory also points to where that data may end up. The FBI says some app privacy policies state that personal information, including system prompts, may be stored on servers in China for as long as developers consider necessary. It adds that some apps require users to consent to data sharing before they can use the service at all.

Malware risk is part of the warning

The FBI’s PSA does not frame the issue only as a privacy policy concern. It also says some apps may contain malware capable of collecting data beyond what the user explicitly authorized. In the bureau’s description, that can include malicious code, backdoors, and additional downloaded packages designed to expand access to a victim’s device and data. The agency says apps downloaded from unfamiliar websites or third-party stores carry a higher risk, while official app stores reduce, but do not eliminate, that exposure.

For users, the bureau’s guidance is to disable unnecessary data sharing, download apps only from official stores, keep device software up to date, and read the terms of service or end-user license agreements before installing an app. The FBI also recommends reporting suspected compromise or suspicious activity related to a foreign-developed app through IC3, including details such as the app name, device type, permissions granted, and any unusual behavior seen after installation.