How to Stop Apps From Sharing Your Data

Open your phone's battery settings and count how many apps ran in the background overnight. On a typical Android device, that number lands somewhere between 40 and 90. Now consider this: a 2024 analysis by the AppCensus research team found that the median free app contacts six to ten distinct third-party domains in its first minute of use, most of them advertising and analytics networks you have never heard of. Your location, your device ID, your app usage patterns, and sometimes your contacts get packaged and shipped off before you finish tapping "Get Started."

The uncomfortable truth is that "sharing data with third parties" is not a bug. For a huge chunk of the mobile and web economy, it is the business model. Free apps monetize you, and the plumbing that does it, software development kits (SDKs) baked into the app, sends telemetry to Facebook, Google, ByteDance, and a long tail of data brokers whose entire job is buying and reselling behavioral profiles.

You cannot flip one master switch and make it stop. But you can cut off the vast majority of this leakage with a layered approach: permission hygiene, network-level blocking, smarter app choices, and a few browser and desktop habits. This guide walks through exactly how to stop apps sharing data with third parties, with real steps, real numbers, and honest tradeoffs about what each method costs you.

Key Takeaways

Permissions are your first line of defense. Denying location, contacts, and "background activity" to apps that don't need them kills a surprising amount of data sharing instantly.

Third-party sharing happens at the network layer. A DNS-based blocker (like NextDNS or Pi-hole) stops trackers even inside apps you can't otherwise control.

Choose offline-first and privacy-respecting apps where possible. An app that never phones home can't leak anything.

iOS gives you App Tracking Transparency; Android gives you granular controls. Use both aggressively, and reset your advertising ID monthly.

Your website is also "an app." If you run WordPress or Joomla, your plugins may be the third parties leaking your visitors' data.

What "sharing data with third parties" actually means

When people picture data sharing, they imagine an app selling their email address. That happens, but the more common and more invisible form is telemetry through embedded SDKs.

Here is how it works in practice. A developer wants analytics, crash reporting, and ad revenue. Instead of building those from scratch, they drop in prebuilt kits: Google Firebase for analytics, Meta's SDK for ad attribution, AppsFlyer or Adjust for install tracking. Each SDK opens its own connection to its own servers and sends its own payload. The developer often has no idea exactly what leaves the device.

The data typically includes:

Persistent identifiers: advertising ID, device model, OS version, sometimes hardware serials.
Coarse and fine location: derived from GPS, Wi-Fi SSIDs, or IP address.
Behavioral events: which screens you view, how long you stay, what you tap.
Cross-app linkage: the same advertising ID appearing in ten apps lets a broker stitch a single profile of you.

Three or four data brokers can reconstruct a startlingly complete picture of your day from these fragments. That is why cutting off any single leak matters less than reducing the total surface area.

Step 1: Do a permission audit and revoke what apps don't need

Most data sharing rides on permissions you granted without thinking. A flashlight app that requests location and contacts is not confused; it is monetizing you. Start here because it costs nothing and takes fifteen minutes.

On Android (13 and later)

Open Settings → Privacy → Permission Manager.
Go through each category: Location, Contacts, Microphone, Camera, Physical activity.
For location, set apps to "Allow only while using the app" at most. Set "Ask every time" for anything you rarely use.
Open Settings → Privacy → Privacy Dashboard to see which apps accessed sensitive data in the last 24 hours. Anything surprising is a red flag.
Under Settings → Apps → [App] → Mobile data, disable background data for apps that don't need to sync when closed.

On iOS (16 and later)

Open Settings → Privacy & Security → Tracking and turn OFF "Allow Apps to Request to Track." This forces every app to be denied the IDFA identifier by default.
Go to Settings → Privacy & Security → Location Services and set apps to "While Using" or "Never." Turn off Precise Location for weather and shopping apps.
Check Settings → Privacy & Security → App Privacy Report to see the exact domains each app contacted. This is the single most eye-opening screen on the phone.

Worked example. Say you have 60 apps installed. In a real audit I ran on my own device, 22 had location access, but only 5 genuinely needed it (maps, ride-share, a running tracker, and two delivery apps). Revoking location from the other 17 dropped the number of unique tracker domains in my App Privacy Report from 214 over seven days to 71. That is a 67% reduction from one afternoon of tapping.

If you run a WordPress site, the same "who has permission to see what" logic applies to your plugins. Our guide on how to audit WordPress plugin permissions to prevent data leaks walks through the server-side equivalent of this exact process.

Step 2: Block trackers at the network layer with DNS filtering

Permissions stop obvious abuse, but they don't stop an app you legitimately use from calling ten analytics servers. For that, you block the connections themselves. The most effective consumer-grade tool is DNS-based filtering, which refuses to resolve the domain names of known tracker networks.

When an app tries to reach graph.facebook.com or app-measurement.com, the DNS filter simply returns "no such host," and the data never leaves. It works across every app on the device without root access.

Your main options

Tool	Setup difficulty	Blocks in-app trackers	Cost	Best for
NextDNS	Easy (profile install)	Yes, device-wide	Free up to 300k queries/mo	Phones and laptops on the go
Pi-hole	Moderate (needs a Raspberry Pi)	Yes, home network only	Free (hardware ~$45)	Whole-home blocking
AdGuard DNS	Easy	Yes, device-wide	Free tier available	Simple mobile setup
Private DNS (built-in)	Very easy	Partial	Free	Baseline encryption, light filtering

How to set up NextDNS on your phone (10 minutes)

Create a free account at nextdns.io and note your configuration ID.
In the dashboard, enable the "Ad & Tracker Blocking" lists plus the "Native Tracking Protection" lists for Samsung, Xiaomi, Apple, and Windows if relevant.
On Android: Settings → Network & internet → Private DNS, choose "Private DNS provider hostname," and paste your NextDNS hostname.
On iOS: install the NextDNS configuration profile from their site, then enable it under Settings → VPN & Device Management.
Watch the live query log for a day. You will see exactly which apps are trying to phone which trackers, and how many are getting blocked.

In my own log, a single evening produced roughly 3,400 DNS queries, of which about 900 were blocked trackers. That is background chatter you never see, running whether the app is open or not.

DNS filtering has one honest limitation: apps that hardcode IP addresses or use their own DNS-over-HTTPS can bypass it. That is rare, but it is why network blocking is a layer, not a silver bullet.

Step 3: Choose apps that don't leak in the first place

The cleanest way to stop an app from sharing your data is to use an app that was never designed to. Offline-first and open-source tools have no ad SDKs because they have no ads.

When I evaluate a new app, I run three quick checks:

Does it need an account to do basic things? If a calculator wants your email, walk away.
What does the App Privacy Report / Data Safety label say? "No data collected" is a real category, and plenty of quality apps qualify.
Is there an offline or self-hosted version? Local processing means nothing travels.

This is why I lean toward tools that do their work on-device. A local calculator like CalculatorX or a self-contained offline games hub can't share what it never sends over the wire. When you browse the desktop utilities and Windows software categories, filtering for offline-capable tools is one of the most reliable privacy moves you can make.

Open-source deserves special mention, because you (or the community) can inspect what it actually does. That transparency cuts both ways, though. Malicious dependencies hide in open-source too, which is why it's worth reading how to vet open-source software for supply chain risks before you trust a fresh GitHub repo with your data.