• Nearly half of the top mobile apps collect your browsing history
• Social media apps are the worst offenders
• Avoiding in-app browsers can limit data collection

You probably assume your web browser is the only app keeping tabs on where you go online. According to new research from Surfshark, that assumption is incorrect.

The cybersecurity firm analyzed 40 of the most popular Android and iOS apps and found that 18 of them, or 45%, report collecting users' browsing history in their app store privacy labels. In other words, nearly half of the apps you open every day may be logging the websites you visit.

Even the best VPN cannot fully stop an app from recording what you do inside its own walls, which makes understanding what you are signing up for more important than ever.

What Surfshark found

Surfshark's team looked at 40 leading apps split evenly across four categories: generative AI, social media, e-commerce, and messaging.

For each one, the researchers checked whether its Apple App Store label reported collecting "Browsing History" and whether its Google Play label reported "Web Browsing History."

Social media came out as the biggest collector by far. Nine of the 10 social apps studied collect browsing history on at least one platform. Facebook, Instagram, TikTok, X, YouTube, and Pinterest do so on both Android and iOS, while Reddit, LinkedIn, and Snapchat collect it on Android only. Discord was the only social app that collected it on neither.

E-commerce came next, with half of the shopping apps analyzed collecting the data on at least one platform.

Messaging was less hungry, with only Rakuten Viber, Messenger, and LINE gathering it, echoing earlier findings on how much data messaging apps collect.

In the generative AI category, Google Gemini was the only app of the 10 to report collecting browsing history.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why apps want your browsing history

The logic is straightforward: the more an app knows about where you go online, the more precisely it can target ads and shape the content in your feed.

As Surfshark's lead system engineer Karolis Kaciulis explains, many apps now route external links through their own "embedded browsers," so the moment you tap a link, they can track what you search for and look at.

The important thing to remember here is that most of these social media and shopping apps do not need your browsing history to provide their services. The practice is not related to providing value to users, and simply takes place to benefit the app companies.

Kaciulis argues that consent for this is usually buried in the fine print, and that the apps fighting hardest to keep you inside their own browser tend to be the ones selling ads rather than the ones that need your history to function.

How to stay safe

There is no single switch that turns all of this off, but a few habits can go a long way.

The easiest is to sidestep in-app browsers: when you tap a link, use the "Open in default browser" option or paste the URL into your default browser, which stops the host app from watching where you go next.

Pair this with switching to a privacy-focused browser, and you'll be able to avoid a lot of the worst data-collecting practices without much effort.

• NordVPN blocked over 5 million malware attempts in January alone
• 99% of phishing attacks impersonate just 300 brands
• AI tools and fraud kits mean attackers no longer need advanced skills

We are well past the days when a cyberattack meant mass-mailing a poorly spelled virus. In 2026, cybercriminals are heavily leveraging generative AI to make their scams highly personal, industrializing fraud on a massive scale.

That is the stark warning from the Consumer Cybersecurity Report: Dismantling the Evolving Threat Landscape, published today by NordVPN. Analyzing threat intelligence data from the first half of the year, the prominent cybersecurity and best VPN provider uncovered that the most exploited vulnerability right now isn't outdated software; it is human trust.

Armed with unrestricted AI models and ready-to-use fraud kits, scammers have drastically lowered the entry barrier for digital crime. The focus has decisively shifted from complex technical exploits to highly targeted campaigns that weaponize greed, urgency, and our faith in familiar brands.

"Bad actors are weaponizing our natural instinct to believe what we see and hear," says Marijus Briedis, CTO at NordVPN, warning that these attacks no longer require advanced skills or significant resources. "Anyone with an internet connection can launch them."

It's in this context that "A single human error is now more likely than ever and likely to be more devastating than ever," Briedis added.

The numbers behind the threat

NordVPN analyzes 12 million unique URLs daily, blocking an average of 130,000 malicious pages every 24 hours before they can reach a user — a critical defense mechanism as NordVPN’s antivirus tool continues to block massive volumes of malicious sites.

Malware remains the single largest threat by volume. January 2026 saw a massive peak of over 5 million blocked attempts as attackers preyed on post-holiday shoppers. Most of these were infostealers aiming to grab saved login credentials.

The US was the hardest hit with 4.89 million attempts across the first half of the year, followed by the UK (2 million) and Germany (1.32 million).

Phishing is equally rampant. NordVPN blocked over 4.4 million phishing attempts in the first half of the year, noting that 99% of these attacks impersonate a narrow list of just 300 brands, often disguised as fake job recruiter campaigns.

Microsoft was the most impersonated company (16.12%), followed by Roblox (12.32%), Google (9.94%), and Netflix (5.99%). Adding to the danger, attackers frequently exploit the trusted .com domain, which accounts for 43.2% of all intercepted scams.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Hijacked sessions and the Dark Web

While users are increasingly wary of downloading fake apps or clicking shady links hidden in pirate sites, attackers are finding stealthier ways in.

Between January 1 and May 26, 2026, a staggering 94 billion cookies were exposed online. Of these, 1.2 billion were active session cookies, which cybercriminals can use to hijack accounts without needing a password, often completely bypassing multi-factor authentication (MFA).

Once data is stolen, it is swiftly commodified. Using its Dark Web Monitoring tools, NordVPN identified 8.4 million compromised accounts in just 90 days.

Frighteningly, over 47% of the exchanged data involved physical addresses and full names, allowing attackers to weave digital and real-world identifiers together into comprehensive victim profiles.

Telephony isn't safe, either. Between the service's launch and June 16, NordVPN blocked nearly 29,000 scam calls and issued spam warnings to over 525,000 users.

How to stay safe

Because technical barriers for criminals are lower than ever, defensive strategies must evolve. NordVPN's report stresses that consumer protection now requires a mix of both technological defenses and behavioral resilience.

Alongside using security tools like a virtual private network (VPN) and antivirus software, users must cultivate a healthy skepticism. If a message, email, or website demands urgent action or offers something too good to be true, pause and verify.

In the age of AI-driven fraud, a moment of hesitation is your best line of defense.

Proton's Unlimited plan has dropped $120, making now the cheapest time to ditch Google entirely, should you wish.

The plan includes everything you'd expect from Google's privacy-unfriendly suite: Docs, Drive, Calendar, Mail, Sheets, and so on. But, it also throws in extras such as Proton VPN, one of the best VPNs available, and Proton Pass, a premium password manager which includes the super-handy email aliasing feature.

Normally, the Proton Unlimited bundle costs $12.99 per month over two years, billed as $311.76.

This deal brings a 38% discount, making it $7.99/month. That saves $120, bringing the total 2-year cost to $191.76.

Unlike Google's suite, all of Proton's tools are end-to-end encrypted and ad-free. This means whatever you send, upload, or create is protected from snoopers looking to intercept your information to use maliciously or sell online.

This is the lowest Proton Unlimited price we've seen in 2026 but we don't know how long it'll last. So, if you're interested, sign up now to lock in the deal, and you can always make use of Proton's 30-day money-back guarantee if you change your mind.

While ditching Google entirely might seem scary, Proton is taking steps to make it as simple as possible.

Its 'Easy Switch' tool sits at the heart of this. It allows you to sign into your old email account, from which Proton automatically pulls information such as your emails, contacts, and calendar.

Files aren't quite so slick but Proton has guides for transferring from services such as Google Drive, OneDrive and more to help you get started.

I've used Proton's privacy suite for nearly two years now. Since the addition of Meet and Sheets (alongside Calendar, Docs, Drive, Mail, Pass and Wallet) it now feels more like Google Workspace than ever, and it's all far more secure.

All of the tools included can be signed up for separately. Most are pricey on their own but the Unlimited bundle makes it really good value.