What's on Your Mind? Exploring Privacy of Mental Health Apps
An empirical privacy analysis of 25 popular Android mental-health, therapy, and companion apps — including conversational-AI chatbots such as Replika, Talkie, Pi, Woebot, Wysa, and Youper — combining static code analysis, dynamic network-traffic capture, and automated privacy-policy extraction to compare disclosed against observed data practices.
Publisher
arXiv (University of California, Irvine / University of California, Riverside)
Published
3 May 2026
Added
1 week ago
DOI
—
Key Findings
- Every app embedded at least one tracker SDK not named in its privacy policy; one app embedded 20 trackers while naming none.
- 68% of apps under-disclosed at least half of their trackers, with permission–policy contradictions across many apps.
- Nearly half (12/25) of apps' privacy policies state user data is processed by third-party AI providers, not always clearly identifying the recipient.
Methodology Notes
Preprint (arXiv 2605.02016; v1 2026-05-03, later revisions through 2026-05-30). Method: static analysis + dynamic traffic capture + privacy-policy extraction across 25 Android apps. Title changed across versions (an earlier version was 'Speak Freely & Never Mind the Pesky Trackers: Privacy Analysis of Popular Therapy Apps'); the current arXiv title is used here, verified via the arXiv abstract page and API. Authors include established privacy/security researchers; not yet peer-reviewed.
Sources
arXiv preprint (primary)
Archived snapshot (Wayback Machine) — preserved against link rot
Authors
Chloe Georgiou, Hans Lu, Emiliano De Cristofaro, Gene Tsudik
Tags
Cite This
APA
Chloe Georgiou et al. (2026). What's on Your Mind? Exploring Privacy of Mental Health Apps. arXiv (University of California, Irvine / University of California, Riverside). https://arxiv.org/abs/2605.02016
Related Insights
AI & Algorithmic Risks Report Netherlands (ARR) — February 2025 (4th edition)
Autoriteit Persoonsgegevens (Dutch Data Protection Authority) · 12 Feb 2025
6(b) Orders to File Special Report Regarding Advertising, Safety, and Data Handling Practices by Companies Offering Generative Artificial Intelligence (AI) Companion Products or Services
FTC · 11 Sept 2025
The Governance of Intimacy: A Preliminary Policy Analysis of Romantic AI Platforms
arXiv (King's College London-affiliated author team) · 25 Feb 2026