A recent investigation highlights serious concerns about how personal data may be mishandled through popular mobile games. Researchers from Proton analyzed the 100 most downloaded free Android games on the Google Play Store, which collectively amassed nearly 20 billion downloads worldwide.
Many of the games examined contain tracking codes that can transmit user data to various foreign advertising companies, including those based in Russia, China, and Israel, as well as firms linked to the Five Eyes alliance. Notable titles in this analysis include Block Blast!, Disney Solitaire, and Subway Surfers.
According to the researchers, these tracking codes can collect sensitive information such as device type, usage habits, payment details, user age, gender, and even location data. This flow of information raises significant privacy concerns, especially with the risk of data ending up in the hands of foreign entities.
Proton’s study, conducted in May 2026, found that the games in question were downloaded nearly 20 million times in the United States alone. Among these, about 15.8 million downloads were linked to games that transmitted data to Chinese companies, while games associated with Russian organizations accounted for 13.7 million downloads. In the United Kingdom, out of 3.6 million downloads, 3 million involved Chinese tracking codes, and 2.7 million contained Russian codes.
Location data is particularly sensitive. In May 2026, there were 1.7 million game downloads in the United States associated with tracking that used location services, while the UK saw 300,000 downloads with similar features. While GPS-based games may justify this tracking, the necessity for simpler apps like puzzle or coloring games is less clear. Proton emphasizes that location data can reveal where someone works or sleeps.
The situation remains concerning when data is sent to seemingly harmless advertising technology companies. For example, a data breach from Mixpanel in November 2025 exposed identifiable user metadata to unauthorized individuals, underscoring the risks associated with data flowing through various tech layers.
To mitigate these privacy risks, Proton recommends using VPNs that include ad and tracker blocking or opting for paid games free from ads and tracking. This approach could help users protect their personal information while enjoying mobile gaming.
The implications of this study are significant. With vast amounts of user data potentially being routed to servers in countries with varying privacy standards and regulations, the urgency of safeguarding personal information has never been greater.
