Open the App. Tap Nothing. You’re Already Being Tracked.

What an Oxford study of 1,297 Android apps taught me about consent, and why it matters for Nepal

By Yadav Nageshwar Prasad · Master’s student, Software AI, Dong-Eui University, South Korea

Picture this. You download a new free game on your phone in Kathmandu, Pokhara or Biratnagar. You tap the icon once. The logo appears, the loading bar moves… and in those few seconds, before you have touched anything else, your phone may already have sent signals to companies you have never heard of.

That is not a scare story. It is what researchers at the University of Oxford measured in “A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps” by Konrad Kollnig, Reuben Binns, Pierre Dewitte, Max Van Kleek, Ge Wang, Daniel Omeiza, Helena Webb and Nigel Shadbolt, presented at the USENIX Symposium on Usable Privacy and Security (SOUPS) in 2021.

I read it for my coursework. In this reflection I share the most interesting idea, the most surprising finding, and one question I still can’t answer, all through a Nepali lens.

A quick glossary (so the numbers make sense)

• Third-party tracking: companies other than the app maker (advertising networks, analytics services) collect data about what you do in an app, and sometimes link it across apps. App developers add this using ready-made code libraries called trackers or SDKs.
• Consent: in EU and UK law (the GDPR and the ePrivacy Directive), tracking generally needs your freely given, specific, informed and unambiguous agreement before it starts. Fines can reach €20 million or 4% of a company’s worldwide annual turnover, whichever is higher.
• Fait accompli: French for “accomplished fact”, something already done before you can object. That is the paper’s point: the tracking has happened before you get a say.
• Hobson’s choice: a choice with no real alternative. The paper uses it for apps that let you “refuse” but then simply close.

The study in 60 seconds

The team ran two studies.

Study 1: what do apps actually do? From about 1.63 million free apps on the UK Google Play Store, the researchers picked 1,297 at random. After removing apps with no working interface, 1,201 remained. Each app was installed on a Google Pixel 4 (Android 10), launched for 15 seconds without any taps, and uninstalled, while its network traffic was recorded and matched against lists of known tracker domains. If an app asked for consent, the researchers said yes, and repeated the measurement.

Study 2: what help do tracker companies give developers? They read the documentation of the 13 most common Android trackers (such as Google Analytics, AdMob, Facebook App Events and Unity Ads) to see whether the companies expect, build in, or explain consent.

Figure 1. How the two studies were built. Diagram by the author, based on the methodology in Kollnig et al. (2021).

A fair warning from the authors: contacting a tracker domain does not prove that a person was identified, and some of these domains can have non-tracking uses. They also only looked at the first 15 seconds, so their numbers are more likely to under-count than over-count.

1. The most interesting thing: consent breaks in the supply chain, not just at the app

What I found interesting

I used to blame app developers: “they didn’t ask me, so they are careless.” The paper shows a more complicated picture. Most developers don’t write tracking code themselves. They add a library from a big company, follow its instructions until the app works, and move on. So the real question is: does the tracker company make it easy to do the right thing?

For the 13 most common trackers, the answer is mostly no:

• 11 of 13 say developers should ask EU/UK users for consent.
• Yet only 3 of 13 (Unity Ads, Twitter MoPub and Facebook Ads) build consent in by default. Facebook Ads, however, opts users in by default unless they change their Facebook settings.
• Only 3 of 13 mention the need for consent in their step-by-step implementation guide, the document developers follow most closely.
• At least 6 of 13, including Google Analytics and the Facebook App Events SDK, need consent but neither implement it nor mention it in the guide.
• For 6 of 13, the authors could not even find a clear statement about whether the tracker stores data on the user’s device.
• Finding the compliance guide took about 1.56 clicks on average, and the guides are hard to read (a Flesch readability score of 41.8, where 100 is “very easy”). 3 of 13 pointed to broken or outdated pages.

Figure 6: The developer’s path Figure 6. What the 13 most common Android trackers do, and do not do, to help developers. Data: Kollnig et al. (2021), Section 5 and Table 2.

And who is on the other end of those connections? Mostly one company:

Figure 5. Share of apps that contacted each company’s tracker hosts at launch. Data: Kollnig et al. (2021), Section 4.2.

Alphabet, Google’s parent company, was contacted by 58.6% of apps. The next biggest, Facebook and Unity, were each at 8.2%. The authors also point out that Google is both the largest tracking company and the maker of Android, which creates a conflict of interest when it comes to protecting user privacy.

Why it matters for Nepal

Android is the main smartphone platform here. StatCounter’s web-traffic data for October 2026 shows Android at about 78% of mobile traffic in Nepal, so the same tracker libraries studied in the paper are likely running on many of our phones. (I did not measure this myself. It is a reasonable guess, not a finding.)

The supply-chain lesson fits Nepal’s growing app scene. Student projects, startups and freelance developers often use free, ready-made SDKs for analytics, ads and crash reports. If the default is “tracking on, consent not included,” many apps will track without anyone deciding to.

Here is how this could inspire local work:

• Teach “privacy by default” in app-development courses. Universities and training centres in Nepal could add one lesson: when you add an SDK, read what data it collects and when it starts.
• Delay the tracker until the user has chosen. One tracker in the study (AppsFlyer) actually advises developers to postpone starting the library until user consent is received. It is a simple technique that Nepali developers can copy.
• Pick tools with clear documentation. Documentation quality is a privacy feature.
• Remember the EU link. The GDPR can also apply to companies outside Europe that offer services to, or monitor the behaviour of, people located in the EU or UK. Nepali developers building apps for European clients should not assume the rules stop at the border.

2. The most surprising thing: a consent screen did not mean less tracking

What surprised me

I assumed that if an app asks for consent, it at least behaves better. The data says otherwise. Compare the three numbers below:

Figure 2. Share of the 1,201 analysed apps. Data: Kollnig et al. (2021), Section 4.2.

• 71.3% (856 apps) contacted known tracker hosts at launch, before any interaction.
• Only 9.9% asked the user for consent.
• Only 3.5% (42 apps) gave a genuine choice to refuse.

And among the apps that did show a consent screen, most were not real choices:

Figure 3. What the consent screens looked like, among the apps that asked. The “about 35%” is the author’s arithmetic from the paper’s counts. Data: Kollnig et al. (2021), Section 4.2.

Get Nageshwar Yadav’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

43.7% offered only one button (such as “Accept Policy and Use App”). Another 20.2% let you press “no” but then exited the app, which the authors call a Hobson’s choice.

Then came the part that surprised me most:

Figure 4. Average number of tracker hosts contacted per app. Data: Kollnig et al. (2021), Section 4.2.

• Apps that asked for consent contacted more tracker hosts (3.7) than apps that did not (2.8).
• Among the 42 apps with a genuine choice, tracker contacts went from 5.2 at launch to 8.1 after accepting. But even after refusing, the number was 7.5, not lower than before.
• 37 of those 42 apps offered a choice only about personalised ads, and none of the apps that used Google’s consent tool asked about further tracking such as analytics. Only 4 apps let users refuse analytics at all.
• Apps that showed display ads contacted far more tracker hosts: 6.0 on average, versus 2.2 for apps without ads.

How it changed my perspective

I used to treat a pop-up that says “We respect your privacy” as a sign of respect. Now I see that a consent screen is not proof of control. It can be a single button, a choice that closes the app, or a choice about ads only while other data flows continue. Other researchers have also shown that consent pop-ups can be designed to steer people toward accepting (Nouwens et al., 2020, cited in the paper).

This does not mean consent is useless. The authors still argue for it, but they say it must be real, and that simple changes by Google, Facebook and other software intermediaries (consent built in by default, better guides, better privacy options) would help a lot.

Steps I could take in Nepal

1. Treat “Accept” as information, not protection. Read what you are agreeing to when an app offers a choice, and look for a visible “refuse” that does not close the app.
2. Use fewer apps. The more ad-supported apps on a phone, the more trackers. Delete the ones you don’t use, especially free games and utility apps.
3. Check your phone’s Ads settings. On many recent Android phones, you can find an advertising-ID setting where you can reset or delete your ad ID (look in Settings under Google or Privacy). The paper notes that Google planned to give users this kind of control, so check what your own phone offers.
4. Developers: ask separately. Don’t bundle everything in one “Accept”. Ask separately for analytics and for personalised ads, and keep the app usable if the user says no.
5. Help family members. Parents and relatives often tap “Accept” because there is no other button. A quick walk-through is the simplest awareness campaign.
6. Know the legal picture, and its limits. According to a law-firm summary published in November 2026, Nepal has no comprehensive GDPR-style data protection law. The main law is the Individual Privacy Act, 2018 (2075), supported by the Individual Privacy Rules, 2077, which require consent in certain cases such as collecting personal information and using electronic personal data. There is no dedicated data protection authority, and a draft Personal Data Protection Policy was reported to be out for consultation. I am not a lawyer, and I do not know how these rules apply to SDK-level tracking in apps. That uncertainty is exactly what my question below is about.

3. The unanswered question: what would the numbers look like for apps used in Nepal?

My question

If we repeated this study on the apps that people in Nepal actually use, would we see the same pattern, and who would ask for consent when there is no GDPR-style law forcing anyone to?

Why this question arose

The study sampled apps from the UK Play Store and judged them against EU and UK law. Under that law, the authors read the low share of apps asking for consent as a sign of “potentially widespread violations”. But in Nepal the legal pressure is different, so the expected behaviour is different too. There are three possibilities, and I can’t tell which is true:

1. Apps used in Nepal may track even more freely, because few developers feel any legal pressure.
2. Apps may look about the same, because most are made with the same global SDKs and ship the same build everywhere.
3. Global apps may show a consent screen only in Europe, so Nepali users never see one. (The paper does not test this, so this is only a hypothesis.)

It interests me because the answer tells us where to push: at developers, at SDK companies, at Google and phone makers, or at lawmakers. The authors themselves say consent is only one of many legal requirements, and that other principles, such as data minimisation and security, are harder to measure but just as important.

How I will look for the answer

1. Read the law properly. Read the English text of the Individual Privacy Act and its Rules, and discuss it with someone who has a legal background, so I understand what “consent” means in Nepal.
2. Choose a sample. Pick about 100 free Android apps: popular global apps used in Nepal plus Nepali apps (wallets, ride-hailing, news, education). A random sample would be better, so I will first check how to get a fair list.
3. Copy the method. Use a clean test phone (or emulator), install each app, launch it for 15 seconds without touching it, record network traffic with a tool such as NetGuard (the one used in the paper), and match the hosts against public tracker lists such as Disconnect and Exodus Privacy.
4. Note the consent screens. Record whether an app asks for consent, whether the choice is genuine, and whether tracking stops after refusal. Then compare with the paper’s 71.3% and 9.9%.
5. Respect the limits. Like the paper, I can only see which hosts are contacted, not the data inside, since many apps encrypt and pin their connections. I will report results as “contacted tracker hosts”, not “stole data”.
6. Be ethical and fair. Use no personal accounts, avoid naming and shaming without double-checking, and discuss the plan with my professors first.
7. Share. Publish the findings and the method so other Nepali students can repeat and improve them.

Final thought

The title of the paper asks whether consent is a fait accompli, a done deal. After reading it, my answer is: for most apps, the tracking was done before the question was even asked. But the study also shows that the fix is not mysterious. It is defaults, documentation and design, things that people in tech, including students like me, can change.

So next time an app gives you one big “Accept” button, ask yourself: what did my phone already say before I tapped?

References

Kollnig, K., Binns, R., Dewitte, P., Van Kleek, M., Wang, G., Omeiza, D., Webb, H., & Shadbolt, N. (2021). A fait accompli? An empirical study into the absence of consent to third-party tracking in Android apps. In Proceedings of the Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021) (pp. 181–195). USENIX Association. https://www.usenix.org/conference/soups2021/presentation/kollnig

Nouwens, M., Liccardi, I., Veale, M., Karger, D., & Kagal, L. (2020). Dark patterns after the GDPR: Scraping consent pop-ups and demonstrating their influence. In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. ACM. (Cited in Kollnig et al., 2021)

Binns, R., Lyngs, U., Van Kleek, M., Zhao, J., Libert, T., & Shadbolt, N. (2018). Third party tracking in the mobile ecosystem. In Proceedings of the 10th ACM Conference on Web Science (WebSci ’18) (pp. 23–31). ACM. (Cited in Kollnig et al., 2021)

Mhaidli, A. H., Zou, Y., & Schaub, F. (2019). “We can’t live without them!”: App developers’ adoption of ad networks and their considerations of consumer risks. In Proceedings of the Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). (Cited in Kollnig et al., 2021)

StatCounter Global Stats. (2026, October). Mobile operating system market share in Nepal. https://gs.statcounter.com/os-market-share/mobile/nepal

Niti Partners. (2026, November 2). Does Nepal have a data protection law? A Q&A for global counsel. https://nitipartners.com/?p=10046

DLA Piper. Data protection laws of the world: Nepal. https://www.dlapiperdataprotection.com/index.html?c=NP&t=law

Charts 2 to 6 were recreated by the author from numbers reported in Kollnig et al. (2021). Figure 1 is the author’s own diagram based on the paper’s methodology. The legal summaries on Nepal are from secondary sources and are not legal advice.