https://medium.com/@bharathi.ravishankar/mobile-applications-privacy-risks-when-apps-collect-more-data-than-necessary-fdebc11da59b

Academic Orientation

This caselet can be used in BCA, MCA, Cybersecurity, Mobile Application Development, Big Data Analytics, Information Systems and Business Ethics courses.

Learning Objectives

• To understand data privacy risks associated with mobile applications collecting personal information.
• To identify the importance of data minimization, user consent and app permission
• To examine the business and ethical implications of customer data collection and
• To understand privacy protection practices in mobile application design and

Learning Outcomes

• Analyse privacy risks arising from excessive data collection by mobile
• Evaluate the impact of data collection practices on customer trust and business
• Recommend suitable measures for data security, access control and responsible data
• Develop privacy-conscious strategies that balance business objectives with user privacy and applicable regulations.

1.  Introduction: A Simple App with Big Ambitions

Ananya didn’t think she’d end up ordering her lunch every day from a new mobile application she downloaded. The app, called QuickBite, had listings of restaurants, discounts, digital payments and home delivery. It was easy to use and the introductory offers were attractive.

Ananya was using QuickBite nearly every day within a few weeks. She used to order lunch during office hours, buy snacks in the evening and sometimes used the application to order groceries. The app kept track of her favorite restaurants and recommended dishes based on her previous orders.

Ananya liked these features. She didn’t have to look for the same restaurants again and again, and the recommendations often matched her tastes. But she started noticing something strange.

Every time she opened the app, it asked permission to access her location. Sometimes the app seemed to know what part of town she was in even when she wasn’t ordering something. It also requested access to her contacts, although she couldn’t figure out why a food delivery app would need them.

At first, she would refuse these requests. Most apps asked for permissions, and she assumed they were required to provide the services being offered. One night, a colleague asked her if QuickBite really needed access to her contacts and location to deliver food. Ananya couldn’t answer.

That conversation caused her to examine the app’s privacy settings more carefully. She discovered that QuickBite was collecting a range of information, from location details to device information, search history and behavioral data.

The experience left her wondering if she’d agreed to share more information than the service actually needed. QuickBite was not a small or unknown app. It was a business growing with millions of users. The management felt that gathering data was an improvement for both the customer experience and revenue generation. But the company was beginning to bump into a question that a lot of mobile application companies bump into: When does gathering helpful customer information become gathering too much data?

2.  Growth of QuickBite

QuickBite was started in 2021 in Bengaluru by two entrepreneurs Karan Malhotra and Neha Iyer. They both had experience in the tech industry and felt that smaller restaurants needed a more affordable way to connect with customers online. The company’s idea was simple: customers should be able to search nearby restaurants, order food and track deliveries through one app.

In the first year, QuickBite was operational in Bengaluru and Mysuru. It was only for restaurant listing, ordering and payment confirmation. The application collected only the information required to perform these activities – a customer’s name, mobile number, delivery address and order details.

As the number of users grew, the founders started looking for ways to make the business more competitive. Larger food delivery platforms already had personalized recommendations,

loyalty programs and targeted discounts. QuickBite wanted to provide similar features, but with a smaller advertising budget. So, the company implemented a data analytics initiative.

By 2025 QuickBite had expanded to multiple cities of India. It had about 2.4 million registered users and a network of restaurant partners and a growing delivery workforce. Its management team liked the progress being made.

The app had become more than an ordering platform. It also gave information on consumer tastes, ordering habits, popular locations and demand patterns. The founders thought that this information would help QuickBite to make better decisions. But as the business grew, so did the amount of data collected by the application. The new features brought new demands for permissions and some data collection activities became less transparent to users.

The company did not set out deliberately to invade customer privacy. The data collection practices had evolved gradually, usually as individual teams sought to add new features or enhance business performance. No one had stopped to see the whole picture.

3.  What Information Did QuickBite Gather?

QuickBite required a few settings to function properly. We needed a delivery address to send food to the customer. To make and send the right things, details of the order were needed. Digital transactions required payment confirmation to be completed. These uses were reasonable and understandable uses of personal information. But over time QuickBite began to collect more data.

The technology team brought in tools to understand how customers were using the application. The tools tracked which pages users visited, how long they stayed on different screens, what products they searched for, and which offers they ignored.

The marketing team wanted to know if there was a difference in customer response to discounts on weekdays and weekends. The product team was curious about why people abandoned their shopping carts. The management team wanted to find out customers who might stop using the application. Each request was reasonable on its own. The application finally gathered information across a number of categories

Much of this information the company stored in a central analytics platform. Data analysts used data from multiple sources to understand customer behavior. The company might, for example, identify users who often order lunch from restaurants near their offices. It might also detect users who were slow to respond to discount offers in the evening.

These insights help QuickBite to improve its promotional campaigns. But the same data could tell you more about the people than the company had originally wanted to.

A person’s day routine may be seen on a restaurant order record. Location records could show where someone regularly worked or studied. Frequent searches and purchases expose personal preferences. For the most part, the management at QuickBite treated these records as business information. It was just starting to realize that together they could paint a detailed picture of a person’s life.

4 The Permission Problem

QuickBite’s app asked for permissions at different points in time. The application asked for permission to access location information when the customer installed it. The app said it needed access to location to find nearby restaurants and calculate delivery availability.

Later, users were prompted to enable notifications to receive order updates and promotional offers. When QuickBite started a referral program, it asked for access to contacts. It was supposed to make it easier for customers to invite friends to join the platform. The issue was that the application didn’t always differentiate between permissions required by the main service and permissions used for optional features.

For example, if a customer wanted to order food they could be asked for contact access, even if the customer had no intention of inviting anyone in. Some users were not sure whether denying a permission disables them to use the application. Others simply clicked “Allow” to continue.

Developers of QuickBite said users could opt out of permissions through their phone settings. The legal team believed the privacy notice was a description of the company’s general data practices. But neither team had examined how customers actually understood these choices.

A permission request is technically optional but psychologically compulsory. Users may feel that there’s no way to continue without accepting a permission request. The problem was not simply whether the application had received a response from the user. But the more appropriate question was whether the user appreciated what was being asked of him and why.

5.  Marketing Team’s Perspective

“We need to gather data for growth,” said Arjun Mehta, Head of Marketing, QuickBite. The company operated in a competitive space. Prices and promotions in restaurants changed frequently and customers could switch quickly to another app. Arjun wanted QuickBite to send out more relevant promotions, not the same ad to all customers.

His team created a customer segmentation model. It segmented its users on the basis of ordering frequency, spending patterns, food preferences and responses to promotional campaigns. A customer who always orders vegetarian food might get special offers from vegetarian restaurants. A customer who regularly purchased family meal bundles could be targeted with weekend promotions for larger parties.

The marketing team said their campaigns were getting better. We saw an increase in the number of customers responding to select promotions, and were able to send fewer promotional messages to get the same number of orders. The results were good for the company and its customers,” Arjun said.

“If you send an offer to a customer that corresponds to his interests, the customer is more likely to find it useful,” he said in an internal review. “We’re not just collecting data for the sake of collecting data. We’re working with it to improve our service.” There was some justice in his plea. Personalization could mean more convenience for customers and less irrelevant advertising.But the marketing team had begun to consider an even more ambitious idea.

It wanted to be able to predict when customers would place an order and send out promotions at those times. The team requested more specific location and usage information so they could improve the predictions.

The data protection team was worried about the proposal. Would QuickBite need to know the location at all times to make restaurant suggestions or would it be sufficient to access the location only when the application is in use? Arjun thought the more data they had the better the model will be. The data protection team questioned whether the extra collection was worth the extra improvement. No one had thought much about the trade-off.

6.    A New Revenue generating Opportunity

QuickBite was pitched to a digital marketing firm called AdSphere Insights in early 2026. AdSphere wanted to partner with QuickBite to understand consumer behavior when purchasing. It paid for access to certain data sets and analytic insights.

In addition to food delivery commissions and restaurant partnerships, the proposed partnership could provide a new revenue stream to QuickBite. AdSphere was curious about customer age groups, broad geographic locations, how often they ordered, their spending ranges, food preferences and what they thought of promotional campaigns.

It said the data would be anonymized before being used for analysis. The finance director liked the idea. QuickBite was hoping to expand into other cities and the extra revenue could help fund its technology investments. Arjun also saw an opportunity to understand the company’s consumer behavior better.

But Priya Nair, the company’s chief technology officer, wanted to know more about the proposed data sharing deal.

She put her three questions:

1. What data fields specifically would be shared?
2. Does AdSphere combine the data with other sources?
3. Will any individual QuickBite customers be identifiable in the information shared?

The answers were not clear enough to satisfy her. Privacy risks would be reduced by deleting names, mobile numbers and email addresses, said AdSphere representatives. But Priya said that the removal of direct identifiers didn’t mean that a data set couldn’t be linked to an individual. Location, timestamps, purchase patterns, and other characteristics in combination could potentially still identify a person, especially when combined with external information.

The legal team also asked whether the current privacy notice explained the proposed sharing sufficiently and whether there was a need for further transparency, consent or other legal mechanisms. The commercial proposal was under consideration.

7.  The complaint that changed the dialog

A few days later, QuickBite got a complaint from a customer named Meera. Meera was using the app for months. She typically ordered lunch at work and occasionally ordered dinner at home. That night she received a promotional alert for a discount at a restaurant near a location she’d visited earlier that day.

The message itself was not offensive. The discount was real, and the restaurant was in the QuickBite network. Meera was worried that she hadn’t expected the app to use her location like this.She called customer support to ask why, when she wasn’t placing an order, the company needed her location information.

The support employee gave a general explanation on personalized services. Meera asked if QuickBite was constantly tracking her location, and if the information was shared with advertising partners. The employee was unable to answer these questions.

Meera then put in a written complaint asking for an explanation of the data that had been collected about her and the uses to which it had been put. The complaint made it to Priya’s office.

Priya had the technology team review location settings and data flows. The investigation revealed that some components of the application were collecting more detailed usage information than the basic ordering service required.

The team also found that the privacy notice was written in broad terms. It mentioned several reasons for data collection, but gave no clear explanation of the differences between essential service functions and optional marketing activities.

There was no evidence at that time that Meera’s information had been misused by a third party. But the complaint revealed a gap between the company’s understanding of its own practices and customer expectations. QuickBite had assumed customers would tolerate its data collection because the application offered useful services. Meera’s complaint proved that convenience was no guaranty of trust.

8.  More Data, More Risk

Priya told the technology and analytics teams to analyze the data that QuickBite had collected. What surprised me about the review was the fact that a number of data fields were being collected because they might be useful in the future, even if there was no current business process that clearly needed them.

Some analytics programs tracked user interactions in detail. Some information was retained long after it was no longer immediately useful. Different teams had separate copies of data sets for reporting and analysis. There was no single process in place for determining whether every data field was needed.

This was especially evident when the team examined location information. The delivery system required a proper delivery address and sometimes the current location of the customer to find nearby restaurants or direct a delivery executive to the customer.But the marketing team wanted longer location histories to see behavior patterns.

They were two different purposes, but the practice did not always distinguish clearly between the two. The team also found that in some analytics work, detailed records could be kept longer than necessary. Longer retention was useful as analysts could look up historic information without having to ask other teams to regenerate datasets. But it also meant a bigger volume of data to protect. Priya explained the concern in a meeting: Each additional data field adds to the responsibility. We need to know why we are collecting it, who can use it, how long we keep it and what happens if it is exposed.”

The company had been touting the benefits of getting more data. It had not had as much time to spend on the cost of protecting that information over its life cycle.

9.  The Review of Security

The QuickBite security team reviewed how customer data was stored, and how it was accessed. No confirmed large-scale data breach was identified during the review. But it also revealed shortcomings that had to be fixed. Some employees had access to datasets that exceeded their roles. Several teams kept analytical extracts apart. Reviews of access were not always conducted at regular intervals.

The team also found some of the test environments had copies of production data in them. This made development and debugging easier but increased the number of places where real customer information could be leaked. The company had controls over access and encryption on important systems. But these protections were not always available for all datasets and workflows.

The review made a simple point: data privacy and data security were related but not the same thing. Security controls helped in preventing unauthorized access, loss or disclosure. Privacy

controls addressed whether the company should collect and use certain information at all. Even a perfectly secured database can have unnecessary data gathered without enough justification.

Similarly, a company may have a legitimate reason to collect data, but still end up disclosing it due to poor security practices. QuickBite had to deal with both problems.

Priya suggested a review of the whole data life cycle, from the collection point to the deletion point. She also suggested limiting employee access according to job responsibilities and setting clearer procedures for third-party sharing. The review took time and resources. Some managers feared greater control could slow new features. “The cost of responsible data management should be part of the development and operation of a mobile application, not one of those optional activities to be done after the business has grown,” said Priya.

10. What Customers Really Needed?

At QuickBite, the managers had often measured customer satisfaction based on how many users were registered and how often the app was being used. The complaint alerted the team to the fact that these measures didn’t necessarily mean that users believed the company was trustworthy with their information.

For example, a customer may continue to use an application because it was convenient, even if he or she felt uncomfortable about its data practices. So the company ran a small survey of customers. The survey asked users if they were OK with QuickBite collecting information needed to process orders and deliver food. Most respondents found this reasonable.

Many users were also comfortable with recommending restaurants based on order history, when this was explained clearly. The answer changed when customers were asked about continued collection of location, access to contacts and sharing information with outside marketing companies.

Some respondents wanted an explicit explanation of the purpose of the information. Some said they would like to have the option to enable optional features only when they wanted to use them.

One respondent said:

I get it, food apps need my address to deliver food. “But why does it need to know everything else I do on my phone?”

Another respondent said personal offers were useful but the company should not presume permission for one purpose was permission for every other purpose.

The survey was small and did not represent all QuickBite users. However, it pointed out a distinction the company had missed. The customers’ answer did not necessarily oppose data collection. They wanted it to be meaningful, understandable and fit the service. The management team began to understand that transparency was not just a legal formality. It could have affected whether customers continued to believe in the brand.

11.  Legal and Ethical Concerns

The company’s legal advisor reviewed the company’s data practices in light of the applicable data protection requirements in India, including but not limited to the Digital Personal Data

Protection Act, 2023 and the rules and provisions applicable to the company’s operations at the time.

The advisor warned against the assumption that a general privacy notice automatically justified every kind of data collection or sharing.The legal review had to cover review of the purpose of processing, applicable notice and consent requirements, lawful grounds, security safeguards, data principal rights, retention obligations and the company’s responsibilities when working with external partners.

Specific obligations would depend on the relevant legal provisions, when they start and apply and the facts in relation to each processing activity. But compliance was just half the battle. The company also had to consider what was fair to its customers.

For instance, take a customer who consented to share a location to discover nearby restaurants. Is it right to use that information for some advertising that has nothing to do with it without making it obvious that it has been changed? A user may have granted access to contacts so that they can invite friends. And, if the app uploaded the entire address book, what if it contained the data of people who’d never used QuickBite?

Imagine a predictive model that could infer a customer’s routines from repeat location and ordering records. Can the company use those inferences just because it enabled them through its technology? To answer these questions it was not enough to ask whether the data was technically accessible.

The company had to consider necessity, proportionality, user expectations and potential harm. The legal adviser said the company should consider each use of data on its own rather than treat all collection of information as one general activity.

12.   Management Meeting

Karan Malhotra, the CEO, called a meeting of the heads of marketing, technology, security, finance and legal affairs.The question was how to respond to QuickBite? Arjun from marketing said the company should not let go of data-driven services. Personalization had helped to improve client engagement and the business needed to keep up.

Priya from technology agreed analytics were important but argued that data collection should be limited to what each feature required. The security head recommended stronger controls on access, better monitoring and regular assessments of third-party systems. The finance director asked about the cost of the proposed changes and whether they would affect advertising revenue. “Ignoring privacy issues can lead to regulatory exposure, customer complaints and reputational damage,” the legal advisor reminded the group.

The CEO heard the differing views.

He did not want QuickBite to be a fear-stalled company that did not want to innovate. Yet he didn’t want growth to come from harvesting data that customers didn’t understand or expect to share.

The discussion showed that privacy was not just the responsibility of the technology team. Customer data was used to decide on marketing, product design, business partnerships and

financial targets. QuickBite needed an approach that protected customers without killing legitimate and useful innovation.

13.   QuickBite has three choices

The management team identified three possible strategies after the meeting.

Option A. Do Nothing

This option would enable QuickBite to continue collecting its existing categories of data and improve specific security controls.The company would continue with its current analytics and marketing model. The AdSphere proposal could move forward after a contract and technical review. The biggest benefit would be limited disruption to the business. Marketing campaigns and product development can continue with little change.

But this would not have solved the problem of some data being collected without any clear demonstrated need. It may also leave customers in the dark about how their information was used.

Option B: Restrict Data Collection at a Severe Level

QuickBite could restrict collection to information necessary for account management, order processing, delivery and payments and other clearly justified purposes. We will only ask for optional permissions when a customer chooses to use the relevant features. The company could scale back how much behavioral and location data it stores for marketing.

That would cut down on unnecessary collection and streamline some privacy risks. But the analytics and marketing teams would have had less data to draw on. Some recommendations might be less personalized and some promotional campaigns less effective.

The company would have to reconfigure some existing features and reexamine its data architecture.

C. Adopt a privacy-first data strategy

With this approach, QuickBite would still use analytics, but would re-design the way data is collected, accessed and retained. Each feature would be purpose-specific and have a documented data requirement. Essential service permissions would be separated from optional permissions. Data would be kept only for as long as justified, with appropriate controls for legal and operational requirements.

The company would also look at aggregated data for business analytics, stronger access restrictions, privacy assessments and carefully reviewed third party partnerships. That would need investment in technology, staff training and governance.

Some releases may take more time. But it may allow QuickBite to leverage data analytics while also reducing needless exposure and increasing customer confidence. Immediately the management team disagreed on the best strategy.

14.  A fresh approach to mobile app design

“Privacy considerations should be part of the product development process from the beginning, not after the app is live,” Priya said. So for example, developers may build a feature that

recommends nearby restaurants. They would start by figuring out what information they need for that purpose.

If the application required access to location, it could ask when the user clicked on the nearby restaurant feature. Continuous background access would not be a default requirement If a referral feature requires contact information, QuickBite could consider options that enable users to invite selected people without uploading their entire address book.

The team can discuss whether aggregated trends or less granular records were adequate for marketing analysis. The product team would also explain the permissions in layman’s terms. The app might explain the reason for a request, rather than broadly stating that it will improve services.

The company would look at whether customers could continue to use key features when they opted out of optional permissions. Priya also suggested a way to delete data no longer required, but keep records which needed to be kept for legitimate legal, accounting or operational reasons.

It was not to stop collecting all the data. This was to ensure that each collection activity had a clear purpose and that the information collected was proportionate to that purpose.

15.   Business Value of Customer Trust

The conversation continued and the CEO asked the finance and marketing teams to consider a different question.

What is the long term business value of trust of the customer?

The company can measure the direct benefits of a marketing campaign in terms of conversion rates and sales. It was harder to assign a value to a customer losing confidence in the application. A privacy complaint may impact a single customer. But if enough customers were uncomfortable, the consequences could be larger.

They may disable permissions, stop responding to promotional messages or switch to competing apps. Negative reviews may turn off new users. Business partners may also question the data management practices of the company.

In contrast, clearer permission options and better explanations can help customers understand the service. Some users might be more willing to share information if they knew why it was needed and had meaningful control over optional uses.

The company could not take it for granted that privacy improvements would automatically boost revenue. Their financial impact would have to be evaluated. But the management team agreed that trust from customers should be a business consideration and not just a legal requirement.

Countless hours had been spent making the QuickBite app faster and more convenient. Now it had to make sure that customers could use it without feeling that their personal information was being collected unnecessarily.

16. The Last Word

Two weeks after Meera’s complaint, the CEO asked the management to come up with a realistic plan.

The plan had to juggle four priorities:

• A handy mobile
• Analytics for improved product & business performance.
• Reducing risks associated with collection and
• To maintain customer confidence and to comply with legal

The technology team suggested reviewing all the permissions the application sought. Marketing team agreed to document what information is needed for each campaign. The security team recommended tighter control of access and more frequent audits. The legal advisor said notices should be clearer and that the proposed AdSphere partnership should be evaluated before any information was shared.

The finance director asked the teams to cost the implementation and to identify which changes should be prioritized.

QuickBite also wanted to understand how users interpreted its permission requests. The company wondered if customers can distinguish between information needed to place an order and information used for optional personalization.

The CEO did not want the review to be a document that employees read once and then shelved. He asked each department to determine who would be responsible for implementing the changes and how progress would be measured.

The AdSphere proposal was still unresolved. Acceptance could bring in new revenue but the company first needed to determine whether the suggested data sharing was justified, transparent, protected adequately and aligned with applicable obligations.

Declining the proposal would remove some risks, but it also could mean missing a potentially valuable business opportunity. The decision would test QuickBite’s ability to treat privacy as part of its business strategy, rather than an obstacle to it.

17.   Conclusion: How Much Data Is Sufficient?

The experience of QuickBite revealed a challenge that many mobile application businesses face. To be able to provide valuable services, information is a prerequisite. Knowing where you are can help find a nearby restaurant. Transaction records can help with order management. Behavioral data can help developers know what features work well.

Data analytics can also assist in better planning, more relevant recommendations, and improved business performance. But the ability to collect information does not necessarily create a need to collect it. A mobile app can access location, contacts, device information and browsing history. That’s not to say every feature requires all of these types of information.

The collection of unnecessary data leads to more burden on the company. It must protect the information, control access, decide how long it should be kept and consider the consequences

of sharing it. The risk rises when information from different sources is mixed. Individual details may not seem to pose a threat, but when combined they can be used to detect sensitive patterns.

Initially, QuickBite saw collecting data as a means to learn more about its customers. The complaint made the company realize that to understand the customer was also to respect the customer’s expectations.

Now the company had to make a fundamental choice. It could keep piling on data collection features whenever it had a possible business benefit. Or it could insist that each new feature had to justify the information it asked for.

The second approach may require more planning. It may involve changes in existing systems and marketing practices.” But it would also lead the company to differentiate between information that was helpful and information that was truly useful. The future of QuickBite would depend not only on how smartly it analyzed data but also on how responsibly it collected and used it.

The problem for its management was no longer how much information the application could gather. It was this:

“Can we build a successful mobile app by collecting less data, being transparent about our choices and earning our customers’ trust?”

The answer would determine the next phase of growth for QuickBite.

Discussion Questions

1. Identify the major privacy risks faced by QuickBite. Explain how collecting location, contact, behavioural and device information beyond what is necessary can affect users and the
2. Should QuickBite continue collecting extensive customer data to improve personalization and marketing? Evaluate the business benefits against privacy risks, customer expectations and potential reputational damage.
3. Compare the three strategies available to QuickBite: continuing existing practices, significantly restricting data collection, and adopting a privacy-first data Recommend the most appropriate approach and justify your choice.
4. Develop a privacy management plan for QuickBite. Suggest measures related to app permissions, data minimization, informed consent, access control, retention, security, transparency and third-party data sharing.
5. “Just because a mobile application can collect data does not mean it should collect it.” Critically discuss this statement using the caselet. Explain how mobile application developers and business managers can balance innovation, personalization, commercial interests and customer privacy.