Smartphones arrive packed with software few people asked for. Some sits idle. Others quietly log location, contacts, browsing habits. A fresh Surfshark study puts hard numbers on the gap between Apple and the leading Android makers.
Samsung devices ship with 88 user-facing pre-installed apps. Google Pixel phones come with 71. Xiaomi loads 61. Apple’s iPhones arrive with 50. But the real divide appears when owners try to delete them.
Removal Freedom Exposes a Control Gap
iPhone owners in the European Union can remove up to 98% of those 50 apps. Elsewhere the figure sits at 88%. Samsung and Xiaomi both allow safe deletion of about 57%. Google trails badly. Only 38% of its preloaded apps carry a safe-to-remove flag according to the Universal Debloater Alliance Next Generation project data that Surfshark consulted.
The numbers come from Bayton’s database of voluntarily synced devices and privacy labels published on the Apple App Store and Google Play as of early September 2026. They reveal more than counts. They show how much manufacturers trust users with their own hardware.
Apple builds every one of its 50 apps in-house. Data practices listed for 47 of them show an average of eight types of information collected per app. That includes approximate location in 19 cases, precise location in eight, and physical addresses in five. Apple Music logs 17 data types. The Apple Store app reaches 18.
Contrast that with Samsung. Thirty-five of its 88 preloaded apps appear on Google Play. They declare an average of 13 data types each. Facebook and Instagram, both preloaded on many Samsung devices, each list 37 out of 38 possible data categories. That covers nearly everything from device identifiers to precise GPS coordinates, browsing history, and even sensitive personal details. Xiaomi’s preloaded selection averages 16 data types per app, the highest of the four. Google’s apps average 13.
But. The ability to delete matters more than the raw count. An unused app that cannot be removed keeps collecting data in the background. It occupies storage. It widens the attack surface. Android’s fragmented approach leaves millions of users stuck with carrier apps, manufacturer utilities, and third-party promotions they never chose.
Researchers have warned about this for years. A 2019 academic analysis of more than 82,000 pre-installed Android apps across 214 vendors found widespread tracking libraries, excessive permissions, and even malware in some cases. The supply chain around Android’s open model created incentives that favored data collection over user control. Little has changed at the high end.
Recent coverage adds fresh context. Android Headlines reported on September 21 that regular app audits remain essential because pre-installed software can pull everything from street addresses to exact coordinates. Ground News aggregated reports as recently as October 7 underscored the same privacy invasion risk.
So users face a choice. Buy an iPhone and gain the power to strip away almost everything except core functions. Or choose Android and accept that many manufacturer and partner apps will stay whether wanted or not. Power users on Android sometimes turn to custom ROMs or debloating tools. Most people never do.
The average owner runs between 60 and 90 apps total yet actively uses only about 10 each day and 30 each month. That leaves dozens of preloaded programs sitting idle yet potentially active. Many request location access, contacts, or background refresh even when never opened.
Apple’s tighter control draws praise for consistency. Yet its own apps still gather behavioral data and location in ways that fuel criticism from privacy advocates. Google’s business model depends on advertising. Preloaded Google apps on Pixel devices reflect that priority. Samsung and Xiaomi layer on additional partners, from social networks to streaming services, each bringing its own data appetite.
EU rules have forced some change. The ability to delete Safari in Europe but not in the United States shows how regulation can shift manufacturer behavior. Still, core system components remain protected everywhere. And third-party apps preloaded by carriers or OEMs often resist removal on Android.
Privacy labels help. They force disclosure. But labels depend on self-reporting. They do not reveal actual data flows or sharing with third parties. Independent analysis remains rare. The Surfshark report stands out because it combines app counts, removal feasibility, and declared data practices in one comparison.
Security researchers point to deeper problems. Pre-installed apps often run with elevated privileges. Some expose components that other apps can query. Tracking SDKs embedded inside them continue to phone home even after users disable obvious settings. Older academic papers documented cases of personal email metadata, call logs, and contacts being accessed without clear consent.
Consumers pay twice. First with storage space and battery life. Then with their information. The data helps advertisers build profiles. It helps manufacturers justify the “free” aspects of their ecosystems. Few owners read the fine print.
Options exist. On iPhone, users can offload unused apps or replace Apple services with alternatives where deletion is allowed. On Android, tools from the Universal Debloater project offer guidance, though they require technical comfort. GrapheneOS and similar privacy-focused Android distributions remove much of the bloat but void warranties and demand advanced knowledge.
The Surfshark analysis does not declare a single winner. It highlights trade-offs. Apple gives more deletion freedom and collects less data per app on average. Android offers greater customization for those willing to work for it, yet most devices ship with heavier loads and fewer easy off-ramps.
One conclusion stands clear. Check what arrives on a new phone. Remove what you can. Audit permissions regularly. The software that comes preloaded often tells a different story than the marketing copy. And that story is written in data points collected whether the app is ever tapped or not.