Right now, there’s a good chance you have a free game on your phone. It might be something you play to pass the time on your daily commute, like a puzzle or word game. Or maybe your kids play it. It costs nothing to download, and it seems harmless enough, apart from the occasional ad.
New Proton research into the most downloaded mobile games across multiple countries, however, has found the vast majority are sending gamers’ personal data (sometimes including highly sensitive real-time location data) abroad to ad-tech companies with headquarters or key operations in China, Russia, and other countries with notoriously poor privacy laws and protections. And the fact that over 90% also send data to Israel and Five Eyes countries strongly suggests that your data can end up anywhere.
These aren’t niche rogue apps. They’re the most popular mobile games on the planet and have collectively been downloaded almost 20 billion times worldwide, and they include household names such as Block Blast!, Disney Solitaire, and Arrows Go!
What we found
Proton examined the most downloaded mobile games currently available through Google Play, analyzing:
- How many trackers each contained
- Where that data goes
- How many gamers are affected
The results paint a disturbing picture of an industry that routinely includes trackers that send large amounts of highly personal data to countries hostile to privacy, with minimal transparency and no meaningful accountability.
While some might assume that these trackers are innocuous, the reality is more concerning. Most of these apps don’t acknowledge exactly what data they collect in practice, but the trackers give them the ability to collect highly personal information, including what device you’re using, which other apps and services you have on your phone, your usage habits, where you are, your payment information, age, gender and more.
When all added together, this creates a detailed picture of a person, and depending on which company or country this data is sent to, it’s very hard to work out what this data is eventually used for once it’s been collected.
In a best-case scenario, some shadowy ad-tech company knows too much about you or your children. A slightly more concerning scenario sees this ad-tech company targeted by hackers, putting your data in the hands of criminals. Possibly the worst case is that the ad-tech company is based in a country like Russia or China, meaning a potentially adversarial government gains access to millions of people’s personal information. No matter the scenario, none of them are positive.
Methodology
We examined free-to-play downloads from the Google Play store. Monthly download counts are estimates from AppTweak for the month of May. For tracker counts, we used data from Exodus Privacy(new window), an open-source platform that analyzes Android apps to detect the code signatures of analytics, advertising, and profiling trackers.
While trackers originate from all over the world, we focused on games that sent information to Russia and China because of the geopolitical situation, the Five Eyes for the sheer number of consumers affected, and Israel, because of its highly prominent and mature ad-tech sector.
Findings per country
To better understand the scale of this global assault on privacy these apps represent, we have launched a study examining the most downloaded mobile games on Google Play in multiple countries. Below are our findings, starting with the United Kingdom and the United States, Germany and France.
United States
Proton examined the 100 most downloaded mobile games available to consumers in the US. The findings are striking:
| Category | Percentage of downloads |
|---|---|
| Send data to Five Eyes entities | 98% |
| Send user data to Israel | 95% |
| Send user data to China | 81% |
| Send user data to Russia | 71% |
| Send user data to all of the above | 70% |
These are the 10 most popular games played in the United States.
| App name | US May 2026 downloads | Global all-time downloads | Trackers | Location tracker | Israel tracker | Russia tracker | China tracker | 5-Eyes tracker |
|---|---|---|---|---|---|---|---|---|
| Arrows – Puzzle Escape | 689,000 | 10M+ | 30 | ✓ | ✓ | ✓ | ✓ | ✓ |
| Arrows GO! | 470,000 | 100M+ | 28 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Block Blast! | 439,000 | 500M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Vita Mahjong | 425,000 | 100M+ | 36 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Coin Master – Board Adventure | 406,000 | 1M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Disney Solitaire | 381,000 | 10M+ | 30 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Castle Busters | 375,000 | 1M+ | 31 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Jewel Coloring | 365,000 | 1M+ | 32 | ✓ | ✓ | ✓ | ✓ | ✓ |
| Royal Kingdom | 358,000 | 50M+ | 9 | ✗ | ✓ | ✗ | ✗ | ✓ |
| Roblox | 353,000 | 1B+ | 4 | ✗ | ✓ | ✗ | ✗ | ✓ |
This means Americans downloaded these games almost 20 million times in one month. Of these, games containing location trackers were downloaded 1.7 million times, and games actively sharing data with Chinese companies were downloaded 15.8 million times. Over 13.7 million downloads were found to be sharing data with Russia. As is also the case with the UK, almost all of these games sent data to Israeli companies, and most of them sent your data just about everywhere.
Concerning as your data going to foreign countries is, most American mobile gamers would likely be alarmed to learn their location data may be accessible not just to advertisers, but also to US government agencies. Federal agencies, including the FBI, have admitted to purchasing location data(new window) from commercial brokers, a practice critics say lets them sidestep the usual requirement to obtain a court-issued warrant.
Since the US is a member of the 5 Eyes, 9 Eyes, and 14 Eyes spying alliances, personal data obtained through your mobile game apps may be widely shared with its allies.
United Kingdom
Proton examined the 100 most downloaded mobile games available to consumers in the UK, which tell a similar story to our US findings.
| Category | Percentage of downloads |
|---|---|
| Send data to Five Eyes entities | 99% |
| Send user data to Israel | 95% |
| Send user data to China | 84% |
| Send user data to Russia | 74% |
| Send user data to all of the above | 73% |
These are the 10 most popular games played in the United Kingdom.
| App name | UK May 2026 downloads | Global all-time downloads | Trackers | Location tracker | Israel tracker | Russia tracker | China tracker | 5-Eyes tracker |
|---|---|---|---|---|---|---|---|---|
| Arrows – Puzzle Escape | 112,000 | 10M+ | 30 | ✓ | ✓ | ✓ | ✓ | ✓ |
| Township | 87,000 | 100M+ | 11 | ✗ | ✓ | ✗ | ✗ | ✓ |
| Vita Mahjong | 87,000 | 100M+ | 36 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Block Blast! | 79,000 | 500M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Castle Busters | 75,000 | 1M+ | 31 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Magic Sort! | 72,000 | 10M+ | 30 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Arrows GO! | 64,000 | 10M+ | 28 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Fortnite | 61,000 | 10M+ | 4 | ✗ | ✓ | ✗ | ✗ | ✓ |
| Disney Solitaire | 59,000 | 10M+ | 30 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Tasty Travels: Merge Game | 59,000 | 10M+ | 17 | ✗ | ✓ | ✗ | ✓ | ✓ |
Proton found more than 300,000 UK game downloads in May 2026 alone that are actively tracking your physical location. Not only that, but games actively sharing data with Chinese companies were downloaded 3 million times, while 2.7 million downloads were found to be sharing data with Russian companies.
Interestingly, while Israeli trackers were one of the most common foreign trackers we found (appearing in 95% of total downloads) this was beaten by Five Eyes trackers, which appeared in 99% (or 3.6 million) total downloads. Out of the 100 games examined in the UK study, virtually all of them contained multiple trackers, with up to a whopping 36 different trackers per game.
Unsurprisingly in today’s interconnected online world, these figures track closely to those found in our analyses of other countries. However, they have particular significance in the UK, where debates about children’s online safety and digital privacy tools are ongoing.
Earlier this year, there were discussions about potentially restricting VPN use for minors under proposed online safety measures — concerns that ultimately led to further review. We’re glad the government has moved away from those restrictive proposals. While the intent behind protecting children online is clear, targeting VPNs would have been counterproductive.
Our research shows that VPNs actually make the internet safer for everyone, including young people. In an ecosystem where we’ve calculated that 74% of top games send data to Russian and Chinese ad-tech firms, reputable audited VPNs with built-in ad and tracker protection are one of the few tools available that allow ordinary people to defend against this. Banning young people from using VPNs would strip this protection from the very children the law claims to safeguard.
Germany
Proton examined the 100 most downloaded mobile games available to consumers in Germany. The findings echo those of the UK and US:
| Category | Percentage of downloads |
|---|---|
| Send data to Five Eyes entities | 97% |
| Send user data to Israel | 91% |
| Send user data to China | 82% |
| Send user data to Russia | 69% |
| Send user data to all of the above | 68% |
The 10 most popular games played in Germany are:
| App name | DE May 2026 downloads | Global all-time downloads | Trackers | Location tracker | Israel tracker | Russia tracker | China tracker | 5-Eyes tracker |
|---|---|---|---|---|---|---|---|---|
| Arrows – Puzzle Escape | 115,000 | 10M+ | 30 | ✓ | ✓ | ✓ | ✓ | ✓ |
| Subway Surfers | 90,000 | 1B+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Vita Mahjong | 86,000 | 100M+ | 36 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Brawl Stars | 79,000 | 500M+ | 5 | ✗ | ✓ | ✗ | ✗ | ✓ |
| Gossip Harbor®: Merge & Story | 75,000 | 50M+ | 14 | ✗ | ✓ | ✗ | ✓ | ✓ |
| Castle Busters | 72,000 | 1M+ | 31 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Coin Master – Board Adventure | 72,000 | 1M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Jewel Coloring | 70,000 | 1M+ | 32 | ✓ | ✓ | ✓ | ✓ | ✓ |
| Township | 70,000 | 100M+ | 11 | ✗ | ✓ | ✗ | ✗ | ✓ |
| Mob Control | 68,000 | 100M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
Together, Germany’s top 100 games were downloaded more than 3.9 million times in May 2026. Chinese trackers were present in 3.2 million of those downloads, Russian trackers in 2.7 million. Trackers belonging to Five Eyes companies appeared in 3.8 million downloads, which is close to the entire German market for free mobile games. More than 371,000 downloads went to apps that actively collect users’ physical location.
These numbers jar for a country with a long-standing cultural sensitivity to surveillance, reinforced by the GDPR, which Germany helped shape. For example, in 2025, citing privacy and cybersecurity concerns, the German government proved decisive in blocking an EU-wide “chat control” proposal to scan private messages for child sexual abuse material (although under interim rules, independent platforms can continue to do this).
Yet free mobile games aimed at the same population, including children, are quietly sending sensitive data to Chinese and Russian ad-tech firms with far less scrutiny than that debate received.
France
Proton examined the 100 most downloaded mobile games available to consumers in France. Again, the results are comparable:
| Category | Percentage of downloads |
|---|---|
| Send data to Five Eyes entities | 98% |
| Send user data to Israel | 93% |
| Send user data to China | 78% |
| Send user data to Russia | 70% |
| Send user data to all of the above | 68% |
The 10 most popular games played in France are:
| App name | FR May 2026 downloads | Global all-time downloads | Trackers | Location tracker | Israel tracker | Russia tracker | China tracker | 5-Eyes tracker |
|---|---|---|---|---|---|---|---|---|
| Arrows – Puzzle Escape | 117,000 | 10M+ | 30 | ✓ | ✓ | ✓ | ✓ | ✓ |
| Vita Mahjong | 98,000 | 100M+ | 36 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Subway Surfers | 97,000 | 1B+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Coin Master – Board Adventure | 86,000 | 1M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Block Blast! | 84,000 | 500M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Fortnite | 80,000 | 10M+ | 4 | ✗ | ✓ | ✗ | ✗ | ✓ |
| Mob Control | 78,000 | 100M+ | 32 | ✗ | ✓ | ✓ | ✓ | ✓ |
| Jewel Coloring | 72,000 | 1M+ | 32 | ✓ | ✓ | ✓ | ✓ | ✓ |
| Royal Kingdom | 72,000 | 50M+ | 9 | ✗ | ✓ | ✗ | ✗ | ✓ |
| Brawl Stars | 71,000 | 500M+ | 5 | ✗ | ✓ | ✗ | ✗ | ✓ |
In May 2026, the top 100 games in France were downloaded more than 4 million times. Of these, 3.1 million downloads contained trackers sending data to China, 2.8 million to Russia, and 3.9 million to Five Eyes countries. Over 330,000 downloads included trackers actively collecting users’ location.
The contrast with France’s current online-safety debate is stark. In July 2026, French lawmakers passed a law banning under-15s from social media outright, requiring age verification to enforce it. More than 120 members of parliament referred the law to France’s Constitutional Council, and on 14 August 2026, the Council struck down the ban(new window), ruling it disproportionately infringed freedom of expression, and separately that lawmakers had failed to build in the privacy safeguards needed to protect the age-verification data the ban would have required collecting.
In other words, France’s highest court blocked a child-protection measure partly because of the privacy risk posed by collecting children’s data. Yet games like Subway Surfers and Block Blast!, downloaded by children as often as adults, face no such scrutiny at all while sending data to ad-tech networks in Beijing and Moscow.
The hidden cost of free
Sending personal data to ad-tech and data-broker networks is how the entire free-to-play ecosystem works, and until people are willing to pay upfront for the games they play, this won’t change.
While most gamers understand this monetization model, they are unlikely to grasp the sheer scale and intrusiveness of the tracking performed, or that their data, often routed via long and opaque supply chains, ends up in China, Russia, and Israel. And with an average of 29 trackers per game, a considerable chunk of your personal data ends up in all three.
Location tracking is particularly worrying
Of all the data being collected, location information deserves particular attention, because location data is not just data. It’s a record of your life.
It tells whoever holds it where you work and where you sleep. It records whether you attended a protest, visited a medical clinic, went to a place of worship, or met with someone you’d rather keep private. It does this continuously, building a timeline of your movements that’s far more revealing than most people understand or would care for.
Of the top 100 games most downloaded globally, seven track your location:
- Magic Tiles 3™ – Piano Game
- Pokémon GO
- Chess – Play and Learn Online
- Arrows – Puzzle Escape
- Jewel Coloring
- 3D Bubble Shoot – ASMR Game
- Rebel Glam: Dress Up Games
Pokémon Go has a legitimate reason to do this, since its core mechanic depends on knowing your physical location, but a puzzle game or coloring game has no legitimate need for your GPS coordinates. The fact that they have them anyway, and are sharing them with third parties in foreign countries, should concern every mobile gamer.
It’s not just governments and ad-tech companies you need to worry about
If data exists, it can be hacked by criminals. For example: Mixpanel is a product analytics platform often embedded into apps to track their users’ behavior. In November 2025, Mixpanel reported a data breach(new window) that allowed attackers to steal historic customer analytics and user-identifiable metadata. Roblox, for example, one of the most popular free games, with over a billions global downloads all-time, sends data to Mixpanel.
What can you do about it?
The free-to-play industry’s multi-billion-dollar revenue depends on you not fully understanding what’s being collected and where it goes. Regulation has been slow and haphazard, and app stores, which could enforce meaningful data-sharing disclosures, have largely looked the other way while taking a cut from the profits.
This all means that structural change is unlikely to happen anytime soon (if ever), so it falls on you, as an individual gamer, to protect yourself.
Use NetShield Ad-blocker
NetShield Ad-blocker is built into Proton VPN on every platform and included with all paid plans. It filters DNS requests, so when an app tries to load content from a domain on our blocklist, the lookup never resolves, and the request dies before anything downloads. This prevents apps from contacting known ad, tracker, and malware domains.
Learn more about NetShield Ad-blocker
Pay for games up front
It simply cannot be said too many times: if you don’t pay for a product, you are the product. Game developers need to make money to pay their bills and to develop new cool stuff. If you won’t simply pay for the games you play, it’s inevitable that they monetize your data by selling it to ad-tech networks.
On most paid-for games, one of the things you’re paying for is software that’s free of ads.
A darker reality
Mobile games are fun, and free is everyone’s favorite price. Having to put up with a few ads may seem like a reasonable cost to pay, but the reality is much darker. The mobile gaming industry is built on an insidious surveillance network with extraordinary reach into the daily lives of hundreds of millions of people — all with very little transparency and no meaningful oversight.
Behind each statistic is a person who opened a puzzle game on their daily commute or let their child play a coloring app before bedtime, with no idea that their personal information is being packaged and dispatched to servers in countries with poor privacy protections and that are, in some cases, hostile to the West.
At Proton, we believe privacy is a right, not a feature. And it’s time the mobile gaming industry started treating it that way.
