&gt; You should really read this Usenix paper<p>I have read it. It describes an attack on the app review process, i.e. a trojan. Their apps require the user to grant privileges. For example, their GreetingCard app requests access to the user&#x27;s address book, and the user has to grant it.<p>&gt; iOS apps (over 250) that were App Store approved were able to retrieve personal user data including email addresses<p>This is not true. Here&#x27;s the blog: <a href="https:&#x2F;&#x2F;sourcedna.com&#x2F;blog&#x2F;20151018&#x2F;ios-apps-using-private-apis.html" rel="nofollow">https:&#x2F;&#x2F;sourcedna.com&#x2F;blog&#x2F;20151018&#x2F;ios-apps-using-private-a...</a><p>The data they collected was list of installed apps, serial numbers, and some sort of AppleID numeric identifier. In particular, they did not (could not) collect email addresses.<p>It&#x27;s bad that the SDK was collecting this stuff, but this data is fairly innocuous. Last I checked, Android provides information like the list of installed apps and various serial numbers without requiring elevated permission.<p>If you think it&#x27;s possible to get the user&#x27;s email address through an iOS private API, I challenge you to tell me what that private API is.<p>&gt; For example you need to declare android.permission.GET_ACCOUNTS permission to get the user&#x27;s primary email. Not on iOS apparently<p>This is wrong. On iOS, the only way to access the user&#x27;s email is through the Address Book framework, which prompts the user at the time of access.<p>&gt; your app gets a broad set of permissions on iOS by default<p>This is completely false. iOS has a comprehensive on-demand permissions model, which is widely recognized as better than the install-time permission model on Android. This is why Android is switching to iOS style on-demand permissions in Marshmallow.<p>&gt; you aren&#x27;t calling a private method on Android without declaring the necessary permission<p>Please stop confusing private methods with elevated permissions. You CAN call private methods without elevated permissions, as my code above demonstrates.