Nearly three-quarters of Android apps and close to half of iOS apps are inappropriately sharing smartphone users’ personal information, according to a joint study from MIT, Carnegie Mellon and Harvard.

“Who Knows What About Me? A Survey of Behind-the-Scenes Personal Data Sharing to Third Parties by Mobile Apps” is a pretty damning indictment of the way developers handle the personal information they get when users download their products. In a random look at 55 apps across both platforms, for example, the study found 47 percent of iOS apps share location data about the iPhone customers, while a staggering 73 percent of Android apps offer email addresses without explicit consent.

Although it’s unlikely many of these apps are offering personal information to cybercriminals, the study shows an apparent lack of accountability in how data moves from one organization to another. As BusinessInsider reported, many of the details seem innocuous enough, such as the iOS version of Instagram sending birthday, gender and location to Apple. In 3 out of 10 medical, health and fitness apps, however, what’s being collected includes in-app search histories for medical terms.

To prove how much spying is going on within mobile apps, the researchers tracked HTTP and HTTPS traffic and then identified personal information that went to third-party domains, according to BBC News. In some cases, the results were mysterious, such as the fact that 93 percent of Android apps covered in the study connected to Safemovedm.com. Privacy International told BBC the report documented a betrayal of smartphone users’ trust and raised questions about possible future data retention legislation.

Although neither Google nor Apple responded to requests from several outlets for comment, it’s not as though they’re unaware of the potential fallout. Just a few weeks ago, for example, a story on Ars Technica said Apple had pulled more than 250 iOS apps from its App Store for violating its privacy policy and collecting personal information from private APIs.

Apple, of course, has been making its approach to privacy a centerpiece of its strategy, with an in-depth policy update earlier this year. As this research proves, however, the problem may be one of mobile OS providers coaching developers on the boundaries for data sharing — and providing more enforcement when necessary.