The code inserted to allow applications to run ads can collect more data on users than even the developers may realize, said executives at Lookout, who conducted the study. (CBC)

Your smartphone applications are watching you — much more closely than you might like.

Lookout Inc., a mobile-phone security firm, scanned nearly 300,000 free applications for Apple Inc.'s iPhone and phones built around Google Inc.'s Android software. It found that many of them secretly pull sensitive data off users' phones and ship them off to third parties without notification.

That's a major concern that has been bubbling up in privacy and security circles.

The data can include full details about users' contacts, their pictures, text messages and internet and search histories. The third parties can include advertisers and companies that analyze data on users.

The information is used by companies to target ads and learn more about their users. The danger, though, is that the data become vulnerable to hacking and use in identity theft if the third party isn't careful about securing the information.

Lookout reported its findings this week in conjunction with the Black Hat computer security conference in Las Vegas.

Lookout found that nearly a quarter of the iPhone apps and almost half the Android apps contained software code that contained those capabilities.

The code had been written by the third parties and inserted into the applications by the developers, usually for a specific purpose, such as allowing the applications to run ads. But the code winds up forcing the application to collect more data on users than even the developers may realize, Lookout executives said.

Developers ignorant about own apps

"We found that not only users, but developers as well, don't know what's happening in their apps, even in their own apps, which is fascinating," said John Hering, CEO of the San Francisco-based Lookout.

Part of the problem is smartphones don't alert users to all the different types of data the applications running on them are collecting. IPhones only alert users when applications want to use their locations.

Android phones offer robust warnings when applications are first installed, but many people breeze through them for the gratification of using the apps quickly. Google said it tries to limit users' risk with the warnings but consistently advises users to only install apps they trust.

Apple didn't respond to a request for comment on Lookout's research.