A hidden data collection system built into Africa’s best-selling smartphones has been quietly sending detailed information about users to servers linked to their Chinese manufacturer, raising fresh concerns over privacy, cybersecurity and cross-border data protection across the continent.
A threat intelligence report by mobile security firm NowSecure found that smartphones made by Transsion Holdings, maker of the Tecno, Infinix and itel brands, contain an embedded telemetry system capable of collecting sensitive information, including users’ GPS location, app usage, mobile data consumption and camera activation events. The data is transmitted to servers operated by Shalltry, a Shenzhen-based software company affiliated with Transsion.
Read also: Smartphone security habits lag behind growing mobile dependence – Kaspersky
The findings could have wide implications for Africa, where Transsion dominates the smartphone market. According to research firm Omdia, the company accounted for about 48 percent of smartphones shipped across the continent in 2025, representing more than 40 million devices out of the 84.4 million smartphones sold during the year.
The report comes as African governments increasingly rely on smartphones to deliver digital public services, mobile banking, digital identity programmes and healthcare applications, making mobile devices central to everyday economic activity.
Researchers said the telemetry framework, known as Athena and oneID, is embedded deep within the Android operating system as a privileged system component rather than an ordinary application. Because of its level of access, users cannot remove or disable it without risking damage to the device.
After decrypting network traffic from a Tecno Spark 40 smartphone, independent security researcher Buchodi, working with NowSecure, found that the software transmitted GPS coordinates, nearby mobile network tower information, app usage patterns, daily mobile data consumption and notifications whenever an application activated the camera, although it did not capture images or video content.
The researchers also found the information was linked to about 14 permanent device identifiers that users cannot reset, allowing activity to be associated with the same handset throughout its lifetime.
The report does not allege that passwords, messages, photographs or financial transactions were collected. However, cybersecurity experts say location history combined with app usage and permanent device identifiers can reveal detailed behavioural profiles of users.
David Weinstein, chief technology and product officer at NowSecure, said the research uncovered software development kits that collected significantly more information than users would normally expect.
“We found SDKs that collect way more information than users likely expect,” Weinstein said.
The findings are likely to draw attention from regulators, particularly in Nigeria, one of Transsion’s largest markets.
The Nigeria Data Protection Commission (NDPC) had not publicly commented on the report at the time of filing. However, under the Nigeria Data Protection Act (NDPA) 2023, organisations processing Nigerians’ personal data must have a lawful basis for doing so and are subject to strict conditions governing cross-border transfers of personal information.
Vincent Olatunji, the national commissioner of the NDPC, had described personal data as a strategic national asset and warned that organisations found violating the country’s data protection law face significant sanctions, including financial penalties.
The Commission has in recent months stepped up enforcement against companies accused of unlawful data processing and cross-border data transfers, signalling a tougher regulatory approach.
Ivan Kinash, chief executive officer and co-founder of mobile security company Licel, said some of the telemetry may have been designed for legitimate purposes such as fraud prevention and device authentication.
“A significant portion of this telemetry is very likely being used for fraud prevention and authentication reinforcement. The industry has relied on device identifiers for years to distinguish legitimate users from fraudsters. The challenge is finding the right balance between security and user privacy,” Kinash said.
Still, experts say the report highlights a broader challenge facing Africa’s rapidly growing digital economy.
Read also: GSMA urges tax cuts on entry-level smartphones to bridge Africa’s 961m usage gap
Affordable smartphones have helped connect millions of first-time internet users across the continent, fuelling the growth of mobile money, e-commerce and digital government services. But as smartphones become the primary gateway to the internet, scrutiny is shifting from hardware prices to how much personal data the devices collect and where that information is stored.
The findings are also likely to intensify debate over digital sovereignty in Africa, where governments are investing in local data centres, artificial intelligence and cloud infrastructure while strengthening national data protection laws.
For Transsion, whose success has been built on designing affordable smartphones for African consumers, the report presents a fresh challenge as trust increasingly becomes a competitive advantage alongside price and innovation.
Get Newsletter Updates
Enjoying our column?
Subscribe to our specialised **Tech Pulse** feed to receive fresh reports and analyses directly in your inbox.
