A hidden data collection system deeply embedded in Africa’s best-selling smartphones has been quietly harvesting detailed user information and transmitting it to servers linked to their Chinese manufacturer. The alarming discovery has sparked fresh debates over digital sovereignty, cybersecurity, and consumer privacy across the continent.
According to a threat intelligence report published by mobile security firm NowSecure, smartphones manufactured by Transsion Holdings—the parent company of wildly popular brands like Tecno, Infinix, and itel—contain unremovable telemetry systems that track sensitive user behavior. The data is reportedly funneled to servers operated by Shalltry, a Shenzhen-based software company with close affiliations to Transsion.
The Scale of the Breach
The implications of the findings are massive for the African market. Research firm Omdia notes that Transsion currently dominates the continent’s smartphone landscape, accounting for approximately 48 percent of all shipments in 2025. That equates to more than 40 million of the 84.4 million smartphones sold across Africa during the year.
As African governments rapidly digitize—relying heavily on mobile devices for public services, banking, digital identity, and healthcare—the integrity of these devices is more critical than ever.
What Data is Being Tracked?
Working alongside NowSecure, independent security researcher Buchodi decrypted the network traffic of a Tecno Spark 40 smartphone to uncover the extent of the tracking. The investigation revealed that the device was actively transmitting:
- Exact GPS coordinates
- Information on nearby mobile network towers
- App usage patterns and daily mobile data consumption
- Notifications whenever an application activated the camera (though no actual image or video content was captured)
The researchers discovered that this telemetry framework, known internally as “Athena” and “oneID,” is not a standard application. Instead, it is embedded deep within the Android operating system as a privileged system component. Because of its root-level access, everyday users cannot remove, restrict, or disable the tracking without risking terminal damage to their devices.
Furthermore, the collected data is tethered to 14 permanent device identifiers that cannot be reset. This allows the manufacturer to build a continuous, lifetime behavioral profile of the handset’s user.
“We found SDKs [Software Development Kits] that collect way more information than users likely expect,” stated David Weinstein, Chief Technology and Product Officer at NowSecure. While the report clarified that direct communications like messages, photos, and passwords were not intercepted, cybersecurity experts warn that combining location history with app usage and permanent device IDs paints a highly invasive portrait of a user’s daily life.
Regulatory Backlash Looms
The revelation is expected to trigger swift regulatory scrutiny, particularly in key markets like Nigeria. The Nigeria Data Protection Commission (NDPC) recently introduced the Nigeria Data Protection Act (NDPA) 2023, which imposes strict limitations on the cross-border transfer of personal information and requires a lawful basis for any data processing.
While the NDPC has not yet issued a formal statement on the NowSecure report, the commission has taken a hardline stance in recent months, aggressively penalizing companies for unlawful data practices.
Fraud Prevention or Privacy Violation?
Some industry insiders argue that the embedded systems may not be entirely malicious in intent. Ivan Kinash, CEO and co-founder of mobile security company Licel, suggested that a portion of the data collection is likely geared toward fraud prevention and device authentication.
“The industry has relied on device identifiers for years to distinguish legitimate users from fraudsters,” Kinash explained. “The challenge is finding the right balance between security and user privacy.”
Despite these defenses, the report underscores a growing tension in Africa’s booming digital economy. For years, affordable hardware from companies like Transsion has been championed for bridging the digital divide, bringing millions of first-time internet users online. However, as mobile phones become the undisputed gateway to the modern economy, the hidden costs of “budget” hardware are coming to light.
For Transsion, a company built on pricing innovation for African consumers, this revelation presents an unprecedented challenge: proving that affordability does not have to come at the expense of privacy.
For more continuous coverage on cybersecurity and tech policies shaping the future, stay tuned to ABT NEWS at www.abtnews.net.
By
