The IT Nerd

Surfshark’s analysis of 1,722 participants worldwide shows that people detect only 40% of bot-generated social media comments. The ones people miss most often are positive, friendly, and logic-sounding bots. According to the researcher, positive social media bots can be utilized for social engineering attacks to bypass real users’ defenses.

“On social media, everyone notices the angry trolls. That’s why the angry trolls are the ones who often get caught. In the simulated social media environment, participants flagged half (50.2%) of negative AI-generated bots,” said Luís Costa, Research and Insights Lead at Surfshark.

However, when a bot hid behind a positive and friendly persona, participants’ detection rate dropped to 38%, a huge 12-point gap. Besides, the simulation is active online, and you can test your bot detection skills.

“Often, AI-powered accounts used in sophisticated manipulation campaigns are agreeable, logical, or simply unremarkable. They can support real users’ opinions and just inflate the number of comments in the discussion to make a minority view look like everyone feels the same way. Seldom do people report such accounts.”

Surfshark researcher points out that positive and friendly AI bots on social media are considered more dangerous than those that are confrontational and annoying. By being friendly and logical, bots bypass people’s skepticism. You don’t see them as an enemy or a threat, so you are more likely to turn to private chat, share personal information, click a link they share, or believe their “logical” disinformation, which can subtly shift your political and social opinions before you even realize you’re talking to an AI machine.

During the live simulation, one of the biggest red flags was the use of emojis. Bots that used many emojis were caught over 60% of the time, while those that kept communication simple were detected only 35% of the time. This huge 30.6-point gap shows why relying solely on emojis is a bad way to protect yourself on social media. Any scammer who simply stops using an excessive amount of emojis instantly becomes twice as hard to spot.

Users of text-driven platforms led the simulation: X users achieved a 49% bot-detection rate and were the strongest bot hunters, significantly ahead of users from visual- and video-first platforms like TikTok (38%) and Facebook (39%). This means AI bots on TikTok and Facebook are more likely to manipulate real users.

Is it still possible to detect AI-generated content on social media?

Even automated detection tools are struggling to detect AI-generated content. For humans, well-made AI content is now almost indistinguishable from content generated by a real person. Luís Costa, Research and Insights Lead at Surfshark, shares recommendations on what people should do to protect themselves on social media: 

• Judge the account, not the content. Take a close look at when the profile was created, the profile photo, and what’s written in the ‘About’ section. If you see a brand-new account with a generic photo, a vague bio, and a history of posting the same message over and over, you’ve likely found a fake.
• Keep in mind that when social media debates get serious, your emotions make you more likely to miss fake accounts and wrongly accuse real people.
• Don’t assume someone is real just because they’re agreeing with you or being supportive. If you get a ton of generic support really fast, that’s actually easy for a bot to fake. 

In this video, find more security expert’s tips on how to tell a bot from a human on social media: https://www.youtube.com/watch?v=nwuhIfnRKko

“Bot or Not” live simulation, created by Interaction Design students from Malmö University, inspired the launch of Surfshark’s Cybersecurity Advocacy Fund, which provides up to €100,000 in annual financial support distributed among students, researchers, and creative cybersecurity awareness initiatives worldwide. The application process is now open. You can find more information here. 

For complete research material behind this study, click here.

The average smartphone user has 60 to 90 apps, using only ~10 daily and ~30 monthly. As a result, 60% to 70% of apps sit unused in the background, collecting personal data. New analysis by Surfshark revealed that bloatware begins with a brand-new phone, as manufacturers load a substantial number of pre-installed apps onto their devices before they reach the user. Samsung leads with 88 preloaded user-facing apps, followed by Google with 71, Xiaomi with 61, and Apple’s iPhone with 50. Interestingly, some of them include third-party apps like Facebook or Instagram that are privacy-invasive, especially when they are never used and just sit in the background.

“Data collection practices by popular applications, particularly social media platforms and chatbots, raise privacy concerns. While certain data points are necessary for basic operational functionality, entities may harvest information for targeted advertising or may even share it with undisclosed third parties. As a result, users are highly recommended to audit installed applications, review permissions, and remove or disable unused apps. Even never-used applications can gather personal data and link to your device,” explains Tomas Stamulis, Chief Security Officer at Surfshark.

Analysis shows that Samsung smartphones come preloaded with apps from Samsung, Google, mobile carriers, and third-party partners. In Bayton’s database of voluntarily synced Samsung smartphones, 88 user-facing apps were logged as preloaded, and 57% of those were marked by the Universal Debloater Alliance Next Generation project as safe to remove and not affecting the phone’s functionality. For example, the iPhone comes with up to 50 built-in apps, all developed by Apple, and EU users can remove up to 98% of them, compared to 88% in other countries.

35 out of 88 pre-installed Samsung apps are available on Google Play, collecting an average of 13 data types per app. This includes location-category data — such as approximate location (14 apps), precise location (12 apps), and physical addresses (11 apps) — among many other types of information.

Facebook and Instagram collect the most data among Samsung pre-installed apps, with each gathering 37 of 38 data types — accounting for 97% of the 38 data types listed on Google Play. Other third-party apps make the list too, including Netflix, Microsoft OneDrive, and Link to Windows, which collect 12, 15, and 6 data types, respectively.

In contrast, an evaluation of 47 of 50 pre-installed iOS apps available on the App Store collects an average of 8 data types. This includes location-category data, such as approximate location (19 apps), precise location (8 apps), or physical addresses (5 apps). It also includes behavioral data, user-generated content, and sensitive information.

Stamulis adds that linking your data to a single ecosystem may be convenient, but those seeking a more privacy-focused approach can minimize data collection by using third-party apps.

“Relying entirely on pre-installed applications can affect your privacy, as apps don’t always protect user data as you might expect. Shifting to third-party alternatives that are privacy-focused can help minimize data collection, limit overall exposure, and reduce unwanted targeted ads. It can also mitigate the risks associated with potential data breaches as your personal data is not stored in a single database.”

Google phones offer the least flexibility for removing pre-installed apps

Bayton’s database shows 71 preloaded user-facing apps on Google smartphones, with 38% identified as safe to remove by the Universal Debloater Alliance Next Generation project. The 40 apps on Google Play disclose an average of 13 data types collected per app, including physical addresses (15 apps), approximate location (14 apps), and precise location (11 apps).

Meanwhile, Xiaomi smartphones have 61 preloaded user-facing apps, with 57% marked safe to remove. There are 33 apps that can be found on Google Play and collect an average of 16 data types, including physical addresses (17 apps), approximate location (15 apps), and precise location (11 apps).

On both Google and Xiaomi smartphones, Google Gemini and the Google app are the most data-hungry, each collecting 29 of 38 data types. However, both manufacturers include apps that claim to collect no data: on Google devices, these include Password Manager, Pixel Screenshots, and Pixel Studio, and on Xiaomi devices – Weather, File Manager, and Mi Browser.

A recent Surfshark analysis shows that 45% of top mobile apps collect information about the websites their users visit. Of the 40 leading Android and iOS apps analyzed across gen AI, social media, e-commerce, and messaging, 18 report collecting browsing history in their app store privacy labels.

Social media collects the most, followed by e-commerce

Nine out of 10 social media apps collect browsing history on at least one platform. Facebook, Instagram, TikTok, X, YouTube, and Pinterest collect it on both Android and iOS. Reddit, LinkedIn, and Snapchat collect it on Android only. Discord was the only social media app that collects it on neither platform.

This data helps platforms build a clearer picture of user interests, target advertising more specifically, and shape in-app feeds based on websites visited outside the app.

Half of the e-commerce apps analyzed collect browsing history on at least one platform. eBay, Shopee, and Shopify collect it on both Android and iOS, while Taobao collects it on iOS only and AliExpress on Android only. The commercial value is direct: the more these apps know about a user’s online interests, the more effectively they can recommend and advertise products. The cost is that browsing habits become increasingly difficult to keep private.

Messaging and generative AI apps also track websites visited

Three messaging apps collect browsing history: Rakuten Viber, Messenger, and LINE. Their parent companies can use this data to build more detailed profiles of users and their interests.

Collection was the least common in the generative AI category. Google Gemini was the only app of the 10 analyzed to report collecting browsing history.

METHODOLOGY

Surfshark analyzed 40 of the most popular mobile apps, 10 each in generative AI, social media, e-commerce, and messaging, selected mainly from Cloudflare’s ranking of the most popular internet services worldwide. For each app, it was recorded whether its Apple App Store privacy label reported collecting “Browsing History” and whether its Google Play Store label reported “Web Browsing History,” then compared results by platform and category. A separate set of browsers was analyzed outside the 40-app sample. For the complete research material behind this study, visit here.

A new study by Surfshark reveals a significant disparity in how the world’s largest technology companies handle personal information. After analyzing 171 Apple App Store apps from Google, Apple, Microsoft, Amazon, and Meta, researchers found that Meta’s apps are the most “data-hungry,” collecting an average of 25 out of 35 possible data types, more than triple the average of Apple (7) or Microsoft (8).

The study analyzed apps across 35 unique data categories, ranging from precise location and browsing history to purchase data linked to user identity. Company averages varied widely: Meta’s apps collected 25 data types on average, followed by Google with 17, Amazon with 12, Microsoft with 8, and Apple with 7. The sample included 44 Google apps, 41 Apple apps, 40 Microsoft apps, 34 Amazon apps, and 12 Meta apps.

The seven most data-hungry apps in the study were all developed by Meta. Meta AI collected 33 data types, followed by Meta Horizon, Meta Business Suite, Meta Ads Manager, Messenger, Forum, and Facebook with 32 each. Notably, all of this data is linked directly to the user’s identity.

Google dominates TOP 40 ranking while Microsoft and Apple remain the least data-hungry

Google accounted for 29 of the 40 most data-hungry apps in the study, compared with 9 from Meta and 2 from Amazon. Google apps in that group collected between 18 and 26 data types each. Although Google’s apps collected fewer data types on average than Meta’s, its presence across the ranking highlights the scale of data collection throughout its extensive app ecosystem. Meanwhile, Amazon Alexa was the most data-hungry non-Meta app, collecting 28 data types.

Microsoft and Apple consistently ranked as the least data-hungry developers across app categories. Microsoft ranked either the least or second-least data-hungry developer in most categories, with the lone exception of Graphics & Design. Apple covered the widest range of categories (15 in total) and consistently ranked as the least data-hungry developer. For example, Apple’s 13 Utilities apps collected an average of 6 data types, compared with 17 for Google’s Utilities apps.

To see a more detailed profile of each Big Tech company, please see the blog post: https://surfshark.com/research/study/big-tech-data-collection  

Have you ever been drawn to an advertised product when reviews and comments were all positive, with a good user experience, and a large number of views? You have most likely been tricked into content that has been boosted with fake engagement. Surfshark has revealed the true cost of fake popularity on social media, showing how genuine public interest can be overshadowed by fake engagement for just $1.40, and warns that views, comments, or followers do not confirm content legitimacy.

Chief Security Officer at Surfshark, Tomas Stamulis, explained that the primary issue is not the low cost of fake engagement itself, but rather our own naive attitude and lack of skepticism when browsing online. We often interact with and plainly trust ads or pages without recognizing them as potential scams because our mindset is not yet set to filter content and actively search for identifiers that verify legitimacy.

Surfshark’s analysis shows a clear pattern that fake views on social media posts are the cheapest form of engagement across all analyzed platforms. Prices range from $1.40 per 1,000 views on TikTok to $6.70 per 1,000 views on YouTube. By contrast, comments are the most expensive form of fake engagement on social media. Based on the available data, the average price for 1,000 comments was lowest on YouTube at $93, followed by Instagram at $104, TikTok at $140, and Facebook at $287.

According to Stamulis, social media spam filters constantly scan for bot interactions and comments. For this reason, AI, combined with human input, is needed to ensure uniqueness. As a result, when encountering high engagement and only positive comments, we should approach it with skepticism and carefully verify the legitimacy of the advertiser or product.

Scammers can fake followers or reposts to trick you

Study shows that shares, reposts, and retweets tend to be the second-most expensive form of fake engagement. TikTok is the most expensive platform on which to purchase fake shares, at $68 per 1,000, followed by Instagram and Facebook at $37 and X at $27. YouTube is an outlier, with shares costing only $17 per 1,000.

Followers and subscribers are also relatively inexpensive to purchase. The advertised price for 1,000 fake followers ranges from $14 to $20 on Facebook, TikTok, Instagram, and X. YouTube is a clear outlier, with 1,000 artificial subscribers costing $78 — more than four times the average price of followers on the other four platforms.

Stamulis shares some tips on how to verify ads or page legitimacy:

1. Check the follower-to-engagement ratio. A legitimate account should have around 1-5% or total followers as likes. If the account has 500 000 followers, but it gets 200 likes, something is not ok.
2. Check the actual comments section. Phrases like “Great content!”, “Love this!”, “Amazing post” most likely are fake. Comments posted within the same narrow time window and have similar phrasing can be flagged as fake.
3. Check the growth history. There are designated tools to check the growth of the account. Sudden spikes in growth can suggest the page has fake engagement.
4. Analyze followers. Review 10-20 profiles. Bot accounts tend to have similar username formats, account creation dates around the same period, and follow many accounts with few friends.

The launch of Meta’s new Muse Image tool has brought renewed scrutiny to a systemic privacy issue: the “consent on” default setting for AI training on social media. This release marks a significant shift from using data for general model improvements to a more personal and potentially invasive application of generative AI.

“While past AI developments mostly worked out of sight, Muse Image changes the game by letting users directly reference public Instagram accounts to create images using data from those posts. This shift turns the ‘consent on’ default into a critical privacy risk, as individuals have no way of knowing when their personal photos are being harvested as source material for someone else’s AI-generated content,” says Luís Costa, Research and Insights Team Lead at Surfshark.

According to a recent Surfshark study, nearly all major social media platforms prioritize AI development over user privacy by default, using active data collection for model training.

The study found that 8 out of the 10 most popular social media platforms set AI training consent to “on” by default. This “opt-out” rather than “opt-in” model means that unless users proactively navigate complex settings and forms to revoke access, their years of posts, photos, and even private interactions have likely already been integrated into training sets.

“If you’ve ever shared content on social media, it’s highly likely that your photos are already being exploited as a resource for AI training without your clear consent. Our findings revealed that because platforms lack user-friendly opt-out options, much of this data usage is effectively irreversible. Opting out today only prevents future collection, but it cannot undo the training that has already occurred,” says Costa.

The issue of using user content for AI training is also highlighted by other social media platforms, most notably Reddit, which offers no option to opt out of AI model training. Its vast forum discussions are openly used for global AI development, highlighted by contracts with Google and OpenAI to license this user-generated data. In contrast, Discord stands out as the singular exception among the 10 platforms examined. It explicitly states that it does not use user data for AI training.

For the complete research material behind this study, click here.

Note that the IT Nerd has covered mitigating this privacy breach here.

Last year, Google and Apple removed nearly 2.2 million mobile applications from both stores, highlighting a low rejection rate: 9 out of 10 submissions to Google Play went through. Interestingly, Apple more than doubled its total App Store removals, surpassing 166,000, with fraud accounting for 54% of those removed (90,608). In contrast, Google saw a significant decline in total removals, from 3.9 million to 2 million, and its fraud-related deletions dropped to only 5% of its total removals.

Surfshark’s analysis shows that in 2025, Apple rejected 23% of submissions to the App Store, whereas Google Play’s rejection rate was nearly three times lower at 8%, meaning 9 out of 10 submissions went through. As a result, Google deleted over 2 million apps for violating its terms and conditions — nearly half the number deleted in 2024. Meanwhile, Apple’s App Store Transparency Report shows that app removals more than doubled, to nearly 167,000, compared with over 82,500 in 2024.

Fraud (54%) and the removal of obsolete software (43%) were the primary drivers behind App Store deletions. Fraud-related removals were primarily associated with developers from China (13%), Pakistan (11%), the United States (11%), Turkey (11%), and Vietnam (8%).

According to the Google Play Annual Transparency Report, the most frequent reason for removals on their platform was data protection and privacy violations (44%). Other significant factors for Google Play included the distribution of ineligible goods, services, or content (35%), infringements on consumer information (13%), and instances of fraud or scams (5%).

You can read the report here: Google and Apple removed millions of apps in 2025

More than 700 participants took part in a week-long experiment conducted by Surfshark and MSc students from Malmö University. Of them, 53% correctly identified more bots than they wrongly flagged humans as bots on the simulated social platforms. However, nearly half (47%) failed the task. A cybersecurity expert warns that the number of people unable to tell bots from real humans on social media will continue to grow rapidly.

“The ‘Bot or Not’ game and experiment help us keep connecting the dots and better understand the influence bad bots have on us, real social media users. Earlier this year, we found that major platforms remove over 6.3 billion fake accounts every year — roughly 47 times the annual number of babies born worldwide (around 135 million). Bots are being generated by the billions, and our latest experiment shows that half of the participants can no longer tell them apart from real people. This trend will accelerate, as the technology lets bots blend in seamlessly with real human profiles,” says Justas Pukys, Senior Product Manager at Surfshark.

When our emotions take over, bots thrive

The results of the recent social media bot experiment were eye-opening. The data suggests that engaging with sensitive political or social topics may reduce people’s ability to spot bots and make them more likely to falsely accuse real people.

The moment the “Bot or Not” simulation shifted to a more emotional tone, our participants’ bot-detection skills dropped. When the debate turned political and focused on immigration, participants’ bot-detection rate dropped to 54%, meaning that nearly half the social media bots slipped right past the players. Participants’ accuracy rate also declined to 63%, showing a spike in internet paranoia when participants accused humans of being bots.

The women’s rights topic presented the biggest bot-spotting challenges. The bot-detection rate crashed to 49%, meaning users missed more bots than they found. Worse, their accuracy rate fell to 61%, showing players most often accused real human content of being bot-generated.

“In comparison, while engaging in the data centers, a more technical debate for many, users performed the largest bot-detection rate of 71% (finding the majority of the bots), and a high (76%) accuracy rate. This suggests that when not directly emotionally triggered, we could detect more AI bots and are less likely to falsely accuse real humans,” explains Luís Costa, Research Lead at Surfshark.

The “Bot or Not” game is now online for everyone to play and take part.

Can we distinguish who is who on social platforms in the future?

“The experiment’s results are novel and significant. They suggest we can’t simply ‘read’ our way out of ‘botted’ social media. Bot-detection skills appear to be shaped by age, preferred platforms, and time spent on them. But the most striking finding was that our biggest blind spot is emotion: when debates get heated, it hijacks our digital radar.

To fight back against automated deception, we don’t need better textual analysis. We need a cooler head and a deeper awareness of our own vulnerabilities,” claims Luís Costa.

Justas Pukys, a cybersecurity expert at Surfshark, shares practical recommendations.

“Don’t forget to double-check the information you find on social media. Also, don’t take everything random users post at face value. Be careful when accepting and interacting with private messages that offer you prizes, invite you to click on strange links, or try to grab your attention with lines like ‘Your family member has been in an accident!’,” he advises.

The expert also highlights the importance of digital security hygiene, such as using anti-scam tools daily. They will help you analyze the content of emails, text messages, and websites and assess whether it has been generated by bots or other attackers.

This “Bot or Not” experiment inspired the launch of Surfshark’s Cybersecurity Advocacy Fund, which provides up to €100,000 in annual financial support distributed among students, researchers, and creative cybersecurity awareness initiatives worldwide. The upcoming application process will open in September 2026 — more information will follow.

METHODOLOGY

This bot-detection study analyzed data from 710 participants who played the interactive simulation “Bot or Not.” This machine and gameplay were created by Interaction Design students from Malmö University for the UNFOLD exhibition — a design competition for universities around the world during Milan Design Week, the world’s largest trade fair. Throughout the week-long public exhibition, visitors were invited to take part in the experiment.

Please find the full research methodology here.

Popular social media platforms are constantly removing massive amounts of fake accounts and spam content. Surfshark’s analysis of annual public transparency reports reveals the staggering scale of this cleanup: Facebook, TikTok, X, and LinkedIn collectively remove 6.3B fake accounts. These platforms, along with YouTube and Instagram, also remove 11.1B pieces of spam content. On the dark market, fake account prices start at $0.08.

While AI agents are learning to interact with each other on their designated social media, bots pretending to be humans continue to sink popular platforms.

“I am convinced that the majority of fake accounts on social media are bots. Especially with the evolution of AI, producing and managing bots becomes easier. On some platforms, AI can fully cover the needs of “faking”. In contrast, on others it’s not that simple — for example, on Facebook, where interaction with real people and response to context are required,” says Justas Pukys, Senior Product Manager at Surfshark.

He explains that bots are programs designed to impersonate humans. They are centrally controlled, like marionettes, and trained to deceive both systems and humans. In addition, bots can also be real people who manage several accounts with a common goal, for example, to influence social media users’ attitudes, push an agenda on a certain issue, provoke society, or show exaggerated support for certain institutions or figures.

Comparing fake account removal volumes to active users reveals the enormous scale of the monitoring and removal that social media must perform.

On some platforms, the number of annual removals rivals or even exceeds the entire active user base. For example, Facebook, with 3B active users, removes 4.5B fake accounts annually — a volume 1.5 times its user count. Similarly, X reports removing 671M accounts each year for platform manipulation and spam, a figure that surpasses its 570M active users. TikTok deletes 1B fake accounts, equivalent to over half its active user base — 1.9B.

“Considering those platforms’ size, global reach, and impact on human opinion and behavior, I wouldn’t be surprised if the number of fake accounts and content were even higher than presented in the official transparency reports. Also, I believe these numbers will continue to grow drastically in the future, unless social media finds effective ways to combat the threat,” says cybersecurity expert at Surfshark.

Real users face increasing scam risks

Given that social media is flooded with fake accounts and content, a really worrying issue is that real users can easily be scammed and harmed, both morally and financially. Consider these recommendations from Surfshark’s experts on how to avoid getting scammed:

Pay attention to suspicious account profile details: fake accounts usually have very few photos or only associative images. Usually, the account is created recently and has a vague or overly promotional bio.

Be aware of unnatural behavior: fake accounts often send friend requests to many people in a short period of time. They may immediately send you links or other suspicious offers, usually encouraging you to move the conversation to WhatsApp or Telegram quickly.

Fake accounts send repetitive or copy-paste comments: they tend to post the same message under many posts. They typically offer “too good to be true” benefits, such as crypto, giveaways, and miracle cures.

What should you do to avoid harm?

• Don’t engage with suspicious accounts and content: don’t reply, argue, or click links;
• Always check: look at important details such as the account’s age, bio, and number of friends;
• Report the account and content: use the social media platform’s report feature;
• Protect yourself: enable two-factor authentication (2FA) on your account, make your social media profile private, and avoid sharing personal details publicly.