Africa’s Dominant Smartphone Brands Under Scrutiny for Hidden Data Transmission to China-Linked Servers
A pervasive data collection system embedded within Africa’s best-selling smartphones is reportedly transmitting detailed user information to servers linked to their Chinese manufacturers, igniting significant concerns regarding privacy, cybersecurity, and cross-border data protection across the continent. A recent threat intelligence report by mobile security firm NowSecure has identified that smartphones produced by Transsion Holdings, the parent company behind popular brands such as Tecno, Infinix, and itel, contain an integrated telemetry system. This system is capable of gathering sensitive data, including users’ GPS location, app usage patterns, mobile data consumption, and camera activation events. The collected data is then transmitted to servers operated by Shalltry, a Shenzhen-based software company affiliated with Transsion.
These findings carry profound implications for Africa, a continent where Transsion commands a dominant position in the smartphone market. Research from Omdia indicates that Transsion accounted for approximately 48 percent of all smartphones shipped across Africa in 2025, translating to over 40 million devices out of the 84.4 million sold that year. This widespread adoption occurs as African governments increasingly leverage smartphones to deliver essential digital public services, facilitate mobile banking, implement digital identity programmes, and deploy healthcare applications, making these devices central to daily economic activity.
The telemetry framework, identified as Athena and oneID, is deeply integrated within the Android operating system as a privileged system component, rather than a standard application. This deep-level access means users cannot remove or disable it without potentially compromising device functionality. Independent security researcher Buchodi, collaborating with NowSecure, decrypted network traffic from a Tecno Spark 40 smartphone and discovered the software transmitting GPS coordinates, nearby mobile network tower information, app usage patterns, daily mobile data consumption, and notifications upon camera activation. While the system did not capture images or video, the data was linked to approximately 14 permanent device identifiers that are unresettable, enabling the tracking of user activity throughout the device’s lifespan.
While the report does not allege the collection of passwords, messages, photographs, or financial transactions, cybersecurity experts caution that the combination of location history, app usage, and permanent device identifiers can construct detailed behavioural profiles of users. David Weinstein, Chief Technology and Product Officer at NowSecure, stated that the research uncovered Software Development Kits (SDKs) collecting substantially more information than users would typically anticipate.
These revelations are poised to attract significant regulatory attention, particularly in Nigeria, a key market for Transsion. The Nigeria Data Protection Commission (NDPC) had not issued a public statement on the report at the time of publication. However, under the Nigeria Data Protection Act (NDPA) 2023, organisations processing personal data of Nigerians are mandated to possess a lawful basis and adhere to stringent conditions for cross-border data transfers. Vincent Olatunji, the National Commissioner of the NDPC, has previously underscored the strategic national importance of personal data and warned of substantial sanctions, including financial penalties, for violations of data protection laws. The Commission has recently intensified enforcement actions against entities accused of unlawful data processing and cross-border data transfers, signalling a more robust regulatory stance.
Some telemetry may serve legitimate purposes such as fraud prevention and device authentication, according to Ivan Kinash, CEO and co-founder of mobile security company Licel. He noted that device identifiers have long been used to differentiate legitimate users from fraudsters, highlighting the ongoing challenge of balancing security with user privacy. Nevertheless, the report underscores a broader challenge for Africa’s burgeoning digital economy. Affordable smartphones have been instrumental in connecting millions of new internet users, driving growth in mobile money, e-commerce, and digital government services. As these devices become the primary internet gateway, scrutiny is shifting from hardware costs to the extent of personal data collection and its storage locations. The findings are also likely to intensify discussions around digital sovereignty in Africa, a continent actively investing in local data centres, AI, and cloud infrastructure while strengthening national data protection frameworks. For Transsion, whose business model is built on providing affordable smartphones to African consumers, this report presents a critical challenge, as trust is increasingly becoming a competitive differentiator alongside price and innovation.
