An alarming number of them are. And consider that in many, many cases, the apps don't even know they're doing it, because the developer is including some SDK that helps them (e.g. SDKs that help them monetize by handling ad placement). The SDKs can do whatever the app can do, so they're quietly siphoning all kinds of data off and sending it back to the publisher of the SDK.