Wikipedia Security & Privacy Scorecard

by Wikimedia Foundation · iOS

98
Overall trust score
Very Secure
97
Security
100
Privacy

App usage is tracked only by Wikipedia's own first-party analytics, with consent collected at onboarding. Donation payments are processed through Adyen and Apple Pay. No advertising networks, behavioral tracking companies, or third-party analytics services receive user data.

Best for

Research and reference without advertising or tracking

Findings

  • 0 critical
  • 0 high
  • 0 medium
  • 2 low
  • 5 info

1 issue identified across security and privacy analysis.

Top security issues

  • Developer Settings Panel with Privileged Toggles Compiled into Production Binary
  • Article WebView PCS Bridge — Dynamic Handler Name with WKContentWorld Isolation
  • Strict App Transport Security — No Exceptions

Top privacy issues

  • First-Party Wikimedia Analytics with Onboarding Consent Screen
  • Persistent App-Install Identifier (WMFAppInstallId) Shared with Donation and Analytics Systems
  • No Third-Party Advertising, Tracking, or Analytics SDKs

Full analysis

Wikipedia

What This Means for You

Your reading activity and analytics are sent only to Wikimedia's own servers, with your consent for analytics requested the first time you open the app.

Recommendation: Very Secure

Wikipedia delivers exceptional privacy: no ads, no third-party tracking, and no commercial analytics SDKs. Uses first-party Wikimedia analytics with consent. Best-in-class choice for privacy-focused readers.

Best For: Privacy-conscious users seeking a tracker-free, ad-free reference experience

Key Findings

Data Security - 0 findings

Network Security - 1 finding (1 info)

Code Safety - 2 findings (1 low, 1 info)

Privacy - 3 findings (3 info)

Privacy Concerns

What Data is Collected

  • Usage data: App interactions and reading activity may be sent to Wikimedia-operated analytics servers (meta.wikimedia.org), with your consent requested during initial setup.
  • Device information: An anonymous app install identifier is shared with Wikimedia's own analytics and donation systems to correlate activity within the app.
  • Payment information: If you choose to donate, payment details are processed by Adyen.

Third-Party Data Sharing

The following third parties may receive your data:

  • Wikimedia Foundation - First-party analytics and encyclopedia services
  • hCaptcha - Bot protection verification during login and account-related actions
  • Adyen - Payment processing for optional in-app donations

Understanding the Scores

Security: 97/100
Privacy: 100/100

Security Breakdown

  • Data Security: 100/100 - Sensitive information is handled securely throughout the app.
  • Network Security: 100/100 - All connections enforce secure HTTPS with no insecure exceptions permitted anywhere in the app.
  • Code Safety: 97/100 - Strong coding practices throughout, with a developer testing panel included in the production build as a low-severity item.

Privacy Breakdown

  • Data Collection: 100/100 - Data collection is minimal and limited to first-party Wikimedia analytics, with user consent requested at onboarding.
  • Data Sharing: 100/100 - No data is shared with advertising networks or commercial tracking services.
  • User Control: 100/100 - Users are presented with a clear analytics consent choice during initial setup.

Positive Security Features

  • All network connections use secure HTTPS with no insecure exceptions anywhere in the app
  • No advertising, tracking, attribution, or commercial analytics SDKs present
  • First-party analytics only, sent to Wikimedia's own servers with user consent collected at onboarding
  • Article content display is isolated from native app capabilities, limiting the impact of content-based attacks
  • No advertising identifier or cross-app tracking framework in use

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Analytics Consent Gating Confirmation
    Confirming that all analytics data transmission is fully gated on the consent choice made during onboarding would provide additional transparency to users.

  2. Privacy Manifest
    Adding an app privacy manifest could make the App Store privacy label more complete.

Security Enhancements

  1. Developer Testing Panel
    The production binary includes a developer testing panel that exposes toggles for certain app behaviors. Removing or restricting access to these tools in production releases would align with standard software release practices.

Technical Context

App Type: Reference and encyclopedia
Classes Analyzed: 0
Third-Party Services: 13 identified
Context Tags: location, donations

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Wikimedia Foundation
Version: 8.2.0 (Build 6087)
Analysis Date: 2026-06-21
Package: org.wikimedia.wikipedia

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on IPA version 8.2.0 analyzed on 2026-06-21
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#2 (current) 98/100