None declared
Mostly a question of trust: Duo Mobile collects data linked to you but declares no tracking. The sensitive items are location. In total the label lists 4 data types; 36% of authenticator apps we checked declare tracking.
Duo Mobile privacy in one look
- 1Collects nothing
- 2Not linked
- 3Linked
- 4Tracks you
Built only from the developer's App Store label. It describes disclosure, not tested behaviour.
Duo Mobile collects 4 data types tied to your identity but declares no tracking.
Did Duo Mobile ask for something?
Pick the permission prompt you saw. We compare it with what Duo Mobile's developer declared.
Duo Mobile lists Location on its label, linked to you. Choose While Using and turn off Precise Location if the feature works without it.
User Content is not on Duo Mobile's label. That can be fine: data used only on your iPhone does not have to be declared. If the data would need to leave the phone for the feature to work, ask why it is missing.
Contacts is not on Duo Mobile's label. That can be fine: data used only on your iPhone does not have to be declared. If the data would need to leave the phone for the feature to work, ask why it is missing.
Duo Mobile declares no tracking, so a tracking prompt would contradict its label. Decline it, and consider reporting the mismatch to Apple.
Health & Fitness is not on Duo Mobile's label. That can be fine: data used only on your iPhone does not have to be declared. If the data would need to leave the phone for the feature to work, ask why it is missing.
A permission is what the app can reach on your iPhone; the label is what the developer says leaves it. They answer different questions.
What Duo Mobile collects, explained
| Data type | What it covers | Where to limit it |
|---|---|---|
| LocationSensitiveLinked to you | Where your phone is, either precisely (street level) or approximately (city or area). | Settings › Privacy & Security › Location Services: choose Never or While Using, and turn off Precise Location if the app does not need it. |
| IdentifiersLinked to youNot linked to you | An account ID, screen name, customer number or a device-level ID such as the advertising identifier. | Settings › Privacy & Security › Tracking: turn off Allow Apps to Request to Track, or tap Ask App Not to Track when prompted. |
| Usage DataLinked to you | What you tap, open and view inside the app, plus which ads you have seen. | There is no single iOS switch. Look for an analytics or personalised-ads toggle in the app's own settings. |
| DiagnosticsLinked to you | Crash logs, launch times, hang rates and energy use. | Settings › Privacy & Security › Analytics & Improvements › Share With App Developers controls what Apple passes on; the app's own crash reporting is separate. |
What Duo Mobile's label means for you
Duo Mobile's label has 4 types under “Data Linked to You”, 1 type under “Data Not Linked to You”. A data type can appear in more than one section when it is used for different purposes — for example, identifiers used for both analytics and advertising.
Duo Mobile declares no tracking, which means the developer says it does not combine your data with other companies' data for advertising or sell it to data brokers. The data linked to you — location, identifiers, usage data and diagnostics — is still tied to your identity, typically through an account, and is covered by the developer's privacy policy and retention rules.
The items that deserve the most attention are location. Location history reveals home, work and routines. Precise location deserves the most scrutiny.
Authenticator apps generate the second factor for your logins. The biggest practical risk is not data collection but losing your codes when you lose your phone. Turn on encrypted backup or export your accounts, and save the recovery codes each service gave you.
Among the 173 authenticator apps in our snapshot with a label, 36% declare tracking, 45% collect data linked to you and 40% say they collect nothing. Duo Mobile lists 4 data types, more than the average of 1.8 for this group.
Business apps often handle other people's data — clients, colleagues and customers — so what they collect can affect more than you.
Settings to check for Duo Mobile
- 1
Tracking
Settings › Privacy & Security › Tracking. If “Allow Apps to Request to Track” is off, apps cannot ask, and they are told to treat you as having declined. You can also turn it off for this app alone.
- 2
Location
Settings › Privacy & Security › Location Services › Duo Mobile. Choose While Using or Never, and switch off Precise Location if a city-level answer is enough.
- 3
Lock the app
On iOS 18 and later, touch and hold the icon and choose Require Face ID. Anyone who picks up your unlocked phone then needs your face, fingerprint or passcode to open it.
- 4
Notifications
Settings › Notifications › Duo Mobile › Show Previews: When Unlocked keeps message and account details off the Lock Screen.
Does Duo Mobile track you?
There is no “Data Used to Track You” section on Duo Mobile's label.
Lock Duo Mobile behind Face ID
- Find Duo Mobile on your Home Screen or in App Library.
- Touch and hold the icon until the quick-actions menu opens.
- Tap Require Face ID (or Require Touch ID / Require Passcode, depending on your iPhone).
- Tap Require Face ID again to confirm. Duo Mobile now asks for authentication every time it opens.
The lock is an iPhone feature, so it works whether or not Duo Mobile has a passcode of its own. It does not change what the app sends to its developer.
About Duo Mobile
| Developer | Duo Security LLC |
| App Store category | Business (also Utilities) |
| Latest version | 4.124.0, released October 2026 |
| First released | March 2011 |
| Requires | iOS 17.0 or later |
| Size | 49 MB |
| Age rating | 4+ |
| Languages | 23 (CA, CS, DA, NL, EN, FI, FR, DE…) |
| Bundle ID | com.duosecurity.DuoMobile |
The current version shipped in October 2026, so the app is actively maintained and its label is likely current. Labels are updated by developers when practices change.
What the label cannot tell you
- A label is self-reported. Apple publishes the developer's answers and can reject apps that misrepresent them, but it does not independently verify what Duo Mobile sends.
- It does not say where data is stored, how long it is kept, whether it is encrypted, or which companies receive it. The privacy policy covers those points.
- Optional data counts: if a feature lets you add something (a profile photo, a phone number), the type is listed even if you never use the feature.
- Data handled only on your iPhone is not 'collected', so a no-collection label is compatible with an app that reads your files locally.
- Third-party sign-in, payment processors and SDKs are supposed to be included, but a label can lag behind a new version.
The question to ask Duo Mobile's developer: If this iPhone is lost, how do I restore my codes?
Duo Mobile vs similar authenticator apps
- Google Authenticator
- Authenticator
- Microsoft Authenticator
- Duo Mobile (this app)
- Authenticator App
- Authenticator ℠ App
- IDMe Authenticator
- 2FA Authenticator
Fewer types is not automatically safer: a cloud backup app has to collect your files to work. Compare like with like.
Look up any of our apps in seconds, or put two labels side by side.
Apps similar to Duo Mobile
All authenticator apps → Who tracks you? A–Z → Apps that collect location → Privacy label decoder →
Your Duo Mobile privacy checklist
Done. You have applied every control the label points to.
True or false?
- Right.Not quite.
False: there is no Data Used to Track You section on Duo Mobile's label.
- Right.Not quite.
Labels are self-reported by developers. Apple can reject or remove apps that misrepresent practices, but it does not audit each label.
- Right.Not quite.
True: Location appears on its label.
- Right.Not quite.
It is collected and sent; the developer says it is de-identified rather than tied to your account or device.
- Right.Not quite.
Apple's rules require apps to work the same whether or not you allow tracking.