Researchers from Prague-based security software company AVAST said they were easily able to retrieve personal data from used smartphones sold online, despite consumers deleting their data.
From the used devices, AVAST was able to recover more than 40,000 personal photos, emails, text messages, and - in some cases - the identities of the sellers.
"We purchased a variety of Android devices from sellers across the US and used readily available recovery software to dig up personal information that was previously on the phones," said Jude McColgan, President of Mobile at AVAST.
"The take-away is that even deleted data on your used phone can be recovered unless you completely overwrite it," he said.
AVAST analysed 20 used smartphones whose previous owners had performed a factory reset or a 'delete all' operation on their devices.
The researchers were able to recover more than 40,000 stored photos, more than 1,500 family photos of children, more than 1,000 Google searches, over 750 emails and text messages, more than 250 contact names and email addresses, four previous owners' identities and one completed loan application.
"More than 80,000 used smartphones are for sale daily on eBay in the US. Along with their phones, consumers may not realise they are selling their memories and their identities," McColgan said.
"Images, emails, and other documents deleted from phones can be exploited for identity theft, blackmail, or for even stalking purposes.Selling your used phone is a good way to make a little extra money, but it's potentially a bad way to protect your privacy," added McColgan.