Few devices know more personal details about people than the smartphones in their pockets: phone numbers, current location, often the owner’s real name—even a unique ID number that can never be changed or turned off and the Wall Street Journal dove in and found out just how many secrets they know and what they’re doing with it.

The Journal‘s report exposes much of what we already suspected, or outright knew but didn’t bother thinking about: iOS and Android apps are having a field day with your personal info. More than half of the 101 popular apps they tested sent your UDID to companies without your awareness or consent. Nearly as many sent your location, and a handful even sent along demographic info and other personal details to advertisers.

It’s a small sample size given the hundreds of thousands of apps out there, but it’s hard to imagine that the most prominent names just happen to be the most aberrant. And the list of worst offenders also reads like a roll-call of must haves: Pandora. Angry Birds. Netflix. Shazam. Yelp.

And yes, it makes perfect sense that apps that deliver location-based information would need to know your location. But the extra step of passing that on to marketers is something a user should at the very least have knowledge of, and should ideally be able to opt out of. Not everyone enjoys highly targeted ads so much that they’re willing to compromise their privacy to have them on their phone. The makers of TextPlus 4, Pandora and Grindr say the data they pass on to outside firms isn’t linked to an individual’s name. Personal details such as age and gender are volunteered by users, they say. The maker of Pumpkin Maker says he didn’t know Apple required apps to seek user approval before transmitting location.

iOS apps shared more data than Android apps, on the whole—somewhat surprising given the rigidity of the App Store approval process compared to Android’s looser environment. And there’s really nothing you can do to stop it.

There’s something Apple and Google could do, though: create privacy policies. Make it abundantly clear to users what information apps are going to take, who they’re going to send it to. And if you’re feeling really generous this holiday season, give us a chance to opt out.

For the full chart—and to get educated about who’s spreading your info—head over to the Journal‘s damning interactive graphic.