Why would it be illegal to look at code on your own device and see what kind of personal data your device sends to companies?

I was thinking along the lines of something like this: https://en.wikipedia.org/wiki/Anti-circumvention

If the app uses DRM (e.g. Netflix), I would imagine that some of these laws could apply depending on the country, right?

No, in most countries it's not illegal. It may be a violation of the Terms of Service or other contracts, but that doesn't apply if you didn't have to sign it to get the APK.

> Proxying all API requests through your servers might work, but only with low-volume and if the service doesn't have rate limits per IP.

No paid api (intended to be used by a server instead of an end-user) has rate limits per ip. If it's a free api you are either using it in a way they did not intend, or the api secret is generally not truly secret (granting you special privileges) just a way to identify developers.

As for low-volume, obviously you should have servers to handle the traffic from your app. If you aren't low-volume I'm sure you can afford more servers.

> Ignoring the results here, isn't the act of disassembling random Android APKs illegal? Theoretically, could one of the affected companies sue them?

It doesn't feel like you're curious for your own sake. Why are you asking?

Also, anything is illegal somewhere. Where do you want the answer to apply to?

There's no hidden motive here. It's interesting work, but usually this type of research is done on malware samples and the like, and not "regular" apps. That's why I'm curious if the authors should fear legal ramifications, and if so why (or why not).

I'm mainly interested in answers for the US, Germany/EU, and Switzerland.