Research Article
Longitudinal Compliance Analysis of Android Applications with Privacy Policies
@INPROCEEDINGS{10.1007/978-3-030-94822-1_16, author={Saad Sajid Hashmi and Nazar Waheed and Gioacchino Tangari and Muhammad Ikram and Stephen Smith}, title={Longitudinal Compliance Analysis of Android Applications with Privacy Policies}, proceedings={Mobile and Ubiquitous Systems: Computing, Networking and Services. 18th EAI International Conference, MobiQuitous 2021, Virtual Event, November 8-11, 2021, Proceedings}, proceedings_a={MOBIQUITOUS}, year={2022}, month={2}, keywords={Data privacy Mobile applications Privacy policy Static analysis Dynamic analysis}, doi={10.1007/978-3-030-94822-1_16} }- Saad Sajid Hashmi
Nazar Waheed
Gioacchino Tangari
Muhammad Ikram
Stephen Smith
Year: 2022
Longitudinal Compliance Analysis of Android Applications with Privacy Policies
MOBIQUITOUS
Springer
DOI: 10.1007/978-3-030-94822-1_16
Abstract
Contemporary mobile applications (apps) are designed to track, use, and share users’ data, often without their consent, which results in potential privacy and transparency issues. To investigate whether mobile apps have always been (non-)transparent regarding how they collect information about users, we perform a longitudinal analysis of the historical versions of 268 Android apps. These apps comprise 5,240 app releases or versions between 2008 and 2016. We detect inconsistencies between apps’ behaviors and the stated use of data collection in privacy policies to reveal compliance issues. We utilize machine learning techniques to classify the privacy policy text and identify the purported practices that collect and/or share users’ personal information, such as phone numbers and email addresses. We then uncover the data leaks of an app through static and dynamic analysis. Over time, our results show a steady increase in the number of apps’ data collection practices that are undisclosed in the privacy policies. This behavior is particularly troubling since privacy policy is the primary tool for describing the app’s privacy protection practices. We find that newer versions of the apps are likely to be more non-compliant than their preceding versions. The discrepancies between the purported and the actual data practices show that privacy policies are often incoherent with the apps’ behaviors, thus defying the ‘notice and choice’ principle when users install apps.
