An Empirical Evaluation of GDPR Compliance Violations in Android mHealth Apps

Abstract

The purpose of the General Data Protection Regulation (GDPR) is to provide improved privacy protection. If an app controls personal data from users, it needs to be compliant with GDPR. However, GDPR lists general rules rather than exact step-by-step guidelines about how to develop an app that fulfills the requirements. Therefore, there may exist GDPR compliance violations in existing apps, which would pose severe privacy threats to app users. In this paper, we take mobile health applications (mHealth apps) as a peephole to examine the status quo of GDPR compliance in Android apps. We first propose an automated system, named HPDROID, to bridge the semantic gap between the general rules of GDPR and the app implementations by identifying the data practices declared in the app privacy policy and the data relevant behaviors in the app code. Then, based on HPDROID, we detect three kinds of GDPR compliance violations, including the incompleteness of privacy policy, the inconsistency of data collections, and the insecurity of data transmission. We perform an empirical evaluation of 796 mHealth apps. The results reveal that 189 (23.7%) of them do not provide complete privacy policies. Moreover, 59 apps collect sensitive data through different measures, but 46 (77.9%) of them contain at least one inconsistent collection behavior. Even worse, among the 59 apps, only 8 apps try to ensure the transmission security of collected data. However, all of them contain at least one encryption or SSL misuse. Our work exposes severe privacy issues to raise awareness of privacy protection for app users and developers.

GDPR Compliance Assessment for Cross-Border Personal Data Transfers in Android Apps

“…While our work focuses on different GDPR requirements, the Jia's work could be seen as complementary to our work as the detection method could minimize the false-negative rate. Fan et al [43] relied on static analysis and privacy policy analysis to carry out an empirical assessment of GDPR compliance in Android MHealth Apps, focusing on transparency, data minimization and confidentiality requirements. In transparency, they checked whether six different practices are informed through privacy policies, but cross-border transfer practices are not covered.…”

“…Focusing on GDPR, Fan et al [14] empirically assessed transparency, data minimization, and confidentiality requirements in Android mHealth apps, checking whether six different practices are informed through privacy policies. Mangset [15] also checked GDPR requirements related to transparency, data minimization (collection practices), confidentiality (data at rest in transit), and some user rights (particularly, consent and objection automatically individual decision-making).…”

“…Domains not classified as firstparty recipients were searched in webXray 13 ; if found, they were classified as third-party recipients. This dataset 14 has been created in the specific context of disclosing personal data to third parties in the web and mobile ecosystem. It maps individual target domains to the owner company and even to parent companies, including the country in which the headquarters are located and service category.…”

“…Domains not classified as a firstor third-party recipient were classified as unknown and excluded from further analysis. 13 https://webxray.org/ 14 As a further contribution of this study, we added 234 new domains to the dataset maintained by a research community, available at https://github.com/PrivApp/webXray_Domain_Owner_List .…”

Demystifying Application Performance Management Libraries for Android

“…On the one hand, the data collected can be leveraged to improve the app, but on the other hand, it can result in privacy leakages. For example, obtaining preferences from users may violate privacy protection rules, such as GDPR [77], [78].…”