Charting App Developers’ Journey Through Privacy Regulation Features in Ad Networks

Abstract

Mobile apps enable ad networks to collect and track users. App developers are given “configurations” on these platforms to limit data collection and adhere to privacy regulations; however, the prevalence of apps that violate privacy regulations because of third parties, including ad networks, begs the question of how developers work through these configurations and how easy they are to utilize. We study privacy regulations-related interfaces on three widely used ad networks using two empirical studies, a systematic review and think-aloud sessions with eleven developers, to shed light on how ad networks present privacy regulations and how usable the provided configurations are for developers. We find that information about privacy regulations is scattered in several pages, buried under multiple layers, and uses terms and language developers do not understand. While ad networks put the burden of complying with the regulations on developers, our participants, on the other hand, see ad networks responsible for ensuring compliance with regulations. To assist developers in building privacy regulations-compliant apps, we suggest dedicating a section to privacy, offering easily accessible configurations (both in graphical and code level), building testing systems for privacy regulations, and creating multimedia materials such as videos to promote privacy values in the ad networks’ documentation.

Developers Say the Darnedest Things: Privacy Compliance Processes Followed by Developers of Child-Directed Apps

“…SDK providers should coordinate with app stores to enable providing timely and up-todate advice to developers on how to exclude data collected from child users from being used for prohibited activities. This would relieve developers from having to search SDK documentation for compliance advice, which was shown to be challenging [68]. Since developers were found to keep using default settings of thirdparty SDKs [55], modifying these settings to be privacypreserving (e.g., serving only contextual ads) would also help reduce the burden of compliance.…”

Embedding Privacy Into Design Through Software Developers: Challenges and Solutions

“…In terms of privacy, it means that the privacy implementation decisions of one developer can directly impact the privacy behavior of all software that uses that component, often in hardto-detect ways. A typical example is advertising libraries that may collect private data, such as location, without the developer's knowledge [8]. A less obvious example is error logs where a thirdparty library may collect crash reports containing personal information [9].…”

“…Even when a developer wants to preserve their users' privacy, the software ecosystem's complexity and the stakeholders' differing goals can make it challenging [8], [11]. Returning to the example of an advertising library, many such libraries offer developers the ability to limit data collection, but finding the settings may involve going through multiple layers of settings or looking up what sample code function parameters actually do [12], [8].…”

“…Even when a developer wants to preserve their users' privacy, the software ecosystem's complexity and the stakeholders' differing goals can make it challenging [8], [11]. Returning to the example of an advertising library, many such libraries offer developers the ability to limit data collection, but finding the settings may involve going through multiple layers of settings or looking up what sample code function parameters actually do [12], [8]. Given the challenges, it is unsurprising that some developers opt to use more straightforward approaches such as feeding libraries random numbers instead of potentially sensitive data or finding ways to avoid using software from larger companies perceived as privacy-unfriendly [5], [13].…”

“…In a survey with 400 participants with mobile app development experience, we evaluated the impact of design in privacy-related interfaces on developers' choices and the possibility of nudging them to make a privacy-friendly decision [11]. We further assessed developers' understanding and ability to find privacy-related interfaces on mobile advertising networks by running 11 think-aloud sessions with developers, two usability experts, and several in-depth sessions with a senior developer, which gave us a chance to extensively analyze the usability of privacy interfaces directed at developers [8], [12], [14].…”