Decision Support for Mobile App Selection via Automated Privacy Assessment

Abstract

Mobile apps have entered many areas of our everyday life through smartphones, smart TVs, smart cars, and smart homes. They facilitate daily routines and provide entertainment, while requiring access to sensitive data such as private end user data, e.g., contacts or photo gallery, and various persistent device identifiers, e.g., IMEI. Unfortunately, most mobile users neither pay attention nor fully understand privacy indicating factors that could expose malicious apps. We introduce APPA (Automated aPp Privacy Assessment), a technical tool to assist mobile users making privacy-enhanced app installation decisions. Given a set of empirically validated and publicly available factors which app users typically consider at install-time, APPA creates an output in form of a personalized privacy score. The score indicates the level of privacy safety of the given app integrating three different privacy perspectives. First, an analysis of app permissions determines the degree of privateness preservation after an installation. Second, user reviews are assessed to inform about the privacy-to-functionality trade-off by comparing the sentiment of privacy and functionality related reviews. Third, app privacy policies are analyzed with respect to their legal compliance with the European General Data Protection Regulation (GDPR). While the permissions based score introduces capabilities to filter over-privileged apps, privacy and functionality related reviews are classified with an average accuracy of 79%. As proof of concept, the APPA framework demonstrates the feasibility of user-centric tools to enhance transparency and informed consent as early as during the app selection phase.

Privacy Assessment in Android Apps: A Systematic Mapping Study

“…At the basic level, Zimmeck et al checked whether a privacy policy was available (ID323), showing that as much as 48% of applications in Google Play do not even provide a policy link. Assuming a privacy policy is available, others apply natural language processing (NLP) and other machine learning techniques to the app policy to address specific data protection principles, for example, assessing whether the policy is easy to read and understand (ID365). The completeness of the privacy policy has been evaluated too (ID323), that is, whether it includes some important information such as changes over previous versions and where to find them, the data subjects' rights, the data collection practices, and the information about with whom and how personal data is shared.…”