“Developers Are Responsible”: What Ad Networks Tell Developers About Privacy

Abstract

Advertising networks enable developers to create revenue, but using them potentially impacts user privacy and requires developers to make legal decisions. To understand what privacy information ad networks give developers, we did a walkthrough of four popular ad network guidance pages with a senior Android developer by looking at the privacy-related information presented to developers. We found that information is focused on complying with legal regulations, and puts the responsibility for such decisions on the developer. Also, sample code and settings often have privacyunfriendly defaults laced with dark patterns to nudge developers' decisions towards privacy-unfriendly options such as sharing sensitive data to increase revenue. We conclude by discussing future research around empowering developers and minimising the negative impacts of dark patterns. CCS CONCEPTS• Security and privacy → Human and societal aspects of security and privacy; • Software and its engineering → Software creation and management; • Information systems → Online advertising.

Understanding Privacy-Related Advice on Stack Overflow

“…Future research may look at analytics' privacy interfaces to understand how they present privacy information to developers and, more broadly, how privacy controls can and should be presented to developers to assist them in making informed decisions for their apps and users' privacy. Recent research shows that ad networks' privacy interfaces may include dark patterns to nudge developers into making privacy-unfriendly decisions [58,61]. Future research may look at similar patterns in other software development platforms such as analytics services.…”

Charting App Developers’ Journey Through Privacy Regulation Features in Ad Networks

“…Besides, there are "configurations" given to developers both as graphical and code-level configurations to limit the data collection by ad networks and to comply with privacy regulations [74]. However, it is yet not clear how usable are these configurations.…”

“…Ad networks, as a software development platform, use privacy-unfriendly defaults [74] and developers often stick with the defaults [52] which in turn would result in ad networks collecting more data from users. For example, a sample code that asks for user consent would appear continuously on the user side asking for consent, and it stops appearing only when the user consents to ads personalization [74]. Developer-facing privacy interfaces on ad networks also contain dark patterns that may nudge developers into making privacy-unfriendly decisions [74].…”

“…When looking at the ad networks' interfaces with privacy configurations, they may contain dark patterns (i.e., "tricks used in websites and apps that make you [users] do things that you [they] didn't mean to" [13]) making it challenging for developers to discover the configurations, understand what they do, and implement them [74]. The defaults are also often not in favor of users and are set to maximize data collection [52,74]. Developers may as well leave the defaults as they are, which in turn means building privacyunfriendly apps for users [52].…”

“…Developers may as well leave the defaults as they are, which in turn means building privacyunfriendly apps for users [52]. Examples include defaults that are set to show personalized ads and not limit data processing [74]. The inconsistencies in the privacy configurations may also result in violating privacy regulations.…”