How Usable Are iOS App Privacy Labels?

Abstract

Standardized privacy labels that succinctly summarize those data practices that people are most commonly concerned about offer the promise of providing users with more effective privacy notices than full-length privacy policies. With their introduction by Apple in iOS 14 and Google’s recent adoption in its Play Store, mobile app privacy labels are for the first time available at scale to users. We report the first indepth interview study with 24 lay iPhone users to investigate their experiences, understanding, and perceptions of Apple’s privacy labels. We uncovered misunderstandings of and dissatisfaction with the iOS privacy labels that hinder their effectiveness, including confusing structure, unfamiliar terms, and disconnection from permission settings and controls. We identify areas where app privacy labels might be improved and propose suggestions to address shortcomings to make them more understandable, usable, and useful.

Website Data Transparency in the Browser

“…"Nutrition labels" for privacy have been discussed [45], particularly, in the IoT space [15,63] and are used on app stores. Apple's privacy labels were found to be useful, though, prone to misconceptions [80] and sometimes inaccurate and misleading [48]. Some apps were shown to violate their label by transmitting data without declaring so [47].…”

The death of privacy policies: How app stores shape GDPR compliance of apps

“…While both categories refer to the transfer of data from the user's device, the difference lies in the transfer to a third-party. Furthermore, previous research pointed out that this categorisation in different data types confused consumers and developers alike (Gardner et al, 2022;Zhang et al, 2022). It is therefore questionable if the design of both labels would meet the general standard of being intelligible (GDPR, Art.…”

“…Additionally, the labels have been analysed from a qualitative perspective to gain insight into how users perceive the new information provision. Recent studies showed that Apple's categorisation of data, such as the difference between "Data used to track you" and "Data linked to you" and certain data subcategories confused users (Zhang et al, 2022) and developers (Gardner et al, 2022). As a consequence, the findings suggest that the general objective of privacy labels, namely, to inform users effectively about data processing practices, is undermined by the several design decisions by the app stores.…”

The Overview of Privacy Labels and their Compatibility with Privacy Policies

“…Researchers have studied the usability of APLs from both users' [50] and developers' [31] perspectives. Zhang et al [50] studied 24 iPhone users to understand their experiences, understanding, and perceptions of privacy labels on the app store. They uncovered that users find the labels confusing with unfamiliar terms.…”

“…Researchers have shown the benefit of privacy labels for users, making privacy practices more accessible [50]. However, prior work has also shown that inaccurate labels can exist due to the developer's knowledge gaps or resource limitations [31].…”