MAPS: Scaling Privacy Compliance Analysis to a Million Apps

Abstract

The app economy is largely reliant on data collection as its primary revenue model. To comply with legal requirements, app developers are often obligated to notify users of their privacy practices in privacy policies. However, prior research has suggested that many developers are not accurately disclosing their apps’ privacy practices. Evaluating discrepancies between apps’ code and privacy policies enables the identification of potential compliance issues. In this study, we introduce the Mobile App Privacy System (MAPS) for conducting an extensive privacy census of Android apps. We designed a pipeline for retrieving and analyzing large app populations based on code analysis and machine learning techniques. In its first application, we conduct a privacy evaluation for a set of 1,035,853 Android apps from the Google Play Store. We find broad evidence of potential non-compliance. Many apps do not have a privacy policy to begin with. Policies that do exist are often silent on the practices performed by apps. For example, 12.1% of apps have at least one location-related potential compliance issue. We hope that our extensive analysis will motivate app stores, government regulators, and app developers to more effectively review apps for potential compliance issues.

Understanding Privacy-Related Questions on Stack Overflow

“…While there is research on making PPs understandable for end users [34,58,72], there is minimal research on helping developers craft PPs. The lack of support can be seen in the wild, where there are still numerous apps without PPs [77] as well PPs that contain misleading and contradictory statements [7]. In our data, many questions ask for help creating privacy policies.…”

How private is your period?: A systematic analysis of menstrual app privacy policies

“…Overall, our results show that menstruapps employ slightly better privacy practices than those in healthrelated apps or the general app ecosystem [12,31,53,57]. Yet, these apps still have a significant number of issues that could lead to serious consequences given the data they handle consists of information like sexual orientation, menstruation and pregnancy.…”

“…Comparatively, menstruapps perform better than average in the market. Zimmeck et al [57] studied the privacy policies of 1 million apps and found that only 50% had policies linked in the Play Store.…”

Standardizing and Implementing Do Not Sell

“…In order to achieve compliance for data transfer requests, major tech companies started the Data Transfer Project (DTP) with the goal of connecting any two participating services for the purpose of transferring data upon a user's request from one service to another [8]. Various academic work on compliance analysis seeks, among others, to identify software implementations that are contradictory to privacy laws, e.g., by identifying discrepancies between privacy practices described (or omitted) in privacy policies and actual code functionality [18,28,29,31,32].…”