PPChecker: Towards Accessing the Trustworthiness of Android Apps’ Privacy Policies

Abstract

Recent years have witnessed a sharp increase of malicious apps that steal users' personal information. To address users' concerns about privacy risks and to comply with data protection laws, more and more apps are supplied with privacy policies written in natural language to help users understand an app's privacy practices. However, little is known whether these privacy policies are trustworthy or not. Questionable privacy policies may be prepared by careless app developers or someone with malicious intention. In this paper, we carry out a systematic study on privacy policy by proposing a novel approach to automatically identify five kinds of problems in privacy policy. After tackling several challenging issues, we implement the approach in a system, named PPChecker, and evaluate it with real apps and their privacy policies. The experimental results show that PPChecker can effectively identify questionable privacy policies with high precision. Applying PPChecker to 2,500 popular apps, we find that 1,850 apps (i.e., 74.0%) have at least one kind of problems. This study sheds light on the research of improving and regulating apps' privacy policies.

Understanding Online Privacy—A Systematic Review of Privacy Visualizations and Privacy by Design Guidelines

“…We excluded mobile-and IoT-specific papers from our survey, because the domains are subject to different privacy concerns, and constrained in terms of privacy communication. Mobile apps are among the most privacy intrusive means of interacting with an online service [12] and privacy policies are almost always incorrect, incomplete, imprecise, inconsistent and/or privacy-unfriendly [160]. Even health apps are often not GDPR compliant [58].…”

Mobile app privacy in software engineering research: A systematic mapping study

“…Yu et al [22] presented PPCkecker, a tool for assessing the trustworthiness of Android apps' privacy policies.…”

Common Privacy Weaknesses and Vulnerabilities in Software Applications

“…The privacy threats that address the same concerns are grouped into the same subcategory. We classify privacy compliance into the following three subcategories Omoronyia et al, 2012;De and Metayer, 2016;Yu et al, 2021;Mihaylov et al, 2016;The OWASP Foundation, 2015). There are 16 individual rights identified in our study (see Table 1).…”