Automated analysis of privacy requirements for mobile apps

24Citations
Citations of this article
185Readers
Mendeley users who have this article in their library.
Get full text

Abstract

Mobile apps have to satisfy various privacy requirements. App publishers are often obligated to provide a privacy policy and notify users of their apps' privacy practices. But how can we tell whether an app behaves as its policy promises? In this study we introduce a scalable system to help analyze and predict Android apps' compliance with privacy requirements. Our system is not only intended for regulators and privacy activists, but also meant to assist app publishers and app store owners in their internal assessments of privacy requirement compliance.Our analysis of 17,991 free apps shows the viability of combining machine learning-based privacy policy analysis with static code analysis of apps. Results suggest that 71 % of apps that lack a privacy policy should have one. Also, for 9,050 apps that have a policy, we find many instances of potential inconsistencies between what the app policy seems to state and what the code of the app appears to do. Our results suggest that as many as 41 % of these apps could be collecting location information and 17% could be sharing such with third parties without disclosing so in their policies. Overall, it appears that each app exhibits a mean of 1.83 inconsistencies.

Cite

CITATION STYLE

APA

Zimmeck, S., Wang, Z., Zou, L., Iyengar, R., Liu, B., Schaub, F., … Reidenberg, J. (2016). Automated analysis of privacy requirements for mobile apps. In AAAI Fall Symposium - Technical Report (Vol. FS-16-01-FS-16-05, pp. 286–296). AI Access Foundation. https://doi.org/10.14722/ndss.2017.23034

Register to see more suggestions

Mendeley helps you to discover research relevant for your work.

Already have an account?

Save time finding and organizing research with Mendeley

Sign up for free