Institutional Repository
Technical University of Crete
Technical University of Crete
EN
|
EL
| URI: | http://purl.tuc.gr/dl/dias/4CA2022F-6357-4358-81DE-1998F20A80C6 | ||
| Year | 2023 | ||
| Type of Item | Master Thesis | ||
| License |
|
||
| Bibliographic Citation | Ioannis Arkalakis, "Abandon all hope ye who enter here: A dynamic, longitudinal investigation of Android’s data safety section", Master Thesis, School of Electrical and Computer Engineering, Technical University of Crete, Chania, Greece, 2023 https://doi.org/10.26233/heallink.tuc.98151 | ||
| Appears in Collections |
Users’ growing concerns about online privacy have led to increased platform support for transparency and consent in the web and mobile ecosystems. To that end, Android recently mandated that developers must disclose what user data their applications collect and share, and that information is made available in Google Play’s Data Safety section. In this work, we provide the first large-scale, in-depth investigation on the veracity of the Data Safety section and its use in the Android application ecosystem. We build an automated analysis framework that dynamically exercises and analyzes applications so as to uncover discrepancies between the applications’ behaviour and the data practices that have been reported in their Data Safety section. Our study on almost 5K applications uncovers a pervasive trend of incomplete disclosure, as 81% misrepresent their data collection and sharing practices in the Data Safety section. At the same time, 79.4% of the applications with incomplete disclosures do not ask the user to provide consent for the data they collect and share, and 78.6% of those that ask for consent disregard the users’ choice. Moreover, while embedded third-party libraries are the most common offender, Data Safety discrepancies can be traced back to the application’s core code in 41% of the cases. Crucially, Google’s documentation contains various “loopholes” that facilitate incomplete disclosure of data practices. Overall, we find that in its current form, Android’s Data Safety section does not effectively achieve its goal of increasing transparency and allowing users to provide informed consent. We argue that Android’s Data Safety policies require considerable reform, and automated validation mechanisms like our framework are crucial for ensuring the correctness and completeness of applications’ Data Safety disclosures.
Copyright © DIAS 2013
