User Interaction Data in Apps: Comparing Policy Claims to Implementations

• URL: http://arxiv.org/abs/2312.02710v1
• Date: Tue, 5 Dec 2023 12:11:11 GMT
• Title: User Interaction Data in Apps: Comparing Policy Claims to Implementations
• Abstract summary: We analyzed the top 100 apps across diverse categories using static analysis methods to evaluate the alignment between policy claims and implemented data collection techniques. Our findings highlight the lack of transparency in data collection and the associated risk of re-identification, raising concerns about user privacy and trust.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: As mobile app usage continues to rise, so does the generation of extensive user interaction data, which includes actions such as swiping, zooming, or the time spent on a screen. Apps often collect a large amount of this data and claim to anonymize it, yet concerns arise regarding the adequacy of these measures. In many cases, the so-called anonymized data still has the potential to profile and, in some instances, re-identify individual users. This situation is compounded by a lack of transparency, leading to potential breaches of user trust. Our work investigates the gap between privacy policies and actual app behavior, focusing on the collection and handling of user interaction data. We analyzed the top 100 apps across diverse categories using static analysis methods to evaluate the alignment between policy claims and implemented data collection techniques. Our findings highlight the lack of transparency in data collection and the associated risk of re-identification, raising concerns about user privacy and trust. This study emphasizes the importance of clear communication and enhanced transparency in privacy practices for mobile app development.

Related papers

• Disclosure Divergence: Measuring Privacy Policy and Data Safety Misalignment at Scale [0.0]
  We measure per-app and per-category consistency and introduce a sensitivity-weighted risk score that emphasizes high-risk data types.<n>We find that misalignment disproportionately affects sensitive categories such as personal information and device identifiers, with sharing disclosures exhibiting lower consistency than collection disclosures.<n>Our findings highlight structural gaps in current disclosure mechanisms and underscore the need for stronger verification and greater transparency in platform-level privacy reporting.
  arXiv  Detail & Related papers  (2026-07-16T00:34:01Z)
• Expecting (Targeted Ads)? Network Analysis of User Health Data Leakage in Fertility Tracking Apps [9.426024604008406]
  We conduct a network-based measurement study of a corpus of 20 Android fertility tracking apps from the Google Play Store.<n>We identify explicit leakage of user health data as well implicit leakage through highly targeted contextual advertising URL's.<n>These findings provide technical grounding for widespread user concerns, but also underscore the importance of consumer choice in the privacy implications of app-based fertility tracking.
  arXiv  Detail & Related papers  (2026-06-24T18:17:04Z)
• VitaBench 2.0: Evaluating Personalized and Proactive Agents in Long-Term User Interactions [63.13827503828231]
  We introduce VitaBench 2.0, a benchmark for evaluating personalized and proactive agent behavior in long-term user interactions.<n>Results show that real-world personalization remains highly challenging even for state-of-the-art models.
  arXiv  Detail & Related papers  (2026-05-26T15:07:38Z)
• PrivacyAssist: A User-Centric Agent Framework for Detecting Privacy Inconsistencies in Android Apps [0.9892966978799635]
  This paper presents PrivacyAssist, a multi-agent LLM-based platform that detects inconsistencies between user-granted permissions and developers' declared sensitive data collection and sharing practices.<n>We evaluate PrivacyAssist with 200 users and 2,347 Android apps, finding that only 16% of apps are fully consistent between granted permissions and declared data practices.
  arXiv  Detail & Related papers  (2026-04-25T10:58:05Z)
• Do Phone-Use Agents Respect Your Privacy? [97.81424230136075]
  We introduce MyPhoneBench, a verifiable evaluation framework for privacy behavior in mobile agents.<n>We operationalize privacy-respecting phone use as permissioned access, minimal disclosure, and user-controlled memory through a minimal privacy contract.<n>Across five frontier models on 10 mobile apps and 300 tasks, we find that task success, privacy-compliant task completion, and later-session use of saved preferences are distinct capabilities.
  arXiv  Detail & Related papers  (2026-04-01T14:50:50Z)
• An Empirical Analysis of Google Play Data Safety Disclosures: A Consistency Study of Privacy Indicators in Mobile Gaming Apps [0.40611352512781873]
  This study investigates the consistency between developer-reported Data Safety disclosures and observable privacy indicators extracted from Android Application Packages (APKs)<n>The results revealed varying levels of agreement across privacy categories.<n>These findings highlight limitations in the reliability of current marketplace transparency mechanisms.
  arXiv  Detail & Related papers  (2026-03-25T04:50:21Z)
• How to DP-fy Your Data: A Practical Guide to Generating Synthetic Data With Differential Privacy [52.00934156883483]
  Differential Privacy (DP) is a framework for reasoning about and limiting information leakage.<n>Differentially Private Synthetic data refers to synthetic data that preserves the overall trends of source data.
  arXiv  Detail & Related papers  (2025-12-02T21:14:39Z)
• A Big Step Forward? A User-Centric Examination of iOS App Privacy Report and Enhancements [11.535543802697836]
  Apple introduced a new feature since iOS 15.2, App Privacy Report, to inform users about detailed insights into apps' data access and sharing.<n>This feature has been marketed as a big step forward in user privacy, but its real-world impacts on user privacy and control remain unexamined.<n>This work provides practical insights that could help enhance user privacy transparency.
  arXiv  Detail & Related papers  (2025-11-01T09:29:04Z)
• Understanding Users' Security and Privacy Concerns and Attitudes Towards Conversational AI Platforms [3.789219860006095]
  We conduct a large-scale analysis of over 2.5M user posts from the r/ChatGPT Reddit community to understand users' security and privacy concerns. We find that users are concerned about each stage of the data lifecycle (i.e., collection, usage, and retention) We provide recommendations for users, platforms, enterprises, and policymakers to enhance transparency, improve data controls, and increase user trust and adoption.
  arXiv  Detail & Related papers  (2025-04-09T03:22:48Z)
• Investigating Vulnerabilities of GPS Trip Data to Trajectory-User Linking Attacks [49.1574468325115]
  We propose a novel attack to reconstruct user identifiers in GPS trip datasets consisting of single trips. We show that the risk of re-identification is significant even when personal identifiers have been removed. Further investigations indicate that users who frequently visit locations that are only visited by a small number of others tend to be more vulnerable to re-identification.
  arXiv  Detail & Related papers  (2025-02-12T08:54:49Z)
• Fingerprinting and Tracing Shadows: The Development and Impact of Browser Fingerprinting on Digital Privacy [55.2480439325792]
  Browser fingerprinting is a growing technique for identifying and tracking users online without traditional methods like cookies. This paper gives an overview by examining the various fingerprinting techniques and analyzes the entropy and uniqueness of the collected data.
  arXiv  Detail & Related papers  (2024-11-18T20:32:31Z)
• PrivacyLens: Evaluating Privacy Norm Awareness of Language Models in Action [54.11479432110771]
  PrivacyLens is a novel framework designed to extend privacy-sensitive seeds into expressive vignettes and further into agent trajectories. We instantiate PrivacyLens with a collection of privacy norms grounded in privacy literature and crowdsourced seeds. State-of-the-art LMs, like GPT-4 and Llama-3-70B, leak sensitive information in 25.68% and 38.69% of cases, even when prompted with privacy-enhancing instructions.
  arXiv  Detail & Related papers  (2024-08-29T17:58:38Z)
• Collection, usage and privacy of mobility data in the enterprise and public administrations [55.2480439325792]
  Security measures such as anonymization are needed to protect individuals' privacy. Within our study, we conducted expert interviews to gain insights into practices in the field. We survey privacy-enhancing methods in use, which generally do not comply with state-of-the-art standards of differential privacy.
  arXiv  Detail & Related papers  (2024-07-04T08:29:27Z)
• IDPFilter: Mitigating Interdependent Privacy Issues in Third-Party Apps [0.30693357740321775]
  Third-party apps have increased concerns about interdependent privacy (IDP) This paper provides a comprehensive investigation into the previously underinvestigated IDP issues of third-party apps. We propose IDPFilter, a platform-agnostic API that enables application providers to minimize collateral information collection.
  arXiv  Detail & Related papers  (2024-05-02T16:02:13Z)
• Transparency in App Analytics: Analyzing the Collection of User Interaction Data [0.0]
  We conducted an analysis of the top 20 analytic libraries for Android apps to identify common practices of interaction data collection. We developed a standardized collection claim template for summarizing an app's data collection practices.
  arXiv  Detail & Related papers  (2023-06-20T11:01:27Z)
• Protecting User Privacy in Online Settings via Supervised Learning [69.38374877559423]
  We design an intelligent approach to online privacy protection that leverages supervised learning. By detecting and blocking data collection that might infringe on a user's privacy, we can restore a degree of digital privacy to the user.
  arXiv  Detail & Related papers  (2023-04-06T05:20:16Z)
• Cross-Network Social User Embedding with Hybrid Differential Privacy Guarantees [81.6471440778355]
  We propose a Cross-network Social User Embedding framework, namely DP-CroSUE, to learn the comprehensive representations of users in a privacy-preserving way. In particular, for each heterogeneous social network, we first introduce a hybrid differential privacy notion to capture the variation of privacy expectations for heterogeneous data types. To further enhance user embeddings, a novel cross-network GCN embedding model is designed to transfer knowledge across networks through those aligned users.
  arXiv  Detail & Related papers  (2022-09-04T06:22:37Z)
• Trustworthy Transparency by Design [57.67333075002697]
  We propose a transparency framework for software design, incorporating research on user trust and experience. Our framework enables developing software that incorporates transparency in its design.
  arXiv  Detail & Related papers  (2021-03-19T12:34:01Z)
• Towards Mass Adoption of Contact Tracing Apps -- Learning from Users' Preferences to Improve App Design [3.187723878624947]
  We explore user preferences for contact tracing apps using market research techniques and conjoint analysis. Our results confirm the privacy-preserving design of most European contact tracing apps. We conclude that adding goal-congruent features will play an important role in fostering mass adoption.
  arXiv  Detail & Related papers  (2020-11-24T19:08:09Z)
• Privacy-accuracy trade-offs in noisy digital exposure notifications [3.04585143845864]
  There is interest in using the power of mobile phones to automate the contact-tracing process. The rough idea is simple: use Bluetooth or other data-exchange technologies to record contacts between users, enable users to report positive diagnoses, and alert users who have been exposed to sick users. Although designing practical protocols is of crucial importance, it is essential to realize that notifying users about exposure events may itself leak confidential information.
  arXiv  Detail & Related papers  (2020-11-08T15:00:38Z)
• Privacy Guidelines for Contact Tracing Applications [19.094312133714023]
  We discuss the scenarios which a contact tracing application should be able to handle. We describe the various threat actors who can disrupt its working, or misuse end user's data. We present privacy guidelines for contact tracing applications from different stakeholder's perspective.
  arXiv  Detail & Related papers  (2020-04-28T06:44:14Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.