Automated analysis of privacy requirements for mobile apps

Sebastian Zimmeck, Ziqi Wang, Lieyong Zou, Roger Iyengar, Bin Liu, Florian Schaub, Shomir Wilson, Norman Sadeh, Steven M. Bellovin, Joel Reidenberg

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Citation (Scopus)

Abstract

Mobile apps have to satisfy various privacy requirements. App publishers are often obligated to provide a privacy policy and notify users of their apps' privacy practices. But how can we tell whether an app behaves as its policy promises? In this study we introduce a scalable system to help analyze and predict Android apps' compliance with privacy requirements. Our system is not only intended for regulators and privacy activists, but also meant to assist app publishers and app store owners in their internal assessments of privacy requirement compliance.Our analysis of 17,991 free apps shows the viability of combining machine learning-based privacy policy analysis with static code analysis of apps. Results suggest that 71 % of apps that lack a privacy policy should have one. Also, for 9,050 apps that have a policy, we find many instances of potential inconsistencies between what the app policy seems to state and what the code of the app appears to do. Our results suggest that as many as 41 % of these apps could be collecting location information and 17% could be sharing such with third parties without disclosing so in their policies. Overall, it appears that each app exhibits a mean of 1.83 inconsistencies.

Original languageEnglish (US)
Title of host publicationFS-16-01
Subtitle of host publicationArtificial Intelligence for Human-Robot Interaction; FS-16-02: Cognitive Assistance in Government and Public Sector Applications; FS-16-03: Cross-Disciplinary Challenges for Autonomous Systems; FS-16-04: Privacy and Language Technologies; FS-16-05: Shared Autonomy in Research and Practice
PublisherAI Access Foundation
Pages286-296
Number of pages11
ISBN (Electronic)9781577357759
StatePublished - Jan 1 2016
Event2016 AAAI Fall Symposium - Arlington, United States
Duration: Nov 17 2016Nov 19 2016

Publication series

NameAAAI Fall Symposium - Technical Report
VolumeFS-16-01 - FS-16-05

Conference

Conference2016 AAAI Fall Symposium
CountryUnited States
CityArlington
Period11/17/1611/19/16

Fingerprint

Application programs
Learning systems

All Science Journal Classification (ASJC) codes

  • Engineering(all)

Cite this

Zimmeck, S., Wang, Z., Zou, L., Iyengar, R., Liu, B., Schaub, F., ... Reidenberg, J. (2016). Automated analysis of privacy requirements for mobile apps. In FS-16-01: Artificial Intelligence for Human-Robot Interaction; FS-16-02: Cognitive Assistance in Government and Public Sector Applications; FS-16-03: Cross-Disciplinary Challenges for Autonomous Systems; FS-16-04: Privacy and Language Technologies; FS-16-05: Shared Autonomy in Research and Practice (pp. 286-296). (AAAI Fall Symposium - Technical Report; Vol. FS-16-01 - FS-16-05). AI Access Foundation.
Zimmeck, Sebastian ; Wang, Ziqi ; Zou, Lieyong ; Iyengar, Roger ; Liu, Bin ; Schaub, Florian ; Wilson, Shomir ; Sadeh, Norman ; Bellovin, Steven M. ; Reidenberg, Joel. / Automated analysis of privacy requirements for mobile apps. FS-16-01: Artificial Intelligence for Human-Robot Interaction; FS-16-02: Cognitive Assistance in Government and Public Sector Applications; FS-16-03: Cross-Disciplinary Challenges for Autonomous Systems; FS-16-04: Privacy and Language Technologies; FS-16-05: Shared Autonomy in Research and Practice. AI Access Foundation, 2016. pp. 286-296 (AAAI Fall Symposium - Technical Report).
@inproceedings{4ed28aec243246d58816f927860adf99,
title = "Automated analysis of privacy requirements for mobile apps",
abstract = "Mobile apps have to satisfy various privacy requirements. App publishers are often obligated to provide a privacy policy and notify users of their apps' privacy practices. But how can we tell whether an app behaves as its policy promises? In this study we introduce a scalable system to help analyze and predict Android apps' compliance with privacy requirements. Our system is not only intended for regulators and privacy activists, but also meant to assist app publishers and app store owners in their internal assessments of privacy requirement compliance.Our analysis of 17,991 free apps shows the viability of combining machine learning-based privacy policy analysis with static code analysis of apps. Results suggest that 71 {\%} of apps that lack a privacy policy should have one. Also, for 9,050 apps that have a policy, we find many instances of potential inconsistencies between what the app policy seems to state and what the code of the app appears to do. Our results suggest that as many as 41 {\%} of these apps could be collecting location information and 17{\%} could be sharing such with third parties without disclosing so in their policies. Overall, it appears that each app exhibits a mean of 1.83 inconsistencies.",
author = "Sebastian Zimmeck and Ziqi Wang and Lieyong Zou and Roger Iyengar and Bin Liu and Florian Schaub and Shomir Wilson and Norman Sadeh and Bellovin, {Steven M.} and Joel Reidenberg",
year = "2016",
month = "1",
day = "1",
language = "English (US)",
series = "AAAI Fall Symposium - Technical Report",
publisher = "AI Access Foundation",
pages = "286--296",
booktitle = "FS-16-01",
address = "United States",

}

Zimmeck, S, Wang, Z, Zou, L, Iyengar, R, Liu, B, Schaub, F, Wilson, S, Sadeh, N, Bellovin, SM & Reidenberg, J 2016, Automated analysis of privacy requirements for mobile apps. in FS-16-01: Artificial Intelligence for Human-Robot Interaction; FS-16-02: Cognitive Assistance in Government and Public Sector Applications; FS-16-03: Cross-Disciplinary Challenges for Autonomous Systems; FS-16-04: Privacy and Language Technologies; FS-16-05: Shared Autonomy in Research and Practice. AAAI Fall Symposium - Technical Report, vol. FS-16-01 - FS-16-05, AI Access Foundation, pp. 286-296, 2016 AAAI Fall Symposium, Arlington, United States, 11/17/16.

Automated analysis of privacy requirements for mobile apps. / Zimmeck, Sebastian; Wang, Ziqi; Zou, Lieyong; Iyengar, Roger; Liu, Bin; Schaub, Florian; Wilson, Shomir; Sadeh, Norman; Bellovin, Steven M.; Reidenberg, Joel.

FS-16-01: Artificial Intelligence for Human-Robot Interaction; FS-16-02: Cognitive Assistance in Government and Public Sector Applications; FS-16-03: Cross-Disciplinary Challenges for Autonomous Systems; FS-16-04: Privacy and Language Technologies; FS-16-05: Shared Autonomy in Research and Practice. AI Access Foundation, 2016. p. 286-296 (AAAI Fall Symposium - Technical Report; Vol. FS-16-01 - FS-16-05).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - Automated analysis of privacy requirements for mobile apps

AU - Zimmeck, Sebastian

AU - Wang, Ziqi

AU - Zou, Lieyong

AU - Iyengar, Roger

AU - Liu, Bin

AU - Schaub, Florian

AU - Wilson, Shomir

AU - Sadeh, Norman

AU - Bellovin, Steven M.

AU - Reidenberg, Joel

PY - 2016/1/1

Y1 - 2016/1/1

N2 - Mobile apps have to satisfy various privacy requirements. App publishers are often obligated to provide a privacy policy and notify users of their apps' privacy practices. But how can we tell whether an app behaves as its policy promises? In this study we introduce a scalable system to help analyze and predict Android apps' compliance with privacy requirements. Our system is not only intended for regulators and privacy activists, but also meant to assist app publishers and app store owners in their internal assessments of privacy requirement compliance.Our analysis of 17,991 free apps shows the viability of combining machine learning-based privacy policy analysis with static code analysis of apps. Results suggest that 71 % of apps that lack a privacy policy should have one. Also, for 9,050 apps that have a policy, we find many instances of potential inconsistencies between what the app policy seems to state and what the code of the app appears to do. Our results suggest that as many as 41 % of these apps could be collecting location information and 17% could be sharing such with third parties without disclosing so in their policies. Overall, it appears that each app exhibits a mean of 1.83 inconsistencies.

AB - Mobile apps have to satisfy various privacy requirements. App publishers are often obligated to provide a privacy policy and notify users of their apps' privacy practices. But how can we tell whether an app behaves as its policy promises? In this study we introduce a scalable system to help analyze and predict Android apps' compliance with privacy requirements. Our system is not only intended for regulators and privacy activists, but also meant to assist app publishers and app store owners in their internal assessments of privacy requirement compliance.Our analysis of 17,991 free apps shows the viability of combining machine learning-based privacy policy analysis with static code analysis of apps. Results suggest that 71 % of apps that lack a privacy policy should have one. Also, for 9,050 apps that have a policy, we find many instances of potential inconsistencies between what the app policy seems to state and what the code of the app appears to do. Our results suggest that as many as 41 % of these apps could be collecting location information and 17% could be sharing such with third parties without disclosing so in their policies. Overall, it appears that each app exhibits a mean of 1.83 inconsistencies.

UR - http://www.scopus.com/inward/record.url?scp=85025824519&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85025824519&partnerID=8YFLogxK

M3 - Conference contribution

AN - SCOPUS:85025824519

T3 - AAAI Fall Symposium - Technical Report

SP - 286

EP - 296

BT - FS-16-01

PB - AI Access Foundation

ER -

Zimmeck S, Wang Z, Zou L, Iyengar R, Liu B, Schaub F et al. Automated analysis of privacy requirements for mobile apps. In FS-16-01: Artificial Intelligence for Human-Robot Interaction; FS-16-02: Cognitive Assistance in Government and Public Sector Applications; FS-16-03: Cross-Disciplinary Challenges for Autonomous Systems; FS-16-04: Privacy and Language Technologies; FS-16-05: Shared Autonomy in Research and Practice. AI Access Foundation. 2016. p. 286-296. (AAAI Fall Symposium - Technical Report).