Automated Analysis of Privacy Requirements for Mobile Apps

Mobile apps have to satisfy various privacy requirements. App publishers are often obligated to provide a privacy pol-icy and notify users of their apps' privacy practices. But how can we tell whether an app behaves as its policy promises? In this study we introduce a scalable system to help analyze and predict Android apps' compliance with privacy requirements. Our system is not only intended for regulators and privacy ac-tivists, but also meant to assist app publishers and app store owners in their internal assessments of privacy requirement compliance. Our analysis of 17,991 free apps shows the viability of com-bining machine learning-based privacy policy analysis with static code analysis of apps. Results suggest that 71% of apps that lack a privacy policy should have one. Also, for 9,050 apps that have a policy, we find many instances of potential inconsistencies between what the app policy seems to state and what the code of the app appears to do. Our results sug-gest that as many as 41% of these apps could be collecting lo-cation information and 17% could be sharing such with third parties without disclosing so in their policies. Overall, it ap-pears that each app exhibits a mean of 1.83 inconsistencies.