On The Ridiculousness of Notice and Consent: Contradictions in App Privacy Policies

TitleOn The Ridiculousness of Notice and Consent: Contradictions in App Privacy Policies
Publication TypeConference Paper
Year of PublicationIn Press
AuthorsOkoyomon, E., Samarin N., Wijesekera P., Bar On A. Elazari, Vallina-Rodriguez N., Feal Á., & Egelman S.
Published inProceedings of the Workshop on Technology and Consumer Protection (ConPro ’19)
Abstract

The dominant privacy framework of the information age relies on notions of “notice and consent.” That is, service providers will disclose, often through privacy policies, their data collection practices, and users can then consent to their terms. However, it is unlikely that most users comprehend these disclosures, which is due in no small part to ambiguous, deceptive, and misleading statements. By comparing actual collection and sharing practices to disclosures in privacy policies, we demonstrate the scope of the problem. Through analysis of 68,051 apps from the Google Play Store, their corresponding privacy policies, and observed data transmissions, we investigated the potential misrepresentations of apps in the Designed For Families (DFF) program, inconsistencies in disclosures regarding third-party data sharing, as well as contradictory disclosures about secure data transmissions. We find that of the 8,030 DFF apps (i.e., apps directed at children), 9.1% claim that their apps are not directed at children, while 30.6% claim to have no knowledge that the received data comes from children. In addition, we observe that 10.5% of 68,051 apps share personal identifiers with third-party service providers, yet do not declare any in their privacy policies, and only 22.2% of the apps explicitly name third parties. This ultimately makes it not only difficult, but in most cases impossible, for users to establish where their personal data is being processed. Furthermore, we find that 9,424 apps do not use TLS when transmitting personal identifiers, yet 28.4% of these apps claim to take measures to secure data transfer. Ultimately, these divergences between disclosures and actual app behaviors illustrate the ridiculousness of the notice and consent framework.

Acknowledgment

This work was supported by the U.S. National Security Agency’s Science of Security program (contract H98230- 18-D-0006), the Department of Homeland Security (contract FA8750-18-2-0096), the National Science Foundation (grants CNS-1817248 and CNS-1564329), the European Union’s Horizon 2020 Innovation Action program (grant Agreement No. 786741, SMOOTH Project), the Rose Foundation, the Data Transparency Lab, and the Center for Long-Term Cybersecurity at U.C. Berkeley

URLhttp://eprints.networks.imdea.org/1967/1/On_The_Ridiculousness_of_Notice_and_Consent_2019_EN.pdf
ICSI Research Group

Usable Security and Privacy