🤖 AI Summary
This study addresses the reliability of Google Play’s Data Safety disclosures, which rely on self-reports from developers and lack empirical validation against apps’ actual privacy practices. Focusing on mobile games, the authors conduct the first fine-grained empirical analysis by statically examining 41 APKs to extract privacy-relevant behaviors involving device identifiers, location data, and personal information. They develop a structured evaluation framework and apply chi-square tests to assess consistency between declared and observed behaviors. The findings reveal high consistency for device identifier disclosures (87.8%) but a substantial inconsistency rate for location data (56.1%). No significant differences emerge between children’s apps and general-audience apps, underscoring a systemic transparency deficit across the mobile application ecosystem.
📝 Abstract
The Google Play marketplace has introduced the Data Safety section to improve transparency regarding how mobile applications (apps) collect, share, and protect user data. This mechanism requires developers to disclose privacy and security-related practices. However, the reliability of these disclosures remains dependent on developer self-reporting, raising concerns about their accuracy. This study investigates the consistency between developer-reported Data Safety disclosures and observable privacy indicators extracted from Android Application Packages (APKs). An empirical analysis was conducted on a dataset of 41 mobile gaming apps. A static analysis approach was used to extract key privacy indicators from APK files, including device IDs, data sharing, personal information access, and location access. These indicators were systematically compared with the corresponding disclosures reported in the Google Play Data Safety labels using a structured consistency evaluation framework. The results revealed varying levels of agreement across privacy categories. Device ID disclosures demonstrated relatively high consistency (87.8%), whereas other indicators exhibited substantial mismatches. Location-related disclosures showed the highest inconsistency rate (56.1%), followed by personal information and data sharing. Comparative analysis between children-oriented and general-audience apps revealed similar mismatch patterns. Also, Chi-square statistical tests indicate that these differences are not statistically significant, suggesting that disclosure inconsistencies are not associated with app category but instead reflect broader ecosystem-level challenges. These findings highlight limitations in the reliability of current marketplace transparency mechanisms and emphasize the need for improved validation and verification approaches to ensure accurate privacy reporting in mobile app ecosystems.