{"publication":"In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)","conference":{"end_date":"2024-11-01","start_date":"2024-10-27","name":"39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024)","location":"Sacramento, California"},"title":"Do Android App Developers Accurately Report Collection of Privacy-Related Data?","_id":"56137","ddc":["000"],"date_updated":"2024-11-18T13:19:51Z","abstract":[{"text":"Many Android applications collect data from users. The European Union's General Data Protection Regulation (GDPR) requires vendors to faithfully disclose which data their apps collect. This task is complicated because many apps use third-party code for which the same information is not readily available. Hence we ask: how accurately do current Android apps fulfill these requirements?\r\nIn this work, we first expose a multi-layered definition of privacy-related data to correctly report data collection in Android apps. We further create a dataset of privacy-sensitive data classes that may be used as input by an Android app. This dataset takes into account data collected both through the user interface and system APIs.\r\nWe manually examine the data safety sections of 70 Android apps to observe how data collection is reported, identifying instances of over- and under-reporting. Additionally, we develop a prototype to statically extract and label privacy-related data collected via app source code, user interfaces, and permissions. Comparing the prototype's results with the data safety sections of 20 apps reveals reporting discrepancies. Using the results from two Messaging and Social Media apps (Signal and Instagram), we discuss how app developers under-report and over-report data collection, respectively, and identify inaccurately reported data categories.\r\nOur results show that app developers struggle to accurately report data collection, either due to Google's abstract definition of collected data or insufficient existing tool support. ","lang":"eng"}],"doi":"10.1145/3691621.3694949","user_id":"88024","type":"conference","language":[{"iso":"eng"}],"status":"public","file_date_updated":"2024-09-16T08:49:42Z","citation":{"bibtex":"@inproceedings{Khedkar_Mondal_Bodden_2024, title={Do Android App Developers Accurately Report Collection of Privacy-Related Data?}, DOI={<a href=\"https://doi.org/10.1145/3691621.3694949\">10.1145/3691621.3694949</a>}, booktitle={In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)}, author={Khedkar, Mugdha and Mondal, Ambuj Kumar and Bodden, Eric}, year={2024} }","ama":"Khedkar M, Mondal AK, Bodden E. Do Android App Developers Accurately Report Collection of Privacy-Related Data? In: <i>In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)</i>. ; 2024. doi:<a href=\"https://doi.org/10.1145/3691621.3694949\">10.1145/3691621.3694949</a>","ieee":"M. Khedkar, A. K. Mondal, and E. Bodden, “Do Android App Developers Accurately Report Collection of Privacy-Related Data?,” presented at the 39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024), Sacramento, California, 2024, doi: <a href=\"https://doi.org/10.1145/3691621.3694949\">10.1145/3691621.3694949</a>.","short":"M. Khedkar, A.K. Mondal, E. Bodden, in: In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24), 2024.","apa":"Khedkar, M., Mondal, A. K., &#38; Bodden, E. (2024). Do Android App Developers Accurately Report Collection of Privacy-Related Data? <i>In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)</i>. 39th IEEE/ACM International Conference on Automated Software Engineering (ASE 2024), Sacramento, California. <a href=\"https://doi.org/10.1145/3691621.3694949\">https://doi.org/10.1145/3691621.3694949</a>","mla":"Khedkar, Mugdha, et al. “Do Android App Developers Accurately Report Collection of Privacy-Related Data?” <i>In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)</i>, 2024, doi:<a href=\"https://doi.org/10.1145/3691621.3694949\">10.1145/3691621.3694949</a>.","chicago":"Khedkar, Mugdha, Ambuj Kumar Mondal, and Eric Bodden. “Do Android App Developers Accurately Report Collection of Privacy-Related Data?” In <i>In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops (ASEW ’24)</i>, 2024. <a href=\"https://doi.org/10.1145/3691621.3694949\">https://doi.org/10.1145/3691621.3694949</a>."},"external_id":{"arxiv":["2409.04167"]},"file":[{"date_created":"2024-09-16T08:49:42Z","creator":"khedkarm","success":1,"access_level":"closed","file_size":1270058,"relation":"main_file","content_type":"application/pdf","file_id":"56138","date_updated":"2024-09-16T08:49:42Z","file_name":"2409.04167v1.pdf"}],"date_created":"2024-09-16T08:50:54Z","year":"2024","author":[{"id":"88024","first_name":"Mugdha","last_name":"Khedkar","full_name":"Khedkar, Mugdha"},{"first_name":"Ambuj Kumar","full_name":"Mondal, Ambuj Kumar","last_name":"Mondal"},{"id":"59256","full_name":"Bodden, Eric","last_name":"Bodden","orcid":"0000-0003-3470-3647","first_name":"Eric"}],"department":[{"_id":"76"}],"has_accepted_license":"1"}