---
res:
  bibo_abstract:
  - Android applications collecting data from users must comply with legal frameworks
    to ensure data protection. This requirement has become even more important since
    the implementation of the General Data Protection Regulation (GDPR) by the European
    Union in 2018. In practice, GDPR compliance involves conducting effective privacy
    assessments, requiring close collaboration between stakeholders with diverse expertise-including
    developers, privacy experts, legal experts, and auditors. This thesis introduces
    a multi-layered definition of privacy-related data, grounded in GDPR’s notion
    of personal data, and presents Privacy-Relevant Input Classification Engine (PRICE),
    a command-line tool for statically labeling privacy-related data collected by
    Android apps. Using PRICE, we examine data collection patterns across Android
    apps and assess how accurately these apps report their data collection practices.
    Our analysis reveals that apps most frequently collect data capable of partially
    identifying users, highlighting the need for greater consistency in privacy-aware
    development and reporting. Complementing this analysis, we investigate developers’
    experiences with Google Play Store’s Data Safety Section (DSS) through a survey
    and analysis of online developer discussions. This study identifies key challenges
    developers face in completing the DSS, including difficulties in identifying privacy-related
    data and limited understanding of the form.Building on these findings, the thesis
    explores how static program analysis can be used to automate and support privacy
    assessments. We introduce Assessor View, a static analysis-based web tool designed
    to assist multiple stakeholders involved in privacy evaluations. Assessor View
    provides a unified view of privacy-related dataflows and supports collaboration
    across technical and non-technical roles. Qualitative evaluations with technical
    and legal participants indicate that the tool’s warnings and guidance are valuable
    to Data Protection Officers and privacy experts,representing a significant step
    toward improving communication between legal and technical experts and streamlining
    privacy assessments. Finally, we extend both PRICE and Assessor View to more directly
    support stakeholder needs by enabling accurate, source code-driven report generation.
    These extensions aim to reduce manual effort, improve consistency between implemented
    behavior and reported disclosures, and support reliable and transparent privacy
    assessments. Collectively, these contributions advance the state of the art in
    privacy-aware software engineering and provide a foundation for more systematic,
    automated, and legally compliant privacy assessments of Android applications.@eng
  bibo_authorlist:
  - foaf_Person:
      foaf_givenName: Mugdha
      foaf_name: Khedkar, Mugdha
      foaf_surname: Khedkar
      foaf_workInfoHomepage: http://www.librecat.org/personId=88024
  bibo_doi: https://doi.org/10.17619/UNIPB/1-2735
  dct_date: 2026^xs_gYear
  dct_language: eng
  dct_publisher: Paderborn University@
  dct_title: Assisting GDPR Compliance through Static Analysis of Android Apps@
...