Even Top-Ranked Android Apps in Google Play Store Provide Misleading Data Safety Labels

An
investigation
into
data
safety
labels
for
Android
apps
available
on
the
Google
Play
Store
has
uncovered
“serious
loopholes”
that
allow
apps
to
provide
misleading
or
outright
false
information.

The

study,
conducted
by
the
Mozilla
Foundation
as
part
of
its

*Privacy
Not
Included
initiative,
compared
the
privacy
policies
and
labels
of
the
20
most
popular
paid
apps
and
the
20
most
popular
free
apps
on
the
app
marketplace.

It

found
that,
in
roughly
80%
of
the
apps
reviewed,
“the
labels
were
false
or
misleading
based
on
discrepancies
between
the
apps’
privacy
policies
and
the
information
apps
self-reported
on
Google’s

Data
safety
form.”

“The
apps
aren’t
self-reporting
accurately
enough
to
give
the
public
any
meaningful
reassurance
about
the
safety
and
privacy
of
their
data,”
Mozilla
further
said,
adding
consumers
are
being
led
to
“believe
these
apps
are
doing
a
better
job
protecting
their
privacy
than
they
are.”

Three
of
the
apps
–
UC
Browser
–
Safe,
Fast,
Private;
League
of
Stickman
Acti;
and
Terraria
–
did
not
have
their
Data
safety
sections
filled
at
all.
A
mere
6
of
the
40
apps
received
an
“OK”
grade.

Last
year,
Google
began

rolling
out
a
new
Data
safety
section
on
the
Play
Store
that
spells
out
the
apps’
privacy
and
security
practices.
It’s
also
the
company’s
answer
to
Apple’s

app
privacy
labels
that
came
into
effect
in
December
2020.

However,
there
are
some
crucial
differences.
Apple’s
labels
emphasize
on
what
data
is
being
collected,
including
those
that
are
collected
for
tracking
purposes
as
well
as
information
that’s
linked
to
the
users.

Google’s
labels,
on
the
other
hand,
allows
developers
to
provide
more
context
as
to
why
such
a
data
collection
may
be
required
and
the
security
principles
that
are
used
to
safeguard
the
information.

That
said,
both
systems
rely
on
developers
to
be
transparent
about
how
their
apps
use
data.
While
Apple
has
instituted
routine
checks
to
ensure
that
the
labels
don’t
provide
a
false
sense
of
security,
Google
leaves
developers
to
make
“complete
and
accurate
declarations.”

Now
according
to
Mozilla,
these

self-reported
labels
may
not
be
an

accurate
representation
of
an
app’s
data-gathering
policies,
calling
into
question
the
effectiveness
of
such
a
framework
in
enhancing
privacy
transparency
and
enabling
users
to
make
informed
decisions.

“For
example,
Google
exempts
apps
sharing
data
with
‘service
providers’
from
its
disclosure
requirements,
which
is
problematic
due
to
both
the
narrow
definition
it
uses
for
service
providers
and
the
large
amount
of
consumer
data
involved,”
Mozilla
said.

To
that
end,
Mozilla
refutes
Snapchat,
TikTok
and
Twitter’s
claims
that
their
apps
don’t
“share
user
data
with
other
companies
or
organizations,”
stating
that
the
apps’
privacy
policies
explicitly
mention
sharing
user
information
with
advertisers
and
internet
service
providers,
among
others.

It’s
worth
pointing
out
here
that
apps
can
be
exempted
from
disclosing
data
sharing
provided
they
have
sought
users’
consent,
if
the
data
is
being
shared
with
a
developer’s
service
provider,
or
if
the
data
is
fully
anonymized.

The
American
non-profit
is
also
recommending
Apple
and
Google
to
adopt
a
universal
nutrition
labeling
standard,
alongside
urging
the
tech
giants
to
“explain
their
enforcement
action
against
apps
that
don’t
comply
and
take
some
responsibility
for
ensuring
the
accuracy
of
the
information
apps
report.”

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts