𝐴 𝐹𝑎𝑖𝑡 𝐴𝑐𝑐𝑜𝑚𝑝𝑙𝑖 An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps

Kollnig, Konrad; Binns, Reuben; Dewitte, Pierre; Van Kleek, Max; Wang, Ge; Omeiza, Daniel; Webb, Helena; Shadbolt, Nigel

Abstract

Third-party tracking allows companies to collect users’ behavioural data and track their activity across digital devices. This can put deep insights into users’ private lives into the hands of many strangers, and often happens without users’ awareness or explicit consent. EU and UK data protection law, however, requires consent, both 1) to access and store information on users’ devices and 2) to legitimate the pro- cessing of personal data as part of third-party tracking, as we analyse in this paper. This paper further investigates whether and to which extent consent is implemented in mobile apps. First, we analyse a representative sample of apps from the Google Play Store. We find that most apps engage in third-party tracking, but only 4% obtained consent before doing so, indicating potentially widespread violations of EU privacy law. Second, we examine the 13 most common third-party tracking libraries in detail. While most acknowledge that they rely on app developers to obtain consent on their behalf, they typically fail to put in place robust measures to ensure this: disclosure of consent requirements is limited; default consent implementations are lacking; and compliance guidance is difficult to find, hard to read, and poorly maintained

Citation

Kollnig, K., Binns, R., Dewitte, P., Van Kleek, M., Wang, G., Omeiza, D., Webb, H., & Shadbolt, N. (2021, August). 𝐴 𝐹𝑎𝑖𝑡 𝐴𝑐𝑐𝑜𝑚𝑝𝑙𝑖 An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps. Presented at Seventeenth Symposium on Usable Privacy and Security, Vancouver, Canada

• Presentation Conference Type: Edited Proceedings
• Conference Name: Seventeenth Symposium on Usable Privacy and Security
• Start Date: Aug 9, 2021
• End Date: Aug 10, 2021
• Acceptance Date: Jun 1, 2001
• Publication Date: 2021
• Deposit Date: Jul 28, 2025
• Peer Reviewed: Peer Reviewed
• Pages: 181-196
• Book Title: Proceedings of the Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021)
• Public URL: https://nottingham-repository.worktribe.com/output/46456071
• Publisher URL: https://www.usenix.org/system/files/soups2021_full_proceedings_interior.pdf