A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps
A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps
复制标题
DOI：
--
复制
发表时间：
2021-06
期刊：
影响因子：
--
通讯作者：
Konrad Kollnig;Reuben Binns;Pierre Dewitte;M. V. Kleek;Ge Wang;Daniel Omeiza;Helena Webb;N. Shadbolt
中科院分区：
文献类型：
--
作者：
Konrad Kollnig;Reuben Binns;Pierre Dewitte;M. V. Kleek;Ge Wang;Daniel Omeiza;Helena Webb;N. Shadbolt
第三方跟踪使公司能够收集用户的行为数据，并跟踪他们在数字设备上的活动。这可能会让陌生人对用户的私生活有更深的了解，而且经常在用户不知情或明确同意的情况下发生。然而，欧盟和英国的数据保护法需要征得同意，1)访问和存储用户设备上的信息，2)将个人数据处理作为第三方跟踪的一部分，正如我们在本文中所分析的那样。本文进一步调查了同意是否在移动应用中实施以及在多大程度上实现了同意。首先，我们分析了来自Google Play商店的一个有代表性的应用程序样本。我们发现，大多数应用程序都参与了第三方跟踪，但很少有应用程序在这样做之前获得同意，这表明可能存在广泛违反欧盟和英国隐私法的行为。其次，我们详细研究了最常见的第三方跟踪库。虽然大多数人承认他们依赖应用程序开发者代表他们获得同意，但他们通常无法制定强有力的措施来确保这一点：同意要求的披露有限；缺乏默认同意实施；合规指导难以找到、难以阅读和维护不力。
Third-party tracking allows companies to collect users' behavioural data and track their activity across digital devices. This can put deep insights into users' private lives into the hands of strangers, and often happens without users' awareness or explicit consent. EU and UK data protection law, however, requires consent, both 1) to access and store information on users' devices and 2) to legitimate the processing of personal data as part of third-party tracking, as we analyse in this paper. This paper further investigates whether and to what extent consent is implemented in mobile apps. First, we analyse a representative sample of apps from the Google Play Store. We find that most apps engage in third-party tracking, but few obtained consent before doing so, indicating potentially widespread violations of EU and UK privacy law. Second, we examine the most common third-party tracking libraries in detail. While most acknowledge that they rely on app developers to obtain consent on their behalf, they typically fail to put in place robust measures to ensure this: disclosure of consent requirements is limited; default consent implementations are lacking; and compliance guidance is difficult to find, hard to read, and poorly maintained.