Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps
Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps
复制标题
DOI：
10.2478/popets-2022-0033
复制
发表时间：
2021-09
影响因子：
--
通讯作者：
Konrad Kollnig;A. Shuba;Reuben Binns;M. V. Kleek;N. Shadbolt
中科院分区：
文献类型：
--
作者：
Konrad Kollnig;A. Shuba;Reuben Binns;M. V. Kleek;N. Shadbolt
摘要 虽然许多研究都关注 Android 和 Google Play 应用生态系统的隐私属性，但对 iOS 和 Apple App Store（美国使用最广泛的生态系统）的了解相对较少。与此同时，这些智能手机操作系统提供商之间围绕隐私的竞争也日益激烈。在本文中，我们从与用户隐私相关的多个维度对 2020 年 2.4 万款 Android 和 iOS 应用进行了研究。我们发现，第三方跟踪和唯一用户标识符共享在两个生态系统的应用程序中都很普遍，甚至在针对儿童的应用程序中也是如此。在儿童类别中，iOS 应用程序往往比 Android 应用程序使用更少的广告相关跟踪，但可以更频繁地访问儿童的位置。在所有研究的应用程序中，我们的研究强调了广泛存在的潜在违反美国、欧盟和英国隐私法的行为，包括 1) 在未经用户同意的情况下使用第三方跟踪；2) 在儿童应用程序中与第三方共享个人身份信息 (PII) 之前未经父母同意；3) 跟踪库的非数据最小化配置；4) 将个人数据发送到没有足够数据保护水平的国家；5) 跟踪方面持续缺乏透明度，部分原因是设计苹果和谷歌的决定。总体而言，我们发现，在我们研究的各个维度上，这两个平台在隐私方面都明显优于另一个平台。
Abstract While many studies have looked at privacy properties of the Android and Google Play app ecosystem, comparatively much less is known about iOS and the Apple App Store, the most widely used ecosystem in the US. At the same time, there is increasing competition around privacy between these smartphone operating system providers. In this paper, we present a study of 24k Android and iOS apps from 2020 along several dimensions relating to user privacy. We find that third-party tracking and the sharing of unique user identifiers was widespread in apps from both ecosystems, even in apps aimed at children. In the children’s category, iOS apps tended to use fewer advertising-related tracking than their Android counterparts, but could more often access children’s location. Across all studied apps, our study highlights widespread potential violations of US, EU and UK privacy law, including 1) the use of third-party tracking without user consent, 2) the lack of parental consent before sharing personally identifiable information (PII) with third-parties in children’s apps, 3) the non-data-minimising configuration of tracking libraries, 4) the sending of personal data to countries without an adequate level of data protection, and 5) the continued absence of transparency around tracking, partly due to design decisions by Apple and Google. Overall, we find that neither platform is clearly better than the other for privacy across the dimensions we studied.