Measuring the Effectiveness of Privacy Policies for Voice Assistant Applications
Measuring the Effectiveness of Privacy Policies for Voice Assistant Applications
复制标题
DOI：
10.1145/3427228.3427250
复制
发表时间：
2020-07
期刊：
影响因子：
--
通讯作者：
Song Liao;Christin Wilson;Long Cheng;Hongxin Hu;Huixing Deng
中科院分区：
文献类型：
--
作者：
Song Liao;Christin Wilson;Long Cheng;Hongxin Hu;Huixing Deng
Amazon Alexa和Google Assistant等语音助理（VA）正在快速无缝地融入人们的日常生活。对VA服务的日益依赖引发了隐私问题，例如私人对话和敏感信息的泄露。隐私政策在解决用户的隐私问题并告知他们有关数据收集，存储和共享实践方面发挥着重要作用。VA平台（包括Amazon Alexa和Google Assistant）允许第三方开发人员构建新的语音应用程序并将其发布到应用程序商店。语音应用程序开发人员必须提供隐私政策，以披露其应用程序的数据做法。然而，很少有人知道这些隐私政策是否在新兴的VA平台上提供信息和值得信赖。另一方面，许多用户通过语音调用语音应用程序，因此用户访问这些隐私策略存在可用性挑战。在本文中，我们进行了第一次大规模的数据分析，以系统地衡量语音应用程序开发人员在两个主流VA平台上提供的隐私政策的有效性。我们试图了解当前应用商店中开发人员提供的隐私政策的质量和可用性问题。我们分析了64，720项亚马逊Alexa技能和16，002项Google Assistant操作。我们的工作还包括用户研究，以了解用户对语音应用程序隐私政策的看法。我们的研究结果揭示了两个主流语音应用商店隐私政策的令人担忧的现实。在17，952项具有隐私策略的技能和9，955项操作中，有许多语音应用程序具有不正确的隐私策略URL或断开的链接。我们发现，1,755个Alexa技能和192个Google操作提供了一个损坏的隐私政策URL。亚马逊Alexa有超过56%的技能具有重复的隐私策略URL。而Google Assistant平台有9.0%的操作具有重复的隐私策略URL。还有一些技能/操作与隐私政策和描述之间不一致。6，047 Google行动没有隐私政策，尽管他们被要求提供一个。谷歌和亚马逊甚至有官方的语音应用程序违反了他们自己的隐私政策要求。我们已经向Amazon Alexa和Google Assistant团队报告了我们的发现，并收到了两家供应商的回复。
Voice Assistants (VA) such as Amazon Alexa and Google Assistant are quickly and seamlessly integrating into people’s daily lives. The increased reliance on VA services raises privacy concerns such as the leakage of private conversations and sensitive information. Privacy policies play an important role in addressing users’ privacy concerns and informing them about the data collection, storage, and sharing practices. VA platforms (both Amazon Alexa and Google Assistant) allow third-party developers to build new voice-apps and publish them to app stores. Voice-app developers are required to provide privacy policies to disclose their apps’ data practices. However, little is known whether these privacy policies are informative and trustworthy or not on emerging VA platforms. On the other hand, many users invoke voice-apps through voice and thus there exists a usability challenge for users to access these privacy policies. In this paper, we conduct the first large-scale data analytics to systematically measure the effectiveness of privacy policies provided by voice-app developers on two mainstream VA platforms. We seek to understand the quality and usability issues of privacy policies provided by developers in the current app stores. We analyzed 64,720 Amazon Alexa skills and 16,002 Google Assistant actions. Our work also includes a user study to understand users’ perspectives on privacy policies of voice-apps. Our findings reveal a worrisome reality of privacy policies in two mainstream voice-app stores. For the 17,952 skills and 9,955 actions that have privacy policies, there are many voice-apps with incorrect privacy policy URLs or broken links. We found that 1,755 Alexa skills and 192 Google actions provide a broken privacy policy URL. Amazon Alexa has more than 56% of skills with duplicate privacy policy URLs. While the Google Assistant platform has 9.0% of actions with duplicate privacy policy URLs. There are also skills/actions with inconsistency between the privacy policy and description. 6,047 Google actions do not have a privacy policy although they are required to provide one. Google and Amazon even have official voice-apps violating their own requirements regarding the privacy policy. We have reported our findings to both Amazon Alexa and Google Assistant teams, and received acknowledgments from both vendors.