Even Top-Ranked Android Apps in Google Play Store Provide Misleading Data Safety Labels

Feb 24, 2023Ravie LakshmananPrivacy / Data Safety

An investigation into data safety labels for Android apps
available on the Google Play Store has uncovered “serious
loopholes” that allow apps to provide misleading or outright false
information.

The study^[1], conducted by the
Mozilla Foundation as part of its *Privacy Not Included^[2]
initiative, compared the privacy policies and labels of the 20 most
popular paid apps and the 20 most popular free apps on the app
marketplace.

It found^[3]
that, in roughly 80% of the apps reviewed, “the labels were false
or misleading based on discrepancies between the apps’ privacy
policies and the information apps self-reported on Google’s
Data safety form^[4].”

“The apps aren’t self-reporting accurately enough to give the
public any meaningful reassurance about the safety and privacy of
their data,” Mozilla further said, adding consumers are being led
to “believe these apps are doing a better job protecting their
privacy than they are.”

Three of the apps – UC Browser – Safe, Fast, Private; League of
Stickman Acti; and Terraria – did not have their Data safety
sections filled at all. A mere 6 of the 40 apps received an “OK”
grade.

Last year, Google began rolling out^[5]
a new Data safety section on the Play Store that spells out the
apps’ privacy and security practices. It’s also the company’s
answer to Apple’s app privacy labels^[6]
that came into effect in December 2020.

However, there are some crucial differences. Apple’s labels
emphasize on what data is being collected, including those that are
collected for tracking purposes as well as information that’s
linked to the users.

Google’s labels, on the other hand, allows developers to provide
more context as to why such a data collection may be required and
the security principles that are used to safeguard the
information.

That said, both systems rely on developers to be transparent
about how their apps use data. While Apple has instituted routine
checks to ensure that the labels don’t provide a false sense of
security, Google leaves developers to make “complete and accurate
declarations.”

Now according to Mozilla, these self-reported labels^[7]
may not be an accurate^[8]
representation of an app’s data-gathering policies, calling into
question the effectiveness of such a framework in enhancing privacy
transparency and enabling users to make informed decisions.

“For example, Google exempts apps sharing data with ‘service
providers’ from its disclosure requirements, which is problematic
due to both the narrow definition it uses for service providers and
the large amount of consumer data involved,” Mozilla said.

To that end, Mozilla refutes Snapchat, TikTok and Twitter’s
claims that their apps don’t “share user data with other companies
or organizations,” stating that the apps’ privacy policies
explicitly mention sharing user information with advertisers and
internet service providers, among others.

It’s worth pointing out here that apps can be exempted from
disclosing data sharing provided they have sought users’ consent,
if the data is being shared with a developer’s service provider, or
if the data is fully anonymized.

The American non-profit is also recommending Apple and Google to
adopt a universal nutrition labeling standard, alongside urging the
tech giants to “explain their enforcement action against apps that
don’t comply and take some responsibility for ensuring the accuracy
of the information apps report.”