Introducing Privacy Threats from Ad Libraries to Android Users Through Privacy Granules

Android mobile users are provided with a per- missions list before installing an app that displays the list of resources available to that app. Users can review the permissions list and decide to install the app if they trust the app with their information. However, this information is accessible not only to the app provider but may also be available to third party ad libraries included in the app, which users are unaware of. In this paper, we propose a novel icon-based privacy threat representation as an alternative to permissions list that shows privacy threats to users from both app providers and associated ad libraries. Our approach considers users' privacy in terms of three granules: location, identity and query. Our proposed interface aims to educate users about which particular app providers and third parties have access to their privacy granules. We obtained user feedback on our technique in two user surveys (n = 137; 294), one each for testing the icons and the icon-based privacy threat display. We present our findings for ease of use and effectiveness of the novel privacy threat interface and further evaluate its impact on users' installation decision. user location, contacts list etc.) from the user's device and send it to their servers along with the device id. Authors in (24) analyzed 13 most popular Android ad libraries and concluded that: (a) Different ad libraries have different practices in place when accessing data from users' devices i.e., some ad libraries might access data that is not disclosed in their documentation while some may not. (b) Third party ad libraries can keep track of users' activity over multiple apps (in which that particular ad library is included) with users' device ids acting as unique identifiers for such data. Although, ad libraries are capable of accessing critical information from the user's device, those details are not revealed to the user during install time through the app's permissions list, since permissions lists only display information accessible to the app provider. Therefore, it would be helpful to provide an interface to end users that communicates the information accessible to both app providers and third party ad libraries, so they can make an informed decision during app installation.