IMDEA Networks Institute Publications Repository

Do You Get What You Pay For? Comparing the Privacy Behaviors of Free vs. Paid Apps

Han, Catherine and Reyes, Irwin and Elazari Bar On, Amit and Reardon, Joel and Feal, Álvaro and Egelman, Serge and Vallina-Rodriguez, Narseo (2019) Do You Get What You Pay For? Comparing the Privacy Behaviors of Free vs. Paid Apps. In: Workshop on Technology and Consumer Protection (ConPro 2019), in conjunction with the 39th IEEE Symposium on Security and Privacy, 23 May 2019, San Francisco, CA, USA., 23 May 2019, San Francisco, CA, USA.

[img] PDF (Do You Get What You Pay For? Comparing the Privacy Behaviors of Free vs. Paid Apps) - Published Version
Download (530Kb)

Abstract

It is commonly assumed that the availability of “free” mobile apps comes at the cost of consumer privacy, and that paying for apps could offer consumers protection from behavioral advertising and long-term tracking. This work empirically evaluates the validity of this assumption by investigating the degree to which “free” apps and their paid premium versions differ in their bundled code, their declared permissions, and their data collection behaviors and privacy practices. We compare pairs of free and paid apps using a combination of static and dynamic analysis. We also examine the differences in the privacy policies within pairs. We rely on static analysis to determine the requested permissions and third-party SDKs in each app; we use dynamic analysis to detect sensitive data collected by remote services at the network traffic level; and we compare text versions of privacy policies to identify differences in the disclosure of data collection behaviors. In total, we analyzed 1,505 pairs of free Android apps and their paid counterparts, with free apps randomly drawn from the Google Play Store’s category-level top charts. Our results show that over our corpus of free and paid pairs, there is no clear evidence that paying for an app will guarantee protection from extensive data collection. Specifically, 48% of the paid versions reused all of the same third-party libraries as their free versions, while 56% of the paid versions inherited all of the free versions’ Android permissions to access sensitive device resources (when considering free apps that include at least one third-party library and request at least one Android permission). Additionally, our dynamic analysis reveals that 38% of the paid apps exhibit all of the same data collection and transmission behaviors as their free counterparts. Our exploration of privacy policies reveals that only 45% of the pairs provide a privacy policy of some sort, and less than 1% of the pairs overall have policies that differ between free and paid versions.

Item Type: Conference or Workshop Papers (Paper)
Subjects: UNSPECIFIED
Divisions: UNSPECIFIED
Depositing User: �lvaro Feal
Date Deposited: 15 Mar 2019 13:31
Last Modified: 05 Apr 2019 12:30
URI: http://eprints.networks.imdea.org/id/eprint/1969

Actions (login required)

View Item View Item