PrivacyInformer : an automated privacy description generator for the MIT App Inventor

Abstract

With the advent of "smart" mobile phones and ubiquitous mobile applications, the pace at which people generate, access, and acquire data has accelerated significantly. In this thesis, we first examine how privacy issues in the mobile apps market compromise the well-being of both app consumers and developers, noting that one important problem is the lack of usable privacy policies. Subsequently, we propose a technical solution named PrivacyInformer that automatically generates mobile app privacy descriptions, thereby relieving developers the burden of manually creating them. This tool is implemented as an extension to the MIT App Inventor, a do-it-yourself mobile app building platform that has a vast international user base, as well as a growing impact on the democratizing of mobile app building. We show that by analyzing source code of mobile apps directly in App Inventor, PrivacyInformer can produce simple and useful privacy descriptions in both human-readable and machine-readable format. Specifically, these generated documents describe how mobile apps use private information, rather than simply enumerating a list of data access as done in the permissions system. Finally, we conduct an exploratory user study to evaluate the effectiveness of PrivacyInformer from the app developer's perspective, as well as discuss the policy impact of such a tool in the mobile app development community.