As digitization continues to surge, data privacy has become more important—and more challenging—than ever. That being said, this isn’t the first time that data management practices have been in the international spotlight.
Most consumers became aware of the ways in which their personal data was being used (and, in the opinion of many, abused) after the 2018 Cambridge Analytica Scandal. While this controversy arose largely from the harvesting of user information without users’ explicit consent, much of the uproar centered around how that data was used—and how it could potentially be used in the future.
This growing concern among the public led to the passage of legislation such as GDPR and CCPA, the widespread use of cookie policy pop-ups, and an increased rollout of preference management controls for users. These changes have helped put control over personal data back into the hands of consumers, but mobile applications remain a potential weak link when it comes to privacy.
Data privacy on the web vs. mobile applications
Before going further, let’s unpack how data collection is different for websites than it is for mobile applications.
When visiting a website, information is mainly collected via your IP address and is relatively limited in scope. These data points include the other pages you’ve visited, your rough location, and any information you share yourself (including metadata from any images you upload).
With mobile applications, app owners, developers, and users have to consider how all of the native features of a smartphone impact data access. The device itself is affiliated with a specific phone number, an exact location, contacts’ data, and more. As long as it has a reason for accessing a given feature, there are many identifying pieces of information a mobile app can access by default that a webpage can’t.
Consent and risk
While it’s been well established that it’s both unethical and (in many cases) illegal to harvest personal data without a user’s consent, much of the data collection from app users today is covered in the terms we agree to when downloading a mobile app. Beyond the information an app needs in order to function, there’s a substantial amount of data that users are voluntarily sharing with applications that can then be used for ad targeting.
Third party app analytics platforms, in particular, are vital sources of business intelligence and can be used to improve the mobile experience over time. For that reason, user data collection and analysis is pretty commonplace: A recent study from Oxford University found that 90% of free apps on the Google Play store share data with organizations.
All this said, it’s critical for developers, app owners, and app users to understand how this data will be collected, utilized, and protected from malicious actors. It’s also important for all parties to be aware of (and in control of) how data is shared with third parties.
Risky permissions
Adding more features, functionality, and integrations to an application experience typically requires more access to user information, so developers and app owners are constantly determining which functionality is “necessary” versus “unnecessary” to the functioning of the app.
For instance, a photo sharing app has a pretty intuitive reason to request access to a user’s camera and photo library.
That said, even necessary permissions can elevate the risk of data exposure. In a recent study, researchers found that 89% of Android apps requested “risky permissions, or “…permissions where the app requests data or resources that involve the user’s private information, or could potentially affect the user’s stored data or the operation of other apps.” A similar study conducted by the Washington Post found that the practice was widespread for iOS apps, as well.
The most commonly found “risky permissions” were requests to track a user’s location, access the camera, record audio, read a phone call log, and read SMS messages.
Requesting access to this information isn’t an inherently nefarious act. Most users simply aren’t aware of just how much personally identifiable information can be collected from granting these permissions.
One example of this is network access. Most users grant apps permission to run on their wifi network, but many aren’t aware that an app can identify your exact location using the wifi networks around you.
Another good example is when an app requests access a smartphone’s photos. Every photo taken and stored on a mobile device includes specific information, such as GPS, the time the photo was captured, the direction the user was facing when the photo was taken, and more. This essentially gives apps access to a historical log of everywhere a user’s ever been.
From a data privacy perspective, this lack of awareness among consumers about how app usage exposes their personal data can be ethically and practically problematic. From a data security perspective, however, failing to adequately protect this wealth of information about specific users can be absolutely catastrophic.
Protecting data privacy
When we at Mindgrub develop mobile apps that will be available in the Apple App Store or the Google Play Store, we architect the experience in such a way that we know exactly what data we need and what we’re doing with it. While it’s best to limit or exclude any third party libraries from apps, it’s often necessary to include an analytics platform like Google Firebase in the app itself, as it’s a critically important source of feedback for the app owner.
In the case of Firebase, Google controls what happens with the data it collects from users of your app. That’s why documentation, permissions, and preference management are so important.
It’s been best practice for some time to only request the permissions that are necessary for an application to function, but recent changes at the operating system level are making this process mandatory. For apps submitted for inclusion in the Apple App Store, for instance, developers are required to document the reason for requesting any and all permissions.
Furthermore, any permission requests need to be included in a publicly-visible privacy policy. The policy needs to explicitly state what is happening with your data. Even if your app doesn’t require any permissions, that needs to be documented somewhere in the privacy policy. If your app is found to be in violation of your privacy policy, it will be revoked from the App Store.
Through Apple’s rollout of their AppTrackingTransparency framework (conspicuously scheduled for Data Privacy Day), apps will be required to request permission to ask for user permission to collect and share their data with “apps, websites, or offline properties owned by other companies.” Their definition of “tracking” also covers:
- Displaying targeted advertisements in your app based on user data collected from apps and websites owned by other companies
- Sharing device location data or email lists with a data broker
- Sharing a list of emails, advertising IDs, or other IDs with a third-party advertising network that uses that information to retarget those users in other developers’ apps or to find similar users
- Placing a third-party software developer kit (SDK) in your app that combines user data from your app with user data from other developers’ apps to target advertising or measure advertising efficiency, even if you don’t use the SDK for these purposes (for example, using an analytics SDK that repurposes the data it collects from your app to enable targeted advertising in other developers’ apps)
While these changes will undoubtedly impact advertisers and app owners’ ability to deliver targeted ads and glean actionable insights, consumers will be more in control of their personal information than they’ve ever been before. In this new era of transparency, many are hopeful that the digital world will become a more safe and trusted place for consumers and businesses alike.