Bug Fixes, Improvements, ... and Privacy Leaks: A Longitudinal Study of PII Leaks Across Android App Versions

Jingjing Ren, Martina Lindorfer, Daniel J. Dubois, Ashwin Rao, David Choffnes, Narseo Vallina-Rodriguez

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review


Is mobile privacy getting better or worse over time? In this paper, we address this question by studying privacy leaks from historical and current versions of 512 popular Android apps, covering 7,665 app releases over 8 years of app version history. Through automated and scripted interaction with apps and analysis of the network traffic they generate on real mobile devices, we identify how privacy changes over time for individual apps and in aggregate. We find several trends that include increased collection of personally identifiable information (PII) across app versions, slow adoption of HTTPS to secure the information sent to other parties, and a large number of third parties being able to link user activity and locations across apps. Interestingly, while privacy is getting worse in aggregate, we find that the privacy risk of individual apps varies greatly over time, and a substantial fraction of apps see little change or even improvement in privacy. Given these trends, we propose metrics for quantifying privacy risk and for providing this risk assessment proactively to help users balance the risks and benefits of installing new versions of apps.
Original languageEnglish
Title of host publicationProceedings 2018 Network and Distributed System Security Symposium
Number of pages15
PublisherInternet Society
Publication date2018
ISBN (Electronic)1891562495
Publication statusPublished - 2018
MoE publication typeA4 Article in conference proceedings
EventNetwork and Distributed System Security Symposium - San Diego, United States
Duration: 18 Feb 201821 Feb 2018

Fields of Science

  • 113 Computer and information sciences

Cite this