用AI比对应用隐私政策与数据声明，发现近半数存在矛盾
PrivPRISM: Automatically Detecting Discrepancies Between Google Play Data Safety Declarations and Developer Privacy Policies
- 结合编码器与解码器模型，自动提取并对比隐私条款与数据声明
- 7770款热门游戏中53%存在不一致，通用应用高达61%
- 揭露大量应用隐瞒敏感数据访问，适合关注隐私安全的用户
用户很少阅读冗长的隐私政策，因此Google Play要求提供简化的数据安全声明作为替代。但这些自我申报的信息常与完整隐私政策矛盾，误导用户并违反监管一致性要求。为此，我们提出PrivPRISM框架，结合编码器与解码器语言模型，系统性地从隐私政策中提取细粒度数据实践，并与数据安全声明进行比对，实现非合规行为的可扩展检测。对7,770款流行移动游戏的评估显示，近53%存在不一致，其中1,711款广泛使用的通用应用达61%。此外，静态代码分析揭示可能的披露不足：隐私政策仅披露了66.8%的潜在敏感数据访问（如位置、金融信息），而游戏类数据安全声明仅披露36.4%。研究结果暴露了系统性问题，包括通用隐私政策的广泛复用、表述模糊或矛盾，以及下载量超1亿的头部应用中隐藏风险，凸显亟需自动化监管以保护平台完整性，提醒用户警惕在热门应用中披露的敏感数据。
原文摘要 · Abstract (English)
End-users seldom read verbose privacy policies, leading app stores like Google Play to mandate simplified data safety declarations as a user-friendly alternative. However, these self-declared disclosures often contradict the full privacy policies, deceiving users about actual data practices and violating regulatory requirements for consistency. To address this, we introduce PrivPRISM, a robust framework that combines encoder and decoder language models to systematically extract and compare fine-grained data practices from privacy policies and to compare against data safety declarations, enabling scalable detection of non-compliance. Evaluating 7,770 popular mobile games uncovers discrepancies in nearly 53% of cases, rising to 61% among 1,711 widely used generic apps. Additionally, static code analysis reveals possible under-disclosures, with privacy policies disclosing just 66.8% of potential accesses to sensitive data like location and financial information, versus only 36.4% in data safety declarations of mobile games. Our findings expose systemic issues, including widespread reuse of generic privacy policies, vague / contradictory statements, and hidden risks in high-profile apps with 100M+ downloads, underscoring the urgent need for automated enforcement to protect platform integrity and for end-users to be vigilant about sensitive data they disclose via popular apps.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。