Communications of the ACM

Privacy

Mobile-App Privacy Nutrition Labels Missing Key Ingredients for Success

By Lorrie Faith Cranor
Communications of the ACM, November 2022, Vol. 65 No. 11, Pages 26-28
10.1145/3563967
Comments

Having advocated for and conducted research on short standardized privacy notices for the past two decades, I was excited when I heard Apple and Google would roll out mobile-app privacy "nutrition labels" (short-form, standardized privacy policies) in their respective app stores. However, when the first iOS labels appeared at the end of 2020, my excitement was replaced with disappointment. The iOS labels were not prominently placed, used confusing terminology, and too often seemed inconsistent with information in the apps' privacy policy. In April 2022, labels appeared in the Android app store that took a different approach from iOS yet appeared to suffer from similar problems.

I wasn't the only one disappointed. A New York Times reporter wrote that the iOS labels were, "often illuminating," but complained that they "created more confusion."² A Washington Post reporter wrote about apps that deceptively claim on their labels that they don't collect data, when in fact they do.⁸ In February 2021, members of the U.S. Congress wrote to Apple CEO Tim Cook with concerns that app labels were misleading consumers.³

Back to Top

The Idea Behind Privacy Nutrition Labels

As website privacy policies gained popularity in the late 1990s and early 2000s, it soon became apparent that most were too long and difficult to understand to be useful to consumers. Some consumer advocates suggested standardizing privacy policies, and I was involved in a World Wide Web Consortium (W3C) effort to specify a standard machine-readable privacy policy format.⁴ Commissioners of the U.S. Federal Trade Commission started talking about the need for a privacy nutrition label with clear consistent language that would allow people to quickly understand a company's data practices and compare policies.¹

Food nutrition labels were mandated in the U.S. by the Nutrition Labeling and Education Act of 1990 (NLEA) and are largely considered to be a success. Even so, research studies have found that nutrition labels have had only a modest impact on consumers' food in-take decisions, with consumers who are most interested in nutrition receiving the greatest benefit.¹⁰ The standardized label approach has also been adopted for drug labels, energy labels on appliances, and financial institution privacy notices.⁵ These labels provide information customized for each product that can help consumers compare products and make informed decisions. These informational labels serve a different purpose than warning labels, which alert consumers to hazards, such as the dangers of smoking cigarettes.

While food nutrition labels may not have had an enormous impact on improving eating habits, they have made it easier for those interested in seeking healthier food choices or avoiding certain ingredients to do so. They have also resulted in greater transparency about the food we consume. Even individuals who rarely consult nutrition labels on their own may benefit when journalists review nutrition labels and write articles about particularly unhealthy foods.

As a privacy researcher, I have been enthusiastic about the privacy nutrition label concept because it offers an opportunity to present privacy information in simple, standardized language for easy comparison. With students and colleagues, I have designed and evaluated privacy nutrition labels for websites,¹¹ mobile apps,¹² and IoT devices.⁷ Privacy is complicated and making privacy labels understandable takes some effort. However, our studies have consistently found that well-designed labels improve understanding about data practices and make privacy choices easier for consumers.

As with food nutrition labels, only a minority of consumers may consult privacy labels often, but labels have the potential to benefit consumers who are interested in considering privacy in their decision making. In addition, standardized labels allow for the development of search engines that take privacy into account^5,6 as well as for easy collection of large-scale datasets describing company data practices.¹⁶ However, if privacy labels are confusing and designed in such a way that comparisons are difficult, and if the information on labels is not trustworthy, then they fail to meet their goals.

Figure. App privacy labels for the Just Dance Now app: a) compact version of Android label; b) compact version of iOS label; c) full Android label (which can be expanded further for additional details); d) full iOS label.

Back to Top

User Studies with Developers and End Users

After seeing concerns about the accuracy of iOS privacy labels, I worked with colleagues and students to investigate whether iOS app developers were able to create privacy labels accurately. While some developers may intentionally misrepresent their data practices, our study suggests that even those who attempt accurate representations have trouble doing so. We interviewed 12 iOS app developers and observed them creating labels for an app they had developed, thinking aloud as they worked. Developers were confused about the terminology used in privacy labels and often found the explanations in Apple's documentation to be ambiguous. We also found several reoccurring errors and misunderstandings about privacy labels. For example, many developers underreported data elements in the iOS "data linked to you" category, failing to realize that data elements that are not inherently identifiable can nonetheless be linked to individuals because they are stored with identifiable data. Many developers also failed to report data elements collected through third-party libraries because they were unaware of libraries' data collection practices.¹⁵ Indeed, a study of traffic sent to known advertising and tracking domains from apps in the German iOS app store found that at least 16% of the apps studied transmitted data to third parties without mention of this practice in their privacy labels.¹³

Having determined that iOS privacy label vocabulary was confusing to app developers, we next interviewed 24 lay iPhone users about their experience with the labels. Although the labels were introduced in the iOS app store over a year before our study, most participants were unaware they existed and few had ever seen one, probably because they require some scrolling to discover. Approximately half of our participants expected incorrectly that all data collected by an app would be disclosed in its label; in fact, the label focuses on data used for tracking or advertising. Many participants were confused about the structure of the label, which displays up to three tiles representing "data used to track you," "data linked to you," and "data not linked to you," and lists specific data types within each tile. Clicking on a tile provides access to a detailed view showing purposes for which data is used, with data types and sometimes specific data elements under each purpose.

Many data types are used in multiple ways and thus listed under more than one purpose, leading some participants to assume the label included redundant information. Users were just as confused about terminology as developers, and few participants noticed or followed the link to Apple's definitions of terms. Both developers and users were especially confused by the term "tracking," which Apple uses to convey that collected data can be linked with third-party data for targeted advertising or shared with data brokers. People often expected the term referred to tracking their physical location or website visits, as that is how they had heard it most commonly used. Finally, some users were frustrated that the iOS label is completely disconnected from iOS privacy controls.

We are currently continuing our research with Android app developers and users. Our preliminary results suggest that Android labels, which use different definitions for some terms, suffer from many of the same comprehension problems as iOS labels. Furthermore, Android label are structured differently and require additional clicks to understand how data is used. On the other hand, Android labels focus on data safety, and some users seem to appreciate the information they provide about app security practices.

Back to Top

A Recipe for Success

The current app privacy labels are disappointing. Here is what Apple and Google can do to improve them:

Improve label accuracy

• App developer tools should automatically compile lists of data collected by the app and aid developers in annotating it with data uses.^9,14 This would allow most of the app privacy label to be generated automatically.
• App stores should use automated verification techniques to verify the accuracy of privacy labels to the extent possible and employ auditing techniques to at least spot check components that can't be verified automatically.

Make labels easier to understand

• App platforms should all develop the same unambiguous, standardized privacy terminology (consistent with common usage of terms) and should have tooltips or convenient links to definitions in both user and developer interfaces.
• Privacy labels should include a summary view that emphasizes what users find most important.
• As privacy labels represent multiple data types that each may be used for multiple purposes, the full label representation should employ a tabular or matrix format that makes this clear.
• Privacy labels should be refined through iterative design and evaluation with users. Testing is needed to determine what is most important to emphasize, how to explain privacy concepts clearly to both users and developers, and how to represent a complex label structure on a small screen.

Make labels easier to find and use

• Privacy labels (or links) should be placed prominently in app stores where they are visible without scrolling.
• Privacy label elements should be integrated into app privacy interfaces to help inform users' privacy decisions within the app (for example, making decisions about runtime permissions).
• App stores should develop (or support third-party development of) tools that make use of label data, for example to allow searching for apps that match a user's privacy criteria, comparing similar apps on the basis of privacy, or customizing labels based on each user's preferences.

Back to Top

Back to Top

The Digital Library is published by the Association for Computing Machinery. Copyright © 2022 ACM, Inc.

---

No entries found