Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study conducts the first large-scale audit of mobile augmented reality (MAR) privacy policies in relation to U.S. state privacy laws, analyzing a dataset of 8,013 MAR apps. The findings reveal significant disclosure gaps, with 44.62% of policies missing over eight critical requirements and four specific requirements having violation rates exceeding 90%. This highlights the inadequacy of MAR privacy disclosures in addressing the evolving landscape of state-level privacy regulations, underscoring the need for improved compliance mechanisms.
Nearly half of mobile AR privacy policies fail to meet critical disclosure requirements, revealing a systemic compliance crisis in the face of evolving U.S. state laws.
Mobile Augmented Reality (MAR) apps can collect and process highly sensitive data such as spatial maps and biometrics, yet their privacy policies remain largely understudied. Prior audits of app privacy policies have typically focused on a single legal framework, such as the GDPR. Meanwhile, 20 U.S. states have comprehensive privacy laws in effect, creating a fragmented and rapidly evolving set of privacy policy obligations. To date, no study has systematically audited privacy policies against this emerging body of state-level legislation. In this paper, we present the first large-scale audit of MAR privacy policies under U.S. state privacy laws. We construct a dataset covering the MAR ecosystem, including 8,013 Google Play MAR app metadata records worldwide, and a U.S.-based subset with 6,620 APKs and 6,426 privacy policy files. We further derive an auditable disclosure taxonomy with 5 baseline requirements, 10 triggered requirements, and 4 logic chains, and build a validated four-stage automated pipeline that produces traceable, evidence-grounded disclosure judgments. Our audit reveals widespread disclosure gaps: 44.62\% of audited policies exhibit severe disclosure omissions, with each missing more than eight requirements, and four privacy-policy requirements have violation rates above 90\%. These findings suggest that MAR privacy disclosures are not keeping pace with the growing complexity of U.S. state privacy regulation. We release our dataset, taxonomy, and auditing pipeline to support future research on scalable privacy compliance auditing.