Search papers, labs, and topics across Lattice.
PrivPRISM, a framework using encoder-decoder language models, extracts and compares data practices from privacy policies against Google Play data safety declarations to detect inconsistencies. Analysis of 7,770 mobile games revealed discrepancies in 53% of cases, while 1,711 generic apps showed 61% discrepancy. Static code analysis further indicated under-disclosures, with privacy policies disclosing only 66.8% of potential sensitive data accesses, compared to 36.4% in data safety declarations for mobile games.
Over half of popular mobile games on the Google Play store have data safety declarations that contradict their own privacy policies, and that's before you even check the code.
End-users seldom read verbose privacy policies, leading app stores like Google Play to mandate simplified data safety declarations as a user-friendly alternative. However, these self-declared disclosures often contradict the full privacy policies, deceiving users about actual data practices and violating regulatory requirements for consistency. To address this, we introduce PrivPRISM, a robust framework that combines encoder and decoder language models to systematically extract and compare fine-grained data practices from privacy policies and to compare against data safety declarations, enabling scalable detection of non-compliance. Evaluating 7,770 popular mobile games uncovers discrepancies in nearly 53% of cases, rising to 61% among 1,711 widely used generic apps. Additionally, static code analysis reveals possible under-disclosures, with privacy policies disclosing just 66.8% of potential accesses to sensitive data like location and financial information, versus only 36.4% in data safety declarations of mobile games. Our findings expose systemic issues, including widespread reuse of generic privacy policies, vague / contradictory statements, and hidden risks in high-profile apps with 100M+ downloads, underscoring the urgent need for automated enforcement to protect platform integrity and for end-users to be vigilant about sensitive data they disclose via popular apps.
