A NEW HOPE: Contextual privacy policies for mobile applications and an approach toward automated generation

• Main Authors: PAN, Shidong, TAO, Zhen, HOANG, Thong, ZHANG, Dawen, LI, Tianshi, XING, Zhenchang, XU, Xiwei, STAPLES, Mark, RAKOTOARIVELO, Thierry, David LO
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2024
• Subjects: Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/9256; https://ink.library.smu.edu.sg/context/sis_research/article/10256/viewcontent/sec24fall_prepub_303_pan_shidong_hope.pdf
• Institution: Singapore Management University

Privacy policies have emerged as the predominant approach to conveying privacy notices to mobile application users. In an effort to enhance both readability and user engagement, the concept of contextual privacy policies (CPPs) has been proposed by researchers. The aim of CPPs is to fragment privacy policies into concise snippets, displaying them only within the corresponding contexts within the application’s graphical user interfaces (GUIs). In this paper, we first formulate CPP in mobile application scenario, and then present a novel multimodal framework, named SEEPRIVACY, specifically designed to automatically generate CPPs for mobile applications. This method uniquely integrates vision-based GUI understanding with privacy policy analysis, achieving 0.88 precision and 0.90 recall to detect contexts, as well as 0.98 precision and 0.96 recall in extracting corresponding policy segments. A human evaluation shows that 77% of the extracted privacy policy segments were perceived as wellaligned with the detected contexts. These findings suggest that SEEPRIVACY could serve as a significant tool for bolstering user interaction with, and understanding of, privacy policies. Furthermore, our solution has the potential to make privacy notices more accessible and inclusive, thus appealing to a broader demographic. A demonstration of our work can be accessed at https://cpp4app.github.io/SeePrivacy/