Are iPhones Really Better for Privacy? A Comparative Study of iOS and Android Apps

Abstract

While many studies have looked at privacy properties of the Android and Google Play app ecosystem, comparatively much less is known about iOS and the Apple App Store, the most widely used ecosystem in the US. At the same time, there is increasing competition around privacy between these smartphone operating system providers. In this paper, we present a study of 24k Android and iOS apps from 2020 along several dimensions relating to user privacy. We find that third-party tracking and the sharing of unique user identifiers was widespread in apps from both ecosystems, even in apps aimed at children. In the children’s category, iOS apps tended to use fewer advertising-related tracking than their Android counterparts, but could more often access children’s location. Across all studied apps, our study highlights widespread potential violations of US, EU and UK privacy law, including 1) the use of third-party tracking without user consent, 2) the lack of parental consent before sharing personally identifiable information (PII) with third-parties in children’s apps, 3) the non-data-minimising configuration of tracking libraries, 4) the sending of personal data to countries without an adequate level of data protection, and 5) the continued absence of transparency around tracking, partly due to design decisions by Apple and Google. Overall, we find that neither platform is clearly better than the other for privacy across the dimensions we studied.

Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels

“…Programming techniques, such as the use of code obfuscation and native code, can pose further obstacles. This is especially true for iOS apps, which are often harder to decompile -compared to Android -and are encrypted by default [34]. While this iOS encryption might legitimately protect paid apps against privacy, Apple also encrypts all free apps downloaded from the App Store.…”

“…Key reasons include the closed-source nature of the Apple ecosystem; the use of exotic, Apple-only programming tools (Xcode) and languages (Objective-C and Swift); as well as the encryption of iOS apps by default (Apple FairPlay DRM). The encryption of iOS apps by Apple -even of free ones -is particularly problematic for research efforts because it drives researchers into legal grey areas of copyright law [34]. As a result, recent work by Kollnig et al [34] was the first large-scale app privacy analysis study on iOS apps since 2013 [1].…”

“…The encryption of iOS apps by Apple -even of free ones -is particularly problematic for research efforts because it drives researchers into legal grey areas of copyright law [34]. As a result, recent work by Kollnig et al [34] was the first large-scale app privacy analysis study on iOS apps since 2013 [1]. These authors managed to avoid legal problems relating to copyright law by conducting part of the analysis on-device through using the popular app instrumentation tool Frida.…”

Before and after GDPR: tracking in mobile apps

“…Paradoxically, the GDPR might actually contribute to the business models of large ad tech companies, by putting a market liberal ideology before the protection of personal data (Daly, 2020;Geradin et al, 2020;Gal & Aviv, 2020). At the same time, there is growing evidence that there are indeed widespread infringements of the GDPR and other data protection laws in the app ecosystem (Reyes et al, 2018;Zimmeck et al, 2019;Kollnig, 2019;Okoyomon et al, 2019;Kollnig, Binns et al, 2021;Kollnig et al, 2022).…”

“…While this paper focuses on Android apps and the Google Play Store, tracking is also widespread on iOS and the Apple App Store (J. Han et al, 2013;Kollnig et al, 2022).…”