Protecting Private Attributes in App Based Mobile User Profiling

Abstract

The Analytics companies enable successful targeted advertising via user profiles, derived from the mobile apps installed by specific users, and hence have become an integral part of the mobile advertising industry. This threatens the users' privacy, when profiling is based on apps representing sensitive information, e.g., gambling problems indicated by a game app. In this work, we propose an app-based profile obfuscation mechanism, ProfileGuard, with the objective of eliminating the dominance of private interest categories (i.e. the prevailing private interest categories present in a user profile). We demonstrate, based on wide-range experimental evaluation of Android apps in a nine month test campaign, that the proposed obfuscation mechanism based on similarity with user's existing apps (ensuring that selected obfuscating apps belong to non-private categories) can achieve a good trade-off between efforts required by the obfuscating system and the resulting privacy protection. We also show how the bespoke (customised to profile obfuscation) and bespoke++ (resource-aware) strategies can deliver significant improvements in the level of obfuscation and (particularly bespoke++) in the use of mobile resources, making the latter a good candidate strategy in resource-constrained scenarios e.g., for fixed data use mobile plans. We also implement a POC ProfileGuard app to demonstrate the feasibility of an automated obfuscation mechanism. Furthermore, we provide insights to Google AdMob profiling rules, such as showing how individual apps map to user's interests within their profile in a deterministic way and that AdMob requires a certain level of activity to build a stable user profile.

Privacy in targeted advertising: A survey

“…household income, parental status, location etc. The profiling is a result of interactions of user device with the AdMob SDK [8] that communicates with Google analytics for deriving user profiles. A complete set of 'Web & App activities' can be found under 'My Google Activity' 6 , which helps Google make services more useful, such as, helping rediscover the things already searched for, read, and watched.…”

“…These include a wide range of different sources enabled with various tools, e.g., the 'Web & Apps activities' are extracted with the help of Andoird/iOS SDKs, their interactions with analytics servers within Google network, cookies, conversion tracking 7 , web searches, user's interactions with received ads etc. Similarly, Google's connected home devices and services 8 rely on data collected using cameras, micro- phones and other sensors to provide helpful features and services 9 . Google Takeout 10 can be used to export a copy of contents (up to several GBs of data) in user's Google Account for backup or use it with a service outside of Google.…”

“…For the in-app ads delivery [7], [8], [27], [28], [29], an ad network may use different information to infer users' interests, in particular, the installed applications together with the device identifier to profile users and to personalise ads pool to be delivered. Similarly, for in-browser ads, user profiling is performed by analytics companies [30] through different information such as browsing history, web searches etc., that is carried out using configured cookies and consequently target users with personalised ads.…”

“…There are various kinds of privacy attacks e.g. in the direct attack, the user profile is (legitimately) derived by the analytics network (in our previous works [7], [8], [9], we focus on Google AdMob). The indirect attack, involves a third party, that monitors the ad traffic (sent in clear text [9], [17] to mobile devices) and infers the user profile based on their targeted ads.…”

“…In the process of data monetisation, the ads/analytics companies aggressively look for all the possible ways to gather personal data from the users, including purchasing users' personal data from third parties. This poses serious threats to privacy of users [7], [8], [9], [10], [11], [12], when apps indicating sensitive information, e.g., a gaming app showing a gambling problem, are the basis for profiling.…”