Do Privacy Policies Match with the Logs? An Empirical Study of Privacy Disclosure in Android Application Logs
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866918476808978432 |
|---|---|
| author | Chen, Zhiyuan Ahir, Love Jayesh Suleiman, Ahmad Yao, Kundi Tang, Yiming Shang, Weiyi Hou, Daqing |
| author_facet | Chen, Zhiyuan Ahir, Love Jayesh Suleiman, Ahmad Yao, Kundi Tang, Yiming Shang, Weiyi Hou, Daqing |
| contents | Privacy policies are intended to inform users about how software systems collect and handle data, yet they often remain vague or incomplete. This paper presents an empirical study of patterns in log-related statements within privacy policies and their alignment with privacy disclosures observed in Android application logs. We analyzed 1,000 Android apps across multiple categories, generating 86,836,964 log entries. Our findings reveal that while most applications (88.0%) provide privacy policies, only 28.5% explicitly mention logging practices. Among those that reference logging, most clearly describe what information is logged; however, 27.7% of log-related statements remain overly simplistic or vague, offering limited insight into actual data collection. We further observed widespread privacy leakages in application logs, with 67.6% of apps leaking sensitive information not mentioned in their policies. Alarmingly, only 0.4% of applications demonstrated consistent alignment between declared policy contents and actual logged data. These findings highlight that current privacy policies provide incomplete or ambiguous descriptions of logging practices, which frequently do not align with actual logging behaviors. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2604_18552 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Do Privacy Policies Match with the Logs? An Empirical Study of Privacy Disclosure in Android Application Logs Chen, Zhiyuan Ahir, Love Jayesh Suleiman, Ahmad Yao, Kundi Tang, Yiming Shang, Weiyi Hou, Daqing Cryptography and Security Software Engineering Privacy policies are intended to inform users about how software systems collect and handle data, yet they often remain vague or incomplete. This paper presents an empirical study of patterns in log-related statements within privacy policies and their alignment with privacy disclosures observed in Android application logs. We analyzed 1,000 Android apps across multiple categories, generating 86,836,964 log entries. Our findings reveal that while most applications (88.0%) provide privacy policies, only 28.5% explicitly mention logging practices. Among those that reference logging, most clearly describe what information is logged; however, 27.7% of log-related statements remain overly simplistic or vague, offering limited insight into actual data collection. We further observed widespread privacy leakages in application logs, with 67.6% of apps leaking sensitive information not mentioned in their policies. Alarmingly, only 0.4% of applications demonstrated consistent alignment between declared policy contents and actual logged data. These findings highlight that current privacy policies provide incomplete or ambiguous descriptions of logging practices, which frequently do not align with actual logging behaviors. |
| title | Do Privacy Policies Match with the Logs? An Empirical Study of Privacy Disclosure in Android Application Logs |
| topic | Cryptography and Security Software Engineering |
| url | https://arxiv.org/abs/2604.18552 |