[PDF] Examining the Integrity of Apple's Privacy Labels: GDPR Compliance and Unnecessary Data Collection in iOS Apps | Semantic Scholar (2025)

[PDF] Semantic Reader

This study conducts a large-scale measurement study of privacy labels using apps from the Android Play Store and the Apple App Store, and establishes a common mapping between iOS and Android labels, enabling a direct comparison of disclosed practices and data types between the two platforms.

This paper presents the first systematic study, based on the new methodology named Lalaine, to evaluate data-flow to privacy-label (flow-to-label) consistency and provides detailed case studies and analyze root causes for privacy label non-compliance that complements prior understandings.

A large-scale empirical study collecting and analyzing the privacy labels of 17, 312 apps and observing that the newly introduced measures resulted in a statistically significant decrease in the number of apps that collect data for tracking purposes, and at the same time, a growth in overall data collection.

It is revealed that privacy label disclosures of what is ostensibly the same mobile app can be quite different, including the possibility that these discrepancies might be indicative of potential privacy compliance issues.

An in-depth look at the privacy labels and how they relate to actual transmitted data, and evaluates the apps’ adherence to the GDPR in respect of providing a privacy consent form, through collected screenshots, and identifies numerous potential violations of the directive.

For apps that have assigned labels during the measurement period nearly all do not change their labels, and when they do, the new labels indicate more data collection than less, suggesting that privacy labels may be a ``set once'' mechanism for developers that may not actually provide users with the clarity needed to make informed privacy decisions.

Analyzing two versions of 1,759 iOS apps from the UK App Store suggests that, while Apple’s changes make tracking individual users more difficult, they motivate a countermovement, and reinforce existing market power of gatekeeper companies with access to large troves of first-party data.

The results show that Android developers rarely discussed privacy concerns when talking about a specific app design or implementation problem, but often had active discussions around privacy when stimulated by certain external events representing new privacy-enhancing restrictions from the Android operating system, app store policies, or privacy laws.

The first indepth interview study with 24 lay iPhone users is reported to investigate their experiences, understanding, and perceptions of Apple’s privacy labels, uncovering misunderstandings of and dissatisfaction with the iOS privacy labels.

This contribution investigates the capabilities and limitations of a privacy label and its labeling tool for use by SMEs in three business domains and identifies the following directions for future research: Enhancing trust in privacy labels, dealing with network aspects, adopting privacy labels and labeling tools, using the labeling process and outcome for auditing own privacy practice, and improving the current privacy labels

...

...