Dynamic Testing for Mobile Privacy Compliance

The privacy policy of a mobile application is a key document for users to understand how their personal information is handled, but its presentation can be opaque, difficult to access, and require default consent. These issues not only undermine user trust but can also pose legal and compliance risks. In this paper, we propose a method to detect privacy text presentation compliance in mobile applications using dynamic testing techniques. This method aims to identify both the presence and consent-by-default of privacy texts. By extracting UI tree information via a dynamic testing engine, locating the privacy text pages using a heuristic search algorithm, and determining the checkbox states with the help of an image classifier, We collected 1,000 application samples as a dataset and demonstrated a precision rate of 83.6% and a recall rate of 86.6% for display violations. We launched a massive test on Alipay’s real-world application and uncovered 97 issues. The proposed detection method shows advantages in enhancing privacy text presentation compliance.