Anycast and Third-Party Libraries: A Recipe for a Privacy Disaster?

Third-party libraries offer a wide range of services that simplify, enhance, and accelerate the development of mobile apps. These libraries oftentimes rely on distributed infrastructures and technologies, such as anycast addresses, to deliver their services worldwide. Yet, they are also frequently involved in personal data transfers, which may cross international borders due to anycast working. However, major privacy legislations restrict the international transfers of personal data and set strict requirements to allow them. This article presents a novel approach to analyze the privacy compliance risks induced by third-party libraries using anycast communications. To this end, we conducted an experiment where we analyzed the personal data transfers of more than 5,759 Android apps, further identifying the libraries triggering the transfers and the destinations' geolocation. The results show that 90 percent of third-party libraries and 98.65 percent of apps integrating them potentially fail to meet the European Union requirements for international personal data transfers.