Poster: Model-driven Privacy Analysis of Messaging Platforms

Analyzing privacy breaches in Internet-based messaging applications is challenging due to overlapping and sometimes conflicting requirements such as confidentiality, anonymity, unlinkability, and user consent. Existing static analysis techniques typically target isolated aspects of privacy, limiting their scope. In this work, we introduce a static analysis framework based on a composite privacy model that captures the interdependencies among these requirements. This unified model enables the systematic identification of technical privacy violations and their associated legal implications, such as infringements of data protection laws and digital rights. We apply our framework to Ejabberd, a real-time communication server used in messaging platforms like WhatsApp. Our analysis focuses on confidentiality and consent-driven privacy concerns, including the right to be informed and the right to erasure. The results highlight the effectiveness of our approach in bridging technical analysis with legal accountability.