Analyzing Privacy and Data Protection Violations in Mobile Applications

Mobile applications have access to the data contained on our smartphones. They are also notorious for collecting and transmitting data to advertisers and known trackers despite the presence of strict data protection legislation. This has severe implications for our privacy, as the data collected and transmitted is not necessarily benign and can provide deep insights into the everyday smartphone users. It is important to understand what data is transmitted to whom, what happens to the data, whether the user can influence the data transmission, and whether constant network communication is not already a privacy problem. In this thesis, those questions are addressed by developing the required tooling to collect encrypted and decrypted app traffic, as well as to conduct an in-depth traffic analysis. We apply this tooling to over 10 000 apps across Android and iOS. Our results prove that apps transmit more data than they publicly admit and that even though users are occasionally asked for consent to data collection, it does not impact overall data transmission. We also find evidence that transmitted personal messages of some chat apps are processed by their providers, and that the constant traffic of apps by itself already presents a privacy risk. Thus, privacy and data protection in mobile apps are contested spaces. Apps frequently skirt European data protection laws, which has implications for users’ privacy, and users need to be aware of this when using their smartphones and apps.