Automating the GDPR Compliance Assessment for Cross-border Personal Data Transfers in Android Applications

TL;DR

This paper presents an automated approach to assess GDPR compliance for cross-border data transfers in Android apps, revealing that over half of popular apps may violate GDPR requirements.

Contribution

The paper introduces a fully automated method for evaluating GDPR compliance in mobile apps, addressing the challenge of manual assessment in a large and dynamic app ecosystem.

Findings

56% of analyzed apps potentially non-compliant with GDPR

Automated assessment method applied to 10,080 top apps

Significant gap between app practices and GDPR requirements

Abstract

The General Data Protection Regulation (GDPR) aims to ensure that all personal data processing activities are fair and transparent for the European Union (EU) citizens, regardless of whether these are carried out within the EU or anywhere else. To this end, it sets strict requirements to transfer personal data outside the EU. However, checking these requirements is a daunting task for supervisory authorities, particularly in the mobile app domain due to the huge number of apps available and their dynamic nature. In this paper, we propose a fully automated method to assess the compliance of mobile apps with the GDPR requirements for cross-border personal data transfers. We have applied the method to the top-free 10,080 apps from the Google Play Store. The results reveal that there is still a very significant gap between what app providers and third-party recipients do in practice and what is intended by the GDPR. A substantial 56% of analysed apps are potentially non-compliant with the GDPR cross-border transfer requirements.