Are iPhones Really Better for Privacy? Comparative Study of iOS and Android Apps

TL;DR

This study compares privacy practices of 24,000 Android and iOS apps from 2020, revealing widespread tracking and potential legal violations, with neither platform clearly superior in protecting user privacy.

Contribution

It provides a comprehensive comparative analysis of privacy-related features and violations in Android and iOS apps, especially focusing on children's apps and legal compliance.

Findings

Widespread third-party tracking in both ecosystems

Children's apps often share PII without parental consent

Potential violations of privacy laws across apps

Abstract

While many studies have looked at privacy properties of the Android and Google Play app ecosystem, comparatively much less is known about iOS and the Apple App Store, the most widely used ecosystem in the US. At the same time, there is increasing competition around privacy between these smartphone operating system providers. In this paper, we present a study of 24k Android and iOS apps from 2020 along several dimensions relating to user privacy. We find that third-party tracking and the sharing of unique user identifiers was widespread in apps from both ecosystems, even in apps aimed at children. In the children's category, iOS apps tended to use fewer advertising-related tracking than their Android counterparts, but could more often access children's location. Across all studied apps, our study highlights widespread potential violations of US, EU and UK privacy law, including 1) the use of third-party tracking without user consent, 2) the lack of parental consent before sharing personally identifiable information (PII) with third-parties in children's apps, 3) the non-data-minimising configuration of tracking libraries, 4) the sending of personal data to countries without an adequate level of data protection, and 5) the continued absence of transparency around tracking, partly due to design decisions by Apple and Google. Overall, we find that neither platform is clearly better than the other for privacy across the dimensions we studied.