Do Privacy Labels Work?

Improving communication about privacy protections on mobile apps

When deciding whether to install an app or share personal information, people need to know how an app will protect their privacy. Recognizing that lengthy, legalistic privacy policies can be hard to understand, privacy nutrition labels (or “privacy labels”) were created as a simpler alternative. Modeled after food nutrition labels, privacy labels succinctly describe how an app may use or share your data. Apple made privacy labels mandatory for all new and version‑updated apps on the Apple iOS App Store in 2020; Google followed suit for apps in its Play Store in 2022.

The question is, do privacy labels work? This project, titled “Measuring, Validating, and Improving upon App-Based Privacy Nutrition Labels,” studies how privacy labels are being applied, interpreted, and acted upon by both end users and developers. By assessing the accuracy and usefulness of privacy labels, we aim to improve the application, messaging, and regulation of privacy for mobile apps.

The project focuses on three questions:

• How are privacy labels being used?
• How do app users understand and make choices based on privacy labels?
• How do developers understand and select privacy labels for their apps, and how can we reduce developers’ misuse of privacy labels?

To answer these questions, we are performing a comprehensive, longitudinal measurement study of iOS and Android platforms, developing automated testing systems to validate the veracity of labels, and tracking changes over time to assess how the app ecosystem reacts to events like regulatory or company policy changes and enforcement actions. Through user studies, we are exploring how people understand and interpret privacy labels and how they might use these labels to decide whether to install or grant permissions to apps.

Together, the outcomes of this work will shed light on how privacy labels work for three main groups: app developers who must select correct labels for their apps; app store administrators that create the policies and standards for the labels; and end users who use them to make decisions. Ultimately, the results will lead to better understanding, design, and use of privacy labels for regulators, developers, and everyone who uses mobile apps.

Project Team

Outcomes

About