Celebrating Recent Milestones from ICSI’s Usable Privacy and Security Group

As digital systems continue to shape almost every aspect of modern life, the urgency of privacy protection has grown. The International Computer Science Institute (ICSI) Usable Privacy and Security group, led by Serge Egelman, PhD, has been at the forefront of uncovering hidden threats, shaping national policy, and building a safer digital future for everyone.

Founded to explore how real-world technologies collect and share user data, the Usable Privacy and Security group quickly became a leader in both technical research and privacy advocacy. Its mission remains simple yet ambitious: to empower users, hold platforms accountable, and shine a light on the dark corners of digital ecosystems.

The group has celebrated numerous wins in impactful research, public advocacy, and policy change.

Discovery to Action: A Decade of Impacts

The past decade has seen exponential growth in mobile apps, digital advertising, and surveillance infrastructure. At the same time ICSI’s Usable Privacy and Security researchers have played a crucial role in discovering how these systems silently extract sensitive user data. Much of this work has focused on software development kits (SDKs) used by thousands of apps, revealing how embedded trackers funnel sensitive user data to advertising and analytics companies — often without users’ knowledge or consent.

1. Testifying for Change

In 2021, Serge Egelman, a Senior Research Scientist at ICSI and Research Scientist at UC Berkeley, testified before the U.S. Senate Committee on Commerce, Science, and Transportation. In his testimony, he provided expert analysis on the widespread manipulation of children’s behavior through data-driven design and in-app advertising. His testimony built upon years of empirical work showing how privacy policies are often inaccessible or misleading, especially in products aimed at kids.

Dr. Egelman’s research laid the foundation for renewed calls to strengthen Children’s Online Privacy Protection Act (COPPA) enforcement and informed the Federal Trade Commission’s efforts to crack down on unfair data practices.

2. Revealing Hidden Data Harvesting 

In a groundbreaking investigation led by Serge Egelman and Joel Reardon, researchers uncovered that dozens of popular Android apps—downloaded more than 60 million times—were embedding a secretive data-harvesting SDK linked to U.S. national security contractors. The work revealed that this SDK, developed by a company called Measurement Systems, was collecting sensitive data such as precise location, email addresses, phone numbers, and even WhatsApp file metadata. 

These findings directly led Google to ban dozens of apps from the Play Store. The same code was later found in software associated with TrustCor, a root certificate authority, prompting Mozilla and Microsoft to revoke trust in its certificates and raising alarms about the integrity of internet security infrastructure. This not only catalyzed industry-wide enforcement actions but also shed light on how surveillance tools can exploit consumer-facing technologies under the radar.

3. Exposing a Billion-Dollar Tracking Industry

In collaboration with investigative journalists from The New York Times, Serge Egelman and other researchers helped expose how dozens of apps secretly harvested precise location data from millions of users—including children, teachers, and healthcare workers—and sold it to advertisers, hedge funds, and other third parties. The resulting article, “Your Apps Know Where You Were Last Night,” revealed that this sensitive data was being shared as frequently as every two seconds and could easily be tied back to individuals. 

Dr. Egelman warned, “There are really no consequences for companies that don’t protect the data, other than bad press that gets forgotten about.” The story prompted widespread public backlash, federal investigations, and inspired major regulatory conversations around geolocation privacy and app permissions, all while highlighting the need for stronger accountability in mobile ecosystems.

4. Holding Big Tech Accountable 

Serge Egelman and colleagues helped uncover rampant violations of children’s privacy laws in the mobile app ecosystem, contributing to a landmark New York Times investigation, “How Game Apps That Captivate Kids Have Been Collecting Their Data.” Their research revealed that more than half of 6,000 popular free Android apps aimed at children—some downloaded over 10 million times—shared personal data like location and device identifiers with third parties, potentially violating COPPA. 

The story prompted a lawsuit by the New Mexico Attorney General against Tiny Lab Productions, Google, Twitter, and others for enabling unlawful tracking through apps listed in Google Play’s “Family” section. “I don’t see any way that anything would change unless there are enforcement actions,” Dr. Egelman stated at the time. Their work catalyzed federal scrutiny, public awareness, and calls for stronger vetting of “kid-safe” apps.

5. Growing the Next Generation

With a steady flow of students and early-career researchers, the Usable Privacy and Security group fosters the next generation of leaders in digital privacy and security. One example is Nikita Samarin, formerly a research assistant in the group, who helped uncover hidden data collection practices in mobile apps and advertising SDKs, contributing to impactful privacy complaints and research that influenced app store enforcement and public policy. He is now a Privacy Researcher at the California Privacy Protection Agency and a PhD candidate at UC Berkeley, where he continues to study the real-world impact of software design on user privacy.

Looking Ahead: Usable Privacy at a Crossroads

As AI, biometric systems, and Internet of Things (IoT) devices become more deeply embedded in daily life, new concerns around privacy and security are emerging all the time. With continued support from ICSI and broader privacy-focused coalitions, the Usable Privacy and Security group is poised to lead the next generation of research and advocacy at the intersection of human-centered design and technical defense.

This story was published in January 2026 as part of a retrospective series highlighting ICSI’s accomplishments and impacts over the years. To learn about our ongoing work, explore our Core Research Themes.