The element of surprise causes hard feelings when it comes to privacy violations, and mobile phone apps are ambushing consumers far too often, according to researchers at Carnegie Mellon University.
Researchers at the school's Human-Computer Interaction Institute studied both the data gathered by the 100 most popular programs in Google's Android app store, and how surprised users were when told what the apps were doing. On Tuesday they released a list of the 10 worst offenders in terms of transparency.
Almost no one was surprised that Google Maps accessed location information, for example, but respondents had a strong negative reaction when they learned that the “Brightest Flashlight” app tracked their location, said Jason Hong, an associate professor at school.
“There's no sensible reason why a flashlight app would need your location," Hong said. "That was the biggest surprise to people -- 95 percent were surprised it used location data."
Of the top 100 Android apps, 56 collected location information, device identifiers and/or contact lists, according to the university’s research. Users, however, often had no idea such data was being collected or how it might be used. For example, 58 percent of those asked about an app that collected device IDs were unaware that they could be used for marketing purposes; another 55 percent said the same about GPS location data.
It turns out that data collection and surprise is a toxic combination for users.
Using both elements, Hong and Professor Norman Sadeh created a list of the 10 worst privacy offenders – apps that collected data and surprised users. The list wasn’t ranked, though Hong said the flashlight app registered the most surprise. The list wasn’t ranked, though Hong said the flashlight app registered the most surprise.
The full list, along with the potentially controversial data collected by each, according to the researchers:
• Brightest Flashlight (device ID, location)
• Toss It game (device ID, location)
• Angry Birds game (device ID, location)
• Talking Tom virtual pet (device ID)
• Backgrounds HD Wallpapers (device ID, contacts)
• Dictionary.com (device ID, location)
• Mouse Trap game (device ID)
• Horoscope (device ID, location)
• Shazam music (device ID, location)
• Pandora Internet Radio (device ID, contacts)
An email sent to the contact address at BrightestFlashlight.com wasn't returned. The website lists no contact phone number.
One intriguing, and promising, element of the research surrounds the notion of expectation and disclosure, said Hong. Many consumers registered less frustration about data collection when researchers explained to consumers precisely why it was necessary, or how the information was used.
For example, Dictionary.com's collection of location information allows the app to offer a fun feature: words others nearby are searching for. That explanation made users much less likely to feel like their privacy had been violated, Hong said.
"Universally, every time we gave an explanation, people were more comfortable with the app. That shows how important disclosures can be," he said. “It's important to emphasize that privacy policies don't work. Transparency is good, but we need to find right way of doing it.”
The more unusual data collection might be, the more important prominent disclosure becomes, the study found. For example, the Backgrounds wallpaper app’s access of contact information allows users to change their phone's screen appearance when a call or text comes in from a specific contact. But many users were unaware why contact access would be needed.
"We could create better privacy based on people's expectations," Hong said. "For many apps, the way the data is being used isn't obvious."
Users who download Android apps are shown a box which indicates what kind of data the app might collect, but multiple studies show that users merely ignore the disclosure, just as they do with website privacy policies.
But even for those who read carefully, mere disclosure that data is collected isn't enough, said Sadeh, the Carnegie Mellon professor.
"When you look at the fundamental issue, it's about informing users and giving them an option," he said. "You need to say more to users than, 'I need permission to collect this.' You need to tell them what you will do with what you collect. ... When you communicate, you put people at ease."
Mobile apps on all platforms fail to give users this critical "how-will-my-data-be-used" information, Sadeh said, but he said app developers weren't the only ones to blame.
"The platforms invite developers to collect more information than you would like," he said. "And the developers can hide behind what the app store offers (for disclosure options). They can say, 'Hey, there's no way for me to offer more.' It's up to these marketplaces to make an effort to convey more information."
The research, which is ongoing, is funded by the National Science Foundation, Google and the Army Research Office.
* Follow Bob Sullivan on Facebook.
* Follow Bob Sullivan on Twitter.
More from Red Tape Chronicles: