Problem Summary

Users face challenges in managing app permissions effectively and making informed privacy decisions. This issue stems from several factors like limited user understanding, numerous permission requests, lack of contextual awareness, static and binary decisions about permissions. Frequent permission requests and the need for constant decision-making can lead to user fatigue, causing users to either indiscriminately accept permissions or ignore important privacy settings. Finding a balance between protecting user personal data and ensuring a seamless and user-friendly experience is challenging, as overly restrictive or obtrusive privacy controls can hinder app functionality.

Rationale

By leveraging automated decision-making, the solutions aim to reduce user burden, enhance privacy protection, and ensure that permission decisions align closely with user preferences and contextual needs. This dynamic and personalised approach to privacy management provides users with better control and understanding of how their data is accessed and shared, fostering a more secure and user-friendly mobile environment.

Solution

Use advanced, user-centric, and context-aware automated decision-making systems to help users manage their app permissions effectively.

Wijesekera et al. [1] present a novel privacy management system for Android that uses contextual signals to predict user privacy preferences dynamically. This system addresses the limitations of the ask-on-first-use (AOFU) model, which does not account for varying contexts in subsequent permission requests. It balances usability with privacy protection by using infrequent prompts to retrain the ML model, ensuring minimal disruption to the user experience.

Rashidi et al. [2] propose DroidNet, an Android permission control framework that uses crowdsourcing to help users make informed decisions about app permissions. DroidNet operates in a "probation" mode for new apps, where permissions are not granted upfront. Instead, it provides recommendations based on decisions from peer expert users. An expertise ranking algorithm using a transitional Bayesian inference model is used to identify expert users. The system offers real-time recommendations on permission requests, helping inexperienced users make safer decisions.

Gao et al. [3] present AutoPer+, an autonomous permission recommendation system for Android that leverages natural language processing (NLP) and machine learning to assist users in making permission decisions. AutoPer+ analyses app descriptions to determine the necessity of permissions, using a multi-topic model and deep semi-supervised learning with Long Short-Term Memory (LSTM) networks to identify similar apps and their permission usages. The system provides recommendations (Allow, Deny, Ask) along with explanations to help users understand the rationale behind each decision.

Liu et al. [4] introduce a Personalized Privacy Assistant (PPA) for mobile app permissions, designed to help users manage the large number of permission decisions they need to make. The PPA predicts privacy preferences by asking users a small number of questions and matching them to privacy profiles derived from real-world data.

Kim, Ko, and Kim [5] introduce the Quality of Private Information (QoPI) model, designed to provide fine-grained and dynamic privacy controls for mobile applications. The QoPI model defines various types and quality levels of private information and incorporates contextual properties affecting privacy decisions. By using this model, users can manage their privacy settings more precisely according to their needs and the context in which the application is used. The model predicts appropriate privacy controls based on user behaviour, improving the accuracy and efficiency of privacy management compared to traditional binary and static approaches.

Olejnik et al. [6] introduce SmarPer, an advanced permission mechanism for Android designed to provide context-aware and automatic runtime permission decisions. SmarPer aims to address the limitations of static permission policies by predicting user decisions using a Bayesian linear regression model. It also includes a data obfuscation feature to offer users a middle ground between allowing and denying permissions. While it does not use crowdsourcing, it employs advanced models to make expert-level privacy recommendations.

Wijesekera et al. [7] investigate the feasibility of dynamically granted permissions on mobile devices, focusing on aligning these permissions with user preferences. The authors conducted a longitudinal field study with 131 participants to analyse contextual privacy decisions and developed a machine-learning model to predict user decisions. The model detects changes in context and infers privacy preferences based on users' past decisions and behaviour.

Liu et al. [8] present PriVs, an unobtrusive privacy permission recommendation system for mobile apps that balances privacy and usability. PriVs uses crowdsourced data to generate personalised privacy recommendations for users. The system collects users’ privacy settings and feedback to refine recommendations continuously. It employs collaborative filtering methods to make privacy permission recommendations and allows users to approve, reject, or temporarily approve suggested settings.

Kaur, Echizen and Kumar [9] proposed an intelligent agent model designed to protect the location privacy of smartphone users. This agent acts as a virtual proxy, managing the release and distortion of location data based on user-defined preferences and contextual information. Utilising neural networks, the agent learns from user behaviour to predict and adjust privacy settings dynamically. By introducing spatial and temporal perturbations, the agent minimises the risk of continuous tracking and unauthorised data inference, ensuring robust privacy protection while maintaining the functionality of location-based services.

These systems proposed in the supporting research leverage various techniques such as crowdsourcing, machine learning, natural language processing (NLP), and collaborative filtering to provide personalised and dynamic privacy recommendations that align with user preferences and behaviours. Frameworks like DroidNet [2] and PriVs [8] use crowdsourced data to gather expert opinions and user feedback, providing real-time permission recommendations based on collective knowledge and preferences. The systems proposed by Wijesekera et al. [1][7] use contextual signals and machine learning to predict user decisions with high accuracy. AutoPer+ [3] uses LSTM networks and NLP for autonomous permission recommendations. The Personalised Privacy Assistant (PPA) [4] uses machine learning to develop privacy profiles and offer personalised recommendations. The QoPI model [5] defines various privacy levels and contextual properties for dynamic privacy management. SmarPer [6] uses Bayesian linear regression to predict user decisions and offers an obfuscation option. The Smart Data agent [9] uses neural networks to learn from user behaviour to predict and adjust privacy settings dynamically.

Platforms: mobile devices

Example

Left: probation and trusted installation mode; Middle: users select resources to be monitored; Right: permission grant prompt, with a suggestion from DroidNet [2]. (See enlarged)

AutoPer+ interface recommendation [3]. (See enlarged)

Left: permission management; Right: daily privacy nudge, which includes the access frequency and purpose information [4]. (See enlarged)

Left: an example scenario for obtaining a QoPI recommendation; Right: manually selecting a QoPI level for the locational information [5]. (See enlarged)

Top: SmarPer permission prompt. Bottom: Information about the effect of the different decision types (when the user clicks the question mark in the permission prompt) [6]. (See enlarged)

From left to right: (a) users are presented with statistical results, which can serve as a reference for their privacy preferences; (b) PriVs can receive and implement the recommendations generated by the algorithm; (c) when an app requests various permissions, PriVs will display an interface to collect user feedback on these permissions; (d)A dialogue pops up to remind users when they choose to approve the recommendation temporarily [8]. (See enlarged)

• The solutions reduce privacy violations and align closely with user preferences, achieving high recommendation accuracy (up to 96.8%). They use contextual information and collaborative filtering to provide automatic permission decisions, offering partial data sharing and personalised privacy management. These systems also provide explanations for recommendations, improving user understanding and acceptance, with studies showing up to 78.7% user acceptance rates [1][3][4][5][6][7][8].
• Uses an expertise ranking algorithm for high-quality recommendations and continuously refines recommendations based on user feedback [2].

• The quality and reliability of the recommendations heavily depend on the accuracy and volume of crowdsourced data. This reliance introduces potential risks such as false responses intended to mislead the recommendation system, necessitating measures to mitigate these threats and ensure the system’s effectiveness [2][8].
• The studies faced some limitations, including a focus on popular apps, which may have introduced bias [6], the requirement of root access for manipulating permission settings, limiting the participant pool [4], and the lack of real-world consequences for denying permissions, which might not accurately reflect user behaviour in typical app usage scenarios [7].
• The integration of contextual data and machine learning models can introduce computational overhead and latency in permission decision-making, which may affect the performance of the mobile device [1].

Privacy choices give people control over certain aspects of data practices. Considering the design space for privacy choices [10], this guideline can be applied in the following dimensions:

All discussed solutions address the control attribute [11] by providing mechanisms that allow users to make informed decisions, customise their privacy settings, and manage permissions dynamically based on context and preferences. Other related privacy attributes: