M06: Inadequate Privacy Controls

📋 What Is It?

Inadequate Privacy Controls occurs when mobile applications collect, store, or share user data without proper consent, transparency, or protection. This includes excessive permissions, unauthorized data collection, tracking without consent, and failure to comply with privacy regulations like GDPR and CCPA. Mobile apps have access to sensitive sensors and data, making privacy controls essential.

M06 OWASP Rank

68% Apps with Issues

Varies Detection Time

⚠️ Common Privacy Issues

Excessive Permissions: Request unnecessary device permissions
Unauthorized Tracking: Collect analytics without consent
Data Leakage: Share PII with third-party SDKs
Clipboard Access: Read clipboard data without notice
Location Tracking: Constant location access when not needed
Contact Harvesting: Upload entire contact lists

🔴 Privacy Violation Flow

1. App requests broad permissions
↓
2. User grants without understanding scope
↓
3. App collects location, contacts, clipboard
↓
4. Data shared with advertising SDKs
↓
5. VIOLATION: Privacy breach, GDPR fines!

❌ Vulnerable Code

// Bad: Excessive permissions (Android)
// AndroidManifest.xml
<uses-permission android:name="android.permission.READ_CONTACTS" />
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.CAMERA" />
<uses-permission android:name="android.permission.READ_SMS" />
<uses-permission android:name="android.permission.RECORD_AUDIO" />
<!-- VULNERABLE: Requesting all permissions without justification -->

// Bad: Tracking without consent (Android)
public void onCreate() {
    // VULNERABLE: Analytics started without user consent
    FirebaseAnalytics.getInstance(this).setAnalyticsCollectionEnabled(true);
    FacebookSdk.setAdvertiserIDCollectionEnabled(true);
    
    // Immediately start collecting data
    trackUserBehavior();
}

// Bad: Uploading contacts without consent (iOS)
func uploadContacts() {
    // VULNERABLE: No user consent, no privacy notice
    let store = CNContactStore()
    let keys = [CNContactGivenNameKey, CNContactPhoneNumbersKey]
    
    let contacts = try? store.unifiedContacts(
        matching: NSPredicate(value: true),
        keysToFetch: keys as [CNKeyDescriptor]
    )
    
    // Upload all contacts to server
    uploadToServer(contacts)
}

// Bad: Clipboard monitoring (iOS)
func monitorClipboard() {
    Timer.scheduledTimer(withTimeInterval: 1.0, repeats: true) { _ in
        // VULNERABLE: Constant clipboard monitoring
        let clipboard = UIPasteboard.general.string
        sendToServer(clipboard)  // Privacy violation!
    }
}

// Bad: Always-on location (Android)
locationManager.requestLocationUpdates(
    LocationManager.GPS_PROVIDER,
    0,  // VULNERABLE: Continuous tracking
    0,
    locationListener
);
                

✅ Secure Code

// Good: Minimal permissions (Android)
// AndroidManifest.xml - Only request what's needed
<uses-permission android:name="android.permission.INTERNET" />
<uses-permission 
    android:name="android.permission.ACCESS_COARSE_LOCATION"
    android:maxSdkVersion="31" />  <!-- Approximate, not fine -->

// Good: Request permission with context (Android)
public void requestLocationPermission() {
    if (ContextCompat.checkSelfPermission(this, 
            Manifest.permission.ACCESS_COARSE_LOCATION) != PackageManager.PERMISSION_GRANTED) {
        
        // Explain why permission is needed
        new AlertDialog.Builder(this)
            .setTitle("Location Access")
            .setMessage("We need your location to show nearby stores")
            .setPositiveButton("OK", (dialog, which) -> {
                ActivityCompat.requestPermissions(this,
                    new String[]{Manifest.permission.ACCESS_COARSE_LOCATION},
                    LOCATION_REQUEST_CODE);
            })
            .show();
    }
}

// Good: Consent-based analytics (Android)
public void showPrivacyConsent() {
    // Show privacy policy and get explicit consent
    new AlertDialog.Builder(this)
        .setTitle("Privacy Settings")
        .setMessage("Allow analytics to improve app experience?")
        .setPositiveButton("Allow", (d, w) -> {
            // Only enable after consent
            FirebaseAnalytics.getInstance(this)
                .setAnalyticsCollectionEnabled(true);
            saveConsentPreference(true);
        })
        .setNegativeButton("Decline", (d, w) -> {
            FirebaseAnalytics.getInstance(this)
                .setAnalyticsCollectionEnabled(false);
            saveConsentPreference(false);
        })
        .show();
}

// Good: Privacy manifest (iOS 17+)
// PrivacyInfo.xcprivacy
{
  "NSPrivacyTracking": false,
  "NSPrivacyCollectedDataTypes": [
    {
      "NSPrivacyCollectedDataType": "NSPrivacyCollectedDataTypeEmailAddress",
      "NSPrivacyCollectedDataTypeLinked": true,
      "NSPrivacyCollectedDataTypeTracking": false,
      "NSPrivacyCollectedDataTypePurposes": [
        "NSPrivacyCollectedDataTypePurposeAppFunctionality"
      ]
    }
  ]
}

// Good: Request contacts with clear purpose (iOS)
func requestContactAccess() {
    let store = CNContactStore()
    
    // Show alert explaining why
    let alert = UIAlertController(
        title: "Contact Access",
        message: "We need access to invite friends. We never store your contacts.",
        preferredStyle: .alert
    )
    
    alert.addAction(UIAlertAction(title: "OK", style: .default) { _ in
        store.requestAccess(for: .contacts) { granted, error in
            if granted {
                // Only access with explicit permission
                self.loadContactsForInvite()
            }
        }
    })
}

// Good: Location only when needed (Android)
public void getLocationOnce() {
    // Request single location update, not continuous
    LocationRequest request = LocationRequest.create()
        .setNumUpdates(1)  // Just once
        .setPriority(LocationRequest.PRIORITY_BALANCED_POWER_ACCURACY);
    
    fusedLocationClient.requestLocationUpdates(request, callback, null);
}
                

✓ Prevention Checklist

Request only necessary permissions with clear justification
Obtain explicit consent before collecting data
Provide clear privacy policy accessible in-app
Implement opt-out mechanisms for analytics/tracking
Use privacy-preserving alternatives when possible
Minimize data collection (data minimization principle)
Allow users to delete their data (right to erasure)
Implement iOS Privacy Manifest (iOS 17+)
Audit third-party SDKs for privacy compliance
Regular privacy impact assessments

🔍 Detection & Tools

Analysis Tools:

Exodus Privacy MobSF AppCensus PrivacyScore Permission Analyzer Charles Proxy

Compliance Tools:

OneTrust TrustArc Cookiebot Osano

How to Test:

Analyze AndroidManifest.xml for excessive permissions
Review Info.plist for iOS permission usage descriptions
Monitor network traffic for unauthorized data transmission
Check for third-party tracker SDKs
Test data collection without user consent
Verify privacy policy matches actual behavior

🌍 Real-World Privacy Issues

TikTok (2021): Clipboard monitoring without disclosure, $92M fine
Facebook (2019): Unauthorized contact collection, $5B FTC fine
Google (2021): Location tracking without consent, €50M GDPR fine
Uber (2018): Background location tracking disclosure issues
LinkedIn (2020): Clipboard reading on iOS, public backlash
Various Apps (2020): Excessive location permissions during COVID-19

📌 Quick Tips

DO NOT collect data without explicit consent
DO NOT request unnecessary permissions
DO NOT hide data collection in fine print
DO implement granular privacy controls
DO provide clear opt-out mechanisms
DO minimize data collection and retention

📜 Compliance

Related Standards:

GDPR Art. 6, 7, 13, 15, 17
CCPA Consumer Privacy Rights
COPPA Children's Privacy
Apple App Store Privacy Requirements
Google Play Data Safety Section
OWASP MASVS MSTG-STORAGE-12

🕵️ Inadequate Privacy Controls