How Many Hands in the Cookie Jar? Examining Privacy Implications of Popular Apps in India

Smartphone app usage has steeply risen in India in the past decade. But limited efforts in the past assess the privacy aspects of these smartphone apps. Many of these are used for common utilities and handle sensitive user data. Such sensitive data leaks can have a wide variety of consequences when exposed to untrusted players (e.g., repressive governments, data/content hosting companies, and other third parties). These could range from mere embar-rassment to personal targeting and surveillance. This paper presents a measurement study on the data collection and privacy considerations of some of the most popular apps on the Indian Google Play Store. We selected 24 apps, and analyzed their data collection behavior on phones as well as the security of the servers to whom they send the data. We also obfuscated the data being collected and sent to the backend servers. Interestingly, for the non-government apps we found that extensive (mostly personally identifiable information), often “unnecessary”, data collection is being performed. In other words, we observed that a lot of these apps work fine even without these pieces of sensitive information. We then classified the data collected as necessary or not necessary based on this information. Furthermore, we found that often such sensitive data may be available in plaintext to the intermediate players managing/deploying the hosting infrastructure. We also found that while the governmental services-based apps collect fewer such unnecessary data points, they often store the data on web-fronted back-end databases with little to no user authentication mechanisms enabled. We expect our study to enable better understanding among both users and app developers about the privacy implications of these data collection practices.