3 ms·

> The Data safety section provides users with a simplified view of how an app collects, shares, & secures user data, but we also want to make app permissions in

> The Data safety section provides users with a simplified view of how an app collects, shares, & secures user data, but we also want to make app permissions information easily viewable ... ^ are these vetted in any way? are they enforced? I'm okay with this being 'vendor says this', but if app stores are reporting it next to permissions (which are programmatic constraints), feels like it's at best aspirational, potentially deceptive. Are there real penalties? Or is this just a system for wrist slapping in the rare case someone is caught in a lie.

saagarjha 4y ago
From Google’s page on this: > When Google becomes aware of a discrepancy between your app behavior and your declaration, we may take appropriate action, including enforcement action. (https://support.google.com/googleplay/android-developer/answer/10787469 https://support.google.com/googleplay/android-developer/answ...)
elliotmurray 4y ago
There are at least some checks in place. I was filling it out for an app that I work on, and forgot about a feature where we shared a GPS location with an API to get a street address. I checked the box to say that the users GPS position never leaves the phone and I pretty much instantly got an email saying that the app was rejected and to fill out the form again.
- yjftsjthsd-h 4y ago
  That's good to hear, but how do they tell? I mean, following a GPS API call through to something that talks over the network seems like the kind of thing that would be a decent amount of work even with the source code; am I underestimating the state of modern analysis on binaries?
  - awinter-py 4y ago
    agree, but also this is where tech needs to get if we want to have private experiences + actual control over downloaded binaries (could also do dataflow analysis on code in a trusted third party CI system)
  - awinter-py 4y ago
    ah I bet this is google detecting an SDK, not doing deeper code analysis to detect exfiltration of GPS data they did this with the huq sdk https://www.vice.com/en/article/y3vp35/google-tells-apps-disclose-location-data-removed-huq https://www.vice.com/en/article/y3vp35/google-tells-apps-dis...

saagarjha 4y ago

From Google’s page on this: > When Google becomes aware of a discrepancy between your app behavior and your declaration, we may take appropriate action, including enforcement action. (https://support.google.com/googleplay/android-developer/answer/10787469 https://support.google.com/googleplay/android-developer/answ...)

elliotmurray 4y ago

There are at least some checks in place. I was filling it out for an app that I work on, and forgot about a feature where we shared a GPS location with an API to get a street address. I checked the box to say that the users GPS position never leaves the phone and I pretty much instantly got an email saying that the app was rejected and to fill out the form again.

yjftsjthsd-h 4y ago
That's good to hear, but how do they tell? I mean, following a GPS API call through to something that talks over the network seems like the kind of thing that would be a decent amount of work even with the source code; am I underestimating the state of modern analysis on binaries?
- awinter-py 4y ago
  agree, but also this is where tech needs to get if we want to have private experiences + actual control over downloaded binaries (could also do dataflow analysis on code in a trusted third party CI system)
- awinter-py 4y ago
  ah I bet this is google detecting an SDK, not doing deeper code analysis to detect exfiltration of GPS data they did this with the huq sdk https://www.vice.com/en/article/y3vp35/google-tells-apps-disclose-location-data-removed-huq https://www.vice.com/en/article/y3vp35/google-tells-apps-dis...