A Fait Accompli? An Empirical Study into the Absence of Consent to Third-Party Tracking in Android Apps

Third-party tracking allows companies to collect users' behavioural data and\ntrack their activity across digital devices. This can put deep insights into\nusers' private lives into the hands of strangers, and often happens without\nusers' awareness or explicit consent. EU and UK data protection law, however,\nrequires consent, both 1) to access and store information on users' devices and\n2) to legitimate the processing of personal data as part of third-party\ntracking, as we analyse in this paper.\n This paper further investigates whether and to what extent consent is\nimplemented in mobile apps. First, we analyse a representative sample of apps\nfrom the Google Play Store. We find that most apps engage in third-party\ntracking, but few obtained consent before doing so, indicating potentially\nwidespread violations of EU and UK privacy law. Second, we examine the most\ncommon third-party tracking libraries in detail. While most acknowledge that\nthey rely on app developers to obtain consent on their behalf, they typically\nfail to put in place robust measures to ensure this: disclosure of consent\nrequirements is limited; default consent implementations are lacking; and\ncompliance guidance is difficult to find, hard to read, and poorly maintained.\n