Skip to content

MASWE-0073: Inadequate Data Collection Declarations

MAS Requirement

The app adequately declares all user collected data.

Mappings

MASVS V1: MSTG-STORAGE-12, MSTG-NETWORK-1

MASVS V2: MASVS-PRIVACY-3, MASVS-PRIVACY-1

CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Overview

This weakness occurs when an app's stated data collection practices, such as those documented in Apple's App Privacy Report and Privacy Nutrition Labels, or Google's Data Safety section, are incomplete or inconsistent with the app's actual behavior.

These declarations must clearly outline what data is collected, how it is used, whether it is linked to the user's identity, and whether it is shared with third parties in accordance with the platform's policies. When they are inaccurate, users are prevented from making informed decisions about their privacy, including understanding whether data will be linked to their identity, used for tracking, or shared with third parties.

Note about third-party libraries (SDKs): Developers, as data controllers, are legally responsible for ensuring that third-party components process sensitive data lawfully, fairly, and transparently, as highlighted in the ENISA study on GDPR compliance (Section 2.2.7, "Data transfers and processing by third parties"). However, in some cases, it may be challenging for mobile app developers to be fully aware of what data these third-party SDKs actually collect.

Modes of Introduction

  • Undeclared Data Collection and Purpose: Failing to declare what data is being collected (e.g., location, contacts, identifiers) and for what purposes (e.g., analytics, personalization).
  • Discrepancies in Declarations vs Behavior: Publishing declarations that differ from the app's actual behavior by using data for purposes other than those disclosed.

Impact

  • Violation of User Privacy: Users can unknowingly share data whose purpose they do not understand, resulting in unauthorized sharing, profiling, or targeted advertising.
  • Loss of User Trust: Users can discover the inconsistent declarations, resulting in negative reviews, lower user engagement, and reduced retention for the app owner.
  • Legal and Regulatory Non-Compliance: Inaccurate or inconsistent data declarations can violate regulations like GDPR or CCPA and platform policies, resulting in fines, legal action, or removal from app stores for the app owner.

Mitigations

  • Maintain Accurate Privacy Labels: Comply with Apple's Privacy Nutrition Labels and Google's Data Safety Section requirements by providing accurate, up to date and transparent information about your data practices, including data collection and sharing with third parties.

Tests

MASTG-TEST-0206: Undeclared PII in Network Traffic Capture MASTG-TEST-0318: References to SDK APIs Known to Handle Sensitive User Data MASTG-TEST-0319: Runtime Use of SDK APIs Known to Handle Sensitive User Data