Skip to content

MASWE-0078: Inadequate or Ambiguous User Consent Mechanisms

MAS Requirement

The app requests user consent prior to any data processing.

Mappings

MASVS V2: MASVS-PRIVACY-4

CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-285: Improper Authorization, CWE-358: Improperly Implemented Security Check for Standard, CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Overview

This weakness occurs when an app processes personal data without obtaining consent that is explicit, informed, and given prior to the processing, or when the consent request is vague, bundled, or coercive.

According to various international privacy regulations, such as the EU's GDPR, California's CCPA, Brazil's LGPD, and Canada's PIPEDA, users must be made fully aware of the purposes of the data collection, as well as the potential consequences of providing consent. Consent should be an active choice, specific to the data being processed, and not bundled with other service agreements or presented in a vague or coercive manner.

In addition, users must be able to easily withdraw their consent at any time and should be clearly informed of how to do so, including the potential impact on the functionality of the app. Developers must maintain a record of user consent and ensure that consent requests are clear, separate from other terms, and legally valid, and avoid practices that obscure the full scope of data processing.

Modes of Introduction

  • Failure to Prompt for Consent Changes: Failing to prompt the user for consent when data collection practices change or when additional data is collected beyond what was originally specified.
  • Ambiguous Consent Mechanisms: Bundling consent with terms of service, often covering future use cases without notifying the user again, or implying consent when the user doesn't explicitly deny access.

Impact

  • Violation of User Privacy: Users can unknowingly give up control over their data, resulting in its use for purposes they may find objectionable or harmful, such as targeted advertising, profiling, discrimination, or even identity theft.
  • Loss of User Trust: Users can lose trust in the app and abandon it, share negative reviews, or discourage others from using it, resulting in reputational damage and potential loss of business for the app owner.
  • Legal and Regulatory Non-Compliance: Processing data without valid consent can violate laws and platform requirements, resulting in legal consequences, fines, or removal from app stores for the app owner.

Mitigations

  • Prompt for Consent on Changes: Establish mechanisms for prompting users for consent if data collection practices change or if additional data is being collected, ensuring transparency when app functionality evolves.
  • Obtain Clear and Explicit User Consent for Immediate Actions: Before accessing sensitive resources like sensors or local data (e.g., camera, location), always request explicit permission from the user. Clearly explain why the permission is needed, using mechanisms like purpose strings on iOS or similar prompts on Android, to ensure users understand the immediate use of their data.
  • Ensure Informed and Transparent Consent: Provide users with clear, specific information about what data will be collected, how it will be used, and the potential impact. Consent should not be hidden in terms of service or bundled for future uses. Users must confirm consent separately for each purpose, especially when permissions extend beyond the initial request.

Tests

No Tests Yet

The MASTG doesn't contain any tests for this weakness yet. If you have proposals or would like to work on some, please open an issue in https://github.com/OWASP/mastg/issues indicating the MASWE-0078 mapping, the test titles and a summary of the tests.