MAS-P - Baseline Privacy
How to proceed when no MASTG TEST exists
The MASTG does not yet provide dedicated tests for every MASWE. Defining a weakness and defining a reliable, reproducible way to test for it are different tasks, and some areas require extensive research, validation, or refinement before they can be captured as formal MASTG TESTs. The guide also evolves continuously as platforms, frameworks, and testing techniques change.
Even when no dedicated MASTG TEST exists, you can still assess the weakness.
-
Start with the MASWE: Review its "Modes of Introduction" to understand the concrete conditions that may introduce the weakness and what should be tested.
-
Check related MASTG content: Look at similar or related existing MASTG TESTs, as they can provide useful testing patterns, structure, and inspiration for designing a new test. Also consult relevant MASTG KNOW, TECH, and TOOL entries, together with the official mobile platform documentation, to understand the topic and identify suitable testing techniques.
-
Contribute back: If you develop a reliable testing procedure, consider contributing a new MASTG TEST and a MASTG DEMO so others can reuse it.
MAS-P provides a baseline for user privacy protection.
This profile outlines essential practices that mobile apps should follow to protect the disclosure of users' personally identifiable information (PII) or other sensitive information, such as health, medical, or financial data, and ensure compliance with prevailing data protection regulations.
It is intended to work cohesively with other OWASP MAS profiles, such as MAS-L1 and MAS-L2, ensuring a holistic approach to both privacy and security.
MAS-P is recommended for
- all mobile apps that deal with user-sensitive data.
Requirements¶
| Requirement | MASWE ID | Platform | MASVS ID | Tests | Status |
|---|---|---|---|---|---|
| The app adequately manages permissions. | MASWE-0066: Inadequate Permission Management | MASVS-PRIVACY-1 | 9 | ||
| The app uses anonymization or pseudonymisation measures. | MASWE-0067: Lack of Anonymization or Pseudonymisation Measures | MASVS-PRIVACY-2 | 0 | ||
| The app does not use persistent or unique identifiers in a way that enables user tracking. | MASWE-0068: Incorrect Use of Identifiers for User Tracking | MASVS-PRIVACY-2 | 0 | ||
| The app uses privacy-preserving functionality. | MASWE-0069: Usage of Non-Privacy-Preserving Functionality | MASVS-PRIVACY-2 | 0 | ||
| The app informs the user about the privacy implications before performing an action. | MASWE-0070: Inadequate Awareness for Privacy Relevant Actions | MASVS-PRIVACY-2 | 0 | ||
| The app uses adequate defaults for privacy relevant actions. | MASWE-0071: Inadequate Defaults for Privacy Relevant Actions | MASVS-PRIVACY-2 | 0 | ||
| The app provides an adequate privacy policy. | MASWE-0072: Inadequate Privacy Policy | MASVS-PRIVACY-3 | 0 | ||
| The app adequately declares all user collected data. | MASWE-0073: Inadequate Data Collection Declarations | MASVS-PRIVACY-3 | 3 | ||
| The app adequately declares all tracking domains it connects to. | MASWE-0074: Inadequate Tracking Domains Declarations | MASVS-PRIVACY-3 | 1 | ||
| The app offers reproducible builds. | MASWE-0075: Non-Reproducible Builds | MASVS-PRIVACY-3 | 0 | ||
| The app provides adequate controls to manage user data. | MASWE-0076: Lack of Proper Data Management Controls | MASVS-PRIVACY-4 | 0 | ||
| The app provides adequate controls over the visibility of user data. | MASWE-0077: Inadequate Data Visibility Controls | MASVS-PRIVACY-4 | 0 | ||
| The app requests user consent prior to any data processing. | MASWE-0078: Inadequate or Ambiguous User Consent Mechanisms | MASVS-PRIVACY-4 | 0 |