Apple and Google introduced their versions of privacy nutrition labels to the mobile app stores to better inform users of the apps' data practices. However, these labels are self-reported by developers and have been found to contain many inaccuracies due to misunderstandings of the label taxonomy. In this work, we present Matcha, an IDE plugin that uses automated code analysis to help developers create accurate Google Play data safety labels. Developers can benefit from Matcha's ability to detect user data accesses and transmissions while staying in control of the generated label by adding custom Java annotations and modifying an auto-generated XML specification. Our evaluation with 12 developers showed that Matcha helped our participants improved the accuracy of a label they created with Google's official tool for a real-world app they developed. We found that participants preferred Matcha for its accuracy benefits. Drawing on Matcha, we discuss general design recommendations for developer tools used to create accurate standardized privacy notices.
Cite
@article{arxiv.2402.03582,
title = {Matcha: An IDE Plugin for Creating Accurate Privacy Nutrition Labels},
author = {Tianshi Li and Lorrie Faith Cranor and Yuvraj Agarwal and Jason I. Hong},
journal= {arXiv preprint arXiv:2402.03582},
year = {2024}
}