<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-mobile-app-privacy-audit
description: >-
  Conduct comprehensive privacy audits of mobile applications including data
  collection inventory, tracker detection, permission justification analysis,
  data flow mapping, consent mechanism validation, and compliance assessment
  against GDPR/CCPA using static analysis, traffic inspection, and runtime
  monitoring with Frida and Exodus Privacy tools.
domain: cybersecurity
subdomain: mobile-security
tags:
  - privacy-audit
  - gdpr
  - ccpa
  - data-collection
  - trackers
  - consent
  - exodus-privacy
  - data-flow
  - frida
  - pii-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1430", "T1426", "T1636"]
  owasp-mobile: ["M1", "M2"]
  tools: ["exodus-standalone", "frida", "mitmproxy", "apktool", "jadx", "mobsf"]
---

# Implementing Mobile App Privacy Audit

## Overview

Mobile privacy audits systematically evaluate what data an app collects, how it
processes and transmits that data, which third-party trackers are embedded, and
whether the app's privacy practices align with its privacy policy and applicable
regulations (GDPR, CCPA, COPPA). The audit produces a data inventory, tracker
report, and compliance gap analysis.

## Prerequisites

```bash
pip install frida-tools mitmproxy exodus-standalone
apt install apktool
# jadx: https://github.com/skylot/jadx/releases
# MobSF: docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf
```

## Workflow

### Step 1: Tracker and SDK Detection

```bash
# Exodus Privacy — detect embedded trackers
exodus-standalone target.apk
# Reports: tracker names, tracker signatures, permission list

# Static tracker detection
jadx -d jadx_out/ target.apk --deobf

# Common tracker SDKs
grep -rn 'com.google.firebase.analytics' jadx_out/
grep -rn 'com.facebook.appevents\|com.facebook.GraphRequest' jadx_out/
grep -rn 'com.adjust\|com.appsflyer\|io.branch' jadx_out/
grep -rn 'com.crashlytics\|com.bugsnag\|io.sentry' jadx_out/
grep -rn 'com.amplitude\|com.mixpanel\|com.segment' jadx_out/

# Check for advertising identifiers
grep -rn 'AdvertisingIdClient\|getAdvertisingId\|ASIdentifierManager' jadx_out/
grep -rn 'AAID\|IDFA\|GAID' jadx_out/
```

### Step 2: Permission Justification Analysis

```bash
# Extract permissions and map to data access
apktool d target.apk -o apktool_out/
grep 'uses-permission' apktool_out/AndroidManifest.xml

# Privacy-sensitive permissions requiring justification
grep -E 'ACCESS_FINE_LOCATION|ACCESS_COARSE_LOCATION|ACCESS_BACKGROUND_LOCATION' \
  apktool_out/AndroidManifest.xml
grep -E 'READ_CONTACTS|READ_CALL_LOG|READ_SMS|RECORD_AUDIO|CAMERA' \
  apktool_out/AndroidManifest.xml
grep -E 'READ_CALENDAR|READ_EXTERNAL_STORAGE|BODY_SENSORS' \
  apktool_out/AndroidManifest.xml

# Check for runtime permission requests
grep -rn 'requestPermissions\|checkSelfPermission\|shouldShowRequestPermissionRationale' jadx_out/

# iOS — check purpose strings (usage descriptions)
plutil -p ipa_out/Payload/*.app/Info.plist | grep -i 'UsageDescription'
```

### Step 3: Data Collection and Transmission Mapping

```bash
# Intercept network traffic to map data flows
mitmproxy --mode regular --listen-port 8080 -w privacy_audit.flow

# Analyze collected data endpoints
mitmdump -r privacy_audit.flow --set flow_detail=3 | \
  grep -iE 'analytics|track|collect|event|log|pixel'

# Check for PII in network requests
mitmdump -r privacy_audit.flow -s pii_detector.py

# Common PII patterns in traffic:
# - Email addresses, phone numbers
# - Device identifiers (IMEI, serial, MAC)
# - Location coordinates
# - Contact lists, calendar events

# Frida — monitor data collection APIs
frida -U -f com.target.app -l monitor_data_collection.js --no-pause
```

### Step 4: Consent Mechanism Validation

```bash
# Check for consent collection before data processing
grep -rn 'consent\|gdpr\|privacy\|opt.?in\|opt.?out' jadx_out/ | head -30

# Verify consent gate — does app collect data before consent?
# Start with clean install, monitor network traffic from first launch
mitmproxy --mode regular --listen-port 8080 --showhost
# Launch app → DO NOT accept consent → check if tracking fires

# Check for consent management platforms (CMP)
grep -rn 'OneTrust\|Didomi\|Quantcast\|IABConsent\|TCF\|IABTCF' jadx_out/

# Verify consent revocation
# Accept consent → revoke → verify tracking stops
```

### Step 5: Data Retention and Deletion

```bash
# Check for account deletion functionality
grep -rn 'deleteAccount\|removeUser\|eraseData\|purge' jadx_out/

# Verify local data cleanup
adb shell run-as com.target.app ls -la shared_prefs/
adb shell run-as com.target.app ls -la databases/
adb shell run-as com.target.app ls -la cache/

# After account deletion — check if local data persists
# After app uninstall — check for residual data
adb shell ls /sdcard/Android/data/com.target.app/ 2>/dev/null
adb shell ls /sdcard/Android/obb/com.target.app/ 2>/dev/null
```

### Step 6: Privacy Policy Compliance Check

```bash
# Extract declared data types from privacy policy
# Map against actual data collection observed in Steps 1-3
# Produce gap analysis:
# - Data collected but not disclosed
# - Trackers present but not disclosed
# - Permissions requested beyond stated purpose
# - Missing legal basis for processing
# - Third-party data sharing not disclosed

# iOS App Privacy Labels (App Store)
# Compare declared privacy labels with actual behavior
# Apple categories: Data Used to Track You, Data Linked to You, Data Not Linked to You
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Undisclosed trackers | Exodus scan | Trackers not in privacy policy |
| Pre-consent tracking | Network capture | Data sent before consent given |
| Excessive permissions | Manifest | Permissions beyond app function |
| PII in cleartext | Traffic analysis | Personal data sent unencrypted |
| No deletion | Code review | Missing account deletion feature |
| Advertising ID | Code review | AAID/IDFA collected without consent |

```yaml
title: Mobile App Privacy Audit Detection
id: b59c3659-d145-4628-8afe-1af5fafdf47d
status: experimental
description: Detects suspicious activity related to implementing mobile app privacy audit techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1430
  - attack.t1426
  - attack.t1636
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Tracker inventory completed via Exodus and manual analysis
- [ ] Permissions mapped to data collection justification
- [ ] Network data flows mapped and PII transmission identified
- [ ] Consent mechanism tested for pre-consent data collection
- [ ] Data retention and deletion capabilities verified
- [ ] Privacy policy alignment with actual behavior assessed

## References

- [Exodus Privacy](https://exodus-privacy.eu.org/)
- [OWASP MASTG — Data Storage](https://mas.owasp.org/MASTG/)
- [GDPR Article 6 — Lawfulness of Processing](https://gdpr-info.eu/art-6-gdpr/)
- [CCPA — California Consumer Privacy Act](https://oag.ca.gov/privacy/ccpa)
- [MITRE T1636 — Protected User Data](https://attack.mitre.org/techniques/T1636/)
