Google and Apple have removed hundreds of apps from their app stores at the request of governments around the world, creating regional disparities in access to mobile apps at a time when many economies are becoming increasingly dependent on them.
At the request of the Indian government, the mobile phone giants have removed over 200 Chinese apps in recent years, including widely downloaded apps like TikTok. Similarly, the companies removed LinkedIn, a must-have professional networking app, from Russian app stores at the request of the Russian government.
However, access to apps is only a concern. Developers also regionalize apps, meaning they produce different versions for different countries. This raises the question of whether these apps differ in their security and privacy features by region.
In a perfect world, app access, security, and privacy features would be consistent everywhere. Popular mobile apps should be available without increasing the risk of users being spied on or tracked, depending on the country they are in, especially given that not every country has strict privacy regulations.
My colleagues and I recently researched the availability and privacy policies of thousands of globally popular apps on Google Play, the app store for Android devices, in 26 countries. We’ve noticed differences in app availability, security, and privacy.
While our study confirms reports of takedowns due to government requests, we also found many differences introduced by app developers. We have found instances of apps with settings and disclosures that expose users to higher or lower security and privacy risks depending on the country in which they are downloaded.
Suggested reading: Online Dating Fatigue: Why Some People Turn to Face-to-Face Apps First
Geo blocked apps
The countries and a special administrative region in our study differ in terms of location, population and gross domestic product. These include the US, Germany, Hungary, Ukraine, Russia, South Korea, Turkey, Hong Kong and India. We also included countries like Iran, Zimbabwe and Tunisia where data collection was difficult. We analyzed 5,684 globally popular apps, each with over 1 million installs, across the top 22 app categories including Books & Reference, Education, Medical, and News & Magazines.
Our study showed high levels of geo-blocking, with 3,672 out of 5,684 popular apps globally blocked in at least one of our 26 countries. Developer blocking was significantly higher than government-mandated takedowns across all our countries and app categories. We found that Iran and Tunisia have the highest blocking rates, with apps like Microsoft Office, Adobe Reader, Flipboard, and Google Books all unavailable for download.
We’ve noticed regional overlaps in geo-blocked apps. In the European countries in our study – Germany, Hungary, Ireland and the UK – 479 of the same apps were geo-blocked. Eight of these, including Blued and USA Today News, have only been banned in the European Union, possibly due to the region’s General Data Protection Regulation. Turkey, Ukraine and Russia also show similar blocking patterns, with high blocking of virtual private network apps in Turkey and Russia, consistent with the recent surge in surveillance laws.
Of the 61 country-specific takedowns by Google, 36 exclusively affected South Korea, including 17 gambling and gaming apps removed under the national ban on online gambling. Surprisingly, while the Indian government took down Chinese apps with full disclosure, most of the takedowns we observed happened without much publicity or debate.
Differences in security and privacy
The apps we downloaded from Google Play also showed differences in their security and privacy features depending on the country. One hundred and twenty-seven apps differed in what the apps were allowed to access on users’ phones, 49 of which had additional permissions that Google deemed “dangerous.” Apps in Bahrain, Tunisia, and Canada requested the most dangerous additional permissions.
Three VPN apps allow plain text communication in some countries, which allows unauthorized access to users’ communications. One hundred and eighteen apps varied in the number of ad trackers included in an app in some countries, with the gaming, entertainment and social categories seeing the largest increase in the number of ad trackers compared to the common baseline in Iran and Ukraine across all countries.
One hundred and three apps have different privacy policies depending on the country. Users in countries not covered by data protection regulations, such as B. the GDPR in the EU and the California Consumer Privacy Act in the US, are exposed to a higher data protection risk. For example, 71 apps available on Google Play have GDPR compliance clauses only in the EU and CCPA only in the US. Twenty-eight apps using dangerous permissions don’t mention it, despite Google’s policy requiring it.
The role of app stores
App stores allow developers to target their apps to users based on a variety of factors, including their country and their device’s specific capabilities. Although Google has taken some steps toward transparency in its app store, our research shows that there are flaws in Google’s audit of the app ecosystem, some of which could compromise user security and privacy.
Possibly also due to app store policies in some countries, app stores specializing in certain regions of the world are becoming more and more popular. However, these app stores may not have proper review policies in place, allowing modified versions of apps to reach users. For example, a national government might pressure a developer to provide a version of an app that contains backdoor access. There is no easy way for users to distinguish a modified app from an unchanged one.
Our research makes several recommendations for app store owners to address the issues we found:
- Better moderate their country targeting features
- Provide detailed transparency reports on app deactivations
- Vet apps for differences by country or region
- Urge transparency from developers about their need for the differences
- Self-host app privacy policies to ensure their availability when policies are blocked in certain countries
Renuka Kumar, Ph.D. Student in Computer Science and Engineering, University of Michigan, first published this article on The Conversation.