Privacy review of mobile apps: SDKs, permissions and declarations
You show with evidence what an app does with personal data: data inventory, permission and SDK inventory, traffic verification, comparison with store declarations, consent flows and assessment against the rules of different countries.
Level 301 · 22 lessons · 18 practice labs
Lessons
Data and rules
- Personal data on mobile: location, contacts, identifiers, health
- Privacy rules around the world: GDPR, CCPA, KVKK, LGPD and shared principles
- Store privacy requirements: the data safety form and privacy labels
- Extra rules for children's and health apps
- Short task: inventory the data an app collects, with the purpose of each
Permissions and SDKs
- Permission minimisation review
- Detecting trackers and SDKs: recognition by signature
- SDK data practices and the contractual side
- Identifiers and fingerprinting
- Privacy manifests and required-reason APIs
- Short task: find the tracker SDKs in an APK and note the permission each one uses
Declaration versus reality
- Comparing traffic with the declaration
- Data sent before consent
- Reviewing the consent screen: manipulative design
- Retention, account and data deletion
- Short task: find the data type seen in traffic but missing from the store declaration
Assessment and report
- The privacy impact assessment
- Cross-border data transfers
- Reporting privacy findings
- Privacy regression checks on every release
- Short task: write a two-page privacy findings report for a fitness app
Capstone
- Capstone: carry out the privacy review of a school communication app and correct its declarations
Practice labs
- List the data types an app collects: Extract the fields collected on the sign-up and profile screens.
- Build the data inventory with purposes: Tabulate purpose, storage location and recipient for each data type.
- Identify needlessly collected data and propose reductions: Question each field in the inventory against its purpose and justify five that can go.
- Find the tracker SDKs in an APK: Scan the package against tracker signatures and list the matches.
- Note the permission each SDK uses: Match the SDKs to manifest permissions and calls in the code.
- Compare IPA privacy manifests with the SDK inventory: Find the required-reason API uses and report the one missing its declaration.
- Read the data types in the store declaration: Turn the data safety declaration into a table.
- Find the data seen in traffic but missing from the declaration: Compare the prepared capture with the declaration and prove the missing data type.
- Correct the declaration and align it across platforms: Correct the Android data safety declaration and iOS privacy label from traffic evidence and make them consistent.
- Find the requests sent before consent: Filter third-party requests before the consent moment in the capture.
- Assess manipulative design on a consent screen: Write up unequal options and pre-ticked boxes in the screenshots as findings.
- Verify that account deletion really removes data: Query the records left on the lab backend after a deletion request and assess them against the retention policy.
- Decide which rules apply to an app: Mark which of GDPR, CCPA, KVKK and LGPD apply given the users' countries.
- Check the extra requirements for a children's app: Check the advertising SDK, age verification and parental consent status in the Gelincik Okulları app.
- Derive cross-border transfers from traffic and assess them: Determine server locations, tabulate which data goes to which country and write the safeguards needed.
- Write one privacy finding with evidence: Turn the advertising ID sent without consent into a finding note.
- Write a two-page privacy report for a fitness app: Summarise inventory, SDK, declaration and consent findings.
- Set up a privacy regression check for every release: Write a script that compares permission, SDK and domain lists with the previous version and reports the difference.
About this course
You show with evidence what an app does with personal data: data inventory, permission and SDK inventory, traffic verification, comparison with store declarations, consent flows and assessment against the rules of different countries.
What you will learn
- Data and rules
- Permissions and SDKs
- Declaration versus reality
- Assessment and report
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.