Pith. sign in

REVIEW 3 major objections 6 minor 54 references

A 4,116-policy audit finds mobile AR apps miss most U.S. state-law privacy disclosures.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

44.62% of audited mobile-AR privacy policies omit more than eight of twenty-two U.S. state-law disclosure requirements, with rights and biometric-data disclosures among the most commonly missing.

T0 review reviewed 2026-07-31 challenge →

load-bearing objection First large-scale MAR audit under U.S. state privacy laws, with a strong dataset/pipeline, but the 44.62% severe-disclosure headline is likely inflated by an over-inclusive legal taxonomy. the 3 major comments →

arxiv 2607.23984 v1 pith:BNTKH6OT submitted 2026-07-27 cs.CR

Beyond GDPR: Examining Disclosure Gaps in Mobile AR Privacy Policies under U.S. State Privacy Laws

Hong Chen , Xueling Zhang , Hong-Ning Dai , Huashan Chen , Qin Yu , Tiange Xie , Duohe Ma , Feng Liu This is my paper
classification cs.CR
keywords mobile augmented realityprivacy policy auditU.S. state privacy lawsdisclosure taxonomyLLM-based auditingbiometric dataGoogle Playcompliance measurement
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to measure whether mobile augmented reality (MAR) apps—which collect camera, location, spatial, and biometric-adjacent data—disclose their data practices well enough to satisfy the privacy laws now in effect in 20 U.S. states. It builds a dataset of 8,013 MAR apps from the Google Play store, distills the state laws into a 22-requirement disclosure taxonomy, and runs an LLM-based pipeline over 4,116 English-language privacy policies. The central finding is that disclosures are systematically incomplete: 44.62% of audited policies miss more than eight requirements, and four requirements—including the right to non-discrimination and an appeal mechanism—are missing in over 90% of policies. The gaps are largest exactly where MAR risk is highest: biometric-data collection is disclosed in 601 policies, but nearly all of those policies lack the incident-response and deletion disclosures that Colorado law requires. A sympathetic reader would take this as evidence that MAR privacy policies have not kept pace with the fragmented, evolving U.S. state-law landscape.

Core claim

The paper's central claim is that MAR privacy policies, at ecosystem scale, fail to reflect the disclosure obligations imposed by U.S. state comprehensive privacy laws. Using a taxonomy of 22 requirements derived from 20 state statutes—organized into 5 baseline requirements, 10 triggered requirements, and 7 conditional requirements in 4 logic chains—the audit finds that only a minority of policies are complete. More than half omit core consumer rights such as the right to access (58.1%), correction (59.5%), and deletion (50.8%); 97.4% lack an appeal mechanism; and among policies that disclose biometric-data collection, 99.8% lack a biometric incident-response protocol and 97.2% lack biometri

What carries the argument

The carrying object is the auditable disclosure taxonomy: a consolidated set of 22 requirements (Data Transparency D1–D6, Rights Notice R1–R9, Privacy Controls PC1–PC4, Policy Administration PA1–PA3) derived from the 20 state laws, with applicability modeled as baseline, triggered, or conditional. Four conditional logic chains encode legal preconditions—e.g., if a policy discloses biometric-data collection, it must also disclose an incident-response protocol and deletion guidelines; if it discloses selling or sharing, it must provide an opt-out. The second key mechanism is a four-stage automated pipeline (clean, annotate, extract, normalize) that labels passages, quotes exact evidence spans,

Load-bearing premise

The audit assumes the union of 22 disclosure requirements drawn from all 20 state laws applies to every U.S.-available app, and that a requirement is failed whenever the automated pipeline finds no matching passage; if the legal scope is too broad or the pipeline under-labels, the measured gaps are inflated.

What would settle it

Have a lawyer, working without the pipeline, audit a random sample of 100 of the 4,116 policies against the statutes of the specific states where each app is distributed, applying the same 22-requirement taxonomy by hand. If the human audit finds violation rates substantially below the paper's figures—particularly for the four requirements with violation rates above 90%—the automated numbers would not reflect real legal exposure.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If the findings hold, regulators have concrete evidence that MAR-specific sensitive data, such as spatial maps and bystander imagery, falls outside current definitions of sensitive personal information and needs explicit statutory treatment.
  • App markets could deploy automated screening tools to flag policies missing required disclosures during pre-release or periodic review, rather than relying on developer self-certification.
  • Developers cannot rely on generic privacy-policy templates: the paper's secondary analysis finds template-generated policies still show 5–8 violations in 56% of cases and more than 8 in 24% of cases.
  • The released dataset, taxonomy, and pipeline let other researchers reproduce the audit and extend it to other app categories or to future state laws.
  • The policy-maintenance gap implies that even apps with reasonable policies fall out of compliance when apps are updated but policies are not; 23.90% of U.S. MAR apps had not been updated since 2023 or earlier.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The audit measures what policies say, not what apps do; if a policy is incomplete, actual runtime behavior might be even less protective, so the findings are likely a lower bound on the transparency problem but say nothing about data-practice compliance.
  • The dominant under-labeling error mode (59% of mismatches are false negatives) means the measured violation rates could be overestimated; a more lenient re-labeling of ambiguous 'data' or 'third parties' passages would likely reduce—but probably not eliminate—the headline gaps.
  • Because the taxonomy unions all 20 state laws, a policy is counted as violating a requirement even if it targets a state that does not impose it (e.g., a biometric incident protocol required only by Colorado); a state-specific audit would yield lower but still substantial violation rates.
  • The same pipeline could be turned around to test whether GDPR-oriented policies, which are structurally similar in many MAR apps, are any closer to satisfying U.S. state-law expectations; the paper hints at regime mismatch when policies are written in GDPR terminology.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper presents a large-scale audit of mobile AR (MAR) app privacy policies against U.S. state comprehensive privacy laws. The authors build a Google Play MAR dataset (8,013 metadata records, 6,620 APKs, 6,426 privacy policies), derive a 22-requirement disclosure taxonomy from 20 state statutes, and apply a four-stage LLM pipeline (processing, annotation, extraction, normalization) to assess 4,116 English-language policies. They report that 44.62% of audited policies miss more than eight requirements, with particularly high violation rates for rights-related and biometric-specific disclosures. The dataset, taxonomy, and pipeline are released for reproducibility.

Significance. This is the first systematic attempt to audit MAR privacy policies against the fragmented U.S. state-law landscape. The contributions are substantial: a public MAR dataset, a law-derived taxonomy, and a largely traceable pipeline with human-validated labels and an extraction-fidelity check (98.32% at threshold 0.95). The descriptive ecosystem analysis (RQ1) and the taxonomy derivation (RQ2) are credible and valuable. However, the quantitative headline (RQ3) is not yet reliable because the taxonomy is a union of state-specific obligations applied uniformly to all policies, and because the pipeline's documented under-labeling would systematically inflate measured violations. With a sensitivity analysis restricted to broadly applicable requirements and error-bounded estimates, the paper could make a strong contribution.

major comments (3)
  1. [IV-B, VI-B] The audit scores every U.S.-available policy against all 22 requirements even though the taxonomy is a union of obligations from 20 state laws, several of which appear in only one or a few states: D2 is required only by California, D6 by California and Minnesota, PA1 by four states, PA2 only by Oregon, PA3 by New Hampshire and Minnesota, R7 only by California, R8/R9 by Minnesota and Maryland, and PC3/PC4 only by Colorado. Many of these state laws also have applicability thresholds (revenue, consumer counts, processing volume) and require a state nexus, so a policy that omits D2, PA2, PC3, PC4, etc., may still comply with every law that actually binds it. The paper performs no sensitivity analysis restricting the taxonomy to requirements shared across states or modeling statutory thresholds. Consequently, the headline 44.62% severe-omission rate and the >90% violation rates (e.g., R7 at 9
  2. [VII, Table VIII] The pipeline evaluation shows document-level multi-label Micro-F1 of 87.69% and Jaccard of 73.56%. The paper further reports that under-labeling dominates passage-level mismatches (1,183 of 1,999; 59.17%), with false negatives arising when passages refer only abstractly to 'information', 'data', or 'third parties'. Since a requirement is counted as violated when the pipeline finds no matching passage, systematic under-labeling directly inflates violation counts. The paper does not report document-level precision/recall and does not provide an error-bounded estimate of the effect of label error on the severe-omission rate. A best-case/worst-case analysis based on the confusion matrix, or a re-annotation of a random sample with corrected rates, is needed before the quantitative findings can be accepted.
  3. [VI-B3] The conditional-chain violation rates are computed only over policies whose trigger is detected by the same pipeline (e.g., Chain 3 uses policies where D1 discloses biometric data). If trigger detection is conservative, the denominator is reduced and the conditional rates describe a subset that may not be representative of all apps engaging in the underlying practice. The paper should report how many policies were excluded due to absent triggers and, if feasible, validate the triggers against the human-annotated ground truth.
minor comments (6)
  1. [Abstract, VI-B] Headline percentages such as 44.62% and the >90% violation rates are reported without confidence intervals; add them, especially given the n=3,855 denominator.
  2. [Table IV] The legend symbols (blank, G#, ⊙, #) are visually hard to distinguish, especially after typesetting. Use explicit text labels such as 'Baseline', 'Triggered', 'Conditional', 'Not required'.
  3. [Fig. 3a, VI-B] Figure 3a labels C1–C4 as if they were individual requirements; the text calls them 'logic chains'. Clarify the terminology so the violation percentages are not misinterpreted as statutory requirements.
  4. [III-F, V-A] The text moves from 6,426 collected policies to 4,116 English policies but does not state how many were excluded by language detection or by the 261 'unlabeled' files. Report these numbers explicitly and discuss potential language bias.
  5. [VI-C, VII] The relationship between '1,529 annotations' in Section VI-C2 and '1,999 mismatches' in Section VII is confusing. Define which set each number refers to.
  6. [VII-A] The secondary APPG-analysis (766/6,426 policies) is introduced without methodological detail on the keyword fingerprinting. Either add a brief description or move the details to the supplemental materials.

Circularity Check

0 steps flagged

No significant circularity: the audit applies an externally derived legal taxonomy and validates its pipeline against human ground truth, with no fitted parameter or self-citation chain determining the results.

full rationale

The paper's derivation chain is not circular. The 22-requirement taxonomy is constructed from 20 enacted U.S. state comprehensive privacy statutes via statutory review (Section IV-B) and is not derived from the policy corpus or from the outcome statistics. The baseline/triggered/conditional categories are defined by legal preconditions independent of the audit results. The auditing pipeline applies this external taxonomy to policy text, and its judgments are validated against a human-adjudicated gold standard (Section VI-C, Table VIII), including document-level precision, recall, and F1; no parameter is fitted to the reported violation rates. The conditional logic chains (e.g., Chain 3: BD in D1 implies PC3 and PC4) are legal implication rules, and although trigger detection and violation detection share the same LLM pipeline, this shared measurement instrument does not make the conclusions true by construction; the paper separately evaluates extraction fidelity and annotation agreement. The critique that single-state requirements (e.g., PC3/PC4, only in Colorado) are applied to all policies is a substantive legal-applicability and measurement-validity concern, not a circularity: the taxonomy is an input, not an output, of the audit. No load-bearing self-citation chain exists; the most closely related prior work [27] is discussed and critiqued, not relied upon. Therefore the empirical findings are not forced by definition or by fitting, and no circular step can be exhibited from the paper's equations or self-citations.

Axiom & Free-Parameter Ledger

2 free parameters · 4 axioms · 0 invented entities

The central claim rests on a self-constructed legal taxonomy and an LLM labeler with measurable error; no physical entities are introduced. The key free parameters are the >8 threshold and the AR-classifier confidence threshold.

free parameters (2)
  • Severe omission threshold = >8 requirements
    Hand-chosen cutoff defining the 44.62% headline result; no principled justification given for why 'more than eight' marks severe omission.
  • DeBERTa AR classifier confidence threshold = 0.96
    Empirically set in Section III-D to trade off LLM calls during dataset expansion; affects dataset composition but not audit labels directly.
axioms (4)
  • domain assumption All 20 state comprehensive privacy laws' disclosure obligations can be consolidated into one taxonomy and applied to every U.S.-available app policy.
    Section IV-B constructs a union taxonomy; Table IV shows single-state items (PC3/PC4 only Colorado, PA2 only Oregon, R6/R8 limited); applying all to every policy inflates violation rates.
  • domain assumption A requirement is failed if the pipeline finds no passage with the corresponding label.
    Section VI-B computes violations from absence of labels; with document-level micro-F1 87.69 and under-labeling 59% of mismatches (Section VII), absence is not proof of legal non-disclosure.
  • domain assumption Privacy policies are the complete disclosure vehicle; no code/dynamic analysis is needed for the disclosure claim.
    Stated limitation in Section VII-B; okay for disclosure-only claim, but means no verification of actual practice.
  • domain assumption The first author's reading of the statutes plus author consensus is a valid legal benchmark.
    Section IV-B: taxonomy extracted by first author and consolidated by discussion; no external legal validation reported.

reviewed 2026-07-31 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Beyond GDPR: Examining Disclosure Gaps in Mobile AR Privacy Policies under U.S. State Privacy Laws." pith.science (2026). https://pith.science/paper/BNTKH6OT

@misc{pith2026260723984,
  author       = {Pith},
  title        = {Pith review of: Beyond GDPR: Examining Disclosure Gaps in Mobile AR Privacy Policies under U.S. State Privacy Laws},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BNTKH6OT}},
  note         = {Machine review of arXiv:2607.23984}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Mobile Augmented Reality (MAR) apps can collect and process highly sensitive data such as spatial maps and biometrics, yet their privacy policies remain largely understudied. Prior audits of app privacy policies have typically focused on a single legal framework, such as the GDPR. Meanwhile, 20 U.S. states have comprehensive privacy laws in effect, creating a fragmented and rapidly evolving set of privacy policy obligations. To date, no study has systematically audited privacy policies against this emerging body of state-level legislation. In this paper, we present the first large-scale audit of MAR privacy policies under U.S. state privacy laws. We construct a dataset covering the MAR ecosystem, including 8,013 Google Play MAR app metadata records worldwide, and a U.S.-based subset with 6,620 APKs and 6,426 privacy policy files. We further derive an auditable disclosure taxonomy with 5 baseline requirements, 10 triggered requirements, and 4 logic chains, and build a validated four-stage automated pipeline that produces traceable, evidence-grounded disclosure judgments. Our audit reveals widespread disclosure gaps: 44.62\% of audited policies exhibit severe disclosure omissions, with each missing more than eight requirements, and four privacy-policy requirements have violation rates above 90\%. These findings suggest that MAR privacy disclosures are not keeping pace with the growing complexity of U.S. state privacy regulation. We release our dataset, taxonomy, and auditing pipeline to support future research on scalable privacy compliance auditing.

Figures

Figures reproduced from arXiv: 2607.23984 by Duohe Ma, Feng Liu, Hong Chen, Hong-Ning Dai, Huashan Chen, Qin Yu, Tiange Xie, Xueling Zhang.

Figure 1
Figure 1. Figure 1: Overview of Pipeline. This preprocessing step is necessary because AR-related ex￾pressions vary substantially across languages, making direct multilingual keyword matching unreliable. We then apply keyword matching using two patterns: (i) “augmented reality” in a case-insensitive manner, and (ii) “AR” only when it appears as a standalone token. Both patterns are applied to app titles and descriptions. This… view at source ↗
Figure 2
Figure 2. Figure 2: Ecosystem characteristics of identified MAR apps. (a) Downloads. (b) Top-8 Categories. (c) Release vs Update Year in U.S. [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: MAR privacy-policy audit results. (a) Violation counts. (b) Policy effective/update years. (c) Disclosed processing purposes. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

54 extracted references · 1 linked inside Pith

  1. [1]

    Mobile augmented reality (AR) users worldwide 2023–2028,

    P. Taylor, “Mobile augmented reality (AR) users worldwide 2023–2028,” https://www.statista.com/statistics/1098630/global-mobile-augmented-r eality-ar-users/, Nov. 2025, accessed: 2026-04-27

    arXiv 2023

  2. [2]

    Investigating privacy concerns related to mobile augmented reality apps - A vignette based online experiment,

    D. Harborth and S. Pape, “Investigating privacy concerns related to mobile augmented reality apps - A vignette based online experiment,” Comput. Hum. Behav., vol. 122, p. 106833, 2021

    2021

  3. [3]

    Boone et al. v. Snap Inc.: Class Action Complaint,

    Boone et al., “Boone et al. v. Snap Inc.: Class Action Complaint,” Circuit Court of the Eighteenth Judicial Circuit, DuPage County, Illinois, Case No. 2022-LA-708, Aug. 2022. [Online]. Available: https://angeion-public.s3.amazonaws.com/www.SnapIllinoisBIPASettl ement.com/docs/Snap-Class%20Action%20Complaint.pdf

    2022

  4. [4]

    In re TikTok, Inc., Consumer Privacy Litigation: Consolidated Amended Class Action Complaint,

    Plaintiffs in In re TikTok, Inc., Consumer Privacy Litigation, “In re TikTok, Inc., Consumer Privacy Litigation: Consolidated Amended Class Action Complaint,” United States District Court for the Northern District of Illinois, Eastern Division, MDL No. 2948, Master Docket No. 20-cv-4699, Document 114, Dec. 2020. [Online]. Available: https://cdn.arstechnic...

    2020

  5. [5]

    Halim v. Charlotte Tilbury Beauty Inc. et al.: Class Action Complaint,

    Halim, Olena, “Halim v. Charlotte Tilbury Beauty Inc. et al.: Class Action Complaint,” Circuit Court of Cook County, Illinois, Case No. 2022-CH-11832, Dec. 2022. [Online]. Available: https://www.classact ion.org/media/halim-v-charlotte-tilbury-beauty-inc-et-al.pdf

    2022

  6. [6]

    Theriot v. Louis Vuitton North America, Inc.: Class Action Complaint,

    Theriot, Paula, “Theriot v. Louis Vuitton North America, Inc.: Class Action Complaint,” United States District Court for the Southern District of New York, Case No. 1:22-cv-02944, Apr. 2022. [Online]. Available: https://www.classaction.org/media/theriot-v-louis-vuitton-n orth-america-inc.pdf

    2022

  7. [7]

    Hidden in plain sight: Exploring privacy risks of mobile augmented reality applications,

    S. M. Lehman, A. S. Alrumayh, K. Kolhe, H. Ling, and C. C. Tan, “Hidden in plain sight: Exploring privacy risks of mobile augmented reality applications,”ACM Trans. Priv. Secur., vol. 25, no. 4, pp. 26:1– 26:35, 2022

    2022

  8. [8]

    US State Privacy Legislation Tracker,

    International Association of Privacy Professionals, “US State Privacy Legislation Tracker,” IAPP Resource, 2026, dynamic tracker of comprehensive U.S. state privacy bills and laws; statistics counted by the authors as of January 1, 2026. [Online]. Available: https://iapp.org/resources/article/us-state-privacy-legislation-tracker

    2026

  9. [9]

    Making mobile augmented reality applications accessible,

    J. Herskovitz, J. Wu, S. White, A. Pavel, G. Reyes, A. Guo, and J. P. Bigham, “Making mobile augmented reality applications accessible,” in Proc. ACM SIGACCESS Conf. Comput. Accessibility (ASSETS), Oct. 2020, pp. 3:1–3:14

    2020

  10. [10]

    A study of user privacy in Android mobile AR apps,

    X. Yang and X. Zhang, “A study of user privacy in Android mobile AR apps,” inProc. IEEE/ACM Int. Conf. Autom. Softw. Eng. (ASE), Oct. 2022, pp. 226:1–226:5

    2022

  11. [11]

    xr-droid: A benchmark dataset for AR/VR and security applications,

    A. Alghamdi, A. A. Kinoon, A. Alghuried, and D. Mohaisen, “xr-droid: A benchmark dataset for AR/VR and security applications,”IEEE Trans. Dependable Secur. Comput., vol. 22, no. 2, pp. 1418–1430, 2025

    2025

  12. [12]

    XRZoo: A large-scale and versatile dataset of extended reality (XR) applications,

    S. Li, C. Zhang, C. Gao, and M. R. Lyu, “XRZoo: A large-scale and versatile dataset of extended reality (XR) applications,”CoRR, vol. abs/2412.06759, 2024

    arXiv 2024

  13. [13]

    OVRseen: Auditing network traffic and privacy policies in Oculus VR,

    R. Trimananda, H. Le, H. Cui, J. T. Ho, A. Shuba, and A. Markopoulou, “OVRseen: Auditing network traffic and privacy policies in Oculus VR,” inProc. USENIX Secur. Symp., Aug. 2022, pp. 3789–3806

    2022

  14. [14]

    An empirical study on Oculus virtual reality applications: Security and privacy perspectives,

    H. Guo, H. Dai, X. Luo, Z. Zheng, G. Xu, and F. He, “An empirical study on Oculus virtual reality applications: Security and privacy perspectives,” inProc. IEEE/ACM Int. Conf. Softw. Eng. (ICSE), Apr. 2024, pp. 159:1– 159:13

    2024

  15. [15]

    VPVet: Vetting privacy policies of virtual reality apps,

    Y . Zhan, Y . Meng, L. Zhou, Y . Xiong, X. Zhang, L. Ma, G. Chen, Q. Pei, and H. Zhu, “VPVet: Vetting privacy policies of virtual reality apps,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), Oct. 2024, pp. 1746–1760

    2024

  16. [16]

    Reliable third-party library detection in Android and its security applications,

    M. Backes, S. Bugiel, and E. Derr, “Reliable third-party library detection in Android and its security applications,” inProc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), Oct. 2016, pp. 356–367

    2016

  17. [17]

    A systematic review of privacy policy literature,

    Y . Javed and A. Sajid, “A systematic review of privacy policy literature,” ACM Comput. Surv., vol. 57, no. 2, pp. 45:1–45:43, 2025

    2025

  18. [18]

    Polisis: Automated analysis and presentation of privacy policies using deep learning,

    H. Harkous, K. Fawaz, R. Lebret, F. Schaub, K. G. Shin, and K. Aberer, “Polisis: Automated analysis and presentation of privacy policies using deep learning,” inProc. USENIX Secur. Symp., Aug. 2018, pp. 531–548

    2018

  19. [19]

    Calpric: Inclusive and fine-grain labeling of privacy policies with crowdsourcing and active learning,

    W. Qiu, D. Lie, and L. M. Austin, “Calpric: Inclusive and fine-grain labeling of privacy policies with crowdsourcing and active learning,” in Proc. USENIX Secur. Symp., Aug. 2023, pp. 1055–1072

    2023

  20. [20]

    PolicyLint: Investigating internal privacy policy contradictions on Google Play,

    B. Andow, S. Y . Mahmud, W. Wang, J. Whitaker, W. Enck, B. Reaves, K. Singh, and T. Xie, “PolicyLint: Investigating internal privacy policy contradictions on Google Play,” inProc. USENIX Secur. Symp., Aug. 2019, pp. 585–602. IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 13

    2019

  21. [21]

    Actions speak louder than words: Entity-sensitive privacy policy and data flow analysis with PoliCheck,

    B. Andow, S. Y . Mahmud, J. Whitaker, W. Enck, B. Reaves, K. Singh, and S. Egelman, “Actions speak louder than words: Entity-sensitive privacy policy and data flow analysis with PoliCheck,” inProc. USENIX Secur. Symp., Aug. 2020, pp. 985–1002

    2020

  22. [22]

    Smart home privacy policies demystified: A study of availability, content, and coverage,

    S. Manandhar, K. Kafle, B. Andow, K. Singh, and A. Nadkarni, “Smart home privacy policies demystified: A study of availability, content, and coverage,” inProc. USENIX Secur. Symp., Aug. 2022, pp. 3521–3538

    2022

  23. [23]

    PolicyChecker: Analyzing the GDPR completeness of mobile apps’ privacy policies,

    A. Xiang, W. Pei, and C. Yue, “PolicyChecker: Analyzing the GDPR completeness of mobile apps’ privacy policies,” inProc. ACM SIGSAC Conf. Comput. Commun. Secur. (CCS), Nov. 2023, pp. 3373–3387

    2023

  24. [24]

    PolicyPulse: Precision semantic role extraction for enhanced privacy policy comprehension,

    A. Adhikari, S. Das, and R. Dewri, “PolicyPulse: Precision semantic role extraction for enhanced privacy policy comprehension,” inProc. Netw. Distrib. Syst. Secur. Symp. (NDSS), Feb. 2025

    2025

  25. [25]

    PoliGraph: Automated privacy policy analysis using knowledge graphs,

    H. Cui, R. Trimananda, A. Markopoulou, and S. Jordan, “PoliGraph: Automated privacy policy analysis using knowledge graphs,” inProc. USENIX Secur. Symp., Aug. 2023, pp. 1037–1054

    2023

  26. [26]

    Evaluating LLMs towards automated assessment of privacy policy understandability,

    K. Mori, D. Ito, T. Fukunaga, T. Watanabe, Y . Takata, M. Kamizono, and T. Mori, “Evaluating LLMs towards automated assessment of privacy policy understandability,” inProc. Symp. Usable Secur. Privacy (USEC), Feb. 2025

    2025

  27. [27]

    Evaluating privacy policies under modern privacy laws at scale: An LLM-based automated approach,

    Q. Xie, K. Ramakrishnan, and F. Li, “Evaluating privacy policies under modern privacy laws at scale: An LLM-based automated approach,” in Proc. USENIX Secur. Symp., Aug. 2025, pp. 5797–5816

    2025

  28. [28]

    Mobile augmented reality: User interfaces, frameworks, and intelligence,

    J. Cao, K. Lam, L. Lee, X. Liu, P. Hui, and X. Su, “Mobile augmented reality: User interfaces, frameworks, and intelligence,”ACM Comput. Surv., vol. 55, no. 9, pp. 189:1–189:36, 2023

    2023

  29. [29]

    AndroZoo: A retrospective with a glimpse into the future,

    M. Alecci, P. J. R. Jim ´enez, K. Allix, T. F. Bissyand ´e, and J. Klein, “AndroZoo: A retrospective with a glimpse into the future,” inProc. IEEE/ACM Int. Conf. Mining Softw. Repositories (MSR), Apr. 2024, pp. 389–393

    2024

  30. [30]

    Mobile Operating System Market Share Worldwide,

    StatCounter, “Mobile Operating System Market Share Worldwide,” ht tps://gs.statcounter.com/os-market-share/mobile/worldwide, 2026, accessed: 2026-04-28

    2026

  31. [31]

    iOS, your OS, everybody’s OS: Vetting and analyzing network services of iOS applications,

    Z. Tang, K. Tang, M. Xue, Y . Tian, S. Chen, M. Ikram, T. Wang, and H. Zhu, “iOS, your OS, everybody’s OS: Vetting and analyzing network services of iOS applications,” inProc. USENIX Secur. Symp., Aug. 2020, pp. 2415–2432

    2020

  32. [32]

    googletrans,

    ssut, “googletrans,” 2025, accessed: 2026-04-28. [Online]. Available: https://github.com/ssut/py-googletrans

    2025

  33. [33]

    google-play-scraper: Node.js scraper to get data from Google Play,

    facundoolano, “google-play-scraper: Node.js scraper to get data from Google Play,” https://github.com/facundoolano/google-play-scraper, 2025, MIT License; accessed 2026-04-28

    2025

  34. [34]

    Findings of the WMT25 general machine translation shared task: Time to stop evaluating on easy test sets,

    T. Kocmi, E. Artemova, E. Avramidis, R. Bawden, O. Bojar, K. Dranch, A. Dvorkovich, S. Dukanov, M. Fishel, M. Freitag, T. Gowda, R. Grund- kiewicz, B. Haddow, M. Karpinska, P. Koehn, H. Lakougna, J. Lundin, C. Monz, K. Murray, M. Nagata, S. Perrella, L. Proietti, M. Popel, M. Popovi´c, P. Riley, M. Shmatova, S. Steingr ´ımsson, L. Yankovskaya, and V . Zou...

    2025

  35. [35]

    RED-CT: A systems design methodology for using LLM-labeled data to train and de- ploy edge linguistic classifiers,

    D. Farr, N. Manzonelli, I. Cruickshank, and J. West, “RED-CT: A systems design methodology for using LLM-labeled data to train and de- ploy edge linguistic classifiers,” inProc. Int. Conf. Comput. Linguistics (COLING), Jan. 2025, pp. 58–67

    2025

  36. [36]

    DeBERTaV3: Improving DeBERTa us- ing ELECTRA-style pre-training with gradient-disentangled embedding sharing,

    P. He, J. Gao, and W. Chen, “DeBERTaV3: Improving DeBERTa us- ing ELECTRA-style pre-training with gradient-disentangled embedding sharing,” inProc. Int. Conf. Learn. Representations (ICLR), May 2023

    2023

  37. [37]

    LoRA: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “LoRA: Low-rank adaptation of large language models,” inProc. Int. Conf. Learn. Representations (ICLR), Apr. 2022

    2022

  38. [38]

    apkeep: A command-line tool for downloading apk files from various sources,

    Electronic Frontier Foundation, “apkeep: A command-line tool for downloading apk files from various sources,” https://github.com/EFFor g/apkeep, 2025, accessed: 2026-04-28

    2025

  39. [39]

    Sensor Tower: Digital intelligence and app data analy- sis,

    Sensor Tower, “Sensor Tower: Digital intelligence and app data analy- sis,” https://sensortower.com/, 2026, accessed: 2026-04-28

    2026

  40. [40]

    Playwright,

    Microsoft, “Playwright,” https://github.com/microsoft/playwright, 2025, accessed: 2026-04-28

    2025

  41. [41]

    SingleFile: Save a complete web page as a single HTML file,

    G. Lormeau, “SingleFile: Save a complete web page as a single HTML file,” https://github.com/gildas-lormeau/SingleFile, 2025, accessed: 2026-04-28

    2025

  42. [42]

    readability-lxml,

    martinblech, “readability-lxml,” https://pypi.org/project/readability-lxm l/, 2025, accessed: 2026-04-28

    2025

  43. [43]

    html2text,

    Alir3z4, “html2text,” https://github.com/Alir3z4/html2text, 2025, accessed: 2026-04-28

    2025

  44. [44]

    trafilatura,

    adbar, “trafilatura,” https://github.com/adbar/trafilatura, 2025, accessed: 2026-04-28

    2025

  45. [45]

    MarkItDown,

    Microsoft, “MarkItDown,” https://github.com/microsoft/markitdown, 2025, accessed: 2026-04-28

    2025

  46. [46]

    Qwen3.5: Towards native multimodal agents,

    Qwen Team, “Qwen3.5: Towards native multimodal agents,” Feb. 2026, blog post, accessed Apr. 20, 2026. [Online]. Available: https://qwen.ai/blog?id=qwen3.5

    2026

  47. [47]

    LLM Leaderboard - Comparison of over 100 AI models from OpenAI, Google, DeepSeek & others,

    Artificial Analysis, “LLM Leaderboard - Comparison of over 100 AI models from OpenAI, Google, DeepSeek & others,” 2026, accessed: 2026-04-20. [Online]. Available: https://artificialanalysis.ai/leaderboard s/models

    2026

  48. [48]

    Google Play is not a long tail market: an empirical analysis of app adoption on the Google Play app market,

    N. Zhong and F. Michahelles, “Google Play is not a long tail market: an empirical analysis of app adoption on the Google Play app market,” inProc. ACM Symp. Appl. Comput. (SAC), Mar. 2013, pp. 499–504

    2013

  49. [49]

    To- wards faithful and robust LLM specialists for evidence-based question- answering,

    T. Schimanski, J. Ni, M. Kraus, E. Ash, and M. Leippold, “To- wards faithful and robust LLM specialists for evidence-based question- answering,” inProc. Annu. Meeting Assoc. Comput. Linguistics (ACL), Aug. 2024, pp. 1913–1931

    2024

  50. [50]

    LLM hallucinations in practical code generation: Phe- nomena, mechanism, and mitigation,

    Z. Zhang, C. Wang, Y . Wang, E. Shi, Y . Ma, W. Zhong, J. Chen, M. Mao, and Z. Zheng, “LLM hallucinations in practical code generation: Phe- nomena, mechanism, and mitigation,”Proc. ACM Softw. Eng., vol. 2, no. ISSTA, pp. 481–503, 2025

    2025

  51. [51]

    RapidFuzz,

    maxbachmann, “RapidFuzz,” https://github.com/maxbachmann/rapidfu zz, 2025, accessed: 2026-04-28

    2025

  52. [52]

    Qwen3 embedding: Advancing text embedding and reranking through foundation models,

    Y . Zhang, M. Li, D. Long, X. Zhang, H. Lin, B. Yang, P. Xie, A. Yang, D. Liu, J. Lin, F. Huang, and J. Zhou, “Qwen3 embedding: Advancing text embedding and reranking through foundation models,”CoRR, vol. abs/2506.05176, 2025

    Pith/arXiv arXiv 2025

  53. [53]

    Is it a trap? A large-scale empirical study and comprehensive assessment of online automated privacy policy generators for mobile apps,

    S. Pan, D. Zhang, M. Staples, Z. Xing, J. Chen, X. Xu, and T. Hoang, “Is it a trap? A large-scale empirical study and comprehensive assessment of online automated privacy policy generators for mobile apps,” inProc. USENIX Secur. Symp., Aug. 2024

    2024

  54. [54]

    User Data Policy,

    Google, “User Data Policy,” https://support.google.com/googleplay/an droid-developer/answer/10144311, 2026, Google Play Developer Policy Center. Accessed: 2026-04-25

    arXiv 2026

This paper was first reviewed by deepseek-v4-flash on July 31, 2026.