An Empirical Study of Data Access Practice in Android AR Apps to Understand User Privacy Risks

Abstract

Mobile Augmented Reality (AR) applications have rapidly expanded across domains such as gaming, education, and healthcare. However, AR's reliance on continuous camera input and access to sensitive data, such as faces and the surrounding environment, raises major privacy concerns. Adhering to best privacy practices requires applications to clearly disclose their use of sensitive data and follow the Principle of Least Privilege (PoLP). This paper presents an empirical study of 179 Android AR applications to assess their data access behaviors and evaluate whether these practices are upheld in the real world. To this end, we developed a novel static analysis technique to examine data accesses of these apps and identify potential privacy risks. Our analysis centers on core AR components, namely anchors and trackables, which link virtual content to real-world entities. Our findings revealed that AR apps often access sensitive data without adequate disclosure and frequently access more data than their functionality requires through unrestricted SDK APIs. Notably, our analysis identified 58 instances of undisclosed access to facial data, 2D images, and skeletal information, and 82 instances of PoLP violations through overly broad data access. A subset of these findings was further confirmed through dynamic instrumentation. Furthermore, our analysis suggests that protecting user privacy in AR apps can benefit from fine-grained access control, AR SDK API redesign, automated disclosure verification, and control/data-flow analysis. Particularly, there are 317 common call paths among the 754 AR-related paths we analyzed, suggesting that many AR apps share similar data usage patterns that can be leveraged for efficient privacy auditing and anomaly detection with manageable overhead.