Personal data in mobile apps includes location, contacts, health, and device identifiers. Privacy failures often come from side channels rather than direct breaches: verbose logging, cached screenshots in the app switcher, clipboard access, cloud backups, and SDKs that send identifiers to third parties. These create regulatory exposure under laws such as GDPR and APPI.
Minimize the personal data collected, obtain consent before collection, keep PII out of logs, URLs, and analytics events, exclude sensitive files from backups, mask sensitive screens, and audit what each SDK transmits.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2024Latest
#06mobile06-2024 Inadequate Privacy Controls
