Privacy policies are intended to inform users about how software systems collect and handle data, yet they often remain vague or incomplete. This paper presents an empirical study of patterns in log-related statements within privacy policies and their alignment with privacy disclosures observed in Android application logs. We analyzed 1,000 Android apps across multiple categories, generating 86,836,964 log entries. Our findings reveal that while most applications (88.0%) provide privacy policies, only 28.5% explicitly mention logging practices. Among those that reference logging, most clearly describe what information is logged; however, 27.7% of log-related statements remain overly simplistic or vague, offering limited insight into actual data collection. We further observed widespread privacy leakages in application logs, with 67.6% of apps leaking sensitive information not mentioned in their policies. Alarmingly, only 0.4% of applications demonstrated consistent alignment between declared policy contents and actual logged data. These findings highlight that current privacy policies provide incomplete or ambiguous descriptions of logging practices, which frequently do not align with actual logging behaviors.

翻译：隐私政策的初衷是告知用户软件系统如何收集和处理数据，但这类政策往往模糊不清或不够完整。本文针对隐私政策中涉及日志记录的陈述模式及其与安卓应用日志中实际隐私披露的一致性开展了实证研究。我们分析了横跨多个类别的1000个安卓应用，累计生成86,836,964条日志记录。研究结果显示：虽然大多数应用（88.0%）提供了隐私政策，但仅有28.5%明确提及日志记录行为。在这些提及日志记录的政策中，大部分清晰描述了被记录的信息类型，然而27.7%的日志相关陈述仍过于简单或模糊，未能充分揭示实际数据收集情况。我们进一步发现应用日志中存在普遍隐私泄露现象——67.6%的应用暴露了政策中未提及的敏感信息。令人警惕的是，仅有0.4%的应用在声明的政策内容与实际日志数据之间展现出完全一致性。这些发现凸显了当前隐私政策对日志记录实践的描述存在不完整或模糊性，且常与实际日志行为不匹配。