Mobile phones enable the collection of a wealth of private information, from unique identifiers (e.g., email addresses), to a user's location, to their text messages. This information can be harvested by apps and sent to third parties, which can use it for a variety of purposes. In this paper we perform the largest study of private information collection (PIC) on Android to date. Leveraging an anonymized dataset collected from the customers of a popular mobile security product, we analyze the flows of sensitive information generated by 2.1M unique apps installed by 17.3M users over a period of 21 months between 2018 and 2019. We find that 87.2% of all devices send private information to at least five different domains, and that actors active in different regions (e.g., Asia compared to Europe) are interested in collecting different types of information. The United States (62% of the total) and China (7% of total flows) are the countries that collect most private information. Our findings raise issues regarding data regulation, and would encourage policymakers to further regulate how private information is used by and shared among the companies and how accountability can be truly guaranteed.

翻译：移动电话能够收集大量私人信息,从独特的识别资料(例如电子邮件地址)到用户所在地,到其文字信息。这种信息可以通过应用程序收集,然后发送到第三方,第三方可以将其用于各种目的。在本文中,我们进行了迄今为止最大的一项关于Android的私人信息收集(PIC)的研究。利用从受欢迎的移动安全产品客户那里收集的匿名数据集,我们分析了在2018年至2019年的21个月期间,17.3M用户安装的2.1M独特应用程序产生的敏感信息的流动情况。我们发现,所有设备中有87.2%将私人信息发送到至少5个不同的领域,在不同区域(例如亚洲和欧洲)活跃的行为者有兴趣收集不同类型的信息。美国(占总数的62%)和中国(占总流量的7%)是收集大多数私人信息的国家。我们的调查结果提出了有关数据监管的问题,并将鼓励决策者进一步监管公司如何使用和共享私人信息,以及如何真正保障问责制。