Mini-app is an emerging form of mobile application that combines web technology with native capabilities. Its features, e.g., no need to download and no installation, have made it popular rapidly. However, privacy issues that violate the laws or regulations are breeding in the swiftly expanding mini-app ecosystem. The consistency between what the mini-app does about the data in the program code and what it declares in its privacy policy description is important. But no work has systematically investigated the privacy problem of the mini-app before. In this paper, to our best knowledge, we are the first to conduct the compliance detection of data practice and policy description in mini-apps. In this paper, we first customize a taint analysis method based on data entity dependency network to adapt to the characteristics of the JavaScript language in the mini-apps. Then, we transform data types and data operations to data practices in program codes and privacy policies, so as to finish a fine-grained consistency matching model.We crawl 100,000 mini-apps on WeChat client in the wild and extract 2,998 with a privacy policy. Among them, only 318 meet the consistency requirements, 2,680 are inconsistent, and the proportion of inconsistencies is as high as 89.4%. The inconsistency in the mini-app is very serious. Based on 6 real-world cases analyzed, in order to reduce this potential data leakage risk, we suggest that the developer should reduce the collection of irrelevant information and the straightforward use of templates, and the platform should provide data flow detection tools and privacy policy writing support.

翻译：小程序是融合网页技术与原生能力的新型移动应用形态，其无需下载安装等特点使其迅速普及。然而，在快速扩张的小程序生态中，违反法律法规的隐私问题正在滋生。小程序在程序代码中实际执行的数据操作与其隐私政策声明内容之间的一致性至关重要，但目前尚无研究系统性地探讨小程序的隐私问题。本文首次（据我们所知）对小程序数据实践与政策声明的一致性合规检测展开研究。我们首先定制了一种基于数据实体依赖网络的污点分析方法，以适配小程序中JavaScript语言特性；随后将数据类型与数据操作转化为程序代码与隐私政策中的具体数据实践，构建细粒度一致性匹配模型。我们采集了微信平台上10万个真实小程序，从中筛选出2998个附有隐私政策的小程序。其中仅有318个满足一致性要求，2680个存在不一致问题，不一致比例高达89.4%。小程序中的不一致问题极为严峻。基于6个真实案例分析，为降低潜在数据泄露风险，我们建议开发者减少无关信息采集并避免模板化表述，同时平台应提供数据流检测工具与隐私政策编写支持。