Privacy policies are intended to inform users about how software systems collect and handle data, yet they often remain vague or incomplete. This paper presents an empirical study of patterns in log-related statements within privacy policies and their alignment with privacy disclosures observed in Android application logs. We analyzed 1,000 Android apps across multiple categories, generating 86,836,964 log entries. Our findings reveal that while most applications (88.0%) provide privacy policies, only 28.5% explicitly mention logging practices. Among those that reference logging, most clearly describe what information is logged; however, 27.7% of log-related statements remain overly simplistic or vague, offering limited insight into actual data collection. We further observed widespread privacy leakages in application logs, with 67.6% of apps leaking sensitive information not mentioned in their policies. Alarmingly, only 4% of applications demonstrated consistent alignment between declared policy contents and actual logged data. These findings highlight that current privacy policies provide incomplete or ambiguous descriptions of logging practices, which frequently do not align with actual logging behaviors.

翻译：隐私政策旨在告知用户软件系统如何收集和处理数据，但它们常常含糊不清或不完整。本文对隐私政策中与日志相关的陈述模式及其与Android应用日志中观察到的隐私披露之间的一致性进行了实证研究。我们分析了跨多个类别的1000个Android应用，生成了86,836,964条日志条目。研究结果表明，尽管大多数应用（88.0%）提供了隐私政策，但只有28.5%明确提及日志记录实践。在那些提及日志记录的政策中，大多数清楚描述了记录的信息内容；然而，27.7%的日志相关陈述仍然过于简单或模糊，对实际数据收集提供的洞察有限。我们进一步观察到应用日志中广泛存在隐私泄露，67.6%的应用泄露了其政策中未提及的敏感信息。令人警惕的是，仅有4%的应用在声明的政策内容与实际记录数据之间表现出一致的一致性。这些发现突显出当前的隐私政策对日志记录实践的描述不完整或含糊不清，且常常与实际日志记录行为不一致。