🤖 AI Summary
This study addresses the limitations of permission-based privacy risk assessments in accurately capturing the actual privacy exposure of mobile games within complex third-party SDK ecosystems. To overcome the constraints of traditional permission-centric paradigms, the authors propose a configuration-aware static analysis framework that systematically evaluates privacy risks by integrating manifest configurations, exported components, and the structural characteristics of SDK ecosystems. Through SDK categorization and statistical analyses—including Spearman correlation, Mann-Whitney U tests, and chi-squared tests—the study reveals that children-targeted games exhibit privacy exposure levels comparable to those of general-audience games. Furthermore, it demonstrates that advertising SDKs and more extensive, diverse SDK ecosystems significantly amplify privacy leakage risks, underscoring the dominant role of ecosystem-level design in shaping privacy exposure.
📝 Abstract
Mobile gaming apps increasingly rely on third-party Software Development Kits SDKs for advertising, analytics, attribution, and user engagement, potentially introducing privacy exposure beyond traditional permission based risks. Existing studies have largely focused on permissions or isolated tracking behaviors, providing only a partial understanding of privacy exposure in modern mobile ecosystems. This study presents a configuration aware empirical assessment of privacy exposure in Android mobile gaming apps by examining permissions, manifest level configurations, exported components, and SDK ecosystem complexity across children-oriented and general-audience games. A systematic static analysis was conducted on 41 widely deployed Android mobile gaming apps collected from the Google Play ecosystem. The analysis incorporated SDK categorisation and statistical evaluation using Spearman correlation, Mann Whitney U, and Chi square testing. The results revealed that privacy exposure is strongly associated with ecosystem-level architectural decisions rather than permission requests alone. Child-oriented games frequently demonstrated exposure conditions comparable to general-audience apps despite sometimes requesting fewer sensitive permissions. Furthermore, larger and more diverse SDK ecosystems were significantly associated with elevated privacy exposure levels, while advertising-oriented SDKs showed strong association with high exposure classifications. These findings highlight the limitations of permission-centric assessment approaches and emphasize the importance of configuration aware and ecosystem-aware privacy evaluation methodologies for modern mobile software systems.