``Because I didn't touch these and even don't know why I should to change these'': Why App Developers Do (Not) Update Apple’s Privacy Labels
Authors: Arwa Alsahdi (The George Washington University), Jialiang Yan (The George Washington University), Monica Kodwani (The George Washington University), Matthias Fassl (The George Washington University), Chris Kanich (University of Illinois Chicago), Adam J. Aviv (The George Washington University)
Volume: 2026
Issue: 4
Pages: 906–926
DOI: https://doi.org/10.56553/popets-2026-0151
Abstract: Apple introduced app-based privacy labels in 2020 to improve apps' communication of their data practices. However, most developers appear to treat privacy labels as a ``set-once'' mechanism. To better understand the dynamics of this system, we first analyzed a four-year longitudinal dataset of Apple's Privacy Label. Next, we conducted an email survey of developers who have changed (or not changed) their privacy labels during this period, and finally, performed follow-up interviews with developers from each group. We find that only 51,364 apps (less than 6%) over this period have made any changes to their privacy labels, many of them changing their initial 'Do Not Collect' label to more refined classification. From the emails and interviews, the ``black box'' of third-party data practice may lead developers to underreport their app's data practices. Many developers reported that privacy labels are a valuable marketing tool for promoting their apps as privacy-friendly. Privacy labels may appear stable not necessarily because practices are stable, but because ambiguity encourages minimal or optimistic disclosure. To improve privacy label maintenance, we recommend enhanced transparency mechanisms for third-party libraries, stronger workflow integration, and platform support that guides developers and strengthens users' control.
Keywords: app store, privacy labels, privacy policies, developers, longitudinal, email survey, interviews
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
