For App Developers, Bad Behavior Doesn’t Pay

Delaying Informed Consent Turns Off Customers

Oct 08, 2019
Decision, Operations and Information Technologies

Siva Viswanathan and Raveesh MayyaSMITH BRAIN TRUST – App makers delayed updating to a more secure version of Google’s Android platform just so they could continue to harvest and sell users’ personal data, finds new research from the University of Maryland’s Robert H. Smith School of Business. The research also reveals the tactic backfired for the devious app developers, who suffered hits to their reputations and revenue. 

Siva Viswanathan, Dean's Professor of Information Systems and Digital Innovation, and Maryland Smith PhD candidate Raveesh Mayya looked at what happened when Google rolled out its Android 6.0 version with tighter privacy rules. Before the 6.0 version – dubbed “Marshmallow” – app developers could use blanket permissions that would give them access to sensitive personal information like location data, contact lists and photos.

“They sell the data and you never know who it’s being sold to and what it’s being used for,” Viswanathan says. “The key thing is, until very recently, with mobile apps you didn’t even have a choice. The only way to download and use any app was to accept all the permissions it sought.”

And users weren’t often reading that entire list of disclosures, Mayya says. “They were used to just scrolling to the bottom and clicking ‘accept.’” That gave app makers access to more information than consumers might be comfortable with. 

But in recent years, as consumers have become much more sensitive to privacy issues (let’s not forget the Cambridge Analytica-Facebook firestorm), platforms have tightened access to user data. Google upgraded privacy with Android 6.0, which requires app makers to ask for individual permissions to sensitive data. Now users pick and choose what they allow apps to have access to.

Google gave Android app developers a three-year window to upgrade, offering an interesting opportunity for the researchers to see when app makers decided to upgrade, track how they changed privacy settings and what happened afterward.

To do so, Mayya and Viswanathan installed over 13,600 apps and developed their own app that tracked all the other Android apps to see which ones changed their permissions each month and what they were asking for before and after upgrading.

The first thing the researchers noticed was that not all the apps were quick to upgrade, prompting them to figure out why. 

“We didn’t expect apps to have a strategic intent to delay upgrading,” Viswanathan says. “We thought it would be more about operational issues or things like that. But when we see that apps of a certain type – the ones asking a lot of nonessential permissions to sell user data or display personalized advertisements – are the ones delaying, then you begin to see that there’s a strategic intent.”

Then the researchers looked at what happened to the apps after they finally upgraded to the tighter privacy rules.

They found that delaying the upgrade didn’t pay off in the long run. With the eventual upgrade, those apps couldn’t keep asking for unnecessary data to sell. And the fact that they took so long to upgrade didn’t sit well with consumers. 

“Users are less likely to give you those permissions, but more importantly, they give you lower ratings,” Mayya says. “They become more sensitive.”

The apps that delayed upgrades ended up receiving more negative reviews from consumers, which pushed them further down the list in Android Play Store, leading to fewer downloads of their apps.   

“The apps that delayed upgrading paid a price,” Mayya says. “Their bad behavior didn’t pay off in the long run.”

Read more: Delaying Informed Consent: An Empirical Investigation of Mobile Apps’ Upgrade is a working paper.



About the Expert(s)


Professor Siva Viswanathan's research focuses on emerging issues related to online firms and markets, and on analyzing the competitive and strategic implications of new information and communication technologies. His current research examines the growth of online information intermediaries, and their potential to disrupt traditional business models and transform the competitive landscape in sectors such as auto-retailing, financial services, and advertising, among others. Viswanathan's research has appeared in top academic journals including Management Science, Information Systems Research, Journal of Marketing, and Decision Support Systems. He is also an active participant in international conferences and industry forums. He is the co-director of the school's Center for Digital Innovation, Technology, and Strategy (DIGITS).

Can AI Help Create More Equitable Workplaces?

Can we partner with artificial intelligence and machine learning tools to build a more equitable workforce? New research may offer a way.

Apr 16, 2021
The Ugly Side of Beauty AI

The pitfalls to AI-driven beauty scoring begin with the premise that beauty is in the eye of the beholder.

Apr 15, 2021
That $2T Infrastructure Price Tag

Surprised by the high price tag of President Biden’s proposed infrastructure facelift? Here's why you shouldn't be.

Apr 08, 2021
Robert H. Smith School of Business
Map of Robert H. Smith School of Business
University of Maryland
Robert H. Smith School of Business
Van Munching Hall
College Park MD 20742