[ISM] Mobile Application Security (OWASP):

[OWASP] Include user privacy and control measures (SSS-02-04-08)

Include privacy controls to protect user data and ensure compliance with privacy regulations. Limit data collection to what is necessary for the app's functionality, provide clear data usage disclosures, and allow users to control their privacy settings.

[OWASP] Strengthen privacy controls for user data (SSS-02-04-08-01)

Minimize data access. Limit app access to sensitive data strictly to what is essential for its functionality, ensuring all access is contingent on explicit, informed user consent. Ensure third-party SDKs respect user consent signals and do not collect data prematurely or unnecessarily. Maintain full accountability across the SDK supply chain by verifying compliance with data minimization practices and recent regulatory requirements, such as SBOM (Software Bill of Materials). Prevent user identification. Implement privacy-preserving techniques, such as data abstraction, anonymization, and pseudonymization, to protect user identities. Restrict the use of device-specific identifiers (e.g., device IDs, IP addresses) to their intended purposes, such as fraud detection, and prevent repurposing for unrelated analytics or tracking. Ensure transparency. Clearly disclose data collection, usage, and sharing practices to users. Highlight any unexpected behaviors, such as background data collection, and comply with platform-specific guidelines for data declarations. Provide users with accessible and understandable information about how their data is handled. Empower user control. Equip users with robust tools to manage their data, such as the ability to view, delete, or modify stored data, and adjust privacy preferences. Regularly re-prompt for consent whenever new data types are required, ensuring alignment with evolving transparency policies and user expectations. These controls collectively align the app with best practices for privacy compliance and user trust while reducing potential exposure to privacy violations.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-04-08-01-01	Minimize access to sensitive data	Request access only to essential data and resources required for app functionality. Restrict third-party SDKs from collecting data before user consent and ensure SDKs respect user preferences.	Development	Development teams, Product teams
SSS-02-04-08-01-02	Ensure anonymization and data isolation	Implement unlinkability techniques like data abstraction, anonymization, or pseudonymization to prevent user identification. Isolate fingerprint-like data streams for specific purposes.	Development	Security team, Privacy compliance team
SSS-02-04-08-01-03	Enhance data transparency	Include a privacy policy link in the app's settings explaining how location data is stored, shared, and used.	Deployment	Legal team, Product teams
SSS-02-04-08-01-04	Offer comprehensive user controls	Add a "Privacy Settings" section where users can revoke location-sharing consent or delete their account and associated data.	Post-deployment	Development teams, Support teams

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1922) The Open Worldwide Application Security Project (MASVS-PRIVACY) The Open Worldwide Application Security Project (MASVS-PRIVACY)