PrivPRISM: Automated check finds mismatches between Google Play data-safety labels and full privacy policies

A new arXiv preprint introduces PrivPRISM, an automated system that scans apps on Google Play and compares the store's simplified data safety declarations with the apps’ full privacy policies to detect inconsistencies. The authors report that many self‑declared labels do not match the underlying policies, potentially misleading users about what data is collected and how it is used. It has been reported that these discrepancies also raise questions about compliance with platform rules and privacy regulations.

What PrivPRISM does

PrivPRISM reportedly parses both the concise data‑safety form Google Play requires and the longer legal privacy documents developers publish, then flags mismatches for human review. The tool is pitched as a scalable audit mechanism: automated checks can cover thousands of apps far faster than manual review. The arXiv paper presents the system and examples of the kinds of contradictions it finds, though the findings are presented as a preprint and have not yet undergone peer review.

Why it matters — regulators, users and app stores

Google Play’s labels were introduced to give users a quick, comparable snapshot of data practices. But when developers’ self‑statements diverge from their policies, users and regulators lose trust. That matters not just in the U.S. or EU, where privacy enforcement is intensifying, but globally. Google Play is effectively unavailable in mainland China; Chinese users rely on stores such as Huawei AppGallery (华为应用市场) and Tencent MyApp (腾讯应用宝). Similar transparency gaps on those platforms could create parallel risks under China’s Personal Information Protection Law (PIPL) and complicate cross‑border data governance amid rising geopolitical scrutiny of apps and data flows.

Can automated auditing help close the gap between short labels and long policies? The PrivPRISM paper argues yes — but its conclusions are preliminary. The system and its results are detailed in arXiv:2603.09214; readers should note the work is a preprint and the broader prevalence and legal implications of the discrepancies will require further validation and regulatory attention.