Ecosystem-Driven Privacy Exposure in Mobile Gaming Apps: A Configuration-Aware Empirical Analysis
2026-05-25 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied privacy risks in Android mobile gaming apps by looking beyond just app permissions to also include app settings, components, and the mix of third-party SDKs. They analyzed 41 popular games, including those for kids, and found that privacy risks often come from how the app and its SDKs are put together, not just which permissions are requested. Games for children sometimes had similar privacy exposure as general games even when asking for fewer permissions. The study suggests that checking permissions alone doesn’t give the full picture of privacy risks in mobile apps.
Android appsSDK (Software Development Kit)mobile gamingapp permissionsprivacy exposurestatic analysischild-oriented appsadvertising SDKmanifest configurationsecosystem-level architecture
Authors
Bakheet Aljedaani
Abstract
Mobile gaming apps increasingly rely on third-party Software Development Kits SDKs for advertising, analytics, attribution, and user engagement, potentially introducing privacy exposure beyond traditional permission based risks. Existing studies have largely focused on permissions or isolated tracking behaviors, providing only a partial understanding of privacy exposure in modern mobile ecosystems. This study presents a configuration aware empirical assessment of privacy exposure in Android mobile gaming apps by examining permissions, manifest level configurations, exported components, and SDK ecosystem complexity across children-oriented and general-audience games. A systematic static analysis was conducted on 41 widely deployed Android mobile gaming apps collected from the Google Play ecosystem. The analysis incorporated SDK categorisation and statistical evaluation using Spearman correlation, Mann Whitney U, and Chi square testing. The results revealed that privacy exposure is strongly associated with ecosystem-level architectural decisions rather than permission requests alone. Child-oriented games frequently demonstrated exposure conditions comparable to general-audience apps despite sometimes requesting fewer sensitive permissions. Furthermore, larger and more diverse SDK ecosystems were significantly associated with elevated privacy exposure levels, while advertising-oriented SDKs showed strong association with high exposure classifications. These findings highlight the limitations of permission-centric assessment approaches and emphasize the importance of configuration aware and ecosystem-aware privacy evaluation methodologies for modern mobile software systems.