AV-TEST privacy analysis
and certification
for Android Apps
Android App Privacy - Privacy Matters!
The AV-TEST Institute has been testing and certifying connected solutions for 10 years, awarding its “Approved IoT Product” seal of approval to products that offer a high level of protection. Mobile applications play a key role as the command center and primary component in many security-relevant processes in virtually all kinds of connected solutions. In addition to security and data protection, consumers, companies and organizations are increasingly prioritizing the protection of their privacy. The issue involves more than just protecting the user’s sensitive information from unauthorized third-party access, but rather it now includes protection from excessive harvesting of data by operators, advertisers, and huge data brokers.
What are the advantages for security-minded consumers and companies?
Our seal of approval indicates to app users that they can rely on the app to use only the bare minimum of personal data. It helps users to quickly identify the apps that have been analyzed by the independent AV-TEST Institute and subsequently received its recommendation for use.
App developers are able to use the certification seal in their sales tactics
and USP in order to maintain a foothold on the competitive app market.
An EU-based seal of approval for data protection opens the door to greater trust around the world as it is based on scientific testing criteria. In addition,
the independent analysis reveals deviations between the intended and the actual behavior of the app, as well as identifies potential for optimizations.
The privacy analysis can be combined with AV-TEST’s modular test setup of a regular IoT security analysis in order to create a more comprehensive product test.
Testing procedure
A formal check for compliance with GDPR is made, followed by a two-part chain analysis specially developed by AV-TEST to check all major aspects when it comes to the collection of user data by an Android app.
1) The static part of the analysis consolidates all available information about the app and its potential to collect user data. It verifies whether the app contains tracking components—software modules designed to capture user information and behavioral data—or other indicators of possible data collection mechanisms. In addition, the app’s privacy policy is reviewed to assess disclosures regarding data collection, processing, and sharing, as well as the extent to which this information is transparently communicated to the user.
2) The dynamic analysis evaluates the app’s actual functionality under simulated real-world usage. By replicating typical user interactions—such as button clicks, slider adjustments, and text inputs—AI generates a comprehensive view of the app’s behavior. Throughout this process, all app communications are captured, analyzed, and assessed. This approach makes it possible to identify what information the app collects, when and why the collection occurs, and where the data is transmitted.
User information versus behavior under normal use
The information we collect in the AV-TEST lab through our static and dynamic analyses delivers a comprehensive and detailed view of the data collection activitiesby an Android app: Which data was collected? Was it necessary to collect this specific data? Who is collecting the data and where was it sent? And more importantly, was the user duly informed? Apps that have been tested and awarded our seal of approval can also be added to the openly accessible list on AV-ATLAS, the AV-TEST Threat Intelligence platform.
