一句话：提出流-政策一致性检查方法 PTPDroid，自动检测 Android 应用隐私政策中向第三方披露用户隐私的违规声明。
Android 应用常访问个人信息，监管要求发布隐私政策说明收集哪些信息及原因。已有工作多关注数据类型，较少考虑收集用户隐私的实体，因此可能把第三方收集的问题声明误判为已披露。为此，论文提出 PTPDroid，一种流到隐私政策的一致性检查方法及自动化工具，全面发现隐私政策中面向第三方用户隐私披露的违规。真实应用实验显示其有效性和优越性；对 1000 个流行应用的实证研究发现，对第三方违反用户隐私披露普遍存在。
Android apps frequently access personal information to provide customized services. Since such information is sensitive in general, regulators require Android app vendors to publish privacy policies that describe what information is collected and why it is collected. Existing work mainly focuses on the types of the collected data but seldom considers the entities that collect user privacy, which could falsely classify problematic declarations about user privacy collected by third-parties into clear disclosures. To address this problem, we propose PTPDroid, a flow-to-policy consistency checking approach and an automated tool, to comprehensively uncover from the privacy policy the violated disclosures to third-parties. Our experiments on real-world apps demonstrate the effectiveness and superiority of PTPDroid, and our empirical study on 1,000 popular real-world apps reveals that violated user privacy disclosures to third-parties are prevalent in practice.