# Assessing the Security and Privacy of Baby Monitor Apps
## 3 Materials and Methods
### Privacy Assessment Methodology  
Multiple privacy regulations have been enforced over the last decade, including prominent instances such as the General Data Protection Regulation (GDPR) [19] and the California Consumer Privacy Act (CCPA). Its amendment, the California Privacy Rights Act (CPRA) [20], went into effect in January 2023, along with the Virginia Consumer Data Protection Act (VCDPA) [21]. These privacy regulations require processors and collectors of personal data to inform affected users about these data practices, such as collection, use, and sharing. The means of informing users about these data practices are privacy policies. Consequently, the rights of affected individuals must be listed in privacy policies along with the contact details of a person for privacy-related questions. This provides individuals with the ability to self-determine information. Fair and transparent handling of personal data builds trust in companies and, in our case, the worry-free usage of baby monitor apps.  
In line with previous studies exploring the privacy of mobile applications containing sensitive data, such as COVID-19 contact tracing apps [22], mHealth apps [11], or child-care apps [15], we utilized several measures to evaluate the privacy implications of baby monitoring apps. Adapting from the different methodologies of previous work, we carried out the following steps to assess the privacy impact of each baby monitor app:  
1. We reviewed the data practices declared in the app's privacy policy and categorized the collected and shared personal data and the security level of confidential data transmission. To perform these assessments, we used the established taxonomy used for the annotation of the OPP-115 privacy policy corpus by [PERSON] et al. [23], as well as its refined and updated taxonomy as used for the annotation of the bilingual English and German MAPP privacy policy corpus by [PERSON] et al. [24]. The updated taxonomy captures the introduced EU GDPR regulations and California's CCPA/CPRA for first-party and third-party data collection. Furthermore, we did not consider the defined \"Do Not Track\" category in [23], as it is no longer supported by the major browsers and is considered a retired specification by the former Tracking Protection Working Group [25]. Table 2 illustrates the categories and attributes of the resulting taxonomy, accompanied by their descriptions.
2. We evaluated the dangerous permissions that each app stated in the Android manifest and identified valid permissions necessary to build a video surveillance solution. Extending previously used methodology [11], we investigated possible misuse of permissions by combining dynamic and static code analysis.
3. We performed a dynamic analysis of the app's communication behavior by capturing and decrypting all network connections using a transparent proxy. In this way, we got insight into the communication destinations, the transport security mechanisms implemented, and the actual data transmitted during a baby monitoring session.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Abbreviated Name** & **APK id@version** & **Installs** & **Rating** \\ \hline Dormi & [EMAIL_ADDRESS] & 1 Mio.+ & 4.1/5 \\ BabyCam & [EMAIL_ADDRESS] & 1 Mio.+ & 4.5/5 \\ Saby & [EMAIL_ADDRESS] & 1 Mio.+ & 3.9/5 \\ Babyphone Mobile & [EMAIL_ADDRESS] & 100.000+ & 3.9/5 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Investigated baby monitor apps. All apps were accessed on 30 March 2023.  
Finally, we checked the results of the dynamic analysis for exposure of personal information and compliance with the respective privacy policy.