  We present the design and design rationale for the user interfaces for
Privacy Enhancements for Android (PE for Android). These UIs are built around
two core ideas, namely that developers should explicitly declare the purpose of
why sensitive data is being used, and these permission-purpose pairs should be
split by first party and third party uses. We also present a taxonomy of
purposes and ways of how these ideas can be deployed in the existing Android
ecosystem.
