你在想什么？探索心理健康应用的隐私
What's on Your Mind? Exploring Privacy of Mental Health Apps
AI总结：
通过对25款流行的Android心理健康应用进行静态分析、动态网络捕获和LLM辅助隐私政策提取，发现这些应用存在严重的透明度问题，包括未披露的跟踪器、权限政策矛盾以及第三方AI处理披露不充分。
摘要：
治疗和生活指导应用的数量、种类和受欢迎程度迅速增长。然而，用户经常分享高度敏感的个人信息，如创伤、幻想、欲望、关系困难和其他心理健康问题。这促使我们需要对该生态系统中的隐私实践进行实证分析，特别是这些应用的隐私政策与其实际行为之间的一致性。在本文中，我们对25款流行的Android心理健康和生活指导应用进行了全面分析，结合了静态分析、动态网络捕获和LLM辅助的隐私政策提取，并与手动注释进行了验证。我们的发现揭示了严重的问题和巨大的透明度差距。首先，每个应用都嵌入了至少一个其隐私政策未命名的跟踪器SDK，68%的应用未能披露其APK中检测到的至少一半跟踪器；仅Talkie就嵌入了20个跟踪器，但未命名任何一个。其次，我们在13个应用中识别出16个权限-政策矛盾，即在清单中声明了危险权限但在政策中省略，包括6个应用请求相机或麦克风访问权限但未披露照片、视频或音频收集。第三，48%的应用披露了第三方AI处理（例如通过OpenAI、Anthropic、Groq），其中一个应用将日记条目同时发送给所有三个，而7个应用仅使用通用语言，未指明接收者。综合来看，我们的发现表明当前的披露实践远未达到有意义知情同意所需的透明度。我们主张在约束持证人类治疗师的专业和道德标准的精神下，对治疗应用进行大幅更新的监管框架。
英文摘要：
Therapy and life-coaching apps have grown rapidly in number, variety, and popularity. At the same time, their users often share highly sensitive and personal information, including mental health issues, trauma experiences, fantasies, desires, and relationship difficulties. This prompts the need to examine privacy practices across the ecosystem. In this paper, we present a comprehensive analysis of a corpus of 25 popular Android mental health and life-coaching apps, such as Replika and Headspace. It builds on static analysis and dynamic network traffic analysis, coupled with identifying gaps between each app's observed behavior and its privacy policies. Our analysis highlights serious concerns and substantial transparency gaps. First, every app in our corpus embeds at least one tracker SDK not named in its privacy policy, and 85\% of the apps we instrument fail to disclose at least half of the trackers detected in their APKs. Second, more than half of the apps declare several dangerous permissions without corresponding privacy-policy disclosures, including camera or microphone permissions. Third, nearly half the apps disclose third-party AI processing (e.g., via OpenAI, Anthropic, and Groq) in their privacy policies, while several use only generic language (e.g., "AI services"), failing to identify which company receives user data. Overall, our results show that current disclosure practices fall short of the transparency needed for meaningful informed consent. We argue for a significantly updated regulatory framework for therapy apps that more closely aligns with the professional and ethical standards that bind licensed human therapists.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
