The Price to Play: a Privacy Analysis of Free and Paid Games in the Android Ecosystem

International audienceWith an ever growing number of smartphone users, the mobile gaming industry is booming and reached more than 2.6 billion players worldwide in 2020. While some mobile games charge a relatively modest fee to be played, the vast majority are free and rely exclusively on ads or tracking for their revenue streams. Over the years, Google and Apple have tightened their privacy requirements for apps. They perform thorough app scanning to detect abusive behaviours and require developers to provide a privacy policy on how they collect and handle user data. Yet, little is known about the data collection that fuels the advertising and tracking industry behind mobile games. Players can see the ads that are presented to them but they may not be aware of the invisible trackers that collect valuable data in the background. In this study, we aim to shine a light on the tracking ecosystem in mobile games on Android and understand how different monetization models can impact user privacy. We introduce a pipeline that collects both free and paid games and we use the static analysis provided by the Exodus audit platform to detect the trackers present in them. We analyse a total of 6, 751 games, including 396 paid games. Our results show that paying for a game does not necessarily shield users from data collection. We find that 87% of free games include at least one tracker, compared to 65% of paid games that do. On average, free games have 3.4 times more trackers and request twice more dangerous permissions than paid games. We also notice that the genre of the game and its targeted audience impact the number of trackers. Games in the Casual category presents the most trackers while those in the Educational one have the least