ANN ARBOR—Objectionable ad that offends your sensibilities come up in that new app you just bought? Feeling a little violated because an ad for something related to an item you just shopped for online pops up when you open a favorite app?

Don’t blame the app developers. Or should you? After all, they didn’t put the ads there. Well, not directly, anyway.

New research from the University of Michigan School of Information, presented this week at the Symposium on Usable Privacy and Security in Santa Clara, California, shows those who create the apps we use are not making decisions about which ads are attached to their apps, but they are picking which ad networks are used.

And those often-arbitrary choices—made mostly for money but, ironically, not always for top dollar—may be making us vulnerable to questionable ads and data privacy concerns.

“Only about half of our survey participants were aware of consumer risks associated with ad networks, such as ad networks collecting extensive information about consumers without their consent or ads infecting people’s devices with malware.”
Florian Schaub

In a study involving both a survey of 49 mostly independent app developers and in-depth interviews with 10, researchers found that app developers believe that entering agreements with groups like Facebook ads, AdMob, ONE by AOL and Unity Ads are the only way to make money from their apps.

Abraham Mhaidli

“Despite this reliance on ads, we were surprised to see that few developers compared different ad networks in detail to find one that serves their needs best,” said lead author Abraham Mhaidli, a U-M doctoral student. “Instead, they relied on information they read in developer forums or a notion of which ad networks are popular.

“Even more surprising, many participants just stuck with the default settings their ad network of choice used, rather than trying to optimize for profit, which might mean collecting more data about their users.”

This not only translated into the developers having no say in the ads attached to their creations, but also removed them from being involved in protecting consumers, despite their strong belief in the importance of security and consumer satisfaction.

This led to several inconsistencies between what the app developers said was important when it came to consumers. For example, 90% of survey participants considered the security of users as very/extremely important, and 74% felt user satisfaction was very/extremely important. Yet when asked about various risks and if they were concerned about ad networks’ data collection practices, 23 survey participants said definitely/probably true; 11 said definitely/probably false.

Florian Schaub

“Only about half of our survey participants were aware of consumer risks associated with ad networks, such as ad networks collecting extensive information about consumers without their consent, users being shown inappropriate or graphic ads, or ads infecting people’s devices with malware, all of which are actual risks that occur in practice,” said Florian Schaub, assistant professor of information.

“Even though many participants claimed that they are concerned about the safety, security and privacy of their users, they did not make adjustments to ad network settings to prevent the ad network from tracking their users or limiting the type of ads shown to people.”

The researchers say alternate monetization models and new policies to make ad networks more consumer-friendly are needed.

“The ecosystem for ads has been pretty mature nowadays, with ad networks serving as the bridge between businesses and app developers, providing developer kits and all kinds of tutorials. However, such support can rarely be found when someone wants to explore other alternative funding models,” said study co-author and U-M doctoral student Yixin Zou.

Yixin Zou

“As the starting point, we need more empirical research to show what monetization models are out there and how well they work for apps, as well as comprehensive online posts/tutorials to help developers set things up. The thought that ads are not (and should not be) the only way to monetize apps should be embedded in education for prospective developers, such as through courses offered to computer science undergraduates.

“Later on, maybe we can encourage the adoption of other revenue models by developing tools and platforms that facilitate the standardized operation of these models, similar to how ad networks work for the ad ecosystem at this point.”

More information:

• Study: “We Can’t Live Without Them!” App Developers’ Adoption of Ad Networks and Their Considerations of Consumer Risks
• Other conference papers co-authored by U-M researchers:
  • An Empirical Analysis of Data Deletion and Opt-Out Choices on 150 Websites
  • Privacy and Security Threat Models and Mitigation Strategies of Older Adults