Recently, the Ministry of Industry and Information Technology (hereinafter referred to as the "Ministry of Industry and Information Technology") organized a third-party testing agency to inspect the App for infringement of user rights and interests. Up to now, 107 apps have not been rectified, and 13 embedded third-party software development kits (SDKs) have illegally collected user device information. The 120 apps and SDKs mentioned above were required to complete rectification by February 25. The Nandu Privacy Guard noted that this is the first time that the Ministry of Industry and Information Technology has pointed out specific problems with the SDK.
According to the notice, among the 107 apps, 53 apps have app compulsion, frequent, excessive permission request and illegal collection of personal information, accounting for nearly half, the former including cloud classroom (7.18.0), film and television encyclopedia (2.9.4), etc., the latter including listening companions (5.4.0), hot cat live broadcast (2.7.5) and so on. There are 25 apps that force users to use the targeted push function, such as Haoxin Cloud Conference (3.6.8), Einstein FM (4.7.7) and so on.
17 apps, such as Cloud Home (10.3.6) and Jukandian (7.6.5), have the problem of illegal use of personal information; 14 apps have the problem of collecting personal information beyond the scope, such as Huajian (12.9.60) and Bear Live (4.1.5.3). In addition, there are 7 apps such as Bobo Video (5.39.04) that deceive, mislead and force users; 2 apps have unclear information on their app distribution platforms.
The Nandu Privacy Guard found that the Juguandian (7.6.5) App was the app with the most problematic app in this announcement, with a total of five violations, while the Gravity Information App (3.0.3) also had four violations.
Judging from the source of the problem App, the App and SDK that were notified this time not only came from the OPPO software store, 360 mobile assistant, App Store and other application stores, but also from Kuaishou, Douyin Volcano Edition and the company's official website. Among them, four Apps are from Kuaishou, six are from Douyin Volcano Edition, and 13 SDK are from the company's official website.
It is worth noting that this is the first time that the SDK has been included in the list of application names, and the SDK developer, source, version and issues involved have been communicated more specifically. A total of 13 SDKs have been notified, including some well-known SDKs such as Baidu Positioning SDK (9.1.8) and iFLYTEK Speech Recognition SDK (1142).
In addition, the issues involved in the SDK that were notified this time are all illegal collection of personal information, of which eight SDKs collect Android IDs, four collect IMEI numbers, three collect Mac addresses, two collect IMSI numbers, and one each collects sensor information, ICCIDs and device installation lists.
The Ministry of Industry and Information Technology stressed that in accordance with the Personal Information Protection Law, the Cybersecurity Law, the Telecommunications Regulations, the Provisions on the Protection of Personal Information of Telecommunications and Internet Users, and other laws and regulations, the above-mentioned Apps and SDKs should complete the rectification and implementation work before February 25. If rectification is not made within the time limit, the Ministry of Industry and Information Technology will organize and carry out relevant disposal work in accordance with laws and regulations.
Written by: Nandu trainee reporter Fan Wenyang Nandu reporter Sun Chao
Attached: A list of Apps (SDDs) notified by the Ministry of Industry and Information Technology of the problematic
