# ROI: A method for identifying organizations receiving personal data

arXiv: https://arxiv.org/abs/2204.09495 · HTML: https://mlsanity.com/paper/2204.09495/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 48 references that are in the map.
- First posted on arXiv 19 Apr 2022.

## Builds on (most cited first, 8 of 8)

- [Polisis: Automated Analysis and Presentation of Privacy Policies Using Deep Learning](https://mlsanity.com/paper/1802.02561/) (2018)
- [Automated Test Input Generation for Android: Are We There Yet?](https://mlsanity.com/paper/1503.07217/) (2015)
- [Are iPhones Really Better for Privacy? Comparative Study of iOS and Android Apps](https://mlsanity.com/paper/2109.13722/) (2021)
- [Third Party Tracking in the Mobile Ecosystem](https://mlsanity.com/paper/1804.03603/) (2018)
- [An Automated Approach to Auditing Disclosure of Third-Party Data Collection in Website Privacy Policies](https://mlsanity.com/paper/1805.01187/) (2018)
- [Haystack: A Multi-Purpose Mobile Vantage Point in User Space](https://mlsanity.com/paper/1510.01419/) (2015)
- [On the (Un)Reliability of Privacy Policies in Android Apps](https://mlsanity.com/paper/2004.08559/) (2020)
- [Measuring third party tracker power across web and mobile](https://mlsanity.com/paper/1802.02507/) (2018)

## Abstract (arXiv)

Many studies have exposed the massive collection of personal data in the digital ecosystem through, for instance, websites, mobile apps, or smart devices. This fact goes unnoticed by most users, who are also unaware that the collectors are sharing their personal data with many different organizations around the globe. This paper assesses techniques available in the state of the art to identify the organizations receiving this personal data. Based on our findings, we propose ROI (Receiver Organization Identifier), a fully automated method that combines different techniques to achieve a 95.71% precision score in identifying an organization receiving personal data. We demonstrate our method in the wild by evaluating 10,000 Android apps and exposing the organizations that receive users' personal data.