Users Want Control, Not Automation

mHealth apps collect sensitive patient data but operate in a regulatory gray zone. 26.1% request fine-grained location without disclosure, creating systemic privacy exposure.

Method: Multi-tool forensic audit of 272 Android mHealth apps using MobSF, RiskInDroid, and OWASP Mobile Audit revealed that 26.1% request fine-grained location permissions without disclosure in privacy policies. The study combined permission forensics, static vulnerability analysis, and user review mining to expose systemic weaknesses in apps that promise patient-provider interaction but deliver surveillance infrastructure.

Caveats: Android-only analysis; iOS permission model differs. Static analysis can't catch runtime data exfiltration or third-party SDK behavior.

Reflections: How do iOS mHealth apps compare in permission overreach and disclosure gaps? · What percentage of location data is actually used for clinical purposes versus marketing? · Can automated policy-permission alignment checks be integrated into app store review processes?

LLM agents need personal data to act on your behalf, but users don't know when autonomy becomes surveillance. The personalization-privacy tradeoff intensifies as agents gain decision-making power.

Method: A 3×3 between-subjects experiment with 450 participants tested how agent autonomy level (low/medium/high) and personalization interact. High-autonomy agents that proactively make decisions without explicit user approval triggered significantly higher privacy concerns, even when personalization quality improved. The study isolated autonomy as an independent variable, proving it's not just what data agents collect but how independently they act on it.

Caveats: Study used hypothetical scenarios, not deployed agents. Real-world trust may differ when users experience tangible benefits over time.

Reflections: Do users recalibrate privacy concerns after experiencing high-autonomy agent benefits for 30+ days? · Which specific decision types (financial, social, health) trigger the strongest autonomy-privacy tension? · Can transparency about agent decision logic reduce privacy concerns without sacrificing autonomy?

Platforms rely on user flagging to scale content moderation, but users flag content based on who said it, not just what was said. Group identity distorts reporting.

Method: Analysis of user flagging behavior revealed systematic bias: users flag identical content at different rates depending on the perceived group identity of the poster. The study controlled for content severity and found that in-group/out-group dynamics significantly predict flagging likelihood, meaning platforms using user reports as ground truth are training moderation systems on biased data.

Caveats: Study doesn't specify which identity dimensions (race, politics, gender) drive the strongest bias, limiting targeted interventions.

Reflections: Can algorithmic debiasing of user flags improve moderation accuracy without increasing false negatives? · Do platforms with reputation-weighted flagging systems show reduced identity bias? · What percentage of flagged content would be reclassified if identity information were hidden from reporters?