arXiv subjects

Chloe Georgiou

Publications and source records attributed to Chloe Georgiou.

4 recordsLinked to original sources

arXiv2026

What's on Your Mind? Exploring Privacy of Mental Health Apps

Therapy and life-coaching apps have grown rapidly in number, variety, and popularity. At the same time, their users often share highly sensitive and personal information, including mental health issues, trauma experiences, fantasies, desires, and relationship difficulties. This prompts the need to examine privacy practices across the ecosystem. In this paper, we present a comprehensive analysis of a corpus of 25 popular Android mental health and life-coaching apps, such as Replika and Headspace. It builds on static analysis and dynamic network traffic analysis, coupled with identifying gaps between each app's observed behavior and its privacy policies. Our analysis highlights serious concerns and substantial transparency gaps. First, every app in our corpus embeds at least one tracker SDK not named in its privacy policy, and 85\% of the apps we instrument fail to disclose at least half of the trackers detected in their APKs. Second, more than half of the apps declare several dangerous permissions without corresponding privacy-policy disclosures, including camera or microphone permissions. Third, nearly half the apps disclose third-party AI processing (e.g., via OpenAI, Anthropic, and Groq) in their privacy policies, while several use only generic language (e.g., "AI services"), failing to identify which company receives user data. Overall, our results show that current disclosure practices fall short of the transparency needed for meaningful informed consent. We argue for a significantly updated regulatory framework for therapy apps that more closely aligns with the professional and ethical standards that bind licensed human therapists.

cs.CR↗

arXiv2026

Dead Men Tell No Tales: Assessing Post-Mortem Data Protection in GenAI Chatbots

Generative AI (GenAI) systems and chatbots rely on vast corpora of consumer data. The use of such data for training GenAI has raised concerns around data ownership, copyright issues, and potential harm to consumers. In this work, we explore a related but less examined angle: the ownership and privacy of data originating from deceased individuals. We propose three post mortem data management principles to guide the protection of deceased individual's data, and analyze popular GenAI chatbots policies and answers to legacy requests. We plan to systematically audit consumer GenAI chatbots on their behavior regarding post-mortem data management

cs.CY↗

arXiv2025

Consumer Beware! Exploring Data Brokers' CCPA Compliance

Data brokers collect and sell the personal information of millions of individuals, often without their knowledge or consent. The California Consumer Privacy Act (CCPA) grants consumers the legal right to request access to, or deletion of, their data. To facilitate these requests, California maintains an official registry of data brokers. However, the extent to which these entities comply with the law is unclear. This paper presents the first large-scale, systematic study of CCPA compliance of all 543 officially registered data brokers. Data access requests were manually submitted to each broker, followed by in-depth analyses of their responses (or lack thereof). Above 40% failed to respond at all, in an apparent violation of the CCPA. Data brokers that responded requested personal information as part of their identity verification process, including details they had not previously collected. Paradoxically, this means that exercising one's privacy rights under CCPA introduces new privacy risks. Our findings reveal rampant non-compliance and lack of standardization of the data access request process. These issues highlight an urgent need for stronger enforcement, clearer guidelines, and standardized, periodic compliance checks to enhance consumers' privacy protections and improve data broker accountability.

cs.CR↗

arXiv2024

On HTLC-Based Protocols for Multi-Party Cross-Chain Swaps

In his 2018 paper, Herlihy introduced an atomic protocol for multi-party asset swaps across different blockchains. His model represents an asset swap by a directed graph whose nodes are the participating parties and edges represent asset transfers, and rational behavior of the participants is captured by a preference relation between a protocol's outcomes. Asset transfers between parties are achieved using smart contracts. These smart contracts are quite involved and they require storage and processing of a large number of paths in the swap digraph, limiting practical significance of his protocol. His paper also describes a different protocol that uses only standard hash time-lock contracts (HTLC's), but this simpler protocol applies only to some special types of digraphs. He left open the question whether there is a simple and efficient protocol for cross-chain asset swaps in arbitrary digraphs. Motivated by this open problem, we conducted a comprehensive study of \emph{HTLC-based protocols}, in which all asset transfers are implemented with HTLCs. Our main contribution is a full characterization of swap digraphs that have such protocols.

cs.DS↗