Why it matters

Device identifiers, IP addresses and behavior patterns can identify a person even without a name. Reusing a fraud-detection fingerprint for analytics turns a security control into tracking.

How to meet it

  • Use keyed, purpose-scoped pseudonyms instead of stable identifiers.
  • Separate data used for fraud detection from analytics, with technical barriers between them.
  • Avoid collecting persistent device identifiers where a resettable or app-scoped one will do.

MASTG tests in the local projects

Neither local project runs a MASTG test for MASVS-PRIVACY-2. The guides below explain the platform mechanisms, and the control’s page on mas.owasp.org links the MASTG tests and weaknesses OWASP maps to it.

Guides on this site

Also covers this · Guide

Tokenization, pseudonymization and privacy transformations: choose deliberately

Choose between vault tokens, keyed pseudonyms, format-preserving encryption, aggregation and differential privacy by the joins, reversibility and leakage each allows, and test re-identification on the data you release.

Gaps on this site

The privacy transformation guide covers pseudonymization in general. No guide here covers device identifiers or tracking signals in mobile apps.

References

  1. MASVS-PRIVACY-2 (OWASP MASVS v2.1.0)
  2. MASVS-PRIVACY: Privacy (OWASP MASVS v2.1.0)

List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

Control statements are quoted from OWASP MASVS v2.1.0, licensed CC BY-SA 4.0; the rest is this site's summary. MASTG tests are those the iOS and Android projects here run, with their titles from mas.owasp.org. License.