Why it matters

Control over data is only real if deletion and consent withdrawal reach every copy, including backends and third parties, and if the app asks again when it starts collecting more.

How to meet it

  • Provide in-app ways to delete data and the account, and to withdraw consent.
  • Propagate deletion and consent changes to the backend and to third parties.
  • Ask for consent again, and update disclosures, before collecting more data than first declared.

MASTG tests in the local projects

Neither local project runs a MASTG test for MASVS-PRIVACY-4. The guides below explain the platform mechanisms, and the control’s page on mas.owasp.org links the MASTG tests and weaknesses OWASP maps to it.

Guides on this site

Also covers this · Guide

GDPR privacy by design for engineers: Articles 25, 32 and 35 in code

Turn GDPR data protection by design and by default, security of processing and DPIA triggers into engineering work: a personal-data inventory checked in CI, defaults that collect and share less, a DPIA screen at design time, and access and erasure requests that reach every store.

Gaps on this site

The GDPR guide covers data subject rights and testing erasure on the backend. No guide here covers in-app account deletion or consent withdrawal in mobile apps.

References

  1. MASVS-PRIVACY-4 (OWASP MASVS v2.1.0)
  2. MASVS-PRIVACY: Privacy (OWASP MASVS v2.1.0)

List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.

Control statements are quoted from OWASP MASVS v2.1.0, licensed CC BY-SA 4.0; the rest is this site's summary. MASTG tests are those the iOS and Android projects here run, with their titles from mas.owasp.org. License.