Investigating Artificial Intelligence Digital Sovereignty in Mobile Shopping Apps: A Case Study of Nigeria

Overview§

This paper investigates how AI features in Nigerian e-commerce mobile applications impact individual digital sovereignty, operationalized through platform transparency. The authors combine Android APK forensic analysis with contextual document analysis (privacy policies, terms of service) and a broader socio-economic assessment of Nigeria's digital dependence. The core methodological contribution is a reproducible transparency scoring framework that quantifies the gap between AI deployment and user-facing disclosure.

Methodology§

The forensic analysis pipeline involves:

• APK decomposition: Using reverse-engineering tools (e.g., `androguard`) to extract manifest files, strings, assets, and DEX bytecode.
• AI-feature detection: Identifying embedded ML SDKs (TensorFlow Lite, ML Kit, ONNX Runtime), model artifacts (`.tflite, .onnx, .pb`), and algorithmically driven behaviors such as recommendation engines or risk scoring.
• Document analysis: Coding privacy policies and in-app notices for explicit mentions of AI, automated decision-making, data processing purposes, and user opt-out options.
• Socio-economic contextualization: Analyzing national metrics on mobile penetration, digital payment adoption, and AI awareness to interpret sovereignty implications.

Transparency Index§

The authors compute a composite transparency score per application:

$$T = \alpha D_d + \beta P_p + \gamma M_m$$

where:

• \(D_d\) = normalized disclosure depth (0–1) based on the specificity of AI-related language in the privacy policy,
• \(P_p\) = binary indicator for explicit AI consent or opt-out mechanism,
• \(M_m\) = model artifact discoverability (0–1) from static analysis,
• \(\alpha, \beta, \gamma\) = weights reflecting the authors' prioritization of disclosure, consent, and auditability (e.g., \(\alpha=0.5, \beta=0.3, \gamma=0.2\)).

This index allows cross-app comparison and highlights cases where AI is embedded "silently" — i.e., models exist but users have no meaningful awareness or control.

Code Snippet (Static AI Detection)§

The following Python snippet illustrates how to detect AI/ML markers in a set of Android APKs using `androguard`:

import re
from androguard.misc import AnalyzeAPK

def analyze_transparency(apk_path):
    a, d, dx = AnalyzeAPK(apk_path)
    findings = {
        'ml_sdks': set(),
        'has_model_files': False
    }
    
    # Search DEX strings for known AI SDK markers
    markers = [
        'tensorflowlite',
        'mlkit',
        'com.google.android.gms.vision',
        'onnxruntime',
        'torch'
    ]
    for dex in dx.get_analysis():
        for string in dex.get_strings():
            lower = string.lower()
            for m in markers:
                if m in lower:
                    findings['ml_sdks'].add(m)
    
    # Check assets for model files
    for fname in a.get_files():
        if re.search(r'\.(tflite|onnx|pb)$', fname.lower()):
            findings['has_model_files'] = True
    
    findings['ml_sdks'] = list(findings['ml_sdks'])
    return findings

for apk in ['jumia.apk', 'konga.apk', 'glovo.apk']:
    print(apk, analyze_transparency(apk))

This script captures the minimal signals that a human researcher then triangulates with privacy-policy coding to compute the transparency index.

Findings and Implications§

The empirical results indicate that AI features (recommendation systems, fraud detection, chat assistants) are pervasive across the studied apps, yet transparent disclosure is rare. Most policies use vague terms like "we may use data to improve services" without explicitly mentioning automated decision-making or giving users a consent choice. The socio-economic analysis further shows that Nigerian consumers are increasingly dependent on foreign-owned digital platforms, heightening sovereignty risks.

The study's main contribution is empirical: it provides a low-cost, repeatable methodology for auditing AI transparency in mobile ecosystems, which is especially relevant in contexts with limited regulatory enforcement. The authors argue that individual digital sovereignty requires more than data-protection laws — it demands actionable transparency mechanisms at the app level, and their transparency index can serve as a benchmark for regulators and consumer advocates.