  Many studies have exposed the massive collection of personal data in the
digital ecosystem through, for instance, websites, mobile apps, or smart
devices. This fact goes unnoticed by most users, who are also unaware that the
collectors are sharing their personal data with many different organizations
around the globe. This paper assesses techniques available in the state of the
art to identify the organizations receiving this personal data. Based on our
findings, we propose ROI (Receiver Organization Identifier), a fully automated
method that combines different techniques to achieve a 95.71% precision score
in identifying an organization receiving personal data. We demonstrate our
method in the wild by evaluating 10,000 Android apps and exposing the
organizations that receive users' personal data.
