Ambiguity in Privacy Policies and the Impact of Regulation

Reidenberg, Joël R.; Bhatia, Jaspreet; Breaux, Travis D.; Norton, Thomas B.

doi:10.1086/688669

Cited by 56 publications

(39 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Work in computer science has tended to suggest that the failure of notice and consent lies with firms who purposely obfuscate their privacy notices (McDonald and Cranor, 2009), and that if presented with transparent information, consumers would make the right privacy choices (Tsai et al, 2011). Echoing this literature, legal commentary on notice and choice has tended to emphasize failures on the part of firms to be sufficiently transparent and compliant with existing policy (Marotta-Wurgler, 2016;Reidenberg et al, 2016). By contrast, our paper suggests that compliance with notice and consent may still not achieve the policy goal of protecting consumer privacy: Due to the effect small frictions can have on shifting consumer behavior away from privacy preferences, consent may not actually reflect true consumer intent.…”

Section: Introductionmentioning

confidence: 99%

The Digital Privacy Paradox: Small Money, Small Costs, Small Talk

Athey¹,

Catalini

Tucker

2017

SSRN Journal

View full text Add to dashboard Cite

Section: Introductionmentioning

confidence: 99%

The Digital Privacy Paradox: Small Money, Small Costs, Small Talk

Athey¹,

Catalini

Tucker

2017

SSRN Journal

View full text Add to dashboard Cite

“…Optional attributes are less common, while mandatory attributes are essential to a data practice. However, the experts' analysis of privacy policies found that descriptions of data practices in privacy policies are often ambiguous on many of these attributes [37]. Therefore, a valid value for each attribute is Unspecified in order to express and capture the absence of information.…”

Section: Resulting Collection Of Data Practice Framesmentioning

confidence: 99%

PrivOnto: A semantic framework for the analysis of privacy policies

Oltramari

Piraviperumal

Schaub

et al. 2018

View full text Add to dashboard Cite

Privacy policies are intended to inform users about the collection and use of their data by websites, mobile apps and other services or appliances they interact with. This also includes informing users about any choices they might have regarding such data practices. However, few users read these often long privacy policies; and those who do have difficulty understanding them, because they are written in convoluted and ambiguous language. A promising approach to help overcome this situation revolves around semi-automatically annotating policies, using combinations of crowdsourcing, machine learning and natural language processing. In this article, we introduce PrivOnto, a semantic framework to represent annotated privacy policies. PrivOnto relies on an ontology developed to represent issues identified as critical to users and/or legal experts. PrivOnto has been used to analyze a corpus of over 23,000 annotated data practices, extracted from 115 privacy policies of US-based companies. We introduce a collection of 57 SPARQL queries to extract information from the PrivOnto knowledge base, with the dual objective of (1) answering privacy questions of interest to users and (2) supporting researchers and regulators in the analysis of privacy policies at scale. We present an interactive online tool using PrivOnto to help users explore our corpus of 23,000 annotated data practices. Finally, we outline future research and open challenges in using semantic technologies for privacy policy analysis.

show abstract

“…Previous research shows that privacy policies are generally long [24,53], ambiguous [44], difficult to understand [15,38], and sometimes downplay the privacy implications of data collection [42]. This is despite the fact that privacy policies remain the key place where users may try and find out information about data handling and sharing practices [45].…”

Section: Languagementioning

confidence: 99%

“…These apps are above average in comparison to other app categories, [31], menstruapps, however, still include complex wording and obfuscating terms within their policies. As happens with most privacy policies, it is not surprising to see the ambiguous term 'may' being the most frequently used [5,44]. On the other hand, some policies were too short to provide useful information to the user or potentially employed inapplicable policies replicated from elsewhere.…”

Section: Policies Should Include All App Behavioursmentioning

confidence: 99%

How private is your period?: A systematic analysis of menstrual app privacy policies

Shipp

Blasco

2020

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Menstruapps are mobile applications that can track a user’s reproductive cycle, sex life and health in order to provide them with algorithmically derived insights into their body. These apps are now hugely popular, with the most favoured boasting over 100 million downloads. In this study, we investigate the privacy practices of a set of 30 Android menstruapps, a set which accounts for nearly 200 million downloads.We measured how the apps present information and behave on a number of privacy related topics, such as the complexity of the language used, the information collected by them, the involvement of third parties and how they describe user rights. Our results show that while common pieces of personal data such as name, email, etc. are treated appropriately by most applications, reproductive-related data is not covered by the privacy policies and in most cases, completely disregarded, even when it is required for the apps to work. We have informed app developers of our findings and have tried to engage them in dialogue around improving their privacy practices.

show abstract

Ambiguity in Privacy Policies and the Impact of Regulation

Cited by 56 publications

References 5 publications

The Digital Privacy Paradox: Small Money, Small Costs, Small Talk

The Digital Privacy Paradox: Small Money, Small Costs, Small Talk

PrivOnto: A semantic framework for the analysis of privacy policies

How private is your period?: A systematic analysis of menstrual app privacy policies

Contact Info

Product

Resources

About