An Automated Approach to Auditing Disclosure of Third-Party Data Collection in Website Privacy Policies

Abstract

A dominant regulatory model for web privacy is "notice and choice". In this model, users are notified of data collection and provided with options to control it. To examine the efficacy of this approach, this study presents the first large-scale audit of disclosure of thirdparty data collection in website privacy policies. Data flows on one million websites are analyzed and over 200,000 websites' privacy policies are audited to determine if users are notified of the names of the companies which collect their data. Policies from 25 prominent third-party data collectors are also examined to provide deeper insights into the totality of the policy environment. Policies are additionally audited to determine if the choice expressed by the "Do Not Track" browser setting is respected.Third-party data collection is wide-spread, but fewer than 15% of attributed data flows are disclosed. The third-parties most likely to be disclosed are those with consumer services users may be aware of, those without consumer services are less likely to be mentioned. Policies are difficult to understand and the average time requirement to read both a given site's policy and the associated third-party policies exceeds 84 minutes. Only 7% of first-party site policies mention the Do Not Track signal, and the majority of such mentions are to specify that the signal is ignored. Among thirdparty policies examined, none offer unqualified support for the Do Not Track signal. Findings indicate that current implementations of "notice and choice" fail to provide notice or respect choice. CCS CONCEPTS• Security and privacy → Human and societal aspects of security and privacy; Usability in security and privacy;

We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy

“…For the measurements in the months in between, we used the lists from previous months to download privacy policies. In the majority of cases, we found links to privacy policies in the footer of a website (an approach also used by Libert [25]) or through links in cookie consent notices. When there was no footer or no link to a privacy policy, annotators inspected the site in more detail.…”

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

“…Thus, end users are often forced to accept privacyrelevant third party behavior if they want to make use of the apps' functionality [24]. Although their study was focused only on websites and not mobile apps, Libert [26] audited the disclosure of third party data collection practices on 200,000 privacy policies for websites. He found that the names of third parties are usually not explicitly disclosed in website privacy policies.…”

Challenges in assessing privacy impact: Tales from the front lines

“…People's control over data, as previously mentioned, is sometimes limited, experts have noted, due to the increased data sharing between different organizations and corporations. The volume of information an individual is required to process, in order to figure out the journey of data collection and sharing is beyond human cognitive abilities; and thus it is questionable whether data sharing could be an informed choice for an individual trying to get people to make informed decisions is really difficult because of the sheer insane fire‐hose volume of information they'd have to pass in order to make – and the cognitive load of making decisions all the time, every day, about things which are trivial until they're not and you don't know what, in advance, what is going to be trivial and what's going to be significant is just – we've basically created a world way outside our biological capability to handle.…”