Crowdsourcing privacy policy analysis: Potential, challenges and best practices

Abstract

Privacy policies are supposed to provide transparency about a service's data practices and help consumers make informed choices about which services to entrust with their personal information. In practice, those privacy policies are typically long and complex documents that are largely ignored by consumers. Even for regulators and data protection authorities privacy policies are difficult to assess at scale. Crowdsourcing offers the potential to scale the analysis of privacy policies with microtasks, for instance by assessing how specific data practices are addressed in privacy policies or extracting information about data practices of interest, which can then facilitate further analysis or be provided to users in more effective notice formats. Crowdsourcing the analysis of complex privacy policy documents to non-expert crowdworkers poses particular challenges. We discuss best practices, lessons learned and research challenges for crowdsourcing privacy policy analysis. → Human and societal aspects of security and privacy → Privacy protections, Security and privacy → Human and societal aspects of security and privacy → Usability in security and privacy, Social and professional topics →

Data Collection Practices of Mobile Applications Played by Preschool-Aged Children

“…However, adults often have inaccurate understandings of the internet and online data flows . Although many parents express concern about their children’s digital privacy, most have limited knowledge of privacy practices, such as those described by privacy policies, which can be difficult to decipher . Until data collection and sharing practices are transparent, parents may wish to install apps from trusted developers (eg, PBS KIDS), learn more about digital privacy from resources such as Common Sense Media, or look up the data collection practices of apps on databases such as http://search.appcensus.io …”

No Risk, More Fun! Automating Breach of Confidentiality Risk Assessment for Android Mobile Health Applications

“…Extant research on automated breach of confidentiality risk assessment can be classified into two categories. First, previous research focused on automatically detecting potential breach of confidentiality risks within metainformation provided by the app, for example, by applying text-classification and machine learning tools to privacy notices [24,25,26]. Automated assessment of metainformation is challenging because privacy notices are written in complex legal language and are difficult to process [27].…”