Identifying the Provision of Choices in Privacy Policy Text

Abstract

Websites' and mobile apps' privacy policies, written in natural language, tend to be long and difficult to understand. Information privacy revolves around the fundamental principle of notice and choice, namely the idea that users should be able to make informed decisions about what information about them can be collected and how it can be used. Internet users want control over their privacy, but their choices are often hidden in long and convoluted privacy policy documents. Moreover, little (if any) prior work has been done to detect the provision of choices in text. We address this challenge of enabling user choice by automatically identifying and extracting pertinent choice language in privacy policies. In particular, we present a two-stage architecture of classification models to identify opt-out choices in privacy policy text, labelling common varieties of choices with a mean F1 score of 0.735. Our techniques enable the creation of systems to help Internet users to learn about their choices, thereby effectuating notice and choice and improving Internet privacy.

MAPS: Scaling Privacy Compliance Analysis to a Million Apps

“…Fei Liu et al [39] and Frederick Liu et al [29] addressed the problem of identifying policy sections relating to the same topic. Sathyendra et al [47] classified advertising opt outs and other privacy-related options on websites. Cranor et al [10] evaluated financial institutions' privacy notices.…”

Question Answering for Privacy Policies: Combining Computational and Legal Perspectives

“…Prescriptive approaches towards communicating privacy information (Kelley et al, 2009;Micheti et al, 2010;Cranor, 2003) have not been widely adopted by industry. Recently, there have been significant research effort devoted to understanding privacy policies by leveraging NLP techniques Oltramari et al, 2017;Mysore Sathyendra et al, 2017;, especially by identifying specific data practices within a privacy policy. We adopt a personalized approach to understanding privacy policies, that allows users to query a document and selectively explore content salient to them.…”

Automatic Detection of Vague Words and Sentences in Privacy Policies

“…Sadeh et al (2013) describe a Usable Privacy Policy Project that seeks to semi-automate the extraction of salient details from privacy policies. Other studies include crowdsourcing privacy policy annotations and categorizing data practices (Ammar et al, 2012;Massey et al, 2013;Wilson et al, 2016b,a), grouping text segments related to certain policy issues , summarizing terms of services (Braun et al, 2017), identifying user optout choices (Sathyendra et al, 2017), and many others. These studies emphasize the "too long to read" issue of privacy policies but leave behind the "difficult to understand" aspect, such as identifying and eliminating vague content.…”