Researchers’ Experiences in Analyzing Privacy Policies: Challenges and Opportunities
Authors: Abraham Mhaidli (University of Michigan), Selin Fidan (University of Michigan), An Doan (University of Michigan), Gina Herakovic (University of Michigan), Mukund Srinath (Penn State University), Lee Matheson (Future of Privacy Forum), Shomir Wilson (Penn State University), Florian Schaub (University of Michigan)
Volume: 2023
Issue: 4
Pages: 287–305
DOI: https://doi.org/10.56553/popets-2023-0111
Abstract: Companies' privacy policies and their contents are being analyzed for many reasons, including to assess the readability, usability, and utility of privacy policies; to extract and analyze data practices of apps and websites; to assess compliance of companies with relevant laws and their own privacy policies, and to develop tools and machine learning models to summarize and read policies. Despite the importance and interest in studying privacy policies from researchers, regulators, and privacy activists, few best practices or approaches have emerged and infrastructure and tool support is scarce or scattered. In order to provide insight into how researchers study privacy policies and the challenges they face when doing so, we conducted 26 interviews with researchers from various disciplines who have conducted research on privacy policies. We provide insights on a range of challenges around policy selection, policy retrieval, and policy content analysis, as well as multiple overarching challenges researchers experienced across the research process. Based on our findings, we discuss opportunities to better facilitate privacy policy research, including research directions for methodologically advancing privacy policy analysis, potential structural changes around privacy policies, and avenues for fostering an interdisciplinary research community and maturing the field.
Keywords: privacy, privacy policies, research practice, public policy, natural language processing, machine learning, research infrastructure
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
