From Lines of Code to Lines of Policy? Exploring Software Developers’ Perceptions of Their Privacy Policy–Related Activities
Authors: Ria Prianka Saha (Technical University of Darmstadt), Daniel Stäcker (Technical University of Darmstadt), Jonas Stromberg (Fraunhofer IGD), Steven Lamarr Reynolds (Fraunhofer IGD), Kilian Demuth (Technical University of Darmstadt), Frank Nelles (Technical University of Darmstadt), Christian Reuter (Technical University of Darmstadt), Jörn Kohlhammer (Fraunhofer IGD), Alexander Benlian (Technical University of Darmstadt)
Volume: 2026
Issue: 3
Pages: 426–440
DOI: https://doi.org/10.56553/popets-2026-0089
Abstract: Ensuring that privacy policies accurately reflect the real-world behavior of software systems is a complex socio-technical challenge. Despite the importance of privacy policies for user trust and regulatory compliance, prior research has paid limited attention to how software developers perceive their own activities in achieving alignment between privacy policies and actual software behavior and which organizational factors they identify as leading to misalignment. This perspective is particularly important because developers’ implementation practices directly shape how software handles personal data. To address this research gap, we conducted 15 semi-structured interviews with software developers directly involved in implementing privacy-relevant functionality. Our findings identify several alignment activities performed by developers and highlight symbolic compliance as an important organizational factor contributing to gaps between documented privacy commitments and actual software behavior. Our study offers implications for researchers investigating privacy challenges in software development and provides valuable insights for organizations and developers seeking to better align privacy policies with actual software behavior.
Keywords: software developer, privacy policy, software behavior, compliance, data protection
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
