A Comprehensive Study on GDPR-Oriented Analysis of Privacy Policies: Taxonomy, Corpus and GDPR Concept Classifiers

To provide users with more personalized online services and for other legitimate lawful bases, online services typically collect personal data from their users. For online services provided via the Internet, privacy policies on their websites remain the main type of legal documents for online users to understand how service providers collect their personal data. A typical privacy policy describes different aspects about collection and processing of personal data by an online service, e.g., what personal data are collected, how they are collected, why they are collected, how such data are protected, how such data are stored, and what data are shared with third parties. Although accepting the content of a privacy policy is often made mandatory for starting using an online service, most users tend to omit reading privacy policies because they are often too long to read quickly and too difficult to understand due to the legal and formal wording used [1]. Despite the existence of data protection laws and regulations in many countries, it has been found that service providers’ privacy policies often do not fully comply with such laws and regulations, leading to concerns from online users, researchers and privacy advocates [2]. For example, in 2019, the CNIL, the French data protection authority, fined Google 50 million Euros for failing to provide transparent and understandable information in its data consent policy [3].

Among all data protection laws and regulations around the world, the EU (European Union)’s GDPR (General Data Protection Regulation) is one of the most demanding and comprehensive privacy regulations ever enacted. It was passed in 2016, and went into effect in the whole EU and EEA (European Economic Area) on May 25, 2018. After Brexit, the UK decided to keep the GDPR in its local law, known as the UK GDPR, which follows largely the same principles but with some differences on UK-specific matters. This leads to two versions of the GDPR: the EU GDPR and the UK GDPR. In this paper, we will use the loose term “the GDPR” to refer to both versions and consider the EU/EEA/UK as the region the GDPR is effective. The GDPR harmonizes data privacy laws across the EU/EEA/UK and is widely regarded as a benchmark for data protection legislation around the world. The GDPR defines a number of principles and requirements for data controllers and data processors to consider in order to be legally compliant. For example, under the GDPR’s transparency principle, data subjects have the right to be informed about the collection and processing of their personal data. A common approach to meet this requirement is to provide data subjects with a privacy policy document, which inform them about all important information they have a right to know according to the GDPR. The GDPR requires each country to have a national authority to take care of the enforcement of the GDPR, and such bodies often release guidelines to data controllers and data processors on how to be GDPR compliant. For instance, the Information Commissioner’s Office (ICO) [4], the UK’s national data protection authority in charge of the enforcement of the GDPR¹¹1The EU GDPR in the UK before Brexit and the UK GDPR afterwards., has provided a general guide on the GDPR [5] and also a template for data controllers to use as a reference of GDPR-compliance privacy policies [6]. In order to meet their legal obligation in terms of the GDPR, many organizations updated their privacy policy to be GDPR compliant, e.g., the New York Times updated its privacy policy on May 24, 2018, the day before the GDPR went into effect, to include provisions on international data transfers.

The importance of privacy policies for both data subjects and data controllers means that GDPR-oriented analyses of such legal documents can be very useful. It can help enhance data subjects’ awareness on important data protection issues, and also help data controllers refine their privacy policy to be more legally compliant to the GDPR. Such an analysis can obviously be done qualitatively by experienced GDPR experts, but more automated analysis is preferred in many applications to help reduce the time and costs spent. As reviewed in Section II of this paper, many researchers have investigated the automation of analysis of privacy policies, but they all evaluated their concept classifiers by splitting the training and testing sets at the segment level without considering which segment belongs to which privacy policy. Such an approach means that segments used in both the training and testing sets can cover all privacy policies, while in real-world applications the classifiers should be tested on segments from unseen privacy policies. Therefore, a classifier tested using the segment-level treatment could perform worse in real-world settings since its training and testing sets may have not covered all segments of an unseen privacy policy. In addition, we also observed other research gaps in the literature, including the lack of a more complete GDPR taxonomy and the less consideration of hierarchical information in privacy policies for developing GDPR-oriented concept classifiers.

In this paper, we fill all the above research gaps by presenting the most comprehensive comparative study on the performances of GDPR concept classifiers. Our study involved the development of a more complete GDPR taxonomy, the first privacy policy corpus covering hierarchical information, and a comprehensive performance analysis of many different GDPR concept classifiers based on a new document-level training-testing set splitting method, two architectures of hierarchical classifiers, and many different sets of features including some covering contextual information. More details about our contributions are summarized as follows (more significant contributions appearing first).

1) We propose a document-level performance evaluation framework for GDPR concept classifiers, and obtained the actual performance of the classifier in real-world scenarios. Different from previous segment-level evaluation, we divide the training and testing sets by documents so that no segments in the testing set are included in the training process. By comparing the performance results at the document and segment levels, we showed that the performances of GDPR concept classifiers reported in past studies are indeed significantly overestimated, so cannot reflect their real-world performances. This indicates the need for all future studies to follow the document-level performance framework.

2) We conduct a comparative study on GDPR concept classifiers (the most comprehensive one to the best of our knowledge). Our study goes beyond past research in multiple ways: i) considering contextual features based on the hierarchical nature of a privacy policy (derived from the parent node and the immediate sibling nodes); ii) comparing two architectures of hierarchical classifiers – local classifier per node (LCN) and local classifier per parent node (LCPN), not just LCPN in past work; iii) obtaining a range of new insights based on extensive experiments, such as evidence against the “one type of classifier fits all” idea followed in past work and the error propagation issue of LCPN classifiers.

3) We constructed a new and the first fully hierarchically encoded GDPR-oriented privacy policy corpus GoPPC-150 and the new framework for extending this new corpus and constructing other new corpora. GoPPC-150 includes 150 privacy policies collected from Alexa.com top websites. It includes expert-annotated GDPR concept labels in a hierarchical manner following a newly extended GDPR privacy policy taxonomy (see below), and is structured at the document-level. The inclusion of explicitly encoded hierarchical information in GoPPC-150 allows more context-aware development of GDPR concept classifiers and other relevant tools. The framework has a high level of automation to minimize human intervention.

4) We propose an extended taxonomy for facilitating GDPR-oriented analysis of privacy policies. This taxonomy is based on a smaller GDPR taxonomy proposed by Torre et al. [7], our own expertise, two important documents from the ICO and the IAPP (International Association of Privacy Professionals), and the work of the W3C Data Privacy Vocabularies and Controls CG (DPVCG). The end result is the most comprehensive GDPR privacy policy taxonomy reported in the literature so far.

To help other researchers reproduce our work reported in this paper, all our source code, data used and newly produced, and all results of our experiments have been uploaded to a GitHub repository available at https://github.com/tp-sh/GDPR_privacy_policies. We will refer to this GitHub repository frequently in the rest of the paper, with a direct URL pointing to the corresponding part of the repository when necessary.

The rest of this paper is structured as follows. Section II discusses related work. Section III shows the initial experimental evidence regarding the significantly reduced performances of selected concept classifiers previously trained at the segment level, when they are applied to unseen privacy policies. Section IV explains the more complete GDPR taxonomy and the new hierarchical corpus we developed, including the methods we used for their development. Section V introduces the comprehensive study on the GDPR concept classifiers and the evaluation results using the document-level evaluation framework. Section VI discusses the further research directions of our work and the field, and the last section concludes the paper.

In this section, we introduce related work in five closely related areas: (1) hierarchical multi-label text classification, (2) privacy policy corpora, (3) privacy policy concept classifiers, and (4) analyses of privacy policies.

Hierarchical multi-label text classification (HMTC). Privacy policy is a hierarchical text with multi-label, so the compliance checking of privacy policy can be regarded as an HMTC task. There are many studies on HMTC, in 2011, Silla et al. [8] summarized the three methods of HMTC, which are flat, local and global approaches. To achieve better results, the latter two are more concerned. Koller et al. [9] introduced the first type of local classifier which is proposed to explore the hierarchy by using local information and build multiple local classifiers around it. Following which, a series of local approaches including LCN (a local classifier per node), LCPN (a local classifier per parent node) as well as LCL (a local classifier per level) based methods are proposed [10, 11, 12]. However, local approaches on their own possess high risk of error-propagation. On the other hand, global approaches are designed to build a single classifier to explore hierarchical information globally, thus reducing the overall model size. Most global approaches are generally modified from the flat classification algorithms such as hAnt-Miner [13], Vens et al. [14]) (decision tree based) and GMNBwU [15](Naive Bayes classifier based). Recently, more neural network based HMTC algorithms which combine both local and global approaches are proposed [16, 17]. Huang [18] proposed HARNN, extracting hierarchical information at different label levels and generating document embeddings for local and global classifications. Zhang [19] introduced LA-HCN which employs label-based attention based on the individual label, and the respective embeddings are obtained for global and local classification for better error propagation control. However, when it comes to the compliance checking of privacy policy, few researches have applied global approaches for classification. Most of the classifiers are local [20, 21, 7, 22, 23]. Their specific approaches are shown in following Table I. The tuples in column Taxonomy explain the numbers of levels and nodes of the taxonomies as (3, 96) represents there are 96 nodes of 3-level in the taxonomy. The tuples in column Corpus/Corpora explain the number of samples, annotation levels and be in hierarchical structure or not. For example, (150, 3, Yes) represents that there are 150 privacy policies with annotations of 3-level in the corpus GoPPC-150 and has a hierarchical structure.

Privacy policy corpora. In 2016, Wilson et al. [24] created a public privacy policy corpus called “Online Privacy Policy” (OPP-115) by hiring three legal experts as annotators and it has been used by many other researchers. However, Sarne et al. [26] used unsupervised ML to model topics in privacy policies and found a mismatch between the topics in privacy policies they analyzed and topics covered in OPP-115. Sathyendra et al. [27] constructed a more fine-grained corpus based on OPP-115 with semi-automated annotation, focusing on “opt-out” in privacy policies. Leblanc and Liu [28] built a corpus of fuzzy words and sentences in privacy policies. Zimmeck et al. [29] created the App-350 Privacy Policy Corpus with the goal of checking compliance of behaviors and privacy policies of mobile apps. They selected 350 privacy policies of the most popular apps on Google Play and hired legal experts as annotators. Robaldo et al. [30] used I/O logic formula to code and model various legal documents, expressed legal statements in a logical language, explained various clauses, and demonstrated their work with the GDPR. Muller et al. [31] introduced a privacy policy dataset containing over 18,300 sentences, tagged according to five core privacy policy requirements of the GDPR. Srinath et al. [23] created PrivaSeer, an automatically constructed corpus containing privacy policies of over 1 million English websites, and studied the composition of the corpus, showing readability tests, document similarity, keyword extraction results, and exploring the corpus through topic modeling. Kuznetsov et al. [32] used a technique for identifying URLs of privacy policies of IoT devices to construct a new corpus with 592 privacy policies in 2022.

Privacy policy concept classifiers. Harkous et al. [20] proposed Polisis, a comprehensive framework for enabling multi-dimensional privacy policy analysis. Polisis provides an online service for privacy policies analysis, using a combination of NLP and deep learning (DL) techniques to extract fragments from privacy policies, each containing a set of labels describing data processing behaviors. Tesfay et al. [33] proposed an ML-based approach to classify multiple categories of privacy policy content using pre-defined keywords. Lippi et al. [34] provided 33 metadata types for privacy policies in terms of the GDPR compliance, and provided automatic support for ambiguity detection of privacy policies based on manual rules and machine learning (ML) based methods. A more comprehensive piece of work was done by Torre et al. [7], who proposed 55 metadata types, covering all types identified by Lippi et al. [34], and studied automated detection of privacy policy integrity using an advanced combination of natural language processing (NLP) and ML based on the 55 metadata types. Their more recent work [25] further improved their privacy policy completeness checking framework with the same GDPR taxonomy and classifiers. Srinath et al. [23] constructed a new privacy policy corpus called PrivSeer, built a pre-trained language model called PrivBERT based on PrivSeer, and then developed a number of concept classifiers for privacy policy analysis based on PriVERT. As a whole, the best-performing classifiers are PrivBERT-based ones and those reported in [25], achieving an F1 score above 0.8 for most concept classifiers, and even above 0.9 for some.

Analyses of privacy policies. There are many past studies focusing on the analyses of privacy policies, some of which are GDPR-oriented. Many of such studies are based on machine learning based concept classifiers, as part of a larger automated system. When it comes to the GDPR-oriented analyses, Tom et al. [35] presented a preliminary GDPR model that aims to provide a simple and visual overview for human operators to achieve a better understanding of the relationships between different concepts in the GDPR. It also describes a method of using their proposed model as a tool to develop privacy policies and illustrates how to extract compliance rules. Palmirani and Governatori [36] proposed a proof of concept applicable to the GDPR domain with the aim of detecting or preventing violations of privacy enforcement norms. Bhatia et al. [37] identified incompleteness of privacy policies by representing data practice descriptions as semantic frames. The approach was a grounded analysis to discover which semantic roles corresponding to a data action are needed to construct complete data practice descriptions. Mousavi et al. [38] proposed a tool called KnIGHT, whose innovation lies in the use of semantic similarity between words to associate sentences in a privacy policy with relevant paragraphs in the legal text of the GDPR. Torre et al. [39] proposed a model-based solution for GDPR-compliance analysis, using Unified Modeling Language (UML) and Object Constraint Language (OCL) to build a UML representation of the GDPR. Hamdani et al. [40] conceptualized a framework to implement document-central compliance checking methods in the data supply chain and developed concrete methods to automatically check GDPR-compliance of privacy policies. The other work focus on the commonalities of privacy policies. In order to increase transparency of privacy policies, Zimmeck et al. [41] proposed Privee, a software architecture for analyzing essential policy terms based on crowd sourcing and automatic classification techniques. They implemented Privee as a proof-of-concept web browser extension that retrieves policy analysis results from an online privacy policy repository or, if no such results are available, performs automatic classifications. Targeting privacy policies of websites and mobile apps, Caramujo et al. [42] proposed a domain-specific language and a model transformation approach for specifying privacy policy models. Pullonen et al. [43] proposed a multi-level model as an extension of the business process model and representation to support visualization, analysis, and communication of the privacy policy characteristics of business processes. Ayala-Rivera and Pasquale [44] proposed a model-based approach to help online services understand their data protection obligations under the GDPR. Zimmeck et al. [45] designed and implemented PrivacyFlash Pro, an automated privacy policy generator for iOS apps that leverages static analysis, which identifies code signatures composed of Plist permission strings, framework imports, class instantiations, authorization methods and other evidence that are mapped to privacy practices expressed in privacy policies. Wang et al. [46] proposed PRIVGUARD, a novel system design that reduces human participation required and improves the productivity of the compliance process, which is mainly comprised of two components: (1) PRIVANALYZER, a static analyzer based on abstract interpretation for partly enforcing privacy regulations, and (2) a set of components providing strong security protection on the data throughout its life cycle. Cui et al. [47] proposed POLIGRAPH, automated analysis of the information disclosed in a policy into a knowledge graph based on NLP technology. Although they also combine the context of the current text for classification, they only focus on the data collection part of the privacy policy, and do not consider the structural information of the privacy policy.

As explained in the Introduction section, all past studies on concept classifiers of privacy policies all followed the segment-level performance evaluation approach. In order to show that such an approach could lead to an overestimation of the performance, we conducted a small experiment to test the performances of some PrivBERT-based concept classifiers with a good performance as reported in [23]²²2For this experiment, we did not select Torre et al.’s classifiers [25] because of the following reasons: 1) their classifiers are not open sourced; 2) they used various artificial rules so it is harder to generalize their classifiers; and 3) we reproduced their classifiers based on their descriptions in [25] and tested their classifiers’ performances against the new corpus we developed, but all the classifiers performed turned out to be very poor (see the results at https://github.com/tp-sh/GDPR_privacy_policies/blob/main/data/Torre_classifiers_results.csv), indicating that their classifiers may have overfitting problems., by applying them to three privacy policies the first author of the paper manually labeled. These classifiers, which were previously trained and tested at the segment level using the OPP-115 corpus, now needed to make predictions on unseen privacy policies, which are not included in the OPP-115 corpus. The results showed that all classifiers performed much worse than what was reported in [23]. Table II shows the performance comparison of 4 concept classifiers with more than 10 positive samples, and the full results of all the 10 concept classifiers can be found at https://github.com/tp-sh/GDPR_privacy_policies/blob/main/data/opp_results.csv.

The results indicate that the PrivBERT classifiers trained and tested at the segment level could not perform as well as shown by the performance metrics reported in [23]. Considering that the way how privacy policies are written has not substantially changed over the years, we believe the significantly reduced performances are caused by the inappropriate way of splitting the training and test sets at the segment level. This calls the need to consider the document-level splitting approach for evaluating performances of such classifiers. This is one of the main foci of our work reported later.

In this section, we give details of our work on the extended GDPR taxonomy, the framework GoHPPC and the new corpus GoPPC-150.

As mentioned in Section II, past studies on automated GDPR compliance of privacy policies focuses mostly on long texts or paragraphs in the privacy policy without considering the hierarchical structure, e.g., no previous work has considered automatic analysis of titles in a privacy policy. Missing such context information in a privacy policy can lead to an incomplete and less accurate analysis. What’s more, previous work tends to view compliance checking task as multi-label classification, using one model classify all concepts of the same level. As a result, the input features of the model are all the same. This seems work when concept types are few. But for the 96 concepts of different levels in our GDPR taxonomy, the same features may well are not suitable. To figure out the effect of different input features and structures of models, we conducted a comprehensive study. As shown in Figure 3, we tried different combinations of structures of classifiers, input features, corpora and evaluation methods, then compared each performance on each concept.

Noticeably, the binary RF model with 100-D TF-IDF vectorization input features is enough for titles’ classification, and the length of titles’ text limit the experiment much. So we only conducted the comprehensive study on paragraphs and applied the simple configuration on title classification task.

The significant difference between the performance results obtained by these two evaluation methods further demonstrates the value of document-level evaluation methods. The results obtained by the previous segment-level evaluation methods are somewhat inflated, and the excellent performance in the test does not mean that the correct prediction can be made in the real environment. Only by using the document-level evaluation method can we understand the performance of the classifiers in the real environment. However, previous work did not pay attention to this point, which may be because the current open source corpus is also segment-level, such as our document-divided corpus is not common, so relevant work can only use segment-level assessment methods. Therefore, we propose that the future corpus need to be divided into documents, so that the document-level evaluation method can be adopted.

The results of our evaluation method show that the performance of current concept classifiers is overestimated, and in fact, the performance of classifiers can not meet the requirements of large-scale automated detection. This results in an error bar that is too large to be trusted. Therefore, it is not possible to do large-scale automated detection of privacy policies at present, and the focus of current work should also be to improve the performance of classifiers. In order to achieve this goal, the corpus needs to be greatly expanded, which cannot be done by our efforts alone, and requires the cooperation of the entire community. We plan to set up an open website and open source our corpus and code to facilitate such a community-wide effort.

At the same time, we found that a single set of classifiers can not always obtain the best performance in all concepts, and for some concepts, the simple configuration of classifiers can get better performance, which indicates that the previous ”one size fits all” point is not correct, especially for the privacy policy analysis scenario that requires dozens of classifiers. It is obviously far-fetched to always adopt the same configuration. For obtaining the best classifier for each concept, it is necessary to conduct comprehensive experiments and analysis to get the best classifier configuration.

Furthermore, LLM may also represent a potential development direction of this part of work. The large training samples of LLM can mitigate the limitations of corpora and ensure the robustness of the classification.

This paper proposes a new evaluation method for concept classifiers which can present the performance of classifiers in real environment. Different from previous method, the new approach divides samples in document-level while training and evaluating. The gap between our evaluation results and previous work shows that the former classifiers are highly overestimated. The real performance of the classifiers are not enough for the large scale automation compliance analysis. We also noticed some other gaps in previous work and improved them. This includes the most complete GDPR-oriented privacy policy taxonomy, a new GDPR-oriented privacy policy corpus GoPPC-150 and an automation-enhancing frameworks for supporting future research on GDPR-oriented analysis of privacy policies. This paper also provides the most comprehensive study on the GDPR-oriented analysis of privacy policies. The study led to a range of new findings and insights, including the usefulness of context-based features for improving performance of machine learning based GDPR concept classifiers, the importance to consider the LCN architecture of hierarchical classifiers and testing cross-corpus generalizability, and the finding that a “one size fits all” idea does not work for GDPR concept classifiers so a more locally optimized approach is needed. Our study also led to a range of new GDPR concept classifiers that can be used by researchers and practitioners. Although our work focused on GDPR-oriented analysis, most results and outcomes can either be easily extended to study other and multiple data protection laws, or the general insights can be re-validated in the wider data protection landscape.