Privacy Policies Research Articles

A Bilingual Longitudinal Analysis of Privacy Policies Measuring the Impacts of the GDPR and the CCPA/CPRA

Privacy policies are the main mechanism for websites to describe their practices in collecting and processing visitors' personal data. Their format and content are subject to legal requirements that have changed due to recent new privacy regulations including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA). Studying how privacy policies are adapted to such regulatory change can help identify shortcomings in implementing the law and inform future legislatory initiatives. Existing work in this area mostly studied effects of the GDPR on privacy policies or the "Do Not Sell My Personal Information" link mandated by the CCPA. Methodologically, insights were mainly drawn from English-language privacy policies using keyword-based analyses or machine learning classifiers. In this work, we address this research gap and conduct a bilingual study of privacy policies in English and German that investigates the effects of the GDPR and CCPA/CPRA on privacy policy content, using established methods from corpus linguistics that are language-independent and do not rely on keyword lists or classifiers that may date quickly. We find that, unlike for the GDPR, the CCPA's requirements were not yet widely implemented when it first became enforceable but only with its amendment, the CPRA. Before that, websites used more than 60 variants of the "Do Not Sell" link instead of the mandated wording and did not prominently reference individual rights granted by the CCPA/CPRA. While companies outside California and the US did adapt their disclosures to the CCPA/CPRA, this was limited to English-language policies and did not spill over to policies in German. For GDPR enforcement, we find websites to increasingly rely on legitimate interests to justify data collection, raising concerns whether individuals' interests in the privacy of their personal information are still sufficiently considered.

Legal Effect of Internet Privacy Policy

Legal Effect of Internet Privacy Policy

Self-Disclosure on Social Media: Do Personality Traits Matter?

The aim of this study is to integrate the privacy calculus theory with the Big Five Personality Traits Theory and to investigate the direct and moderating effects of the Big Five personality traits (openness, neuroticism, agreeableness, extraversion, and conscientiousness) on the relationship between the privacy calculus structural factors (Perceived Risk and Perceived Benefits) and disclosure of personal information on social network sites. A survey was conducted to collect data from 379 social network sites users. The sample is composed of 225 females and 154 males. The survey was designed in Qualtrics and distributed on WhatsApp using the snowball sampling technique. The measurements of the research model and the hypotheses related to the direct and moderating effects were tested using SmartPLS software. We found that perceived risk was a strong inhibitor, while perceived benefit was a strong facilitator for the disclosure of personal information. In contrast to our expectation, we found no indication that the Big Five personality traits moderate the disclosure of personal information. However, agreeableness had a positive direct effect on information disclosure. These results have implications for privacy policy makers in organizations in modifying policies and strategies for users based on their unique personality traits.

Data Safety vs. App Privacy: Comparing the Usability of Android and iOS Privacy Labels

Privacy labels---standardized, compact representations of data collection and data use practices---are often presented as a solution to the shortcomings of privacy policies. Apple introduced mandatory privacy labels for apps in its App Store in December 2020; Google introduced mandatory labels for Android apps in July 2022. iOS app privacy labels have been evaluated and critiqued in prior work. In this work, we evaluated Android Data Safety Labels and explored how differences between the two label designs impact user comprehension and label utility. We conducted a between-subjects, semi-structured interview study with 12 Android users and 12 iOS users. While some users found Android Data Safety Labels informative and helpful, other users found them too vague. Compared to iOS App Privacy Labels, Android users found the distinction between data collection groups more intuitive and found explicit inclusion of omitted data collection groups more salient. However, some users expressed skepticism regarding elided information about collected data type categories. Most users missed critical information due to not expanding the accordion interface, and they were surprised by collection practices excluded from Android's definitions. Our findings also revealed that Android users generally appreciated information about security practices included in the labels, and iOS users wanted that information added.

Enhancing Industrial IoT Security: Utilizing Blockchain-Assisted Deep Federated Learning for Collaborative Intrusion Detection

The Industrial Internet of Things (IIoT) is a rapidly evolving features with multiple applications, including critical infrastructure. Privacy policies are required to preserve the protection of user data in the threat intelligence community. Blockchain is a modern technology which used recently to provide more secure storage and efficiency. In this research, Blockchain Assisted Deep Federated Learning (BC_DFL) system is used to detect intruders. The three key processes used in the proposed intrusion detection architecture are data collection, pre-processing and intrusion detection. Data normalization, reduction, cleaning and transformation are used in pre-processing to remove extraneous information and improve data quality. This pre-processed data is sent to the Blockchain Assisted Deep Federated Learning (BC_DFL) system for intrusion detection. To detect intruders, the federated learning-based Capsule Auto-Encoder (FL_CAE) architecture first learns the properties from the inputs. Blockchain technology (BCTech) is not only used for storage but also improves security by eliminating the possibility of threatening node and individual server failure. The ToN_IoT and UNSW-NB15 data sets are used in the implementation and performance evaluation study. The proposed model is evaluated using existing in the Results section. In the UNSW-NB15 dataset, proposed model achieved an accuracy, precision, recall and F1 score of 97.26%, 97.28%, 96.89% and 96.96% respectively as well as in ToN_IoT data set proposed model achieved an accuracy, precision, recall and F1 score of 95.74%, 99.54 %, 99.49% and 99.24%, respectively. The execution of the proposed approach takes 2.31 seconds in the UNSW-NB15 dataset and 1.66 seconds in the ToN_IoT dataset. Blockchain offers a transparent and impenetrable ledger for transaction recording and verification. Within the framework of cooperative intrusion detection, it guarantees a secure and reliable exchange of threat intelligence and detection models between various users of IIoT ecosystem.

Implementation of Consumer Personal Data Protection in Ecommerce from the Perspective of Law No. 27 of 2022

This research aims to analyze the implementation of the Personal Data Protection Law (PDP Law) No. 27 of 2022 in the e-commerce sector in Indonesia, with a focus on consumer data protection. The method used is normative juridical, focusing on analyzing relevant documents and regulations to outline the legal framework and its application in e-commerce practices. Sources of legal materials include laws and regulations, academic literature, and interviews with legal experts and e-commerce practitioners. The results show that e-commerce companies have made significant adjustments to comply with the PDP Law, including improved privacy policies and investments in data security technologies. However, challenges to the full implementation of the PDP Law remain, particularly regarding consumers' and companies' awareness and understanding of the rights and obligations stipulated in the PDP Law. While there has been an increase in consumer trust in e-commerce platforms, increasing consumer awareness and active participation in the protection of their data still requires further efforts. The implication of this study is that the PDP Law No. 27 of 2022 has provided a stronger and more comprehensive legal framework for consumer data protection in Indonesia's e-commerce sector. However, to maximize the effectiveness of this law, a concerted effort is needed between regulators, the e-commerce industry, and the wider public to improve education and awareness of personal data protection, as well as ongoing adjustments to data management practices by e-commerce companies.

Handling of Personal Data by Smart Home Equipment: an Exploratory Analysis in the Context of LGPD

This paper presents an exploratory research that analyzed the Privacy and Security Policies and the Instruction Manuals of 59 home automation equipment for Smart Home in order to verify which personal data was handled and how these documents were providing information about processes performed in personal data. The analysis was conducted with a quantitative approach followed by a qualitative analysis, using content analysis. The surveys identified the following types of personal data: Identification, Financial, Devices and Location. The results presented greater interest in identification data, although financial and location are also used in specific cases. We also concluded that the Privacy and Security Policies present several information that meets the LGPD’s guidelines, especially regarding the purpose of using the data and which personal data is used. However, there is a visible lack of information about the benefits provided to data subjects and about sharing data with third parties, such as recipient data and the legal basis for sharing data.

Purchase intentions in a chatbot environment: An examination of the effects of customer experience

Research background: Chatbots represent valuable technological tools that allow companies to improve customer experiences, meet their expectations in real time, and provide them with personalized assistance. They have contributed to the transformation of conventional customer service models into online solutions, offering accessibility and efficiency through their integration across various digital platforms. Nevertheless, the existing literature is limited in terms of exploring the potential of chatbots in business communication and studying their impact on the customer's response. Purpose of the article: The main objective of this study is to examine how consumers perceive chatbots as customer service devices. In particular, the paper aims to analyze the influence of the dimensions of “Information”, “Entertainment”, “Media Appeal”, “Social Presence” and “Risk for Privacy” on the “Customer Experience” and the latter on the “Purchase Intention”, under the consideration of the Uses and Gratifications Theory. Moderations due to Chatbot Usage Frequency for some of the relationships proposed are also analyzed. Methods: An empirical study was performed through a questionnaire to Spanish consumers. The statistical data analysis was conducted with R software through the lavaan package. To test the hypotheses from the conceptual model a structural equation modelling approach was adopted. Findings & value added: The results obtained identify the main characteristics of chatbots that can support brands to effectively develop their virtual assistants in order to manage their relational communication strategies and enhance their value proposal through the online customer journey. Findings demonstrate the contribution that chatbot dimensions make to the online consumer experience and its impact on the purchase intention, with the consideration of the moderating effect exercised by the user's level of experience (novice vs. experienced) with the use of chatbots. Regarding managerial implications, this research offers recommendations for e-commerce professionals to manage chatbots more effectively. The “Entertainment” and “Social Presence” dimensions can be operationalized at a visual (e.g., appearance of the avatar and text box, use of designs aligned with the website) and textual level (e.g., style and tone of voice, use of expressions typical of the target audience) to generate a feeling of proximity with the chatbot and facilitate its adoption. “Media Appeal” requires that the chatbot be easy to use, effective, and accessible, to facilitate its usability. Finally, mitigation of “Privacy Risk” concerns should be achieved by presenting an appropriate privacy policy and requesting permission for the use of customers’ private information.

Analysis of Data Privacy Policy, Data Processing Ethics, and Technology Ethics Awareness on User Privacy Protection in West Java

This study investigates the relationships between data privacy policy adherence, data processing ethics, technological ethics awareness, and user privacy protection in West Java, Indonesia. Utilizing a quantitative research design, data was collected through surveys administered to organizations and individual users. Structural Equation Modeling (SEM) with Partial Least Squares (PLS) analysis was employed to analyze the data. The results reveal significant positive relationships between data privacy policy adherence, data processing ethics, and technological ethics awareness with user privacy protection. The findings underscore the importance of regulatory compliance, ethical data practices, and user awareness in safeguarding user privacy. These insights provide valuable implications for policymakers, organizations, and users seeking to enhance privacy protection efforts in West Java and beyond.

Analysis on Privacy Preserving Clustering Methods for Big Datasets Using Random Number Generators

Due to the growing requirement for powerful processing capabilities, safeguarding and processing sensitive data in big data systems has become an increasingly prevalent issue. Additional effort is required to secure sensitive data on a system with numerous connections, each of which has its own privacy policy, and to exchange cryptographic keys in accordance with the appropriate protocols for each of these parties. Data encrypted using homomorphic encryption algorithms can undergo the same kinds of arithmetic operations as data encrypted using plaintext. This allows for the outsourcing of computations to cloud services while also providing data privacy by processing in the encrypted domain. Also, key exchange sessions become easier for everyone involved because of this. This study presents new privacy-preserving clustering algorithms and homomorphic encryption systems that may together operate on a shared HPC infrastructure, like the cloud. Therefore, it is not necessary for the participants in this system to have a lot of processing power, as the system would distribute the most power-intensive jobs to any provider of cloud computing. Multiple clustering techniques can have their distance matrices computed in a way that does not compromise user privacy using our technology.

Analysis of users’ perceptions of data privacy on social media networks in Nigeria

This present study aims to classify users' perceptions of data privacy on social media and provide feedback to users on making informed choices. The emergence of social media networks (SMNs) has revolutionized the way people interact and share information online. SMNs have enabled users to connect with friends, family, and colleagues, making communication more efficient and faster. Several studies have highlighted the data privacy challenges without providing a framework for the development of a system for classifying users’ perceptions of these data privacy challenges on SMNs. Furthermore, there is limited evidence-based research that examines the level of awareness about these hidden data privacy issues based on perceived threats by users. However, the widespread adoption of social media technologies has also raised concerns about privacy and security. The study explores and adopts a mixed-methods approach, integrating quantitative surveys and qualitative interviews. The survey collects data using Likert scale questions to measure participants' privacy concerns and awareness of data privacy settings. A total of 468 responses were obtained, representing diverse demographics. The findings indicate that the majority of respondents were males aged 18-25 years, with a high school education. Additionally, participants spent an average of 2-4 hours daily on social media. The study highlights the need for users to read privacy policies before registering information on websites. The results of this research contribute to a better understanding of users' perceptions of data privacy on SMNs, facilitating informed decision-making regarding social media usage.

Hunter: Tracing anycast communications to uncover cross-border personal data transfers

Cross-border personal data transfers are heavily regulated worldwide, with data protection authorities imposing huge fines on organizations that fail to meet their strict compliance requirements. However, network-level optimizations such as anycast addresses were not designed with personal data in mind, and their use may unwittingly divert personal data out of a legal boundary. This paper describes Hunter, an automated method to trace anycast communications and identify those threatening data protection compliance. We have applied Hunter in the wild to a set of Android apps to discover that all apps observed sending personal data to anycast addresses eventually carry out international transfers but fail to disclose them in their privacy policies. Our findings suggest that using anycast addresses to transmit personal data generally results in data protection compliance issues.

A personal information privacy perceptions model for university students

ABSTRACT This study aims to address the lack of personal information privacy policies in Zimbabwean universities by proposing and validating a Student Personal Information Privacy Perception (SPIPP) model. The model helps institutions understand and implement data privacy principles based on students’ perceptions. The students’ perceptions were determined for the following privacy constructs: privacy awareness; privacy expectations; and student confidence in the university’s data privacy practices. In this study, a quantitative research method using a cross-sectional survey with a closed-ended questionnaire was adopted to collect data from 284 student participants. To refine the preliminary instrument, an expert review and pilot study were conducted. The privacy model was validated using confirmatory factor analysis (CFA) and structural equation modeling (SEM). Seven new factors emerged from the validation of the instrument: university confidence; practice confidence; individual awareness; privacy awareness; external awareness; privacy expectations; and correctness expectations. SEM showed a good overall match between the suggested conceptual model and the empirically derived model. The validated questionnaire that was developed can be used by universities to ascertain students’ perceptions of privacy to create a culture of privacy and to protect student data in line with regulatory requirements and best practices.

Cross‐network service recommendation in smart cities

SummaryNowadays, Internet of Things, artificial intelligence, cloud computing, and other revolutionary technologies (e.g., edge and fog computing) have become the pillar of smart cities. These latter make users' lives easier, thanks to a wide variety of smart services offered in different dimensions (e.g., smart living, smart mobility, smart economy, smart governance). However, the rapid adoption of smart services by users and the full servicelization of several cities around the world is faced with two major issues: the lack of knowledge regarding smart services' capacities (e.g., features, contextual requirements, pricing models, privacy policies, provisioning terms, etc.), and the lack of unified rating and quantification of smart services' QoS behavior. Indeed, interested users often exploit traditional search tools (e.g., Web search engines, social networks) to find and rate the needed services. This behavior has scattered the smart services' usage data (e.g., users contexts, ratings) across multiple providers platforms, which makes the search task beyond the capacity of users and, even, other service providers. Although recommender systems are a natural solution to exempt users from exploring the huge space of the offered smart services, current recommendation approaches for smart city environments are unable to deliver correct recommendations. In fact, they have been initially designed to single‐network settings (a single service repository), while smart services' consumers often are involved in multiple provider platforms. To the best of our knowledge, there exists no approach that treated smart service recommendation across multiple information networks. Therefore, the goal of this paper is to propose a cross‐network recommender system for smart cities. We first model the multiplex network of smart services' providers as a multirelational fuzzy lattice family thanks to fuzzy relational concept analysis (fuzzy RCA), which is a powerful mathematical method for data analysis and clustering. We also use the concept of anchor users to connect providers networks via the users involved in more than one provider platform. Guided by anchors' cross‐network relations, we compute the similarity between users and we define algorithms for exploring the smart services' information network, i.e. lattice family. Extensive experiments have proved the effectiveness of cross‐network recommendation and the quality of produced recommendations, compared to state‐of‐the‐art single‐network recommendation.

XLMR4MD: New Vietnamese dataset and framework for detecting the consistency of description and permission in Android applications using large language models

Google Play and other application marketplaces have various Android applications and metadata. Among these, description information and privacy policy help explain the application's functionality. They also describe the permission of the application, especially those related to sensitive information. Detecting the inconsistency between the description of the application and privacy information and the permission extracted in the application's source code helps users decide whether to install and use the application. In this research, we propose a new method based on a pre-trained language model to detect inconsistencies between the permission extracted from the description application and privacy policy and the permission extracted from the application's source code (file APK). Related works focus on models of large-scale datasets, especially for resource-rich languages such as English. However, a language with low resources, like Vietnamese, needs more datasets for the task. To solve this problem, we propose the ViDPApp dataset (Description and Privacy Policy of Applications on Vietnamese domains), a high-quality dataset that humans manually annotate with 12,000+ sentences with an inter-annotator agreement (IAA) of over 85%. In addition, we proposed XLMR4MD, a new framework using large language models, outperforming powerful machine models (LSTM, Bi-GRU-LSTM-CNN, WikiBERT, DistilBERT, mBERT, and PhoBERT) and achieving the best with 84.04% F1 score in detecting inconsistencies between Android application permission and description. This framework can be fine-tuned for 100 languages, which benefits low-resource languages like Vietnamese. The dataset is available for research purposes.

Blockchain-based group signature for secure authentication of IoT systems in smart home environments

ABSTRACT Current solutions that rely on a single-server architecture have privacy, anonymity, integrity, and confidentiality limitations. Blockchain-based solutions can address some of these issues but face challenges regulating behaviour and protecting access policy privacy. This study proposes a new approach to securing a smart home environment to overcome these limitations.The proposed architecture is based on a group signature scheme, which allows multiple IoT devices to securely exchange keys and authenticate each other without needing a central authority. Our experimental results indicate the effectiveness and efficiency of the proposed architecture and provide insights into its security and privacy features compared to existing IoT authentication methods.

Consumer Protection of Personal Data in the Era of the Industrial Revolution

The thesis entitled Consumer Protection of Personal Data in the Era of the Industrial Revolution written to analyze how Consumer protection of Personal Data listed on the Privacy Policy of a social media. The type of research that the author uses in normative legal research, namely legal research that places law as a building system of norms. The system of norms in qeustion are in regarding the principles, norm, rules of laws and regulations, court decisions, agreement and doctrines (teachings). The research results obtained are, First, to be protected and feel secure in the protection of personal data in the privacy policy contained in the SNS not to be disseminated without the permission of the owner of the personal data. to avoid selling consumer information to third parties, which has the potential for cybercrime such as: scams, phishing, password leaks, hacked and profiling. Second, The intervention that can be carried out by the State is to make laws and regulations to protect a person's personal data from a privacy policy that is not in accordance with existing norms.

Design for Embedding the Value of Privacy in Personal Information Management Systems

Personal Information Management Systems (PIMS) aim to facilitate the sharing of personal information and protect privacy. Efforts to enhance privacy management, aligned with established privacy policies, have led to guidelines for integrating transparent notices and meaningful choices within these systems. Although discussions have revolved around the design of privacy-friendly systems that comply with legal requirements, there has been relatively limited philosophical discourse on incorporating the value of privacy into these systems. Exploring the connection between privacy and personal autonomy illuminates the instrumental value of privacy in enabling individuals to live their lives autonomously, highlighting the importance of intentionally embedding the value of privacy into these systems. To translate the value of privacy into concrete design requirements, this study constructs a values hierarchy consisting of values, norms, and design requirements. After analyzing the relationships between privacy and autonomy and identifying norms, the design requirements translated from the norms associated with the components of personal autonomy are specified at the lowest layer. These requirements include a design to prevent unauthorized access and dark patterns and to provide effective and efficient notices and choices. The findings contribute to expanding the requirements for designing the aspect of privacy as a legal requirement to incorporate the value of privacy into systems.

Comprehensive evaluation of privacy policies using the contextual integrity framework

AbstractOnline privacy policies are often lengthy and difficult to understand. This may lead many users to avoid reading them despite increasing concerns about how their personal information is managed. This article presents a structured approach to evaluate the transparency and comprehensiveness of privacy policies using a comprehensive set of evaluation questions within the contextual integrity (CI) framework. We use these questions to identify policies' responses to key privacy concerns. Applying the CI framework, we analyze the clarity and context of these responses, identifying any vagueness and contextual issues that could impede a user's understanding of the privacy policy. Using the CI analysis, we quantify the quality of policies' responses, thereby enabling users to make informed decisions about online services or products. We apply our methodology to two popular messaging apps, Telegram and WhatsApp, using them as case studies to systematically uncover the strengths and weaknesses of their privacy policies. The findings demonstrate that our proposed methodology can effectively identify transparency issues and assess the comprehensiveness of privacy policies. This suggests that our approach could serve as a practical alternative to subjective evaluations typically conducted by privacy experts.

Layered vulnerability and researchers’ responsibilities: learning from research involving Kenyan adolescents living with perinatal HIV infection

BackgroundCarefully planned research is critical to developing policies and interventions that counter physical, psychological and social challenges faced by young people living with HIV/AIDS, without increasing burdens. Such studies, however, must navigate a ‘vulnerability paradox’, since including potentially vulnerable groups also risks unintentionally worsening their situation. Through embedded social science research, linked to a cohort study involving Adolescents Living with HIV/AIDS (ALH) in Kenya, we develop an account of researchers’ responsibilities towards young people, incorporating concepts of vulnerability, resilience, and agency as ‘interacting layers’.MethodsUsing a qualitative, iterative approach across three linked data collection phases including interviews, group discussions, observations and a participatory workshop, we explored stakeholders’ perspectives on vulnerability and resilience of young people living with HIV/AIDS, in relation to home and community, school, health care and health research participation. A total of 62 policy, provider, research, and community-based stakeholders were involved, including 27 ALH participating in a longitudinal cohort study. Data analysis drew on a Framework Analysis approach; ethical analysis adapts Luna’s layered account of vulnerability.ResultsALH experienced forms of vulnerability and resilience in their daily lives in which socioeconomic context, institutional policies, organisational systems and interpersonal relations were key, interrelated influences. Anticipated and experienced forms of stigma and discrimination in schools, health clinics and communities were linked to actions undermining ART adherence, worsening physical and mental health, and poor educational outcomes, indicating cascading forms of vulnerability, resulting in worsened vulnerabilities. Positive inputs within and across sectors could build resilience, improve outcomes, and support positive research experiences.ConclusionsThe most serious forms of vulnerability faced by ALH in the cohort study were related to structural, inter-sectoral influences, unrelated to study participation and underscored by constraints to their agency. Vulnerabilities, including cascading forms, were potentially responsive to policy-based and interpersonal actions. Stakeholder engagement supported cohort design and implementation, building privacy, stakeholder understanding, interpersonal relations and ancillary care policies. Structural forms of vulnerability underscore researchers’ responsibilities to work within multi-sectoral partnerships to plan and implement studies involving ALH, share findings in a timely way and contribute to policies addressing known causes of vulnerabilities.