A Step Towards Usable Privacy Policy: Automatic Alignment of Privacy Statements

Proceedings of COLING 2014, the 25th International Conference on Computational Linguistics: Technical Papers, pages 884–894, Dublin, Ireland, August 23-29 2014. A Step Towards Usable Privacy Policy: Automatic Alignment of Privacy Statements Fei Liu Rohan Ramanath Norman Sadeh Noah A. Smith School of Computer Science Carnegie Mellon University Pittsburgh, PA 15213, USA {feiliu, rrohan, sadeh, nasmith}@cs.cmu.edu Abstract With the rapid development of web-based services, concerns about user privacy have height- ened. The privacy policies of online websites, which serve as a legal agreement between service providers and users, are not easy for people to understand and therefore offer an opportunity for natural language processing. In this paper, we consider a corpus of these policies, and tackle the problem of aligning or grouping segments of policies based on the privacy issues they address. A dataset of pairwise judgments from humans is used to evaluate two methods, one based on clustering and another based on a hidden Markov model. Our analysis suggests a five-point gap between system and median-human levels of agreement with a consensus annotation, of which half can be closed with bag of words representations and half requires more sophistication. 1 Introduction Privacy policies are legal documents, authored by privacy lawyers to protect the interests of companies offering services through the web. According to a study conducted by McDonald and Cranor (2008), if every internet user in the U.S. read the privacy notice of each new website she visited, it would take the nation 54 billion hours annually to read privacy policies. It is not surprising that they often go unread (Federal Trade Commission, 2012). Users, nonetheless, might do well to understand the implications of agreeing to a privacy policy, and might make different choices if they did. Researchers in the fields of internet privacy and security have made various attempts to standardize the format of privacy notices, so that they are easier to understand and to allow the general public to have better control of their personal information. An early effort is the Platform for Privacy Preferences Project (P3P), which defines a machine-readable language that enables the websites to explicitly declare their intended use of personal information (Cranor, 2002). Many other studies primarily focus on the qualitative perspective of policies and use tens of carefully selected privacy notices. For example, Kelley et al. (2010) proposed a “nutrition label” approach that formalizes the privacy policy into a standardized table format. Breaux et al. (2014) map privacy requirements encoded in text to a formal logic, in order to detect conflicts in requirements and trace data flows (e.g., what data might be collected, to whom the data will be transferred and for what purposes). The need for automatically or semi-automatically generating simple, easy-to-digest privacy summaries is further exacerbated by the emergence of the mobile Web and the Internet of Things, with early efforts in this area including the use of static analysis to identify sensitive data flows in mobile apps (Lin et al., 2012) and the development of mobile app privacy profiles (Liu …

Content truncated to 500 words