Identifying the Provision of Choices in Privacy Policy Text

Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pages 2774–2779 Copenhagen, Denmark, September 7–11, 2017. c⃝2017 Association for Computational Linguistics Identifying the Provision of Choices in Privacy Policy Text Kanthashree Mysore Sathyendra School of Computer Science Carnegie Mellon University ksathyen@andrew.cmu.edu Shomir Wilson EECS Department University of Cincinnati shomir.wilson@uc.edu Florian Schaub School of Information University of Michigan fschaub@umich.edu Sebastian Zimmeck School of Computer Science Carnegie Mellon University szimmeck@andrew.cmu.edu Norman Sadeh School of Computer Science Carnegie Mellon University sadeh@cs.cmu.edu Abstract Websites’ and mobile apps’ privacy poli- cies, written in natural language, tend to be long and difficult to understand. Infor- mation privacy revolves around the fun- damental principle of notice and choice, namely the idea that users should be able to make informed decisions about what information about them can be collected and how it can be used. Internet users want control over their privacy, but their choices are often hidden in long and con- voluted privacy policy documents. More- over, little (if any) prior work has been done to detect the provision of choices in text. We address this challenge of en- abling user choice by automatically iden- tifying and extracting pertinent choice lan- guage in privacy policies. In particular, we present a two-stage architecture of classi- fication models to identify opt-out choices in privacy policy text, labelling common varieties of choices with a mean F1 score of 0.735. Our techniques enable the cre- ation of systems to help Internet users to learn about their choices, thereby effectu- ating notice and choice and improving In- ternet privacy. 1 Introduction Website privacy policies are long, verbose docu- ments that are often difficult to understand. It has been shown that an average Internet user would require an impractical amount of time to read the privacy policies of online services that they use and would not properly understand them (McDon- ald and Cranor, 2008). Although Internet users are concerned about their privacy and would like to be informed about the privacy controls they can exercise, they are not willing or able to find these choices in policy text. Choices for privacy controls, which are the most actionable pieces of information in these documents, are frequently “hidden in plain sight” among other information. However, the nature of the text and the vocabulary used to present choices provide us with an oppor- tunity to automatically identify choices, a goal that we focus upon in this paper. We define a choice instance as a statement in a privacy policy that indicates that the user has dis- cretion over aspects of their privacy. An example (which notably features a hyperlink) is the follow- ing: If you would like more information on how to opt out of information collec- tion practices, go to www.aboutads. info.1 Some examples of choices offered to users include opt-outs or controls for the sharing of personal information with third parties, receiving targeted ads, or receiving promotional emails. Analyzing these choice instances in aggregate will help to un- derstand how notice …

Content truncated to 500 words