# SoK: Technical Implementation and Human Impact of Internet Privacy
Regulations

Eleanor Birrell  Pomona College
<EMAIL_ADDRESS>Jay Rodolitz  Northeastern University
<EMAIL_ADDRESS>Angel Ding  Wellelsey College
<EMAIL_ADDRESS>Jenna Lee  Emily McReynolds  University of Washington
<EMAIL_ADDRESS>Unaffiliated
<EMAIL_ADDRESS>Jevan Hutson  Hintze Law PLLC
<EMAIL_ADDRESS>Ada Lerner  Northeastern University
<EMAIL_ADDRESS>
###### Abstract

Growing recognition of the potential for exploitation of personal data and of
the shortcomings of prior privacy regimes has led to the passage of a
multitude of new online privacy regulations. Some of these laws—notably the
European Union’s General Data Protection Regulation (GDPR) and the California
Consumer Privacy Act (CCPA)—have been the focus of large bodies of research by
the computer science community, while others have received less attention. In
this work, we analyze a set of Internet privacy and data protection
regulations drawn from around the world—both those that have frequently been
studied by computer scientists and those that have not—and develop a taxonomy
of rights granted and obligations imposed by these laws. We then leverage this
taxonomy to systematize 270 technical research papers published in computer
science venues that investigate the impact of these laws and explore how
technical solutions can complement legal protections. Finally, we analyze the
results in this space through an interdisciplinary lens and make
recommendations for future work at the intersection of computer science and
legal privacy.

###### Index Terms:

SoK, Privacy Regulations, Data Protection, Usable Privacy, Measurements

##  1 Introduction

Privacy law is shifting and developing rapidly throughout the world. As of
March 2022, 157 nations have enacted privacy laws, with 12 laws enacted in
2021 alone [99]. Over the past decade, a large body of computer science
research has emerged which studies these laws and their effects. This work has
covered topics including rates of corporate compliance; people’s ability to
exercise privacy rights; design patterns that subvert the consent process; and
citizens’ expectations, understandings, and actions in the face of laws like
the GDPR, which has been called “one of the strictest privacy laws in the
world” [236].

What have computer scientists learned about these laws and their effects on
privacy? And perhaps more importantly, what directions for future computer
science research will be most impactful and effective at informing and driving
better privacy laws that create more meaningful and equitable privacy
outcomes? This paper sets out to answer these questions through an
interdisciplinary lens by an authorship team consisting of both computer
scientists and legal scholars.

We begin with a close reading of 25 Internet privacy and data protection
regulations, which provides a broad overview of a landscape of laws far too
numerous to discuss individually yet which often share significant
commonalities due to the broad influence of the GDPR on legislators worldwide
[290]. From this close reading we construct a taxonomy of rights guaranteed
and business obligations imposed by current Internet privacy regulations.

We then review and systematize the computer science literature around modern
digital privacy laws by organizing studies according to the rights and
obligations in our taxonomy that they examine. We find that while the research
in this space is extensive, its thoroughness varies dramatically, with the
overwhelming majority of papers studying either California’s CCPA or the EU’s
GDPR, laws which protect only about 6.3% of the world’s population [5, 6, 45].
Additionally, certain aspects of these laws such as design patterns in consent
banners have been explored deeply, while other aspects (e.g., the right to
non-discrimination) have been studied little or not at all.

Building on these analyses, our discussion presents two major arguments.
First, we ask how great a limitation our focus on a few specific laws and a
few specific rights is to our broad understanding of privacy law writ large.
In other words: can we generalize from our deep study of these few contexts?
Based on our systematization of the literature and on our interdisciplinary
team’s analysis of legal factors that can cause varying privacy outcomes even
under similar or identical laws, we argue that we should be wary of
generalizing specific results beyond their cultural, temporal, and legal
contexts. However, we also find that in combination with scholarship from
other fields, this body of work has built a compelling case for certain
general ideas about privacy law. Most prominently, we analyze the literature’s
body of evidence against privacy self-management as a paradigm for privacy
regulation, arguing that a strong case exists for the necessity of alternative
paradigms if we are to produce effective and equitable privacy regulation in
the future. We thus conclude our discussion by presenting a roadmap for
computer science research that studies approaches beyond privacy self-
management.

The contributions of this paper are:

  1. 1.

We develop a taxonomy of rights and obligations enacted by modern Internet
privacy laws through close readings of global laws.

  2. 2.

We systematize the computer science literature in the Internet privacy law
space, characterizing its extent, depth, and skew within our taxonomy.

  3. 3.

We analyze results in this space through an interdisciplinary lens to
formulate recommendations for how future computer science research can help
guide more effective and equitable privacy regulation.

##  2 Methodology

This work involved three phases: (1) we identified computer science papers
relating to Internet privacy regulations, (2) we developed a taxonomy of
rights and obligations imposed by such regulations around the world, and (3)
we systematized the computer science literature relating to these regulations
within this taxonomy, and (4) we formulated recommendations for future work
informed by these results. Our methodology for phases (1) and (2) are
described in this section. Our systematization is presented in Section 3. Our
recommendations are discussed in Section 4.

###  2.1 Paper Selection

We identified ten computer science conferences that regularly published work
in the domain of Internet privacy:

  1. 1.

IEEE Symposium on Security and Privacy (“Oakland”)

  2. 2.

ACM Conference on Computer and Communications Security (CCS)

  3. 3.

USENIX Security Symposium

  4. 4.

Privacy Enhancing Technologies Symposium (PETS)

  5. 5.

Symposium on Usable Privacy and Security (SOUPS)

  6. 6.

ACM Conference on Human Factors in Computing Systems (CHI)

  7. 7.

ACM Conference On Computer-Supported Cooperative Work And Social Computing
(CSCW)

  8. 8.

Network and Distributed System Security Symposium (NDSS)

  9. 9.

ACM The Web Conference (WWW)

  10. 10.

ACM Conference on Fairness, Accountability, and Transparency (FAccT)

For each of these ten conferences, one author looked at the title and abstract
of each paper published in that venue in the six years between 2017-2022111For
FAccT, which was founded in 2018, we considered the six years 2018-2023.; we
also included papers published in the 2023 conferences through August 2023.
This resulted in a preliminary list of 127 computer science papers relating to
Internet privacy and data protection regulations.

For each paper on our preliminary list, we applied the same analysis to (1)
all of the backwards citations (i.e., works cited by that paper) and (2) all
forward citations (i.e., subsequent papers found on Google Scholar that cited
that paper). We also iteratively applied this analysis to any additional
papers that were published in any of our ten selected venues (e.g., papers
that were published prior to 2017 or that were initially excluded). This
resulted in a maximal list of 410 candidate papers.

For each of candidate paper, one of the authors read through the full paper
and made a final determination about whether the paper was in scope for this
work. Papers were considered in scope if they were computer science papers
that evaluated the impact of of an Internet privacy or data protection
regulation or if they describe or evaluate a tool to complement or enhance
privacy under such a regulation. Merely mentioning a privacy law in the
introduction was insufficient to be considered in scope. We focused
exclusively on Internet privacy; sector-specific privacy laws (e.g., HIPAA)
were out of scope. Any papers for which the assigned reader was unsure whether
it was in scope were discussed with the full set of authors until a consensus
was reached. This resulted in a list of 314 in-scope papers.

Due to practical limitations, we removed any papers published outside of major
computer science conferences unless they mentioned a relevant regulation or a
specific right under such a regulation in the title of the paper. This
resulted in a revised full list of 270 papers: 134 papers published in one of
our ten selected venues, 19 papers published in other major computer science
conferences (e.g., IMC, VLDB), 102 papers published in other computer science
venues (e.g., minor conferences, workshops, or journals), 5 whitepapers, and
11 pre-prints posted on arXiv.

Definitions | Self-Managed Rights | Fundamental Rights | Business Obligations | Applicability | Enforcement
---|---|---|---|---|---
1\. Personal info | 1\. Right to access | 1\. Right to not be subject | 1\. Notice and Transparency | 1\. Subjects | 1\. Protection Auth.
2\. Anonymization | 2\. Right to portability | to automated decisions | 2\. Purpose/Processing Lim. | 2\. Organizations | 2\. Gov. Agency
| 3\. Right to correct | 2\. Prohibitions on certain | 3\. Data Minimization |  | 3\. Elected Official
| 4\. Right to delete | technologies | 4\. Security Requirements |  | 4\. Priv. Right of Act.
| 5\. Right to opt-out of | 3\. Prohibitions on certain | 5\. Privacy by Design |  | 5\. Class Action
| processing | processing | 6\. Record Keeping |  | 6\. Arbitration
| 6\. Right to consent to | 4\. Right to nondiscrim. | 7\. Cross-border Trans. Lim. |  | 7\. Civil Penalties
| processing | (based on protected attr.) | 8\. Risk Assessment |  | 8\. Criminal Penalties
|  | 5\. Right to nondiscrim. | 9\. Contracting Reqs. |  |
|  | (for invoking rights) | 10\. Breach Notification |  |
TABLE I: Taxonomy of rights and obligations under Internet privacy and data
protection regulations around the world

###  2.2 Legal Taxonomy

We organize our central presentation of the literature around a taxonomy of
legal features. This taxonomy was derived by the legal scholar members of our
team through close readings of 25 laws. These laws comprise all Internet
privacy and data protection regulations among countries that represent 75% of
the global population and 75% of global GPD. Drawing on the text of these
laws, we developed a taxonomy of rights and obligations imposed by current
Internet privacy and data protection regulations (Table I).

###  2.3 Paper Coding

We deductively coded each of the 270 papers in our revised full list using our
taxonomy of legal features. We also inductively coded each paper for: research
methodology, system stage, platform, and applicable laws.

##  3 Systematization

Our legal taxonomy organized features of privacy laws into six general
categories: (1) definitions, (2) self-managed rights, (3) fundamental rights
and prohibitions, (4) obligations, (5) applicability, and (6) enforcement. We
also identified papers that did not study any specific legal features, e.g.,
by observing changes in tracking before and after a law was implemented but
without connecting hypothesized changes in tracking to any particular aspect
of the law beyond the fact that it is a privacy law. We describe these papers
under a General heading at the end of the section.

#####  Research Methodologies

160 papers (59.3%) conducted measurement studies to observe the implementation
of legal requirements. Of those, 60.0% used automated techniques to conduct
large-scale studies and 51.3% conducted manual measurement studies (some
papers performed multiple measurements). 20.6% of these paper included a
longitudinal study that analyzed changes over time, and 16.3% included a
cross-jurisdicational study that analyzed differences between different legal
jurisdictions.

79 papers (29.3%) used human-computer interaction methods to investigate the
human impact of privacy laws. Of these, 51.9% conducted an exploratory study,
51.9% conducted a large-scale quantitative study, and 24.1% conducted an
experimental study (some conducted multiple studies).

45 papers (16.7%) used systems techniques to implement and evaluate a system
for implementing or enhancing privacy regulations. 10 papers (3.7%) introduced
novel attacks based on legal privacy features. 17 papers (6.3%) used
theoretical methods such as cryptography. 15 papers (5.6%) introduced
frameworks.

#####  System Stage

Of the 45 papers that about tools and systems, 6 were deployed with a non-
trivial userbase in the real world, 23 had implemented prototypes, 2 were in
the design phase, and 3 were still high-level proposals.

#####  Platform

34.1% of papers investigated privacy features specifically in the context of
websites, 18.9% focused on websites, 9.6% focused on IoT devices, and 13.7%
focused on other domains including databases, routers, TVs, social media,
blockchains, networks, and cloud services. 33.7% of papers did not apply to
any specific platform.

#####  Applicable Laws

87.0% of papers on our revised final list studied the implementation and
impact of GDPR. 17.0% studies CCPA, 9.3% studied COPPA, and just 9.6% studied
any other law. Only six papers (2.2%) considered laws outside of the United
States and Europe. Two papers looked at Canada’s PIPEDA [296, 182]. One paper
included India’s proposed PDPB [234], one included Singapore’s PDPA [199], one
paper included the Phillipines’s PDPA [220], and one paper included Turkey’s
KVKK [133].

###  3.1 Definitions

Legal interpretation of privacy regulations depends strongly on
interpretations of key definitions. Many works that consider this problem do
within the scope of a specific regulatory requirement. However, 8 papers
explore definitions of terms that broadly affect the scope of applicable
privacy regulations.

Giomi et al. [92] proposed a statistical framework for GDPR-compliant
anonymization. Gomez et al. [96] explored user perceptions of what constituted
sensitive information. Kutylowski et al [146] discuss challenges induced by
GDPR’s definitions of personal data and pseudoanonymization when applying
GDPR’s requirements in real-world systems. Cohen and Nissim (2020) [58]
formalize GPDR’s “singling out” terminology—used to define identifiable data
in Recital 26—as a privacy attack they term “predicate singling out”, then
establish the relationship between this definition and existing techniques
such as differential privacy and $k$-anonymity.

Cohen [57] demonstrated a set of powerful attacks that show that common
anonymization techniques such as $k$-anonymity might fall short of GDPR’s
legal standard for de-identifying data. Narayanan and Shmatikov [182] also
discuss the challenges of applying algorithmic technologies to legal
definitions of personally-identifiable and de-identified information.

Gruschka et al. [103] observe that GDPR’s rules about the storage and
processing of personal information do not apply to anonymous data, but that
anonymizing data sets is a difficult problem; they analyze two projects that
analyze sensitive large datasets to identify how those projects attempt to
protect users’ privacy as required under GDPR.

###  3.2 Self-Managed Rights

Many Internet privacy and data protection regulations introduce rights that
individuals can invoke to protect their personal information. These include
rights to access, rights to portability, rights to correct, rights to delete,
and rights to opt-out of certain types of processing.

####  3.2.1 Right to Access

11 laws we examined provide people with a right to access, although the
detailed requirements (e.g., timing requirements, format specifications, etc.)
and exceptions to the right of access vary between laws. This right has a high
level of awareness in the EU [143, 196]; people are less aware of access
requests in other jurisdictions, even those with legally-guaranteed rights of
access, although many companies honor access requests regardless of user
location [196].

##### Access Request Mechanisms

While researchers have consistently found that the most common Subject Access
Request (SAR) mechanisms are email requests and web form [269, 270, 42],
detailed procedures are generally different for every website [42]. Moreover,
many websites [42] and child care apps [100] do not accept requests via email,
although user studies suggest people consider email the most natural way to
claim their right to access data [9].

##### Authentication of Access Requests

Since responses to SARs can contain personal information, returning data
without authenticating the request can constitute a data breach. However,
refusing a genuine request denies people their right to access. This tension
makes authentication critical for privacy of SARs. Several research projects
have attempted to quantify how organizations authenticate SARs [39, 47, 70,
42, 69] with somewhat varying results: an estimated 10-71% use national ID
cards to authenticate requests, 15-31% use subject email access, 15-36% use
subject account login, 6-22% use secret questions or confidential information,
0-11% use device cookies, and 1-5% call the data subject. Researchers have
also examined whether companies consider IP addresses as sufficiently
identifying to authenticate a request [2], with negative results. Boniface et
al. examined recommendations from the 28 EU countries’ Data Protection
Authorities (DPAs) and found inconsistent guidelines [39].

To evaluate authentication of SARs, several projects have issued experimental,
spoofed requests. A 2014 study found 25% of websites returned information in
response to requests from email addresses that didn’t match the account
information [116] . Work conducted after GDPR went into effect produced
varying results. One study found that 58/334 popular websites failed to take
any steps to authenticate requests [42]. Using publicly information,
researchers have had success rates of 10/14 [47], 15/55 [70], and 60/150 [195]
at accessing PII in response to spoofed SARs. Social engineering persuaded
2-6% of companies to accept weaker authentication than initially requested
[70, 42]. Around half of vulnerable organizations remained vulnerable to the
same attack years later [69], and mid-sized organizations and non-profits were
most frequently vulnerable [195].

An interview study found that companies don’t receive many requests for access
(i.e., less than 100 per year at some large companies), that some haven’t
suspected any misuse of SARs, and that some have just 4-5 people with the
access required to answer SARs while others handle them across a full customer
service department [69].

#####  Compliance with Right to Access

A lot of work has examined organizations’ compliance with SARs, e.g., by
making legitimate requests and analyzing the outcomes of those requests [116,
269, 270, 39, 42, 141, 41, 213].

One focus of this work has been quantifying how many organizations violate
GDPR’s right to access by failing to handle the request within its 30 day
deadline. Estimates of this non-compliance rate have varied, with various
studies reporting 34-40% non-compliance [269], 36-46% [270], 28.2% [42], and
24.4% [41] of websites responding to SARs within the legal deadline. However,
some of those responses stated that no data was found. Kröger et al. performed
a similar experiment for mobile apps and found that 19-28% of apps failed to
handle the request within 30 days [141]. One study found that a sending a
reminder email to the company decreased non-compliance to 20% [141]. Another
study noted inconsistencies in how companies counted the time limit (from
initial request or from the time they received additional information
required) [269].

User studies in which website users [41, 196] or smart home users [51] issue
requests show people find the process confusing and frustrating and
authentication can be difficult.

Studies have also quantified the distribution of data formats returned in
response to SARs. Over half of responses were answered with data in structured
formats such as CSV, JSON, or XML [42, 141, 269], but many non-machine-
readable formats were received as well, including screenshots, pdfs, raw-text
emails, and printed files [42]. Many of these formats are not what users
expect to receive (pdfs, word files, or spreadsheets) [9]. Some studies found
that data was unintelligible due to obscure labeling or formatting errors
[270, 141]. User studies find that people often found the returned data
incomprehensible, meaningless, unusable, or not useful [41, 283, 196]. Some
users also struggled to open unfamiliar file formats (e.g., JSON files) [278].

Responses to SARs often fall short of user expectations [9, 41, 196]: most
users would like responses to include derived data (82%), data acquired from
third-parties (81%), and metadata (73%), but only a minority of responses
(39%, 49%, and 4% respectively) included these data and the returned data was
often incomplete [41]. Some companies (22% in 2015 prior to GDPR, 6% in 2019)
returned only data types and not actual values [141]. In 2014, only 43% of
apps and websites returned data that matched the observed data collected
[116]. In 2022, many Android apps do not return data types that can be
observed through traffic analysis [213]. However, a series of focus groups
still found that people are surprised, shocked, and scared by the the level of
details that some data downloads provide [278, 22], and user reported finding
the data Twitter and Facebook shared about tracking to be illuminating [283].

#####  Dashboards and Tools

To address usability shortcomings of current SARs, some companies offer tools
or dashboards for directly downloading or interactively exploring data.
However, these rarely provide both an online tool and an opportunity to
download formatted data, they often omit data of concern to users, and they do
not help users understand what data is collected by companies [267]. A
qualitative examination of 10 privacy dashboards determined that none complied
with GDPR’s right to access [260]. Nonetheless, a user study focused on
Facebook’s transparency dashboard found that people were surprised by and
changed their attitudes after interacting with the dashboard [22].

Researchers have proposed and developed new tools to support the right to
access, including a privacy dashboard intended to facilitate user rights under
GDPR [202], a co-design effort to propose designs, formats, and tools for
future data downloads to achieve transparency goals [278], and a document
engineering approach to designing and evaluating a disclosure interface [185].
Arfelt et al. [21] express GDPR’s access requirement in temporal logic and
find it can be efficiently monitored. Jordan et al. built VICEROY, a browser
extension that enables people without accounts to make verifiable consumer
requests (CCPA) or subject access requests (GDPR) in order to exercise rights
to access, correct, and delete personal information using privacy-preserving
techniques [129]. Agarwal et al [4] built a tool for supporting access
requests in legacy database systems. Luckett et al. [160] built a tool for
retrofitting access requests into legacy systems. Shezan et al. built CHKPLUG,
a static analysis tool that identifies missing information flows in WordPress
Plugins that correspond to incomplete responses to access requests [231].

####  3.2.2 Right to Portability

Eight laws provide a right to portability. Among GDPR’s self-management
rights, this was the least-known and the most misunderstood [143].

Three independent projects—one conducted in 2018 [287] and two conducted in
2021 [245, 143]—made portability requests to hundreds of online services under
GDPR; their results were compatible. First, 25% to 30% of companies failed to
provide data export within the GDPR-mandated time frame of 30 days. Second,
40% to 50% of file formats received were not compatible with GDPR’s
requirement that data be exported in a structured, commonly-used, and machine
readable format [287, 288]. Larger companies provide a larger scope of data
export, more rigorous procedures for authentication, and are more likely to
provide import options [245], but import options remain generally rare (about
25% of studied services) [143].

Two projects looked at data portability for IoT [266, 28]. While most (4/4 and
18/34) devices and platforms returned data within GDPR’s 30 day requirement,
several issues were encountered including lack of request authentication [28],
data not structured for machine readability [266, 28], and lack of
documentation and explanation [266].

10% of participants had considered switching between online services, but
about two-thirds felt that lack of portability was an obstacle to switching
[143]. The Odlaw tool [160] also supports portability requests.

####  3.2.3 Right to Correct

Eleven privacy regulations provide a right to correct data. This right to
correct was one motivation for building VICEROY [129], an authenticated access
tool for privacy self-management rights. However, no work has focused
explicitly on the right to correct.

####  3.2.4 Right to Delete

11 laws included some form of a right to delete, including rights to withdraw
consent. Similar rights have also been granted by other laws, including the
Right to be Forgotten. Among GDPR’s self-management rights, this right was the
most widely known [143].

#####  The Right to Be Forgotten

Researchers have examined trends among delisting requests, including who makes
these requests (most commonly law firms and reputation management services
[35] about young adult men [293]) and types of information delisted (most
commonly personal information or official information relating to illegal
activities [35, 293]). While it is possible to use data-driven inferences to
find many delisted links, the right to be forgotten does appear to enhance
privacy of the delisted material [293].

##### The Right to Erasure

The right to erasure is compatible with users’ expectations and normative
beliefs about privacy [77, 175, 220], but users often are not aware of or do
not use deletion controls [77, 109]. Many people assume deleted posts are
sensitive or compromising, although 80% of users have deleted a post, often
for innocuous reasons [174].

Work conducted in 2014 found that 52-57% of websites and apps in Germany
deleted accounts upon request [116]. An analysis of a stratified sample of
English-language websites found that 27% updated or added privacy policies
relating to deletion after GDPR came into effect [110], although many
blockchain systems do not address this right in their policy [211]. However,
users are often not aware of or do not use deletion controls [77, 109],
sometimes because they cannot locate those controls [109, 252] or due because
they encountered barriers such as authentication requirements, account
requirements, paywalls, and dark patterns [252, 220]. Sometimes controls are
insufficiently fine-grained, e.g., only offering an option to delete a full
account [176]. People also reported that it was difficult to determine whether
removal was successful and that keeping information off the Internet required
ongoing efforts [252], and one third of attempted account deletion requests
were never complete [220].

#####  Challenges to Deletion

Researchers have identified a number of technical challenges to implementing
the right to delete, such as deleting all replicas of data including
distributed data centers, backups, and offline copies [219, 228, 225, 64].
High-efficiency lazy deletion algorithms have been found to take hours on
database such as Redis [225] or months (e.g., 180 days in Google Cloud) [228]
to delete data, and systems are sometimes not built to guarantee that all
copies of data were deleted [228]. A GDPR-compliant version of Redis which
deletes data immediately incurred significant overhead [225], as did a SQL-
based implementation designed to automate compliance with deletion and
retention requirements [222]. However, some researchers argue that state-of-
the-art practices can still implement these rights [198, 67]. Other research
suggests that rights to delete might be fundamentally incompatible with some
technologies such as blockchains [211], although Farshid et al. [78] propose a
blockchain-like technology that supports data deletion.

Legal exceptions can also pose a barrier to the right to delete; some
electronic monitoring apps claim exemption from the Right to Delete under CCPA
citing clauses about retaining data to “comply with a legal obligation” [192].

#####  Tools for Deletion

Garg et al. [89] and Godin and Lamontagne [95] provide two possible formal
definitions of deletion. Arfelt et al. [21] express GDPR’s right to erasure in
temporal logic and find it can be efficiently monitored. Agarwal et al. [4]
built a tool for supporting deletion requests in legacy database systems.
Luckett et al. [160] built a tool for adding deletion support to legacy
systems. CHKPLUG, a static analysis tool that looks for missing information
flows in WordPress Plugins, is designed to identify incomplete responses to
deletion requests [231].

####  3.2.5 Rights to Opt-out of Processing

Seven laws grant a right to opt-out of some processing, with different scope.

#####  The Right to Opt-out of Sale under CCPA

While compliance with the CCPA’s right to opt-out of sale has increased over
time since CCPA went into effect [188], there are still numerous websites that
are covered by CCPA but do not provide an opt-out of sale link on their
homepage [188, 277]. Opt-out interfaces often exhibit dark patterns and other
interface designs that make it harder to opt-out [188, 277]; dark patterns
that frequently occur in the wild—e.g., asymmetric UI, extra clicks, and
fillable forms—significantly decrease opt-out of sale rates among California
users [188].

The right to opt-out of sale is widely misunderstood: only 30.5-61.1% of
Californians correctly identifying which behaviors would be covered by this
right [55]. Websites are also inconsistent about how they interpret
“sale”[55].

Some efforts have been made to explore ways to improve the usability of the
right to opt-out of sale, including standardized icons and taglines [61,
111]—a recommendation incorporated into the California Attorney General
recommendations and the text of CPRA—and browser extensions that improve
visibility of opt-out mechanisms [232] and set browser headers and privacy
signals to automatically opt-out of sale [298] (signals that California
regulations recognize as valid opt-outs). However, while the purpose of these
signals is generally well-understood, rates of website compliance with these
signals is currently low [301].

#####  Other Rights to Opt-out of Processing

Nearly 90% of websites provide opt-out choices for email communications or
targeted advertising in their privacy policy, but that these choices are often
hard to find and comprehend because of poor readability and the lack of
standardized wording [110]. Kumar et al. [26] built a corpus and a model to
extract and classify opt-out links in privacy policies. They classify opt-out
links as being related to targeted ads, communication, cookies, analytics,
sharing with third parties, and “other”. They observe variations in kinds and
frequencies of opt-outs based on the popularity of sites/ranking in Alexa, and
find that many privacy policies have no such links. They created a browser
extension, Opt-Out Easy, which surfaces these links to users. Arfelt et al.
[21] express GDPR’s withdrawal of consent (Article 7(3)), right to restrict
processing (Article 18), and right to object (Article 21) in temporal logic
and demonstrate efficient monitoring. Allegue et al. [11] provide a consent
manager for IoT smart homes. Odlaw [160] claims to support the right to object
in legacy systems.

####  3.2.6 Rights to Consent to Processing

Many laws require affirmative consent for certain types of data processing.
GDPR requires consent—defined as a freely-given, affirmative act—for any
processing of personal information that is not covered by an alternative legal
basis, a model that was also adopted by many subsequently laws.

#####  Consent Interfaces

Many efforts have been made to categorize and quantify consent interfaces.
Most have focused on cookie banner designs:

  1. 1.

Choice Options. Although GDPR requires free consent, observational studies
have consistently found that 20-37% of banners presented no options or were
confirmation-only [121, 65, 171]. Rates can be higher in certain countries
[65], certain contexts (e.g., porn websites [275]), or certain modalities
(e.g., desktop websites vs. mobile apps [105]). Banners with choices used a
variety of mechanisms including binary buttons, sliders, checkboxes, and per-
vendor settings; among choice mechanisms, checkboxes were the most common
immediately after GDPR went into effect [65], but options to opt-out of
cookies directly in a cookie banner were rare [65, 214, 273, 134].

  2. 2.

Location. Most desktop cookie banners (57.9%) are implemented as bars at the
bottom of the page [273].

  3. 3.

Design Elements. Several studies have found that highlighting, pre-selection,
and other forms of nudging and dark patterns are common [273, 169, 187, 171,
208].

  4. 4.

Banner Text. GDPR requires that cookie purposes be disclosed to the user; this
requirement is not always met. Studies have found that a non-trivial fraction
of banners fail to mention a purpose [218], use vague purpose-specification
language [218], assign incorrect purposes [37], or use biased text with
framing [218].

Computer scientists have identified requirements for cookie consent [216],
characterized dark patterns [168], and developed frameworks for evaluating
privacy choice interfaces [107, 80]. Overall, estimates suggest that 54-95% of
cookie banners fail to meet the standards imposed by GDPR for free, informed
consent [169, 187, 217, 37, 208], and some researchers argue that there is no
natural set of design requirements that satisfy all of GDPR’s elements [98].
Notifications that a banner is not compliant with legal requirements do not
consistently result in improvements to the banner design [115].

The passage of legal regulations regarding consent to cookie collection has
driven adoption solutions provided by Consent Management Providers (CMPs). CMP
adoption is highest among mid-market sites, but is increasingly used by all
sorts of sites, with significant jumps in adoption immediately after laws like
GDPR and CCPA went into effect [117]. However, banners produced by CMPs are
not necessarily compliant with all relevant jurisdictions [262, 241, 208]. The
default banner produced by many CMPs uses highlighting to nudge user consent
[262], 38% of CMPs did not support any nudge-free designs [241], and some
cookie consent libraries support cookie banners with no decline option [65].

Consent interfaces have also been observed in the context of trackers in
mobile apps—42.6% were confirmation-only [184]—smart homes—interfaces are
manipulative, frustrating, and lack options [51] and withholding or revoking
consent is hard [53]—Hybrid Broadcast Broadband TVs—some channels lack consent
mechanisms or fail to support consent revocation [246]—and voice assistants
[224].

#####  Impact of Interfaces on Consent Decisions

In 2022, there were 56% more cookie banners in the EU compared to other
jurisdictions [201], and many European users report banner fatigue [144].
Nonetheless, interface design—including nudging and dark patterns—can impact
consent decisions.

  1. 1.

Choice Options. Removing the opt-out button from the first page has the most
effect on consent choices, increasing consent rates by 20-30 percentage points
[187, 108]. Users are significantly more likely to consent to cookies when
presented with a confirmation-only or binary-choice banner compared to banners
with finer-grained options [273]. The exact number of choices does not have an
effect [162], but the presence of an opt-out on the first page does [40].

  2. 2.

Location. A large-scale study of European users in the wild found that people
are three times as likely to interact with banners in the lower-left than with
banners at the top and bottom of a page [273]. However, a later study with
predominantly-American MTurk users found that position had no significant
effect [34].

  3. 3.

Design Elements. Pre-selection or defaults can significantly increase cookie
opt-in [273, 162] and result in lower recall and more regret [162]. A color-
based nudging bar displaying privacy threat is the most effective mechanism at
nudging users away from default options [34]. However, highlighting does not
significantly increase opt-in [273, 34]. In general, defaults and nudging can
influence the cognitive decision process, particularly for users with lower
privacy concerns [24].

  4. 4.

Banner Text. Many variations in text such as the labels on buttons and whether
a banner implies that declining cookies will negatively effect experience have
no significant effect on cookie consent [108, 40], but loss versus gain
framing for the button labels does [161].

Behavior can also differs significantly between desktop and mobile devices
[273, 34, 201]. Manipulative consent interfaces are not constrained to cookie
consent; some websites use nudging and dark patterns to steer users towards
particular behaviors [167]. Users familiar with computer security are more
likely to change defaults [34].

#####  Tools for Consent:

Consent-O-Matic [186] and BannerClick [201] automatically answer consent pop-
ups based on a user’s preferences. CookieEnforcer [134] automatically
identifies cookie notice and predicts actions required to disable unnecessary
cookies. Chetri et al. [56] develop a tool for automatically verifying
informed consent as a legal basis. van Hofslot et al. [276] explored the
feasibility of using NLP to detect non-compliant banner language; they found
that BERT and LEGAL-BERT provided 70-97% accuracy, but that the models were
constrained by the small size and distribution of the labeled training data.
Hils et al. [118] conducted a longitudinal study of privacy preference
signals.

#####  Effect of Consent Requirements on Cookies and Tracking

Researchers have applied two distinct methodologies to measure the effect of
consent requirements on cookies and tracking: (1) conducting longitudinal
studies before and after a law goes into effect, and (2) quantifying non-
consensual processing after a law is in effect.

1\. Longitudinal Studies: Multiple independent projects have conducted a
longitudinal analysis of the effect of GDPR on tracking and third-parties [65,
239, 121, 126, 271, 120, 128, 63]. Although they observed a reduction in usage
of third-party web technology and cookies immediately after GDPR went into
effect [128, 121], there was no significant long-term drop [128, 65]. There
were some changes towards increased market concentration in third-party
services [128, 239, 126, 120, 63], and one study observed a 40% reduction in
cookie syncing, though the general shape of the ecosystem didn’t change [271].
Another study observed an uptick in new third-party cookies placed when GDPR
went into effect [120], which might signify adoption of CMPs.

Rasaii et al. [201] measured the impact of CCPA and LGPD and found that those
laws had no effect on cookies.

Research has also looked at tracking by mobile apps. Although there are
geodifferences in tracking behavior [145], there was no significant change in
tracking by apps after GDPR went into effect [137]. It is common for apps to
engage in third-party tracking, and very few of those apps obtain consent
[127, 300, 138, 122]. Apps continued to share data with tracking companies
prior to user consent after Apple introduced App Tracking Transparency (ATT)
[139]. Ret at al. [206] looked at information exposure by IoT devices across
jurisdictions; they noted that US devices contact more third-parties compared
to UK devices.

Although most users feel negatively about third-parties, many take no action
to prevent tracking [60]. Among those who do, most common actions were using a
browser extension or manually deleting cookies; fewer people used a privacy-
oriented browser or private browsing mode [171].

2\. Processing without consent: Websites without banners sometimes set cookies
[49, 76, 121, 274], and 82.5% of websites that use CMPs set at least one
cookie that is not covered by their cookie banner and therefore assume
implicit consent [37]. Websites with banners set cookies prior to obtaining
consent [169, 264, 187, 37, 214, 274, 208], a practice that is even more
common among EU government websites [212]. However, there is some evidence
that the practice of setting cookies prior to consent decreased after GDPR
[62, 151, 121]. Some websites set cookies even after the user rejects those
cookies [121, 37, 169, 214], some use browser fingerprinting to bypass cookie-
consent rules [194], and 3.8% of top websites use cookie respawning [86].
However, opting out of cookies does result in fewer cookies [201] and can also
result in fewer scripts (and corresponding reduced vulnerability to scripting
attacks) [135].

Some of the issues with non-consensual cookies arise from third-party elements
that are imported into a site. Many profiling cookies set prior to user
consent are actually set by advertising networks [264] and ghosted cookies
[215]—cookies set by hierarchically-imported resources—pose a challenge to
consent because the website does not have full control over the setting of
these first-party cookies. Only 12.8% of third-party cookies have a cookie
policy that mentions that cookie, and only 5% include a description of the
cookie’s purpose in a well-structured table [85].

Beyond website cookies, 16.7% of mobile apps share data with third-party
trackers prior to user consent and 1.0% shared data even after a user
explicitly declined consent [184]. 20.9% of apps transmit data without
displaying a consent dialogue or privacy notice [136]. 34.4% of apps share
personal information with third-party data controllers without opt-in consent,
most commonly sending the AAID [183]. Leaks of unresettable user identifiers
(UUIs) on Android devices can bypassed the permission consent mechanisms
[172]. Hybrid Broadcast Broadband TV channels track users prior to receiving
consent [246]. Attacks can extract personal information about other users from
an Amazon Echo device [88]. Apps practice deceptive uses of legitimate
interest to justify data collection without consent in ways inconsistent with
user preferences [147]. Some websites continue to send market emails without
opt-in consent, without an option to revoke consent, or after a user revokes
their consent [142]. Karami et al. developed a programming language that
generates runtime errors if data are used without consent [131].
Misconceptions about what is required for consent are common, with many
developers believing that having a privacy policy supersedes the need to have
explicit consent [183]; many developers also argued that they rely on third-
party app builders or SDKs to make their app compliant, and assumed that
libraries would implement GDPR-compliant behavior.

#####  Effect of Consent Requirements for Sensitive Data

Nine laws require opt-in consent for processing sensitive personal
information. Definitions of “sensitive” vary between laws and differ
significantly from what users consider sensitive [96].

Work conducted prior to GDPR found that Facebook made significant use of
sensitive data for targeting ads prior to GDPR and therefore predicted that
the regulation should significantly impact data processing by major ad
providers [46]. Subsequent work did find significantly lower rates of tracking
for sensitive data in Europe compared to other jurisdictions [63], however,
tracking persisted on sites relating to sensitive personal information
including health [123, 63], sexual orientation and preferences [123, 275],
religion [123, 63], and politics [63]. 74% of paid versions of apps held the
same dangerous permissions as their free versions [113].

Restrictions on the collection of sensitive personal information can also have
unintended negative consequences. Interviews with industry experts working on
algorithmic fairness for machine learning revealed that GDPR’s restrictions
were viewed as prohibitive, and the resulting lack of access to racial data
resulted in no longer trying to detect racial bias in their machine learning
systems [18].

#####  Effect of Consent Requirements for Children’s Data

Nine laws require parental consent for information about children, but the
details (e.g., collection versus processing, the age limit for protection, and
the requirements for verifying parental consent) vary between regulations.
CCPA and CPRA require opt-in consent (resp., parental consent) to sell
personal data about children under 16 (resp., under 13).

Several projects have investigated COPPA compliance by mobile apps. This work
has consistently found that many apps violate COPPA in a variety of ways,
including using SDKs that prohibit use in child-targeted apps because they
collect or share PII [207, 8, 79, 100, 203], using libraries without necessary
COPPA-compliant parameters [8], not asking for parental consent prior to
collection [100, 12], using fingerprinting-alike libraries to bypass parental
consent [83], or using parental consent mechanisms such as age gates and
knowledge-based questions that do not satisfy the FTC’s requirements for
verifiable parental consent [12]. Behaviors that violate COPPA have also been
observed in COPPA-approved and child-oriented websites [279] and in voice
assistant skills in the “kids” category [150]. Overlapping behavior in free
and paid versions of apps might also be indicative of practices that violate
COPPA [113]. Xie et al. [292] automatically analyzed use of children’s data by
IoT devices and found noncompliance in 8/512 skills.

Failure to comply with restrictions on processing children’s data might be due
to barriers to compliance rather than malicious intent. Developers of popular
Android children’s’ apps report issues including a lack of transparency from
libraries, a need for data to understand user behavior, and difficulty
monetizing apps in age-appropriate ways [72].

Efforts to facilitate COPPA compliance have resulted in tools that leverage
dynamic execution and traffic monitoring [285] or machine learning [31, 292]
to analyze apps or IoT devices and detect behavior that violates legal
regulations. These tools have high accuracy but are not currently in
widespread use.

In general, COPPA requirements are consistent with parental expectations and
social norms, although younger parents are significantly more accepting of
data collection [20]. However, by incentivizing online services to ban users
younger than 13, there is also some evidence that COPPA may have reduced
privacy for adolescents, who may lie about their age to join platforms, thus
aging out of protections for minors before they turn 18 [68].

###  3.3 Fundamental Rights and Prohibitions

In contrast with self-managed rights, which must be explicitly invoked by
individuals, fundamental rights impose general prohibitions on certain types
of behaviors. These rights are relatively rare in current privacy regulations.

Eight laws create rights to not be subject to automated decision making.
Kaushik et al. studied GDPR’s version of this right and found it is commonly
misunderstood—many people believe users can opt-out in advance—and fails to
meet expectations for transparency about automated decisions [132]. Krishna et
al. [140] formulate the problem of implementing the right to explanation in
the context of automated decisions as an optimization problem robust against
model updates to accommodate deletion requests. Other work has considered how
this right might be implemented for database systems [227, 228].

Shastri et al. [227] also discuss how databases can support two additional
rights—prohibitions on facial recognition and prohibitions on targeted
advertising—that are granted by GDPR. Analogous rights prohibiting certain
technologies or processing activities do not appear in other privacy
regulations.

GDPR and LGPD grant freedom from discriminatory processing on the basis of
sensitive personal information. Four laws, including CPRA, GDPR, LGPD, and
China’s PIPA grant a right to non-discrimination if a user invokes their
rights to privacy self-management. These right has not been the explored in
the computer science literature.

###  3.4 Obligations

Obligations are procedural requirements that must be satisfied when collecting
or processing data. Examples include transparency requirements, legal basis
requirements, data minimization requirements, and privacy by design. Some of
these legal aspects—specifically transparency and consent as a legal
basis—have been the focus of significant bodies of work by computer
scientists. Others have not.

####  3.4.1 Notice and Transparency

Transparency was been a key motivation behind many privacy laws. GDPR calls
for data to be “processed lawfully, fairly and in a transparent manner in
relation to the data subject” [5(1)(a)]. CCPA features the “right to know” as
the first right granted to consumers. Nine other jurisdictions also have
transparency requirements. Despite some challenges [173], a lot of work has
focused on privacy policies as the most common form of notice; some work has
also looked at other transparency mechanisms in the context of legal
requirements.

#####  Impact of Regulations on Privacy Policies

Several independent longitudinal studies looked at privacy policies before and
after GDPR went into effect to understand it’s impact on privacy policies [65,
110, 284, 154, 295, 15, 3]. An estimated 4.9% of apps added privacy policies
and 50% updated pre-exising policies [65]—the most widespread changes in the
last decade [15, 3]—with many adding particular new content (e.g., options
regarding deletion [110], information about privacy self-management rights
[3], and information about protections for children’s data [295]) to meet
particular GDPR requirements. 38% of Android developers reported adding or
updating the privacy policy for their app [284]. Overall, privacy policy
sensitivity increased over time, with spikes corresponding to enactment of
privacy regulations [158]. However, not all companies had privacy policies
even after GDPR [65, 145, 163]. Levato et al. [158] studies the impact of a
broader range of legislation using a longitudinal corpus from 1997-2018.
Cross-jurisdictional analyses have also identified jurisdictional differences
between policies in the EU and the US [145, 23], with some evidence suggesting
that the GDPR reduced data collection [23].

The impact of regulations on the transparency of privacy policies was mixed.
Using NLP techniques, researchers found an increase in terms related to GDPR
rights [65, 154, 3] and in granularity of disclosures [23]; most apps with
different policies in different countries were due to additional clauses
relating to GDPR or CCPA [145]. Some longitudinal studies have found that
policies became more specific with improved presentation [154] and simpler and
more regularized [158]. However, many privacy policies showed no improvement
in any of 10 privacy measures [295]. Many studies have found that privacy
policies also became longer [154, 15, 3] and harder to read [15]. Some
policies covered more data use practices at the cost of reduced specificity
[154], and information about tracking and information sharing with third
parties were still frequently missing [15]. Few developers reported making
substantive changes such as adding popup consent dialogues [284].

#####  Compliance with GDPR Transparency Requirements

According to analyses, privacy policies can violate GDPR in five ways: (1)
omitting required information [59, 153] (Fan et al. [75] identify six required
notice categories; Vanezi et al. [294] identified a list of 89 terms across 7
groups that should be included in privacy policies), (2) describing data use
practices that violate legal restrictions [59, 153], (3) using unclear
language [59, 153, 190], (4) not providing the privacy policy in an accessible
location, and (5) inaccurately or incompletely disclosing data practices. A
large body of work has also been devoted to developing tools that use machine
learning and natural language processing techniques for analyzing privacy
policies to determine whether they fulfill the transparency requirements
imposed by GDPR [59, 178, 269, 270, 16, 17, 75, 85, 204, 294, 190, 156, 73,
102, 200, 199, 155, 191]. Many of these tools have been applied to corpuses of
post-GDPR privacy policies to determine rates of compliance with GDPR.

1) Omitting Required Information. Between 8.3% [294] and 23.7% [75] of website
privacy policies are missing at least one required category. Observed
compliance levels significantly for different disclosure requirements imposed
by GDPR [200]: more than 90% of policies disclose categories of data collected
and purposes of data processing (albeit sometimes bundled [176]), but only
15.3% disclose how personal information is used for automated decision making
or profiling [266]. 43% of child care apps do not mention processing sensitive
data about children [100]. 56% of privacy policies for browser extensions omit
one or more pieces of information required by GDPR [155]. Users struggle to
identify policy excerpts relevant to GDPR’s articles [178].

2) Illegal Data Use Practices None of the papers we included measured
prevalence of illegal practices.

3) Unclear Language. An estimated 1.4% of website privacy policies have
readable privacy policies [190]. Many use vague language [176, 122]. Moreover,
7.6-18.1% of privacy policies for Android apps contain contradictions that may
be indicative of misleading statements [16, 17, 44]; many are contradictions
due to inconsistencies with GDPR’s definition of personal information. GDPR
requires that privacy notices be understandable to children if a company
processes children’s data; however, misconceptions about data collection,
storage, and processing remain pervasive among children [244], suggesting that
current implementations fall short of meeting this legal standard.

4) Inaccessible Policy. Most websites provide a privacy policy in an
accessible location [190], but there still are some without privacy policies
[274]. Compliance can be lower in other contexts: 74% of IoT producers’
websites [266, 163], 62.2% of Google Assistant actions [150], 50.5-55% of
Android App Store pages [300, 113], 32% of browser extensions [155], 9% of
Smart Home Devices [163], 27.7% of Amazon Alexa skills [150], and only 16% of
porn sites [275]. Moreover, there aren’t clear standards for accessible means
for apps and smart home devices [300, 163].

5) Inaccurate Policy. App behavior is not always consistent with notices
provided by websites and apps [205, 17, 127, 302, 75, 44, 12]: 42.4-77.9% of
apps exhibit at least one behavior inconsistent with their privacy policy [17,
75, 291] and 17-18% share information with third parties without disclosing it
[302, 79], and app behavior is frequently inconsistent with app privacy labels
[136, 291]. 35% of European websites collect data not disclosed by their
privacy policy [191]. 11/165 popular trackers with opt-out choices exhibited
data practices inconsistent with their privacy policy [43]. IoT skills for
Amazon and Google devices have also been found to be inconsistent with their
privacy policies [106, 292], and 31% of IoT companion apps share data without
disclosing it. Independent work developing a testbed for IoT devices and found
that half of 11 sample devices collected data not disclosed by their privacy
policy [243]. Ling et al. [155] identified inconsistencies between privacy
policies and actual data practices for almost half of browser extensions.

Overall, early estimates suggested up to a third of the privacy policies for
large companies are not compliant with GDPR’s requirements [59], but later
work found that number could be as high as 97% [200], with many privacy
policies having multiple compliance issues [156]. Compliance is higher for top
tracking companies, most of which meet the minimum legal requirements set out
by GDPR [270].

#####  Compliance with Other Transparency Requirements

Three projects focused on the transparency requirements imposed by COPPA on
apps that target children under 13. Early work found that only 10.8% of these
apps targeted at young children provided a privacy policy in their Google Play
Store page in 2013 even though half collected some amount of personal
information [152]. Five years later, only half of parental control apps
clearly informed users of their data collection and sharing practices, and
only 24% provided a complete list of third-parties with which they share
information [79]. Some companies violate COPPA by failing to address
children’s data in their privacy policy [203] or not disclosing data practices
in the privacy policy [300]. In 2022, many child care apps still failed to
disclose use of trackers or processing of sensitive data about children [100].
Dempsey et al [66] surveyed children ages 7-11 to understand whether it is
possible to meet GDPR’s requirement to meet GDPR’s child-related transparency
requirements; the found clear saftey concerns, but also found that children
weren’t aware that personal data had value.

Chen et al. found that while almost all U.S. websites describe their data
sharing practices, only 24.4% of those list every category of personal
information that is shared with each category of recipient as required by CCPA
[55]. Musa et al. [179] proposed a technique for automatically inferring data
sharing relationships and validated it against CCPA’s data broker registry,
suggesting a means to verify accuracy of CCPA disclosures.

Qamar et al. [199] developed a tool that measures similarity between the text
of a law and a privacy policy; their tool supports compliance evaluation for
Singapore’s PDPA, but they have not published compliance rates.

#####  Tools to Improve Transparency

One approach to facilitating compliance with transparency requirements is to
automatically generate policies that comply with the various laws. Such tools
have been developed for COPPA [152, 299], GDPR [90, 14, 299, 29, 230], CCPA
[299], and CalOPPA [299]. There are also questionnaire-based generators that
create privacy policies for mobile apps [19, 125, 255, 256]; three of these
claim to generate policies that are compliant with COPPA, GDPR, and CCPA.
However, an independent analysis [299] found that the resulting policies are
only actually compliant with GDPR as of January 2021; all generated policies
violated multiple transparency-related requirements imposed by COPPA and by
CCPA.

An alternative approach is to enhance transparency with summarization or
annotation. Several independent projects applied NLP to automatically identify
and highlight parts of privacy policies are relevant to GDPR’s requirements
[257, 258, 178, 54, 23]. Mustapha et al. [180] provide an improved tool for
automatically annotating privacy policies.

Other tools include formal languages for expressing GDPR’s transparency
requirements [21, 101], expressing and verifying privacy policies [259], and
modeling inter-process communication to audit policies [29]. Wang et al. used
cryptographic tools and trusted execution environments to automate compliance
with privacy regulations [282].

####  3.4.2 Purpose or Processing Limitations

Ten laws impose purpose or processing limitations as a business obligation.
These include both legal bases for processing and explicit purpose
limitations.

#####  Legal bases for processing

GDPR Article 6 enumerates six legal bases for processing, and this model has
been replicated in many subsequent laws. One of those bases is user consent,
turning a business obligation into a self managed right. Consent as a legal
basis has been extensively studied by computer scientistis (Section 3.2.6).
Other legal bases have been studied less. Arfelt et al. [21] express GDPR’s
legal basis requirement (Article 6(1)) in temporal logic and find it can be
efficiently monitored. Kutylowski et al. [146] discuss challenges that can
arise from GDPR’s legal basis requirement in cases where a processor ceases to
exist but personal data are still stored by a third-party storage provider.
Han et al. (2021) [114] argue that the “Legitimate Interests” clause in the
GDPR covers use of data collected prior to GDPR; they build a system to
provide sequential recommendations by training a global model using pre-GDPR
data then fine-tuning that model locally with more recent data.

#####  Purpose Limitation

A few projects works have looked at purpose limitations in other contexts. One
work found that after GDPR went into effect, Android apps declared fewer
dangerous permissions and that many apps reduced the number of times they
accessed permissions [177], suggesting that GDPR’s purpose limitation
requirement might have significantly enhanced privacy. Another study found
that additional metadata required to enforce purpose limitation and other GDPR
requirements imposed a 2-5x performance slowdown on three widely-used database
systems [227].

To facilitate compliance with purpose limitation requirements, Wolf et al.
developed HivePBAC, an adaptation of purpose-based access control designed to
ensure purpose limitation for message-oriented architectures [286]. Karami et
al. develop a programming language that generates runtime errors if data are
used for purposes other than those for which they were collected or if they
are not deleted after their purpose is complete [131].

####  3.4.3 Data Minimization

Ten laws impose a data minimization obligation, however this obligation has
been rarely studied. One study found that personalization can be relatively
robust to global minimization but that quality loss is significant for some
users [36]. Anothers found that few apps enable data-minimization SDK settings
[139] and that 16/31 IoT devices had at least one unnecessary data flow [164].
Senarath et al. [223] found that developers struggle to implement data
minimization due to uncertainty about how data could potentially be used, and
that developers are inconsistent in how they applied data minimization.

Arfelt et al. [21] express a data minimization requirement in temporal logic
and find it can be efficiently monitored. Shanmugam et al. proposed a
framework for implementing data minimization in machine learning systems by
iteratively estimating the system performance curve and use of personal data
when a performance-based stopping criteria is achieved [226]. Zhou et al.
[297] developed a tool for automatically comparing privacy policies between
counterparts and identifying overly-broad data practices; their analysis
flagged 48.3% of policies as overly broad.

####  3.4.4 Security Requirements

Ten laws impose security requirements such as encryption for personal
information. Longitudinal studies observed a 9% decrease in plaintext
transmission of personal data after GDPR went into effect, but of 39% of top
Android apps still transmitted plaintext data [127, 75]. Many mHealth apps
that attempted to encrypt data contained at least one error [75]. Although
some apps contain geodifferences in security settings, those differences do
not correspond to privacy regulation jurisdictions [145].

In some cases, compliance with legally-mandated encryption requirements can
impose a significant performance overhead [225]. Marjanov et al. analyzed
fines imposed for violations of GDPR’s security requirements and identified
common failings and danger points [165].

####  3.4.5 Privacy by Design

Among the laws we reviewed, only GDPR includes a privacy by design obligation,
although this obligation is also present in other laws beyond the scope of our
review (e.g., Australia’s Privacy Act, Kenya’s Data Protection Act). A few
projects have considered this requirement from various approaches. Research
has analyzed the mobile ecosystem through the lens of privacy by design [50],
conducted case studies [94], and studied developer perspectives on privacy by
design to identify barriers [10]. Recommendations include more guidance for
developers [50], changes at individual and organization levels [10], and
development of tools targeted at the engineering mindset [166].

Independent work has developed tools for facilitating privacy by design using
domain-specific languages [90, 91], semantic models and automated verification
[56], and formal modeling and interactive theorem proving [130]. Deshpande
proposed an architecture for private-by-design database systems [67]. Tamò-
Larrieux et al. analyze Privacy by Design as a stepping stone toward a right
to customize data processing [253].

####  3.4.6 Record Keeping

Nine laws impose a record-keeping requirement, but this obligation has been
studied only in limited contexts such as measuring overhead incurred by adding
synchronous logging to Redis [225] or by a multi-level logging scheme [263].
Ryan et al. proposed DPCat, a standardized representation for the collection
and transfer of Register of Processing Activities (ROPA) information [210].

####  3.4.7 Cross-Border Transfer Limitations

Nine laws impose restrictions on cross-border transfers. Analyses of the
mobile tracking ecosystem prior to GDPR predicted a significant impact [203].
However, subsequent work found that tracking flows did not change
significantly [123] and that compliance rates were low, with with 93% of
websites embedding third parties located in regions outside the Privacy Shield
[268] and 66% of apps including cross-border transfers that were not
accurately disclosed in their privacy policy [104]. IoT companion apps also
transmit data across regions in ways that could violate GDPR [181].

####  3.4.8 Risk Assessments

Eight laws require risk assessments such as Data Protection Impact
Assessments, Privacy Impact Assessments, or Algorithmic Impact Assessments.
Three projects have briefly considered this requirement in the context of big
data systems [103], database systems [228], and smart homes [94], but it
hasn’t been a significant focus.

####  3.4.9 Contracting Requirements

Five laws have contracting requirements, e.g., for service providers or third-
parties who process personal information. Amaral et al. [13] developed an NLP
approach to automating compliance checking for GDPR data processing
agreements. No other work has looked at this obligation.

####  3.4.10 Breach Notification Requirements

Eight laws have breach notification requirements. Shastri et al.’s work on
GDPR-compliant database systems briefly mentions this obligation [227, 228],
but no work explicitly focuses on this requirement.

###  3.5 Applicability

The privacy laws and data protection regulations we analyzed included a range
of different scopes of applicability, both in terms of which people were
granted these protections (criteria included residence, citizenship, physical
location, age, and employee status) and in terms of which organizations were
subject to the regulation (criteria included number of users, company revenue,
revenue from selling personal information, organization’s country of
registration, jurisdictions in which a company did business, and non-profit or
governmental status). While some papers conducted cross-jurisdictional
measurements or studies, none looked explicitly at the impact of legal
applicability.

###  3.6 General Papers

While we were able to position most papers within our legal taxonomy, some
work approached privacy regulations from a more general perspective. For
example, a few projects explored generally what types of architectural and
design changes would be required to bring systems into compliance with GDPR
[93, 193, 148, 119, 228, 221, 30, 48], and one did so for the proposed Indian
Personal Data Protection Bill [234]. Wong et al. [289] studied how GDPR and
CCPA impact business risks identified in investor documents. Lopes et al.
[157] evaluated how ISO 27001 standards might facilitate GDPR compliance, and
Lu et al. [159] considered GDPR’s effect on WHOIS records. Soussi et al. [240]
explored the impact of GDPR on feasibility of large-scale vulnerability
notifications. Truong et al. [265] explored a blockchain-based approach to
providing assurance of continuous GDPR-compliance. Others developed or
proposed formal languages [27, 21, 261, 38] or tools [74, 81, 197, 82, 1, 38,
13, 254, 124] for facilitating and automating GDPR compliance. Other work
explored users’ [229, 296] and developers’ [235, 87, 52, 247, 12, 250, 51,
272, 133] attitudes towards, awareness of, and understanding of various
privacy regulations. Since legal compliance is often framed as the developer’s
choice and responsibility [251], research has also explored advice or guidance
available to (and used by) developers [251, 250, 50, 249, 149, 12] and
identified barriers to compliance from the developer’s perspective [250, 247,
12, 112, 32, 242, 274, 133, 248, 7]. However, Utz et al. [274] found that
notifications about privacy issues were less well-received than notifications
about security issues.

Other work documented differences in various measures after a law went into
effect. For example, Wang et al. found that 1/42 Android app libraries that
exhibited cross-library data harvesting eliminated this behavior after GDPR
went into effect [281]. Some work evaluated the impact of laws using cross-
jurisdictional comparisons, for example finding now differences in
universities’ cloud migration between GDPR countries and others [84].

##  4 Discussion

Looking at the 270 papers systematized in this work through an
interdisciplinary lens, we see a deep, active, and highly impactful body of
scholarship. However, systematizing this volume of work also illuminates
patterns in how computer scientists currently approach the problem of
analyzing the implementation and impact of privacy regulations. Based our
analysis of these patterns and our systematization of the existing research in
this space, we formulate recommendations about directions for future computer
science research at the intersection of privacy and law.

Recommendation 1: Computer science researchers should recognize the growing
inter-disciplinary consensus that privacy self-management is inherently flawed
and move beyond critiques of self-management features.

A majority of the work we systematized (51.5%) focused on measuring,
evaluating, or enhancing one or more privacy self-management features such as
access, deletion, opting-in, or opting-out. Another 27.8% of the papers
focused on the right to transparency, and many of these were framed within the
context of notice and consent, implicitly interpreting this requirement
through the lens of privacy self-management; most of this work is comprised of
criticisms of privacy self-management, such as quantifying designs that deter
users from invoking their right or measuring the (poor) usability of existing
implementations of self-management rights.

The critiques of self-management resulting from the systematized work
contribute to a growing interdisciplinary consensus that privacy self-
management as not only inherently unworkable, but actually detrimental to
privacy. Enhanced transparency is intended to empower users to make informed
decisions about whether to consent to data practices, but the resulting
disclosures are still unreadable [15, 190] and omit critical information [75,
294]. Implementations of self-management rights frequently deter people from
invoking their rights by leveraging cognitive biases in so-called “dark
patterns” [71, 280, 97, 273, 188]. Moreover, self-management simply doesn’t
scale to the number of companies with which users regularly interact and the
difficulty of identifying the many third parties with access to personal data
[170, 237, 209, 238].

Based on these compelling and consistent inter-disciplinary critiques, we
believe computer scientists should consider critiques of self-management to be
a solved problem. Instead of continuing generate new critiques of self-
management features, computer science researchers should evaluate non-self
management features of existing regulations through measurements and user
studies, and we should work to develop tools that complement regulatory
efforts.

Recommendation 2: Computer science researchers should extend our efforts to
evaluate the implementation and impact of currently under-studied aspects of
privacy regulations.

Much of the work we systematized focused on a small number of legal aspects
such as right to access (34 papers), consent interfaces (41 papers), and right
to transparency (75 papers). By contrast, other aspects of modern privacy laws
have gone largely unstudied by our community. Some of these understudied
aspects challenge and enhance common approaches to self-management or take
users out of the self-management loop. Examples of under-studied legal aspects
that could benefit from additional research include data minimization (9
current papers), anti-discrimination requirements (0 current papers),
prohibitions on certain technologies such as facial recognition (1 current
paper), and rights not to be subject to automated decisions (4 current
papers).

Recommendation 3: Computer science researchers should prioritize longitudinal
and cross-cultural work at the intersection of technology and privacy law.

The measurement work systematized in this paper focused on the time
immediately after or immediately around the date when a law went into effect.
However, the legal community considers post-enactment guidelines and case law
to provide essential interpretations of laws that define the rights and
obligations imposed by those laws. For example, what constitutes a valid opt-
out of sale mechanism under California law has evolved since January 2020 via
new guidelines, new interpretations and legal actions, and subsequent legal
amendments. To provide meaningful evaluations of privacy regulations, future
work will need to conduct longitudinal measurement studies over longer periods
after a law goes into effect, specifically including the evaluation of post-
enactment events that can change legal interpretation.

Similar sounding legal rights can also result substantively legal realities in
different jurisdictions due to different interpretations in different
jurisdictions. For example, many national privacy laws provide special
protection for “sensitive personal data”, but Singapore’s PDPA provides no
statutory definition or protection for sensitive data over other types of data
[233]. However, guidance from Singapore’s Personal Data Protection Commission
indicates that sensitivity of data is a factor for consideration, thus
introducing the potential for sensitive data protections under a law which
otherwise lacks such protections [189]. These differences can result in
results that don’t generalize between different jurisdictions even if they
have similar legal aspects and regulatory language. For example, consider an
illustrative example from the research on dark patterns and nudging: two
studies investigated the effects of the on-page location of consent banners on
interactions and user consent decisions [273, 34]. A study with Europeans
found participants were three times more likely to interact with banners in
the lower-left than in other positions; a study with a predominantly-American
population found position had no effect on interaction [34]. While there are
many possible reasons for these inconsistencies (including timing,
recruitment, and methodology), one possibility is that a genuine difference
exists between these two populations, which may have been induced by cultural
factors, differing experiences with privacy and consent, or the impact that
the GDPR (and the changes to corporate behavior it triggered, e.g., the
frequency of cookie banners) might have had on European’s behavior. To provide
meaningful results about the impact of privacy regulations globally,
researchers should conduct cross-jurisdictional studies and should replicate
results from single-jurisdictional work to validate whether the results
generalize to other legal jurisdictions.

Recommendation 4: Computer science researchers should explore how technical
expertise and methodology might be applied to evaluating proposed future
regulations and regulatory approaches in addition to laws currently in effect.

Existing work provides critiques of extant laws. This can (and has) impacted
subsequent interpretation and enforcement. However, this impact could be
amplified if computer scientists developed techniques to empirically evaluate
proposed regulations. Certain upcoming and proposed laws contain absolute
clauses beyond the scope of existing privacy guarantees, for example the
District of Columbia’s Stop Discrimination by Algorithms Act of 2021 and
Section 207 (”Civil Rights and Algorithms”) of the proposed new US omnibus
privacy legislation, the American Data Privacy and Protection Act (ADPPA).
Such laws are beginning to address a key facet of privacy regulation, which is
the ways in which it can be made to enforce equity in privacy across axes of
marginalization and class. Studies of these laws would be valuable for
understanding how non-discrimination approaches impact privacy outcomes and
privacy equity.

Finally, we encourage the study of regulatory regimes which have only been
theorized in academic law literature, such as data fiduciary approaches [25]
and civil rights approaches [33]. Such regimes could be deeply transformative
but would rely on major shifts in both privacy regulations and also how
societies construct and value privacy.

## References

  * [1] Abdulaziz Aborujilah, Abdulaleem Z Al-Othmani, Zalizah Awang Long, Nur Syahela Hussien, and Dahlan Abdul Ghani.  Conceptual model for automating gdpr compliance verification using natural language approach.  In 2022 International Conference on Intelligent Technology, System and Service for Internet of Everything (ITSS-IoE), pages 1–6. IEEE, 2022\.
  * [2] Supriya Adhatarao, Cédric Lauradoux, and Cristiana Santos.  Why IP-based subject access requests are denied?  arXiv preprint arXiv:2103.01019, 2021.
  * [3] Andrick Adhikari, Sanchari Das, and Rinku Dewri.  Evolution of composition, readability, and structure of privacy policies over two decades.  Proceedings on Privacy Enhancing Technologies, 3:138ś153, 2023\.
  * [4] Archita Agarwal, Marilyn George, Aaron Jeyaraj, and Malte Schwarzkopf.  Retrofitting GDPR compliance onto legacy databases.  Proceedings of the VLDB Endowment, 15(4), 2021.
  * [5] Central Intelligence Agency.  European union.  https://www.cia.gov/the-world-factbook/countries/european-union/#people-and-society, August 2022.
  * [6] Central Intelligence Agency.  World.  https://www.cia.gov/the-world-factbook/countries/european-union/#people-and-society, August 2022.
  * [7] Abdulrahman Alhazmi and Nalin Asanka Gamagedara Arachchilage.  Why are developers struggling to put gdpr into practice when developing privacy-preserving software systems?  arXiv preprint arXiv:2008.02987, 2020.
  * [8] Suzan Ali, Mounir Elgharabawy, Quentin Duchaussoy, Mohammad Mannan, and Amr Youssef.  Betrayed by the guardian: Security and privacy risks of parental control solutions.  In Annual Computer Security Applications Conference, pages 69–83, 2020.
  * [9] Fatemeh Alizadeh, Timo Jakobi, Alexander Boden, Gunnar Stevens, and Jens Boldt.  GDPR reality check-claiming and investigating personally identifiable data from companies.  In 5th European Workshop on Usable Security, 2020.
  * [10] Sami Alkhatib, Jenny Waycott, George Buchanan, Marthie Grobler, and Shuo Wang.  Privacy by design in aged care monitoring devices? Well, not quite yet!  In 32nd Australian Conference on Human-Computer Interaction, pages 492–505, 2020.
  * [11] Sahar Allegue, Mouna Rhahla, and Takoua Abdellatif.  Toward GDPR compliance in iot systems.  In Service-Oriented Computing–ICSOC 2019 Workshops: WESOACS, ASOCA, ISYCC, TBCE, and STRAPS, Toulouse, France, October 28–31, 2019, Revised Selected Papers 17, pages 130–141. Springer, 2020.
  * [12] Noura Alomar and Serge Egelman.  Developers say the darnedest things: Privacy compliance processes followed by developers of child-directed apps.  Proceedings on Privacy Enhancing Technologies, 4:250–273, 2022\.
  * [13] Orlando Amaral, Muhammad Ilyas Azeem, Sallam Abualhaija, and Lionel C Briand.  Nlp-based automated compliance checking of data processing agreements against gdpr.  IEEE Transactions on Software Engineering, 2023.
  * [14] David Restrepo Amariles, Aurore Clément Troussel, and Rajaa El Hamdani.  Compliance generation for privacy documents under GDPR: A roadmap for implementing automation and machine learning.  arXiv preprint arXiv:2012.12718, 2020.
  * [15] Ryan Amos, Gunes Acar, Elena Lucherini, Mihir Kshirsagar, Arvind Narayanan, and Jonathan Mayer.  Privacy policies over time: Curation and analysis of a million-document dataset.  In The Web Conference, pages 2165–2176, 2021.
  * [16] Benjamin Andow, Samin Yaseer Mahmud, Wenyu Wang, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Tao Xie.  PolicyLint: Investigating internal privacy policy contradictions on Google Play.  In 28th USENIX Security Symposium, pages 585–602, 2019.
  * [17] Benjamin Andow, Samin Yaseer Mahmud, Justin Whitaker, William Enck, Bradley Reaves, Kapil Singh, and Serge Egelman.  Actions speak louder than words: Entity-sensitive privacy policy and data flow analysis with PoliCheck.  In 29th USENIX Security Symposium, pages 985–1002, 2020.
  * [18] McKane Andrus, Elena Spitzer, Jeffrey Brown, and Alice Xiang.  What we can’t measure, we can’t understand: Challenges to demographic data procurement in the pursuit of fairness.  In ACM Conference on Fairness, Accountability, and Transparency, pages 249–260, 2021.
  * [19] App privacy policy generator.  https://app-privacy-policy-generator.nisrulz.com/.
  * [20] Noah Apthorpe, Sarah Varghese, and Nick Feamster.  Evaluating the contextual integrity of privacy regulation: Parents’ IoT toy privacy norms versus COPPA.  In 28th USENIX Security Symposium, pages 123–140, 2019.
  * [21] Emma Arfelt, David Basin, and Søren Debois.  Monitoring the GDPR.  In 24th European Symposium on Research in Computer Security (ESORICS), pages 681–699. Springer, 2019.
  * [22] Patricia Arias-Cabarcos, Saina Khalili, and Thorsten Strufe.  ‘surprised, shocked, worried’: User reactions to facebook data collection from third parties.  Proceedings on Privacy Enhancing Technologies, 1:384–399, 2023\.
  * [23] Siddhant Arora, Henry Hosseini, Christine Utz, Vinayshekhar K Bannihatti, Tristan Dhellemmes, Abhilasha Ravichander, Peter Story, Jasmine Mangat, Rex Chen, Martin Degeling, et al.  A tale of two regulatory regimes: Creation and analysis of a bilingual privacy policy corpus.  In LREC proceedings, 2022.
  * [24] Paritosh Bahirat, Martijn Willemsen, Yangyang He, Qizhang Sun, and Bart Knijnenburg.  Overlooking context: How do defaults and framing reduce deliberation in smart home privacy decision-making?  In CHI Conference on Human Factors in Computing Systems, pages 1–18, 2021.
  * [25] Jack M Balkin.  The fiduciary model of privacy.  Harv. L. Rev. F., 134:11, 2020.
  * [26] Vinayshekhar Bannihatti Kumar, Roger Iyengar, Namita Nisal, Yuanyuan Feng, Hana Habib, Peter Story, Sushain Cherivirala, Margaret Hagan, Lorrie Cranor, Shomir Wilson, et al.  Finding a choice in a haystack: Automatic extraction of opt-out statements from privacy policy text.  In The Web Conference, pages 1943–1954, 2020.
  * [27] Adam Barth, Anupam Datta, John C Mitchell, and Helen Nissenbaum.  Privacy and contextual integrity: Framework and applications.  In IEEE Symposium on Security and Privacy, 2006.
  * [28] Marlene Barth.  A case study on data portability.  Datenschutz und Datensicherheit-DuD, 45(3):190–197, 2021.
  * [29] David Basin, Søren Debois, and Thomas Hildebrandt.  On purpose and by necessity: Compliance under the GDPR.  In Financial Cryptography and Data Security: 22nd International Conference, FC 2018, Nieuwpoort, Curaçao, February 26–March 2, 2018, Revised Selected Papers 22, pages 20–37. Springer, 2018.
  * [30] Daniel Bastos, Fabio Giubilo, Mark Shackleton, and Fadi El-Moussa.  GDPR privacy implications for the internet of things.  In 4th Annual IoT Security Foundation Conference, volume 4, pages 1–8, 2018.
  * [31] Kanad Basu, Suha Sabi Hussain, Ujjwal Gupta, and Ramesh Karri.  COPPTCHA: COPPA tracking by checking hardware-level activity.  IEEE Transactions on Information Forensics and Security, 15:3213–3226, 2020.
  * [32] Kathrin Bednar, Sarah Spiekermann, and Marc Langheinrich.  Engineering privacy by design: Are engineers ready to live up to the challenge?  The Information Society, 35(3):122–142, 2019.
  * [33] Alvaro M Bedoya.  Privacy as civil right.  NML Rev., 50:301, 2020.
  * [34] Carlos Bermejo Fernandez, Dimitris Chatzopoulos, Dimitrios Papadopoulos, and Pan Hui.  This website uses nudging: Mturk workers’ behaviour on cookie consent notices.  Human-Computer Interaction, 5(CSCW2):1–22, 2021.
  * [35] Theo Bertram, Elie Bursztein, Stephanie Caro, Hubert Chao, Rutledge Chin Feman, Peter Fleischer, Albin Gustafsson, Jess Hemerly, Chris Hibbert, Luca Invernizzi, et al.  Five Years of the Right to be Forgotten.  In ACM SIGSAC Conference on Computer and Communications Security, pages 959–972, 2019.
  * [36] Asia J Biega, Peter Potash, Hal Daumé, Fernando Diaz, and Michèle Finck.  Operationalizing the legal principle of data minimization for personalization.  In International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 399–408, 2020.
  * [37] Dino Bollinger, Karel Kubicek, Carlos Cotrini, and David Basin.  Automating cookie consent and GDPR violation detection.  In 31st USENIX Security Symposium, 2022.
  * [38] Piero A Bonatti, Sabrina Kirrane, Iliana M Petrova, and Luigi Sauro.  Machine understandable policies and gdpr compliance checking.  KI-Künstliche Intelligenz, 34:303–315, 2020.
  * [39] Coline Boniface, Imane Fouad, Nataliia Bielova, Cédric Lauradoux, and Cristiana Santos.  Security analysis of subject access request procedures.  In Annual Privacy Forum, pages 182–209, 2019.
  * [40] Elijah Robert Bouma-Sims, Megan Li, Yanzi Lin, Adia Sakura-Lemessy, Alexandra Nisenoff, Ellie Young, Eleanor Birrell, Lorrie Faith Cranor, and Hana Habib.  A us-uk usability evaluation of consent management platform cookie consent interface design on desktop and mobile.  In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, pages 1–36, 2023.
  * [41] Alex Bowyer, Jack Holt, Josephine Go Jefferies, Rob Wilson, David Kirk, and Jan David Smeddinck.  Human-GDPR interaction: Practical experiences of accessing personal data.  In CHI Conference on Human Factors in Computing Systems, pages 1–19, 2022.
  * [42] Luca Bufalieri, Massimo La Morgia, Alessandro Mei, and Julinda Stefa.  GDPR: when the right to access personal data becomes a threat.  In IEEE International Conference on Web Services, pages 75–83, 2020\.
  * [43] Duc Bui, Brian Tang, and Kang G Shin.  Do opt-outs really opt me out?  In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 425–439, 2022.
  * [44] Duc Bui, Yuan Yao, Kang G Shin, Jong-Min Choi, and Junbum Shin.  Consistency analysis of data-usage purposes in mobile apps.  In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 2824–2843, 2021.
  * [45] United States Census Bureau.  Quickfacts california.  https://www.census.gov/quickfacts/fact/table/CA/PST045221, July 2021\.
  * [46] José González Cabañas, Ángel Cuevas, and Rubén Cuevas.  Unveiling and quantifying Facebook exploitation of sensitive personal data for advertising purposes.  In 27th USENIX Security Symposium, pages 479–495, 2018.
  * [47] Matteo Cagnazzo, Thorsten Holz, and Norbert Pohlmann.  Gdpirated–stealing personal information on-and offline.  In European Symposium on Research in Computer Security, pages 367–386, 2019.
  * [48] Daniel Prett Campagna, Altigran Soares da Silva, and Vanessa Braganholo.  Achieving gdpr compliance through provenance: An extended model.  In Anais do XXXV Simpósio Brasileiro de Bancos de Dados, pages 13–24. SBC, 2020.
  * [49] Caudio Carpineto, Davide Lo Re, and Giovanni Romano.  Automatic assessment of website compliance to the european cookie law with coolcheck.  In Workshop on Privacy in the Electronic Society, pages 135–138, 2016.
  * [50] C Castelluccia, S Guerses, M Hansen, JH Hoepman, J van Hoboken, B Vieira, et al.  Privacy and data protection in mobile applications: A study on the app development ecosystem and the technical implementation of GDPR.  2017\.
  * [51] George Chalhoub and Ivan Flechais.  Data protection at a discount: Investigating the ux of data protection from user, designer, and business leader perspectives.  Proceedings of the ACM on Human-computer Interaction, 6(CSCW2):1–36, 2022.
  * [52] George Chalhoub, Ivan Flechais, Norbert Nthala, and Ruba Abu-Salma.  Innovation inaction or in action? the role of user experience in the security and privacy design of smart home cameras.  In 16th Symposium on Usable Privacy and Security, pages 185–204, 2020.
  * [53] George Chalhoub, Martin J Kraemer, Norbert Nthala, and Ivan Flechais.  “it did not give me an option to decline”: A longitudinal analysis of the user experience of security and privacy in smart home products.  In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems, pages 1–16, 2021.
  * [54] Cheng Chang, Huaxin Li, Yichi Zhang, Suguo Du, Hui Cao, and Haojin Zhu.  Automated and personalized privacy policy extraction under GDPR consideration.  In International Conference on Wireless Algorithms, Systems, and Applications, pages 43–54, 2019.
  * [55] Rex Chen, Fei Fang, Thomas Norton, Aleecia M McDonald, and Norman Sadeh.  Fighting the fog: Evaluating the clarity of privacy disclosures in the age of CCPA.  In Workshop on Privacy in the Electronic Society, pages 73–102, 2021.
  * [56] Tek Raj Chhetri, Anelia Kurteva, Rance J DeLong, Rainer Hilscher, Kai Korte, and Anna Fensel.  Data protection by design tool for automated GDPR compliance verification based on semantically modeled informed consent.  Sensors, 22(7):2763, 2022.
  * [57] Aloni Cohen.  Attacks on deidentification’s defenses.  In 31st USENIX Security Symposium, 2022.
  * [58] Aloni Cohen and Kobbi Nissim.  Towards formalizing the GDPR’s notion of singling out.  Proceedings of the National Academy of Sciences, 117(15):8344–8352, 2020.
  * [59] Giuseppe Contissa, Koen Docter, Francesca Lagioia, Marco Lippi, Hans-W Micklitz, Przemysław Pałka, Giovanni Sartor, and Paolo Torroni.  Claudette meets GDPR: Automating the evaluation of privacy policies using artificial intelligence.  Available at SSRN 3208596, 2018.
  * [60] Kovila P.L. Coopamootoo, Maryam Mehrnezhad, and Ehsan Toreini.  “i feel invaded, annoyed, anxious and i may protect myself”: Individuals’ feelings about online tracking and their protective behaviour across gender and country.  In 31st USENIX Security Symposium, 2022.
  * [61] Lorrie Faith Cranor, Hana Habib, Yixin Zou, Alessandro Acquisti, Joel Reidenberg, Norman Sadeh, and Florian Schaub.  Design and evaluation of a usable icon and tagline to signal an opt-out of the sale of personal information as required by CCPA.  Retrieved September 13th, 2020.
  * [62] Adrian Dabrowski, Georg Merzdovnik, Johanna Ullrich, Gerald Sendera, and Edgar Weippl.  Measuring cookies and web privacy in a post-GDPR world.  In International Conference on Passive and Active Network Measurement, pages 258–270, 2019.
  * [63] Savino Dambra, Iskander Sanchez-Rola, Leyla Bilge, Davide Balzarotti, Yixin Zou, Allison McDonald, Julia Narakornpichit, Nicola Dell, Thomas Ristenpart, Kevin Roundy, et al.  When sally met trackers: Web tracking from the users’ perspective.  In 31st USENIX Security Symposium, 2022.
  * [64] Javam de Castro Machado and Paulo Roberto Pessoa Amora.  How can db systems be ready for privacy regulations.  In Anais do XXXV Simpósio Brasileiro de Bancos de Dados, pages 235–240. SBC, 2020.
  * [65] Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub, and Thorsten Holz.  We Value your Privacy… Now Take some Cookies: Measuring the GDPR’s Impact on Web Privacy.  In 26th Network and Distributed System Security Symposium, 2019\.
  * [66] John Dempsey, Gavin Sim, and Brendan Cassidy.  Designing for gdpr-investigating children’s understanding of privacy: A survey approach.  In Proceedings of the 32nd International BCS Human Computer Interaction Conference 32, pages 1–13, 2018.
  * [67] Amol Deshpande.  Sypse: Privacy-first data management through pseudonymization and partitioning.  In CIDR, 2021.
  * [68] Ratan Dey, Yuan Ding, and Keith W Ross.  Profiling high-school students with Facebook: How online privacy laws can actually increase minors’ risk.  In Internet Measurement Conference, pages 405–416, 2013.
  * [69] Mariano Di Martino, Isaac Meers, Peter Quax, Ken Andries, and Wim Lamotte.  Revisiting identification issues in GDPR ‘right of access’ policies: A technical and longitudinal analysis.  Proceedings on Privacy Enhancing Technologies, 2022(2):95–113, 2022\.
  * [70] Mariano Di Martino, Pieter Robyns, Winnie Weyts, Peter Quax, Wim Lamotte, and Ken Andries.  Personal information leakage by abusing the GDPR ’right of access’.  In 15th Symposium on Usable Privacy and Security, pages 371–385, 2019.
  * [71] Nora A Draper and Joseph Turow.  The Corporate Cultivation of Digital Resignation.  New media & society, 21(8):1824–1839, 2019.
  * [72] Anirudh Ekambaranathan, Jun Zhao, and Max Van Kleek.  “Money makes the world go around”: Identifying barriers to better privacy in children’s apps from developers’ perspectives.  In CHI Conference on Human Factors in Computing Systems, pages 1–15, 2021.
  * [73] Rajaa El Hamdani, Majd Mustapha, David Restrepo Amariles, Aurore Troussel, Sébastien Meeùs, and Katsiaryna Krasnashchok.  A combined rule-based and machine learning approach for automated GDPR compliance checking.  In International Conference on Artificial Intelligence and Law, pages 40–49, 2021.
  * [74] Lavanya Elluri and Karuna Pande Joshi.  A knowledge representation of cloud data controls for EU GDPR compliance.  In IEEE World Congress on Services, pages 45–46, 2018.
  * [75] Ming Fan, Le Yu, Sen Chen, Hao Zhou, Xiapu Luo, Shuyue Li, Yang Liu, Jun Liu, and Ting Liu.  An empirical evaluation of GDPR compliance violations in android mhealth apps.  In IEEE 31st International Symposium on Software Reliability Engineering, pages 253–264, 2020.
  * [76] Sabrina Fang.  Investigating GDPR compliance across consumer-related websites: Are businesses telling consumers the truth about data collection?  2018\.
  * [77] Florian M. Farke, David G. Balash, Maximilian Golla, Markus Dürmuth, and Adam J Aviv.  Are privacy dashboards good for end users? evaluating user perceptions and reactions to google’s my activity.  In 30th USENIX Security Symposium, pages 483–500, 2021.
  * [78] Simon Farshid, Andreas Reitz, and Peter Roßbach.  Design of a forgetting blockchain: A possible way to accomplish gdpr compatibility.  2019\.
  * [79] Álvaro Feal, Paolo Calciati, Narseo Vallina-Rodriguez, Carmela Troncoso, Alessandra Gorla, et al.  Angel or devil? a privacy study of mobile parental control apps.  Proceedings of Privacy Enhancing Technologies (PoPETS), 2020, 2020\.
  * [80] Yuanyuan Feng, Yaxing Yao, and Norman Sadeh.  A design space for privacy choices: Towards meaningful privacy control in the internet of things.  In CHI Conference on Human Factors in Computing Systems, pages 1–16, 2021.
  * [81] Pietro Ferrara and Fausto Spoto.  Static analysis for GDPR compliance.  In ITASEC, 2018.
  * [82] Mafalda Ferreira, Tiago Brito, José Fragoso Santos, and Nuno Santos.  RuleKeeper: GDPR-aware personal data compliance for web frameworks.  In 2023 IEEE Symposium on Security and Privacy (SP), pages 2817–2834. IEEE, 2023.
  * [83] Christof Ferreira Torres and Hugo Jonker.  Investigating fingerprinters and fingerprinting-alike behaviour of android applications.  In European Symposium on Research in Computer Security, pages 60–80, 2018.
  * [84] Tobias Fiebig, Seda Gürses, Carlos H Gañán, Erna Kotkamp, Fernando Kuipers, Martina Lindorfer, Menghua Prisse, and Taritha Sari.  Heads in the clouds? measuring universities’ migration to public clouds: Implications for privacy & academic freedom.  In Proceedings on Privacy Enhancing Technologies Symposium, volume 2023, 2022.
  * [85] Imane Fouad, Cristiana Santos, Feras Al Kassar, Nataliia Bielova, and Stefano Calzavara.  On compliance of cookie purposes with the purpose specification principle.  In IEEE European Symposium on Security and Privacy Workshops, pages 326–333, 2020.
  * [86] Imane Fouad, Cristiana Santos, Arnaud Legout, and Nataliia Bielova.  My cookie is a phoenix: Detection, measurement, and lawfulness of cookie respawning with browser fingerprinting.  In 22nd Privacy Enhancing Technologies Symposium, 2022.
  * [87] M da C Freitas and Miguel Mira da Silva.  Gdpr compliance in SMEs: There is much to be done.  Journal of Information Systems Engineering & Management, 3(4):30, 2018.
  * [88] Eoghan Furey and Juanita Blue.  Can I trust her? Intelligent personal assistants and GDPR.  In 2019 International Symposium on Networks, Computers and Communications (ISNCC), pages 1–6. IEEE, 2019.
  * [89] Sanjam Garg, Shafi Goldwasser, and Prashant Nalini Vasudevan.  Formalizing data deletion in the context of the right to be forgotten.  In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 373–402. Springer, 2020.
  * [90] Armin Gerl, Nadia Bennani, Harald Kosch, and Lionel Brunie.  Lpl, towards a GDPR-compliant privacy language: formal definition and usage.  In Transactions on Large-Scale Data-and Knowledge-Centered Systems XXXVII, pages 41–80. Springer, 2018.
  * [91] Armin Gerl and Bianca Meier.  The layered privacy language art. 12–14 GDPR extension–privacy enhancing user interfaces.  Datenschutz und Datensicherheit-DuD, 43(12):747–752, 2019.
  * [92] Matteo Giomi, Franziska Boenisch, Christoph Wehmeyer, and Borbála Tasnádi.  A unified framework for quantifying privacy risk in synthetic data.  Proceedings on Privacy Enhancing Technologies, 2:312–328, 2023\.
  * [93] Harald Gjermundrød, Ioanna Dionysiou, and Kyriakos Costa.  privacytracker: a privacy-by-design GDPR-compliant framework with verifiable data traceability controls.  In International Conference on Web Engineering, pages 3–15, 2016\.
  * [94] Olga Gkotsopoulou, Elisavet Charalambous, Konstantinos Limniotis, Paul Quinn, Dimitris Kavallieros, Gohar Sargsyan, Stavros Shiaeles, and Nicholas Kolokotronis.  Data protection by design for cybersecurity systems in a smart home environment.  In 2019 IEEE Conference on Network Softwarization (NetSoft), pages 101–109. IEEE, 2019.
  * [95] Jonathan Godin and Philippe Lamontagne.  Deletion-compliance in the absence of privacy.  In 2021 18th International Conference on Privacy, Security and Trust (PST), pages 1–10. IEEE, 2021.
  * [96] Alejandra Gómez Ortega, Jacky Bourgeois, and Gerd Kortuem.  What is sensitive about (sensitive) data? characterizing sensitivity and intimacy with google assistant users.  In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, pages 1–16, 2023.
  * [97] Colin M Gray, Yubo Kou, Bryan Battles, Joseph Hoggatt, and Austin L Toombs.  The dark (patterns) side of ux design.  In Proceedings of the 2018 CHI conference on human factors in computing systems, pages 1–14, 2018.
  * [98] Colin M Gray, Cristiana Santos, Nataliia Bielova, Michael Toth, and Damian Clifford.  Dark patterns and the legal requirements of consent banners: An interaction criticism perspective.  In CHI Conference on Human Factors in Computing Systems, pages 1–18, 2021.
  * [99] Graham Greenleaf.  Now 157 countries: Twelve data privacy laws in 2021/22.  176 Privacy Laws & Business International Report 1, 3-8, March 2022\.
  * [100] Moritz Gruber, Christian Höfig, Maximilian Golla, Tobias Urban, and Matteo Große-Kampmann.  “We may share the number of diaper changes”: A privacy and security analysis of mobile child care applications.  Proceedings on Privacy Enhancing Technologies, 3:394–414, 2022\.
  * [101] Elias Grünewald and Frank Pallas.  Tilt: A GDPR-aligned transparency information language and toolkit for practical privacy engineering.  In ACM Conference on Fairness, Accountability, and Transparency, pages 636–646, 2021.
  * [102] Elias Grünewald, Paul Wille, Frank Pallas, Maria C Borges, and Max-R Ulbricht.  Tira: An openapi extension and toolbox for GDPR transparency in restful architectures.  In IEEE European Symposium on Security and Privacy Workshops, pages 312–319, 2021.
  * [103] Nils Gruschka, Vasileios Mavroeidis, Kamer Vishi, and Meiko Jensen.  Privacy issues and data protection in big data: A case study analysis under GDPR.  In IEEE International Conference on Big Data, pages 5027–5033, 2018\.
  * [104] Danny S Guamán, Jose M Del Alamo, and Julio C Caiza.  GDPR compliance assessment for cross-border personal data transfers in android apps.  IEEE Access, 9:15961–15982, 2021.
  * [105] Johanna Gunawan, Amogh Pradeep, David Choffnes, Woodrow Hartzog, and Christo Wilson.  A comparative study of dark patterns across mobile and web modalities.  In Conference on Computer-Supported Cooperative Work and Social Computing, volume 5, 2021.
  * [106] Zhixiu Guo, Zijin Lin, Pan Li, and Kai Chen.  $\\{$SkillExplorer$\\}$: Understanding the behavior of skills in large scale.  In 29th USENIX Security Symposium (USENIX Security 20), pages 2649–2666, 2020.
  * [107] Hana Habib and Lorrie Cranor.  Evaluating the usability of privacy choice mechanisms.  In Symposium on Usable Privacy and Security, 2022.
  * [108] Hana Habib, Megan Li, Ellie Young, and Lorrie Cranor.  “Okay, whatever”: An evaluation of cookie consent interfaces.  In CHI Conference on Human Factors in Computing Systems, pages 1–27, 2022.
  * [109] Hana Habib, Sarah Pearman, Jiamin Wang, Yixin Zou, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, and Florian Schaub.  ” it’s a scavenger hunt”: Usability of websites’ opt-out and data deletion choices.  In CHI Conference on Human Factors in Computing Systems, pages 1–12, 2020.
  * [110] Hana Habib, Yixin Zou, Aditi Jannu, Neha Sridhar, Chelse Swoopes, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, and Florian Schaub.  An empirical analysis of data deletion and opt-out choices on 150 websites.  In 15th Symposium on Usable Privacy and Security, pages 387–406, 2019.
  * [111] Hana Habib, Yixin Zou, Yaxing Yao, Alessandro Acquisti, Lorrie Cranor, Joel Reidenberg, Norman Sadeh, and Florian Schaub.  Toggles, dollar signs, and triangles: How to (in) effectively convey privacy choices with icons and link texts.  In CHI Conference on Human Factors in Computing Systems, pages 1–25, 2021.
  * [112] Irit Hadar, Tomer Hasson, Oshrat Ayalon, Eran Toch, Michael Birnhack, Sofia Sherman, and Arod Balissa.  Privacy by designers: Software developers’ privacy mindset.  Empirical Software Engineering, 23(1):259–289, 2018.
  * [113] Catherine Han, Irwin Reyes, Álvaro Feal, Joel Reardon, Primal Wijesekera, Narseo Vallina-Rodriguez, Amit Elazar, Kenneth A Bamberger, and Serge Egelman.  The price is (not) right: Comparing privacy in free and paid apps.  Proceedings on Privacy Enhancing Technologies, 2020(3), 2020.
  * [114] Jialiang Han, Yun Ma, Qiaozhu Mei, and Xuanzhe Liu.  Deeprec: On-device deep learning for privacy-preserving sequential recommendation in mobile commerce.  In The Web Conference, pages 900–911, 2021.
  * [115] Anne Hennig, Heike Dietmann, Franz Lehr, Miriam Mutter, Melanie Volkamer, and Peter Mayer.  Your cookie disclaimer is not in line with the ideas of the gdpr. why?  In International Symposium on Human Aspects of Information Security and Assurance, pages 218–227. Springer, 2022.
  * [116] Dominik Herrmann and Jens Lindemann.  Obtaining personal data and asking for erasure: Do app vendors and website owners honour your privacy rights?  arXiv preprint arXiv:1602.01804, 2016.
  * [117] Maximilian Hils, Daniel W Woods, and Rainer Böhme.  Measuring the emergence of consent management on the web.  In Internet Measurement Conference, pages 317–332, 2020.
  * [118] Maximilian Hils, Daniel W Woods, and Rainer Böhme.  Privacy preference signals: Past, present and future.  Proceedings on Privacy Enhancing Technologies, 2021(4):249–269, 2021.
  * [119] Kalle Hjerppe, Jukka Ruohonen, and Ville Leppänen.  The general data protection regulation: requirements, architectures, and constraints.  In IEEE 27th International Requirements Engineering Conference, pages 265–275, 2019.
  * [120] Xuehui Hu, Guillermo Suarez de Tangil, and Nishanth Sastry.  Multi-country study of third party trackers from real browser histories.  In IEEE European Symposium on Security and Privacy, pages 70–86, 2020.
  * [121] Xuehui Hu and Nishanth Sastry.  Characterising third party cookie usage in the EU after GDPR.  In ACM Conference on Web Science, pages 137–141, 2019.
  * [122] Irene Ioannidou and Nicolas Sklavos.  On general data protection regulation vulnerabilities and privacy issues, for wearable devices and fitness tracking applications.  Cryptography, 5(4):29, 2021.
  * [123] Costas Iordanou, Georgios Smaragdakis, Ingmar Poese, and Nikolaos Laoutaris.  Tracing cross border web tracking.  In Internet Measurement Conference 2018, pages 329–342, 2018.
  * [124] Zsolt Istvan, Soujanya Ponnapalli, and Vijay Chidambaram.  Towards software-defined data protection: Gdpr compliance at the storage layer is within reach.  arXiv preprint arXiv:2008.04936, 2020.
  * [125] iubenda.  https://www.iubenda.com/en/.
  * [126] Sorensen Jannick Kirk, Hilde Van den Bulck, and Sokol Kosta.  Privacy policies caught between the legal and the ethical: European media and third party trackers before and after GDPR.  In TPRC47: The 47th Research Conference on Communication, Information and Internet Policy, 2019.
  * [127] Qiwei Jia, Lu Zhou, Huaxin Li, Ruoxu Yang, Suguo Du, and Haojin Zhu.  Who leaks my privacy: Towards automatic and association detection with GDPR compliance.  In International Conference on Wireless Algorithms, Systems, and Applications, pages 137–148, 2019.
  * [128] Garrett Johnson, Scott Shriver, and Samuel Goldberg.  Privacy & market concentration: Intended & unintended consequences of the GDPR.  Available at SSRN 3477686, 2021.
  * [129] Scott Jordan, Yoshimichi Nakatsuka, Ercan Ozturk, Andrew Paverd, and Gene Tsudik.  Viceroy: GDPR-/CCPA-compliant enforcement of verifiable accountless consumer requests.  arXiv preprint arXiv:2105.06942, 2021.
  * [130] Florian Kammueller.  Formal modeling and analysis of data protection for GDPR compliance of iot healthcare systems.  In 2018 IEEE International Conference on Systems, Man, and Cybernetics (SMC), pages 3319–3324. IEEE, 2018.
  * [131] Farzane Karami, David Basin, and Einar Broch Johnsen.  DPL: A language for GDPR enforcement.  In 2022 IEEE 35th Computer Security Foundations Symposium (CSF), pages 112–129. IEEE, 2022.
  * [132] Smirity Kaushik, Yaxing Yao, Pierre Dewitte, and Yang Wang.  “How I know for sure”: People’s perspectives on solely automated decision-making (SADM).  In 17th Symposium on Usable Privacy and Security, pages 159–180, 2021.
  * [133] Dilara Keküllüoğlu and Yasemin Acar.  ”We are a startup to the core”: A qualitative interview study on the security and privacy development practices in Turkish software startups.  In 2023 IEEE Symposium on Security and Privacy (SP), pages 2015–2031. IEEE, 2023.
  * [134] Rishabh Khandelwal, Asmit Nayak, Hamza Harkous, and Kassem Fawaz.  Automated cookie notice analysis and enforcement.  In 32nd USENIX Security Symposium (USENIX Security 23), pages 1109–1126, 2023.
  * [135] David Klein, Marius Musch, Thomas Barber, Moritz Kopmann, and Martin Johns.  Accept all exploits: Exploring the security impact of cookie banners.  In Proceedings of the 38th Annual Computer Security Applications Conference, pages 911–922, 2022.
  * [136] Simon Koch, Malte Wessels, Benjamin Altpeter, Madita Olvermann, and Martin Johns.  Keeping privacy labels honest.  Proceedings on Privacy Enhancing Technologies, 4(486-506):2–2, 2022\.
  * [137] Konrad Kollnig, Reuben Binns, Max Van Kleek, Ulrik Lyngs, Jun Zhao, Claudine Tinsman, and Nigel Shadbolt.  Before and after GDPR: tracking in mobile apps.  Internet Policy Review, 10(4), 2021.
  * [138] Konrad Kollnig, Pierre Dewitte, Max Van Kleek, Ge Wang, Daniel Omeiza, Helena Webb, and Nigel Shadbolt.  A fait accompli? an empirical study into the absence of consent to third-party tracking in android apps.  In 17th Symposium on Usable Privacy and Security, pages 181–196, 2021.
  * [139] Konrad Kollnig, Anastasia Shuba, Max Van Kleek, Reuben Binns, and Nigel Shadbolt.  Goodbye tracking? Impact of iOS app tracking transparency and privacy labels.  arXiv preprint arXiv:2204.03556, 2022.
  * [140] Satyapriya Krishna, Jiaqi Ma, and Himabindu Lakkaraju.  Towards bridging the gaps between the right to explanation and the right to be forgotten.  arXiv preprint arXiv:2302.04288, 2023.
  * [141] Jacob Leon Kröger, Jens Lindemann, and Dominik Herrmann.  How do app vendors respond to subject access requests? a longitudinal privacy study on ios and android apps.  In International Conference on Availability, Reliability and Security, pages 1–10, 2020.
  * [142] Karel Kubicek.  Checking websites’ GDPR consent compliance for marketing emails.  Proceedings on Privacy Enhancing Technologies, 2022.
  * [143] Sophie Kuebler-Wachendorff, Robert Luzsa, Johann Kranz, Stefan Mager, Emmanuel Syrmoudis, Susanne Mayr, and Jens Grossklags.  The right to data portability: Conception, status quo, and future directions.  Informatik Spektrum, 44(4):264–272, 2021.
  * [144] Oksana Kulyk, Nina Gerber, Annika Hilt, and Melanie Volkamer.  Has the GDPR hype affected users’ reaction to cookie disclaimers?  Journal of Cybersecurity, 6(1):tyaa022, 2020.
  * [145] Renuka Kumar, Apurva Virkud, Ram Sundara Raman, Atul Prakash, and Roya Ensafi.  A large-scale investigation into geodifferences in mobile apps.  In 31st USENIX Security Symposium, 2022.
  * [146] Mirosław Kutyłowski, Anna Lauks-Dutka, and Moti Yung.  GDPR–Challenges for reconciling legal rules with technical reality.  In 25th European Symposium on Research in Computer Security (ESORICS), pages 736–755. Springer, 2020.
  * [147] Lin Kyi, Sushil Ammanaghatta Shivakumar, Cristiana Teixeira Santos, Franziska Roesner, Frederike Zufall, and Asia J Biega.  Investigating deceptive design in gdpr’s legitimate interest.  In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems, pages 1–16, 2023.
  * [148] Clément Labadie and Christine Legner.  Understanding data protection regulations from a data management perspective: a capability-based approach to EU-GDPR.  In 14th International Conference on Wirtschaftsinformatik (2019), 2019.
  * [149] Tianshi Li, Elizabeth Louie, Laura Dabbish, and Jason Hong.  How developers talk about personal data and what it means for user privacy: A case study of a developer forum on Reddit.  Proceedings of the ACM on Human-Computer Interaction, 4(CSCW):1–28, 2021.
  * [150] Song Liao, Christin Wilson, Long Cheng, Hongxin Hu, and Huixing Deng.  Measuring the effectiveness of privacy policies for voice assistant applications.  In Annual Computer Security Applications Conference, pages 856–869, 2020.
  * [151] Timothy Libert, Lucas Graves, and Rasmus Kleis Nielsen.  Changes in third-party content on European news websites after GDPR.  2018\.
  * [152] Ilaria Liccardi, Monica Bulger, Hal Abelson, Daniel J Weitzner, and Wendy Mackay.  Can apps play by the COPPA rules?  In 12th Annual International Conference on Privacy, Security and Trust, 2014.
  * [153] R Liepina, Giuseppe Contissa, Kasper Drazewski, Francesca Lagioia, Marco Lippi, H-W Micklitz, Przemyslaw Palka, Giovanni Sartor, and Paolo Torroni.  GDPR privacy policies in Claudette: Challenges of omission, context and multilingualism.  In 3rd Workshop on Automated Semantic Analysis of Information in Legal Texts, volume 2385, 2019.
  * [154] Thomas Linden, Rishabh Khandelwal, Hamza Harkous, and Kassem Fawaz.  The privacy policy landscape after the gdpr.  Proceedings on Privacy Enhancing Technologies, 2020(1):47–64, 2020\.
  * [155] Yuxi Ling, Kailong Wang, Guangdong Bai, Haoyu Wang, and Jin Song Dong.  Are they toeing the line? Diagnosing privacy compliance violations among browser extensions.  In Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, pages 1–12, 2022.
  * [156] Shuang Liu, Baiyang Zhao, Renjie Guo, Guozhu Meng, Fan Zhang, and Meishan Zhang.  Have you been properly notified? automatic compliance analysis of privacy policy text with GDPR article 13.  In The Web Conference, pages 2154–2164, 2021.
  * [157] Isabel Maria Lopes, Teresa Guarda, and Pedro Oliveira.  How ISO 27001 can help achieve GDPR compliance.  In 2019 14th Iberian Conference on Information Systems and Technologies (CISTI), pages 1–6. IEEE, 2019.
  * [158] Juniper Lovato, Philip Mueller, Parisa Suchdev, and Peter Dodds.  More data types more problems: A temporal analysis of complexity, stability, and sensitivity in privacy policies.  In Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency, pages 1088–1100, 2023.
  * [159] Chaoyi Lu, Baojun Liu, Yiming Zhang, Zhou Li, Fenglu Zhang, Haixin Duan, Ying Liu, Joann Qiongna Chen, Jinjin Liang, Zaifeng Zhang, et al.  From WHOIS to WHOWAS: A Large-Scale Measurement Study of Domain Registration Privacy under the GDPR.  In 28th Network and Distributed System Security Symposium, 2021\.
  * [160] Connor Luckett, Andrew Crotty, Alex Galakatos, and Ugur Cetintemel.  Odlaw: A tool for retroactive gdpr compliance.  In 2021 IEEE 37th International Conference on Data Engineering (ICDE), pages 2709–2712. IEEE, 2021.
  * [161] Eryn Ma and Eleanor Birrell.  Prospective consent: The effect of framing on cookie consent decisions.  In CHI Conference on Human Factors in Computing Systems Extended Abstracts, pages 1–6, 2022.
  * [162] Dominique Machuletz and Rainer Böhme.  Multiple purposes, multiple problems: A user study of consent dialogs after gdpr.  arXiv preprint arXiv:1908.10048, 2019.
  * [163] Sunil Manandhar, Kaushal Kafle, Benjamin Andow, Kapil Singh, and Adwait Nadkarni.  Smart home privacy policies demystified: A study of availability, content, and coverage.  In 31st USENIX Security Symposium (USENIX Security 22), pages 3521–3538, 2022.
  * [164] Anna Maria Mandalari, Daniel J Dubois, Roman Kolcun, Muhammad Talha Paracha, Hamed Haddadi, and David Choffnes.  Blocking without breaking: Identification and mitigation of non-essential iot traffic.  Proceedings on Privacy Enhancing Technologies, 4:369–388, 2021\.
  * [165] Tina Marjanov, Maria Konstantinou, Magdalena Jóźwiak, and Dayana Spagnuelo.  Data security on the ground: Investigating technical and legal requirements under the gdpr.  Proceedings on Privacy Enhancing Technologies, 3:405–417, 2023\.
  * [166] Yod-Samuel Martin and Antonio Kung.  Methods and tools for GDPR compliance through privacy and data protection engineering.  In 2018 IEEE European symposium on security and privacy workshops (EuroS&PW), pages 108–111. IEEE, 2018.
  * [167] Arunesh Mathur, Gunes Acar, Michael J Friedman, Elena Lucherini, Jonathan Mayer, Marshini Chetty, and Arvind Narayanan.  Dark patterns at scale: Findings from a crawl of 11k shopping websites.  Proceedings of the ACM on Human-Computer Interaction, 3(CSCW):1–32, 2019.
  * [168] Arunesh Mathur, Mihir Kshirsagar, and Jonathan Mayer.  What makes a dark pattern… dark? design attributes, normative considerations, and measurement methods.  In CHI Conference on Human Factors in Computing Systems, pages 1–18, 2021.
  * [169] Célestin Matte, Nataliia Bielova, and Cristiana Santos.  Do cookie banners respect my choice?: Measuring legal compliance of banners from IAB Europe’s transparency and consent framework.  In IEEE Symposium on Security and Privacy, pages 791–809, 2020\.
  * [170] Aleecia M McDonald and Lorrie Faith Cranor.  The cost of reading privacy policies.  Isjlp, 4:543, 2008.
  * [171] Maryam Mehrnezhad, Kovila Coopamootoo, and Ehsan Toreini.  How can and would people protect from online tracking?  Proceedings on Privacy Enhancing Technologies, 1:105–125, 2022\.
  * [172] Mark Huasong Meng, Qing Zhang, Guangshuai Xia, Yuwei Zheng, Yanjun Zhang, Guangdong Bai, Zhi Liu, Sin G Teo, and Jin Song Dong.  Post-gdpr threat hunting on android phones: dissecting os-level safeguards of user-unresettable identifiers.  In The Network and Distributed System Security Symposium (NDSS), 2023.
  * [173] Abraham Mhaidli, Selin Fidan, An Doan, Gina Herakovic, Mukund Srinath, Lee Matheson, Shomir Wilson, and Florian Schaub.  Researchers’ experiences in analyzing privacy policies: Challenges and opportunities.  Proceedings on Privacy Enhancing Technologies, 4:287–305, 2023\.
  * [174] Mohsen Minaei, Mainack Mondal, and Aniket Kate.  Empirical understanding of deletion privacy: Experiences, expectations, and measures.  2022\.
  * [175] Reham Ebada Mohamed and Sonia Chiasson.  Online privacy and aging of digital artifacts.  In 14th Symposium on Usable Privacy and Security, pages 177–195, 2018.
  * [176] Jayashree Mohan, Melissa Wasserman, and Vijay Chidambaram.  Analyzing GDPR compliance through the lens of privacy policy.  In Heterogeneous Data Management, Polystores, and Analytics for Healthcare: VLDB 2019 Workshops, Poly and DMAH, Los Angeles, CA, USA, August 30, 2019, Revised Selected Papers 5, pages 82–95. Springer, 2019.
  * [177] Nurul Momen, Majid Hatamian, and Lothar Fritsch.  Did app privacy improve after the GDPR?  IEEE Security & Privacy, 17(6):10–20, 2019.
  * [178] Najmeh Mousavi Nejad, Simon Scerri, and Jens Lehmann.  Knight: Mapping privacy policies to GDPR.  In European Knowledge Acquisition Workshop, pages 258–272, 2018\.
  * [179] Maaz Bin Musa and Rishab Nithyanand.  Atom: ad-network tomography.  Proceedings on Privacy Enhancing Technologies, 4:295–313, 2022\.
  * [180] Majd Mustapha, Katsiaryna Krasnashchok, Anas Al Bassit, and Sabri Skhiri.  Privacy policy classification with xlnet (short paper).  In International Workshop on Data Privacy Management, pages 250–257. Springer, 2020.
  * [181] Yuhong Nan, Xueqiang Wang, Luyi Xing, Xiaojing Liao, Ruoyu Wu, Jianliang Wu, Yifan Zhang, and XiaoFeng Wang.  Are you spying on me? Large-Scale analysis on IoT data exposure through companion apps.  In 32nd USENIX Security Symposium, pages 6665–6682, 2023.
  * [182] Arvind Narayanan and Vitaly Shmatikov.  Myths and fallacies of” personally identifiable information”.  Communications of the ACM, 53(6):24–26, 2010.
  * [183] Trung Tin Nguyen, Michael Backes, Ninja Marnau, and Ben Stock.  Share first, ask later (or never?) studying violations of gdpr’s explicit consent in android apps.  In 30th USENIX Security Symposium, 2021.
  * [184] Trung Tin Nguyen, Michael Backes, and Ben Stock.  Freely given consent? studying consent notice of third-party tracking and its violations of gdpr in android apps.  In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 2369–2383, 2022.
  * [185] Chris Norval, Kristin Cornelius, Jennifer Cobbe, and Jatinder Singh.  Disclosure by design: Designing information disclosures to support meaningful transparency and accountability.  In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pages 679–690, 2022.
  * [186] Midas Nouwens, Rolf Bagge, Janus Bager Kristensen, and Clemens Nylandsted Klokmose.  Consent-o-matic: Automatically answering consent pop-ups using adversarial interoperability.  In CHI Conference on Human Factors in Computing Systems Extended Abstracts, pages 1–7, 2022.
  * [187] Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal.  Dark patterns after the GDPR: Scraping consent pop-ups and demonstrating their influence.  In CHI Conference on Human Factors in Computing Systems, pages 1–13, 2020.
  * [188] Sean O’Connor, Ryan Nurwono, Aden Siebel, and Eleanor Birrell.  (Un)clear and (In)conspicuous: The right to opt-out of sale under CCPA.  In Workshop on Privacy in the Electronic Society, pages 59–72, 2021\.
  * [189] Personal Data Protection Commission of Singapore.  Advisory guidelines on key concepts in the personal data protection act.  https://www.pdpc.gov.sg/guidelines-and-consultation/2020/03/advisory-guidelines-on-key-concepts-in-the-personal-data-protection-act.
  * [190] Junhyoung Oh, Jinhyoung Hong, Changsoo Lee, Jemin Justin Lee, Simon S Woo, and Kyungho Lee.  Will EU’s GDPR act as an effective enforcer to gain consent?  IEEE Access, 9:79477–79490, 2021.
  * [191] Haoran Ou, Yong Fang, Yongyan Guo, Wenbo Guo, and Cheng Huang.  Viopolicy-detector: An automated approach to detecting GDPR suspected compliance violations in websites.  In Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses, pages 409–430, 2022.
  * [192] Kentrell Owens, Anita Alem, Franziska Roesner, and Tadayoshi Kohno.  Electronic monitoring smartphone apps: An analysis of risks from technical, human-centered, and legal perspectives.  2022\.
  * [193] Harshvardhan J Pandit, Declan O’Sullivan, and Dave Lewis.  Queryable provenance metadata for GDPR compliance.  Procedia Computer Science, 137:262–268, 2018.
  * [194] Emmanouil Papadogiannakis, Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos P Markatos.  User tracking in the post-cookie era: How websites bypass GDPR consent to track users.  In The Web Conference, pages 2130–2141, 2021.
  * [195] James Pavur, Casey Knerr, and LTD Dionach.  Gdparrrrr: Using privacy laws to steal identities.  Blackhat, 2019.
  * [196] Justin Petelka, Elisa Oreglia, Megan Finn, and Janaki Srinivasan.  Generating practices: investigations into the double embedding of gdpr and data access policies.  Proceedings of the ACM on Human-Computer Interaction, 6(CSCW2):1–26, 2022.
  * [197] Luca Piras, Mohammed Ghazi Al-Obeidallah, Andrea Praitano, Aggeliki Tsohou, Haralambos Mouratidis, Beatriz Gallego-Nicasio Crespo, Jean Baptiste Bernard, Marco Fiorani, Emmanouil Magkos, Andres Castillo Sanz, et al.  DEFeND architecture: A privacy by design platform for GDPR compliance.  In International Conference on Trust and Privacy in Digital Business, pages 78–93, 2019.
  * [198] Eugenia Politou, Efthimios Alepis, and Constantinos Patsakis.  Forgetting personal data and revoking consent under the GDPR: Challenges and proposed solutions.  Journal of cybersecurity, 4(1):tyy001, 2018.
  * [199] Ayesha Qamar, Tehreem Javed, and Mirza Omer Beg.  Detecting compliance of privacy policies with data protection laws.  arXiv preprint arXiv:2102.12362, 2021.
  * [200] Tamjid Al Rahat, Tu Le, and Yuan Tian.  Automated detection of GDPR disclosure requirements in privacy policies using deep active learning.  arXiv preprint arXiv:2111.04224, 2021.
  * [201] Ali Rasaii, Shivani Singh, Devashish Gosain, and Oliver Gasser.  Exploring the cookieverse: A multi-perspective analysis of web cookies.  In International Conference on Passive and Active Network Measurement, pages 623–651. Springer, 2023.
  * [202] Philip Raschke, Axel Küpper, Olha Drozd, and Sabrina Kirrane.  Designing a GDPR-compliant and usable privacy dashboard.  In IFIP international summer school on privacy and identity management, pages 221–236, 2017.
  * [203] Abbas Razaghpanah, Rishab Nithyanand, Narseo Vallina-Rodriguez, Srikanth Sundaresan, Mark Allman, Christian Kreibich, Phillipa Gill, et al.  Apps, trackers, privacy, and regulators: A global study of the mobile tracking ecosystem.  In The 25th Annual Network and Distributed System Security Symposium, 2018.
  * [204] Ronak Razavisousan and Karuna P Joshi.  Analyzing GDPR compliance in cloud services’ privacy policies using textual fuzzy interpretive structural modeling (tfism).  In IEEE International Conference on Services Computing, pages 89–98, 2021.
  * [205] Joel Reardon, Álvaro Feal, Primal Wijesekera, Amit Elazari Bar On, Narseo Vallina-Rodriguez, and Serge Egelman.  50 ways to leak your data: An exploration of apps’ circumvention of the android permissions system.  In 28th USENIX Security Symposium, 2019.
  * [206] Jingjing Ren, Daniel J Dubois, David Choffnes, Anna Maria Mandalari, Roman Kolcun, and Hamed Haddadi.  Information exposure from consumer iot devices: A multidimensional, network-informed measurement approach.  In Proceedings of the Internet Measurement Conference, pages 267–279, 2019.
  * [207] Irwin Reyes, Primal Wijesekera, Joel Reardon, Amit Elazari Bar On, Abbas Razaghpanah, Narseo Vallina-Rodriguez, Serge Egelman, et al.  “Won’t somebody think of the children?” examining COPPA compliance at scale.  In The 18th Privacy Enhancing Technologies Symposium, 2018.
  * [208] Gerard Reynolds and Seamus Dowling.  An analysis of ireland’s homecare companies’ cookie practices in terms of gdpr compliance.  In 2022 Cyber Research Conference-Ireland (Cyber-RCI), pages 1–7. IEEE, 2022.
  * [209] Neil Richards and Woodrow Hartzog.  The pathologies of digital consent.  Wash. UL Rev., 96:1461, 2018.
  * [210] Paul Ryan, Rob Brennan, and Harshvardhan J Pandit.  Dpcat: Specification for an interoperable and machine-readable data processing catalogue based on GDPR.  Information, 13(5):244, 2022.
  * [211] Rahime Belen Sağlam, Çağri Burak Aslan, Shujun Li, Lisa Dickson, and Ganna Pogrebna.  A data-driven analysis of blockchain systems’ public online communications on GDPR.  In IEEE International Conference on Decentralized Applications and Infrastructures, pages 22–31, 2020.
  * [212] Nayanamana Samarasinghe, Aashish Adhikari, Mohammad Mannan, and Amr Youssef.  Et tu, brute? privacy analysis of government websites and mobile apps.  In Proceedings of the ACM Web Conference, pages 564–575, 2022.