The OPP-115 Corpus of annotated privacy policies was released by the Usable Privacy Policy Project in 2016 and was the first large-scale effort to annotate privacy policies in a fine level of detail. Since then, it has been used by natural language processing (NLP) researchers working on automated analysis of websites’ and applications privacy policy documents, with efforts continuing in the present day. We share reflections on design decisions that went into the creation of the corpus and lessons learned from obstacles associated with it. Additionally, we describe open problems in research on privacy documents that the OPP-115 Corpus introduced or brought attention toward. These open problems show the continuing need for research on privacy policy text to support consumers’ digital privacy.

Privacy policies are crucial for informing users about data practices, yet their length and complexity often deter users from reading them. In this paper, we propose an automated approach to identify and visualize data practices within privacy policies at different levels of detail. Leveraging crowd-sourced annotations from the ToS;DR platform, we experiment with various methods to match policy excerpts with predefined data practice descriptions. We further conduct a case study to evaluate our approach on a real-world policy, demonstrating its effectiveness in simplifying complex policies. Experiments show that our approach accurately matches data practice descriptions with policy excerpts, facilitating the presentation of simplified privacy information to users.

Websites’ and mobile apps’ privacy policies, written in natural language, tend to be long and difficult to understand. Information privacy revolves around the fundamental principle of Notice and choice, namely the idea that users should be able to make informed decisions about what information about them can be collected and how it can be used. Internet users want control over their privacy, but their choices are often hidden in long and convoluted privacy policy texts. Moreover, little (if any) prior work has been done to detect the provision of choices in text. We address this challenge of enabling user choice by automatically identifying and extracting pertinent choice language in privacy policies. In particular, we present a two-stage architecture of classification models to identify opt-out choices in privacy policy text, labelling common varieties of choices with a mean F1 score of 0.735. Our techniques enable the creation of systems to help Internet users to learn about their choices, thereby effectuating notice and choice and improving Internet privacy.