PrivOnto: A semantic framework for the analysis of privacy policies

Issue title: The Semantic Web and Linked Data: Security, Privacy and Policy

Guest editors: Mathieu d’Aquin, Sabrina Kirrane and Serena Villata

Article type: Research Article

Authors: Oltramari, Alessandro^{a; *} | Piraviperumal, Dhivya^a | Schaub, Florian^b | Wilson, Shomir^c | Cherivirala, Sushain^a | Norton, Thomas B.^d | Russell, N. Cameron^d | Story, Peter^a | Reidenberg, Joel^d | Sadeh, Norman^a

Affiliations: [a] Carnegie Mellon University, 5000 Forbes Avenue, Pittsburgh, PA 15213, USA. E-mails: oltramale@gmail.com, sadeh@cs.cmu.edu | [b] University of Michigan School of Information, 105 S. State St., Ann Arbor, MI 48109, USA | [c] College of Engineering and Applied Science, University of Cincinnati, 2901 Woodside Drive, Cincinnati, OH 45221, USA | [d] Fordham University School of Law, New York, NY 10023, USA

Correspondence: [*] Corresponding author. E-mail: oltramale@gmail.com.

Abstract: Privacy policies are intended to inform users about the collection and use of their data by websites, mobile apps and other services or appliances they interact with. This also includes informing users about any choices they might have regarding such data practices. However, few users read these often long privacy policies; and those who do have difficulty understanding them, because they are written in convoluted and ambiguous language. A promising approach to help overcome this situation revolves around semi-automatically annotating policies, using combinations of crowdsourcing, machine learning and natural language processing. In this article, we introduce PrivOnto, a semantic framework to represent annotated privacy policies. PrivOnto relies on an ontology developed to represent issues identified as critical to users and/or legal experts. PrivOnto has been used to analyze a corpus of over 23,000 annotated data practices, extracted from 115 privacy policies of US-based companies. We introduce a collection of 57 SPARQL queries to extract information from the PrivOnto knowledge base, with the dual objective of (1) answering privacy questions of interest to users and (2) supporting researchers and regulators in the analysis of privacy policies at scale. We present an interactive online tool using PrivOnto to help users explore our corpus of 23,000 annotated data practices. Finally, we outline future research and open challenges in using semantic technologies for privacy policy analysis.

Keywords: Privacy policies, privacy technologies, ontology-based data access, SPARQL

DOI: 10.3233/SW-170283

Journal: Semantic Web, vol. 9, no. 2, pp. 185-203, 2018