PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA
PrivAudit framework audits 998 websites for CCPA compliance, finding stronger disclosures but pervasive, weakly responsive third-party cookie tracking.
PrivAudit is an automated dual-lens auditing framework combining LLM-based analysis of privacy policies grounded in CCPA provisions with automated browser measurements of cookie writes under diverse privacy configurations. Applied to 998 websites, it finds CCPA-subject sites disclose opt-outs, data sharing, and user rights more frequently, yet tracking remains pervasive: 6,392 targeting cookies, 49% third-party writes. Cookies show limited-to-moderate responsiveness to privacy signals and consent choices even when sites claim to honor them. The framework is open-sourced and shared with regulators.