PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA
PrivAudit framework audits 998 websites for CCPA compliance, finding stronger disclosures but pervasive, weakly responsive third-party cookie tracking.
PrivAudit is an automated dual-lens auditing framework combining LLM-based analysis of privacy policies grounded in CCPA provisions with automated browser measurements of cookie writes under diverse privacy configurations. Applied to 998 websites, it finds CCPA-subject sites disclose opt-outs, data sharing, and user rights more frequently, yet tracking remains pervasive: 6,392 targeting cookies, 49% third-party writes. Cookies show limited-to-moderate responsiveness to privacy signals and consent choices even when sites claim to honor them. The framework is open-sourced and shared with regulators.
- Dual-lens: LLM policy analysis plus browser cookie measurement
- Audited 998 websites; observed 6,392 targeting cookies
- 49% of cookie writes are third-party
- Cookies respond weakly to privacy signals despite disclosures
- Open-sourced and used in regulator engagement
- Products
- PrivAudit
- Countries
- California
From the original article
1 min read at arxiv.orgFive years after the enforcement of the California Consumer Privacy Act (CCPA), understanding how website privacy practices evolve at scale in response to regulation remains a key challenge for both researchers and regulators.
By Mohamed Moustafa Dawoud · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.