A comprehensive keyword analysis of online privacy policies. Issue 5 (2nd November 2018)

• Record Type: Journal Article
• Authors: Kaur, Jasmin; Dara, Rozita A.; Obimbo, Charlie; Song, Fei; Menard, Karen
• Is Part Of: Information security journal. Volume 27:Issue 5/6(2018)
• Page Start: 260
• Page End: 275
• Publication Date: 2018-11-02
• Subjects: Privacy policies -- topic modelling -- keyword analysis -- regulations -- seed keywords; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1080/19393555.2019.1606368
• Languages: English
• ISSNs: 1939-3555

Abstract

ABSTRACT: Online privacy policies are known to have inconsistent formats and incomplete content. They are also hard to understand and do not effectively help individuals to make decisions about the data practices of the online service providers. Several studies have focused on the deficiencies of privacy policies such as length and readability. However, a very limited number of studies have explored the content of privacy policies. This paper aims to shed some lights on the content of these legal documents. To this end, we performed a comprehensive analysis of keywords and content of over 2000 online policies. Policies were collected from variety of websites, application domains, and regulatory regimes. Topic modeling algorithms, such as Latent Dirichlet Allocation, were used for topic coverage analysis. This study also measured the coverage of ambiguous words in privacy policies. Lastly, a method was used to evaluate keyword similarity between privacy policies which belonged to different regulatory framework or applications. The findings suggested that regulations have an impact on the selection of terminologies used in the privacy policies. The results also suggested that European policies use fewer ambiguous words but use more words such as cookie and compliance with the regional regulations. We also observed that the seed keywords extracted for each section of privacy policies were consistently used in all policies regardless of the application domain and regulations.