arXiv:2601.20792cs.CYcs.CL2026-01被引 1

隐私政策的结构缺陷让非监管地区用户难以获取真实数据信息

Jurisdiction as Structural Barrier: How Privacy Policy Organization May Reduce Visibility of Substantive Disclosures

  • 将敏感信息藏在特定地区条款中,其他用户默认看不到
  • 审计发现77家大公司中有44%存在此类设计漏洞
  • 适合关注数字透明与监管公平的研究者和政策制定者

隐私政策本应提供清晰告知,但若关键信息仅出现在用户跳过的地区条款中,透明性便失效。我们识别出一种结构性模式:数据处理信息仅在标注‘加州居民’或‘欧盟/英国用户’的区域条款中以具体形式呈现,而通用部分则使用模糊表述。对123家主要公司的审计发现,77家公司中存在282个潜在实例(占62.6%);经与OPP-115人工标注验证的保守估计显示,54家公司存在138个实例(占比44%)。若用户按信息觅食理论跳过地区章节,则非受监管地区用户将无法获得影响自身权益的信息,这是一种由文档架构导致的透明度缺失。我们提出‘普遍实质性披露’原则:所有用户受影响的数据实践应在主政策中明确列出,区域条款仅保留程序性权利说明。该标准在证券、信贷透明度、营养标签等制度中已有先例。监管机构可借助FTC‘清晰醒目’标准与GDPR透明性原则推动实施。本研究为假设生成型工作,已证实该结构模式存在并结合行为理论建立透明度关切,但需进一步验证用户是否真会跳过地区章节。方法与标注数据集已公开供复现。

原文摘要 · Abstract (English)

Privacy policies are supposed to provide notice. But what if substantive information appears only where users skip it? We identify a structural pattern we call jurisdiction-siloed disclosure: information about data practices appearing in specific, actionable form only within regional compliance sections labeled "California Residents" or "EU/UK Users," while general sections use vague or qualified language for the same practices. Our audit of 123 major companies identifies 282 potential instances across 77 companies (62.6% of this purposive sample). A conservative estimate restricted to practice categories validated against OPP-115 human annotations finds 138 instances across 54 companies (44%); post-2018 categories central to our findings await independent validation. If users skip jurisdiction-labeled sections as information foraging theory predicts, users outside regulated jurisdictions would receive less specific information about practices affecting them--a transparency failure operating through document architecture rather than omission. We propose universal substantive disclosure: practices affecting all users should appear in the main policy body, with regional sections containing only procedural rights information. This standard finds support in analogous disclosure regimes (securities, truth-in-lending, nutritional labeling) where material information must reach all affected parties. Regulators could operationalize this through the FTC's "clear and conspicuous" standard and GDPR transparency principles. This work is hypothesis-generating: we establish that the structural pattern exists and ground the transparency concern in behavioral theory, but direct measurement of jurisdiction-specific section skipping remains the critical validation priority. We release our methodology and annotated dataset to enable replication.

隐私政策透明度数据治理合规设计

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。