系统梳理隐私文档从生成到使用的全生命周期研究,助力构建可信数字服务透明机制。
SoK: From Generation to Consumption of Privacy Documents in Software Systems
- 按软件工程视角构建隐私文档全生命周期框架,涵盖定义、生成、分析等五个环节
- 综述290篇文献,提炼15大趋势与21个开放问题,揭示当前研究短板
- 聚焦AI平台新挑战,推动政策与代码协同分析,兼顾用户与开发者双重体验
隐私文档(如隐私政策)是数字服务披露数据实践并获取用户同意的核心机制。近年来研究范围已扩展至隐私标签、界面透明设计等新型形式。随着该领域持续发展,研究者难以把握隐私文档在创建、分析、评估和维护等环节的系统性脉络。本文通过系统性回顾2010至2025年间发表的290篇论文,围绕五个核心研究问题:(1)隐私文档的定义与范围,(2)生成方式,(3)内容分析与提取,(4)不一致性和合规性检测,(5)可用性评估与优化。在此基础上,识别出15项关键研究趋势与21个开放机遇,并提出四大前瞻性方向:(i)面向AI驱动平台的新挑战,(ii)构建多样化、实时更新的数据基础,(iii)基于大语言模型的统一政策-代码分析,(iv)同时支持终端用户与开发者的双重视觉可用性。本文旨在为未来隐私文档研究提供共享基础。
原文摘要 · Abstract (English)
Privacy documents (e.g., privacy policies) are a central mechanism through which digital services disclose data practices and seek user consent. Over the past decades, research on privacy documents has expanded significantly, encompassing not only traditional privacy policies but also short notices (e.g., privacy labels) and interface-level transparency mechanisms. As this research area continues to grow, it has become increasingly difficult to obtain a coherent view of how privacy documents are created, analyzed, evaluated, and maintained across their lifecycle. This SoK provides a unified, lifecycle-oriented view of privacy documents from a software engineering perspective. We systematically review and analyze 290 papers published between 2010 and 2025, organizing them around five research questions that examine how privacy documents are (1) defined and scoped, (2) generated, (3) analyzed and extracted, (4) checked for inconsistencies and noncompliance, and (5) evaluated and improved for usability. Building on our findings, we identify 15 key research trends and 21 open opportunities. We further chart four broader research directions that highlight (i) emerging challenges in AI-centric platforms, (ii) the need for diverse and up-to-date data foundations, (iii) LLM-based unified policy-code analysis, and (iv) dual usability for end-users and developers. We hope this SoK provides a shared foundation for future research on privacy policies and privacy documents.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。