Network privacy policy scoring
A user of a client device accesses a service provided by a server computer. The server computer gathers data about the user. The data gathered may be kept private by the server computer, shared only with other computers and users owned by the same entity, shared with selected third parties, or made public. The server computer provides a privacy policy document that describes how the data gathered is used. A privacy server analyzes the privacy policy document and, based on the analysis, generates a privacy score. The privacy score or an informational message selected based on the privacy score are provided to the client device. In response, the client device presents the privacy score or the informational message to the user. In this way, the user is informed of privacy risks that result from accessing the server computer.
1. A method comprising:
receiving, by a server and from a client device, a uniform resource locator (URL) of a web site accessed by the client device;
accessing, by the server, text describing a privacy policy associated with the URL;
identifying, by the server, a set of phrases within the text, each phrase of the set of phrases having a corresponding score component;
determining, by the server, based on the score components corresponding to the phrases of the set of phrases, a score for the privacy policy, the score components comprising a score component for data protection; and
based on the score for the privacy policy and a comparison to a predetermined reference, causing an informational message to be presented on a display device associated with the client device, wherein the causing of the informational message to be displayed on the display device comprises sending the score for the privacy policy to a browser plug-in running on the client device.
2. The method of claim 1 , wherein the determining of the score for the privacy policy comprises using a trained machine learning model.
3. The method of claim 1 , wherein the score components comprise a score component for data ownership.
4. The method of claim 3 , wherein the score component for data protection is based on an indication of General Data Protection Regulation (GDPR) compliance.
5. The method of claim 3 , wherein the score component for data protection is based on an indication of rights to users to control gathered data.
6. The method of claim 1 , wherein the score components comprise a score component for data disclosure.
7. The method of claim 1 , wherein the score components comprise a score component for data sale.
8. The method of claim 1 , wherein the causing of the informational message to be displayed on the display device is further based on one of the score components and a second predetermined reference.
9. The method of claim 1 , wherein the score component for data protection is based on whether the web site stores client data in publicly accessible files.
10. The method of claim 1 , wherein the score component for data protection is based on whether the web site stores client data in publicly editable files.
11. The method of claim 1 , wherein the score component for data protection is based on whether client data is stored on a device with up-to-date software.
12. The method of claim 1 , wherein the score component for data protection is based on whether client data is stored in a device that is not directly accessible from the public internet.
13. A system comprising:
a memory that stores instructions; and
one or more processors configured by the instructions to perform operations comprising:
receiving, from a client device, a uniform resource locator (URL) of a web site accessed by the client device;
accessing text describing a privacy policy associated with the URL;
identifying a set of phrases within the text, each phrase of the set of phrases having a corresponding score component;
determining, based on the score components corresponding to the phrases of the set of phrases, a score for the privacy policy, the score components comprising a score component for data protection; and
based on the score for the privacy policy and a comparison to a predetermined reference, causing an informational message to be presented on a display device associated with the client device.
14. The system of claim 13 , wherein the determining of the score for the privacy policy comprises using a trained machine learning model.
15. The system of claim 13 , wherein the score components comprise a score component for data ownership.
16. The system of claim 13 , wherein the score components comprise a score component for data use.
17. The system of claim 13 , wherein the score components comprise a score component for data disclosure.
18. A non-transitory machine-readable medium that stores instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving, from a client device, a uniform resource locator (URL) of a web site accessed by the client device;
accessing text describing a privacy policy associated with the URL;
identifying a set of phrases within the text, each phrase of the set of phrases having a corresponding score component;
determining, based on the score components corresponding to the phrases of the set of phrases, a score for the privacy policy, the score components comprising a score component for data protection; and
based on the score for the privacy policy and a comparison to a predetermined reference, causing an informational message to be presented on a display device associated with the client device.
19. The non-transitory machine-readable medium of claim 18 , wherein the determining of the score for the privacy policy comprises using a trained machine learning model.