Systems and methods for managing privacy policy violations
The disclosed computer-implemented method for managing privacy policy violations may include obtaining, by the computing device, an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy. The method may also include comparing, by the computing device, behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy. The method may further include enforcing, by the computing device, the formal policy at least in part by taking a security action in response to the violation. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for managing privacy policy violations, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
obtaining, by the computing device, an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy, wherein the extracting includes:
(a) looking for a particular word on the website in one or more languages;
(b) following one or more links associated with the particular word;
(c) downloading one or more documents located at the one or more links;
(d) determining if the one or more documents look like privacy policies; and
(e) recursively following any links found in all of the one or more documents that look like privacy policies;
comparing, by the computing device, behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy; and
enforcing, by the computing device, the formal policy at least in part by taking a security action in response to the violation.
2. The method of claim 1 , wherein the security action includes denying one or more requests to add one or more networks if they are not listed in the privacy policy.
3. The method of claim 1 , wherein the security action includes notifying a user of the violation.
4. The method of claim 1 , wherein the security action includes creating an auto-filled form for a user to submit a complaint to a relevant regulatory body detailing the violation.
5. The method of claim 1 , wherein the security action includes hiding, from a third party not listed in the privacy policy, at least part of one or more requests, wherein the hiding includes hiding at least one of:
one or more user-agent strings;
one or more referrer strings;
one or more search queries in one or more Uniform Resource Locators (URLs); or
one or more portions of one or more payloads.
6. The method of claim 1 , wherein the computing device carries out the obtaining, comparing, and enforcing by enacting computer-readable instructions that are packaged as a browser extension.
7. The method of claim 1 , wherein the extracting includes attempting to identify a cookie banner.
8. The method of claim 7 , wherein the extracting further includes, in response to no privacy policy being found, providing a notification to a user and asking the user to find a privacy policy document on a webpage of the website.
9. The method of claim 1 , wherein the parsing employs at least one natural language processing technique that involves use of a classifier that determines whether a document contains a snippet related to a particular feature of interest.
10. A system for managing privacy policy violations, the system comprising:
at least one physical processor; and
physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:
obtain an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy, wherein the extracting includes:
(a) looking for a particular word on the website in one or more languages;
(b) following one or more links associated with the particular word;
(c) downloading one or more documents located at the one or more links;
(d) determining if the one or more documents look like privacy policies; and
(e) recursively following any links found in all of the one or more documents that look like privacy policies;
compare behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy; and
enforce the formal policy at least in part by taking a security action in response to the violation.
11. The system of claim 10 , wherein the security action includes denying one or more requests to add one or more networks if they are not listed in the privacy policy.
12. The system of claim 10 , wherein the security action includes notifying a user of the violation.
13. The system of claim 10 , wherein the security action includes creating an auto-filled form for a user to submit a complaint to a relevant regulatory body detailing the violation.
14. The system of claim 10 , wherein the security action includes hiding, from a third party not listed in the privacy policy, at least part of one or more requests, wherein the hiding includes hiding at least one of:
one or more user-agent strings;
one or more referrer strings;
one or more search queries in one or more Uniform Resource Locators (URLs); or
one or more portions of one or more payloads.
15. The system of claim 10 , wherein the computer-executable instructions are packaged as a browser extension.
16. The system of claim 10 , wherein the extracting includes attempting to identify a cookie banner.
17. The system of claim 16 , wherein the extracting includes, in response to no privacy policy being found, providing a notification to a user and asking the user to find a privacy policy document on a webpage of the website.
18. The system of claim 10 , wherein the parsing is performed by employing at least one natural language processing technique that involves use of a classifier that determines whether a document contains a snippet related to a particular feature of interest.
19. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
obtain an intermediate representation of a privacy policy, wherein the intermediate representation denotes a formal policy and is generated by extracting the privacy policy in natural language from a website and parsing the privacy policy, wherein the extracting include:
(a) looking for a particular word on the website in one or more languages;
(b) following one or more links associated with the particular word;
(c) downloading one or more documents located at the one or more links;
(d) determining if the one or more documents look like privacy policies; and
(e) recursively following any links found in all of the one or more documents that look like privacy policies;
compare behavior of the website against the intermediate representation, thereby detecting at least one violation of the formal policy; and
enforce the formal policy at least in part by taking a security action in response to the violation.
20. The non-transitory computer-readable medium of claim 19 , wherein the security action includes notifying a user of the violation.