# The Privacy Policy Landscape After the GDPR

arXiv: https://arxiv.org/abs/1809.08396 · HTML: https://mlsanity.com/paper/1809.08396/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Sep 2018.

## Built on by (most cited first, 18 of 18)

- [PolicyGPT: Automated Analysis of Privacy Policies with Large Language Models](https://mlsanity.com/paper/2309.10238/) (2023)
- [PolicyLR: A Logic Representation For Privacy Policies](https://mlsanity.com/paper/2408.14830/) (2024)
- [Privacy Policies Across the Ages: Content and Readability of Privacy Policies 1996--2021](https://mlsanity.com/paper/2201.08739/) (2022)
- [PrivComp-KG : Leveraging Knowledge Graph and Large Language Models for Privacy Policy Compliance Verification](https://mlsanity.com/paper/2404.19744/) (2024)
- [Entailment-Driven Privacy Policy Classification with LLMs](https://mlsanity.com/paper/2409.16621/) (2024)
- [A Longitudinal Measurement of Privacy Policy Evolution for Large Language Models](https://mlsanity.com/paper/2511.21758/) (2025)
- [More Data Types More Problems: A Temporal Analysis of Complexity, Stability, and Sensitivity in Privacy Policies](https://mlsanity.com/paper/2302.08936/) (2023)
- [Word-level Annotation of GDPR Transparency Compliance in Privacy Policies using Large Language Models](https://mlsanity.com/paper/2503.10727/) (2025)
- [Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact](https://mlsanity.com/paper/2510.05860/) (2025)
- [PrivPRISM: Automatically Detecting Discrepancies Between Google Play Data Safety Declarations and Developer Privacy Policies](https://mlsanity.com/paper/2603.09214/) (2026)
- [Detecting Compliance of Privacy Policies with Data Protection Laws](https://mlsanity.com/paper/2102.12362/) (2021)
- [Automated Detection of GDPR Disclosure Requirements in Privacy Policies using Deep Active Learning](https://mlsanity.com/paper/2111.04224/) (2021)
- [NL2GDPR: Automatically Develop GDPR Compliant Android Application Features from Natural Language](https://mlsanity.com/paper/2208.13361/) (2022)
- [FedCross: Intertemporal Federated Learning Under Evolutionary Games](https://mlsanity.com/paper/2412.16968/) (2024)
- [LADFA: A Framework of Using Large Language Models and Retrieval-Augmented Generation for Personal Data Flow Analysis in Privacy Policies](https://mlsanity.com/paper/2601.10413/) (2026)
- [PrivSTRUCT: Untangling Data Purpose Compliance of Privacy Policies in Google Play Store](https://mlsanity.com/paper/2604.22157/) (2026)
- [SoK: From Generation to Consumption of Privacy Documents in Software Systems](https://mlsanity.com/paper/2608.12511/) (2026)
- [Privacy Washing: Detecting Internal Contradictions in Privacy Policies](https://mlsanity.com/paper/2609.02055/) (2026)

## Abstract (arXiv)

The EU General Data Protection Regulation (GDPR) is one of the most demanding and comprehensive privacy regulations of all time. A year after it went into effect, we study its impact on the landscape of privacy policies online. We conduct the first longitudinal, in-depth, and at-scale assessment of privacy policies before and after the GDPR. We gauge the complete consumption cycle of these policies, from the first user impressions until the compliance assessment. We create a diverse corpus of two sets of 6,278 unique English-language privacy policies from inside and outside the EU, covering their pre-GDPR and the post-GDPR versions. The results of our tests and analyses suggest that the GDPR has been a catalyst for a major overhaul of the privacy policies inside and outside the EU. This overhaul of the policies, manifesting in extensive textual changes, especially for the EU-based websites, comes at mixed benefits to the users. While the privacy policies have become considerably longer, our user study with 470 participants on Amazon MTurk indicates a significant improvement in the visual representation of privacy policies from the users' perspective for the EU websites. We further develop a new workflow for the automated assessment of requirements in privacy policies. Using this workflow, we show that privacy policies cover more data practices and are more consistent with seven compliance requirements post the GDPR. We also assess how transparent the organizations are with their privacy practices by performing specificity analysis. In this analysis, we find evidence for positive changes triggered by the GDPR, with the specificity level improving on average. Still, we find the landscape of privacy policies to be in a transitional phase; many policies still do not meet several key GDPR requirements or their improved coverage comes with reduced specificity.