# Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset

arXiv: https://arxiv.org/abs/2008.09159 · HTML: https://mlsanity.com/paper/2008.09159/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Aug 2020.

## Built on by (most cited first, 28 of 28)

- [PolicyGPT: Automated Analysis of Privacy Policies with Large Language Models](https://mlsanity.com/paper/2309.10238/) (2023)
- [Bringing order into the realm of Transformer-based language models for artificial intelligence and law](https://mlsanity.com/paper/2308.05502/) (2023)
- [A Comprehensive Survey on Legal Summarization: Challenges and Future Directions](https://mlsanity.com/paper/2501.17830/) (2025)
- [PLUE: Language Understanding Evaluation Benchmark for Privacy Policies in English](https://mlsanity.com/paper/2212.10011/) (2022)
- [Users are the North Star for AI Transparency](https://mlsanity.com/paper/2303.05500/) (2023)
- [Benchmarking LLM Privacy Recognition for Social Robot Decision Making](https://mlsanity.com/paper/2507.16124/) (2025)
- [Creation and Analysis of an International Corpus of Privacy Laws](https://mlsanity.com/paper/2206.14169/) (2022)
- [Automating Governing Knowledge Commons and Contextual Integrity (GKC-CI) Privacy Policy Annotations with Large Language Models](https://mlsanity.com/paper/2311.02192/) (2023)
- [PolicyLR: A Logic Representation For Privacy Policies](https://mlsanity.com/paper/2408.14830/) (2024)
- [HARPO: Learning to Subvert Online Behavioral Advertising](https://mlsanity.com/paper/2111.05792/) (2021)
- [Privacy Policies Across the Ages: Content and Readability of Privacy Policies 1996--2021](https://mlsanity.com/paper/2201.08739/) (2022)
- [EROS: Entity-Driven Controlled Policy Document Summarization](https://mlsanity.com/paper/2403.00141/) (2024)
- [Entailment-Driven Privacy Policy Classification with LLMs](https://mlsanity.com/paper/2409.16621/) (2024)
- [A Multi-Agent Framework for Mitigating Dialect Biases in Privacy Policy Question-Answering Systems](https://mlsanity.com/paper/2506.02998/) (2025)
- [A Longitudinal Measurement of Privacy Policy Evolution for Large Language Models](https://mlsanity.com/paper/2511.21758/) (2025)
- [Regulatory gray areas of LLM Terms](https://mlsanity.com/paper/2601.08415/) (2026)
- [More Data Types More Problems: A Temporal Analysis of Complexity, Stability, and Sensitivity in Privacy Policies](https://mlsanity.com/paper/2302.08936/) (2023)
- [C3PA: An Open Dataset of Expert-Annotated and Regulation-Aware Privacy Policies to Enable Scalable Regulatory Compliance Audits](https://mlsanity.com/paper/2410.03925/) (2024)
- [Let's Measure the Elephant in the Room: Facilitating Personalized Automated Analysis of Privacy Policies at Scale](https://mlsanity.com/paper/2507.14214/) (2025)
- [Overcoming Language Barriers: Multilingual Analysis of the 2023 Swiss Privacy Law's Impact](https://mlsanity.com/paper/2510.05860/) (2025)
- [PrivPRISM: Automatically Detecting Discrepancies Between Google Play Data Safety Declarations and Developer Privacy Policies](https://mlsanity.com/paper/2603.09214/) (2026)
- [Demystifying Legalese: An Automated Approach for Summarizing and Analyzing Overlaps in Privacy Policies and Terms of Service](https://mlsanity.com/paper/2404.13087/) (2024)
- [An LLM-enabled semantic-centric framework to consume privacy policies](https://mlsanity.com/paper/2509.01716/) (2025)
- [PrivSTRUCT: Untangling Data Purpose Compliance of Privacy Policies in Google Play Store](https://mlsanity.com/paper/2604.22157/) (2026)
- [Enabling Multilingual Privacy Policy Audits: Large-Scale Analysis of Spanish Mobile Apps](https://mlsanity.com/paper/2607.18424/) (2026)
- [SoK: From Generation to Consumption of Privacy Documents in Software Systems](https://mlsanity.com/paper/2608.12511/) (2026)
- [Privacy Washing: Detecting Internal Contradictions in Privacy Policies](https://mlsanity.com/paper/2609.02055/) (2026)
- [Silent Revision: Measuring Undisclosed Change in the Safety Frameworks of Frontier AI Developers](https://mlsanity.com/paper/2609.08789/) (2026)

## Abstract (arXiv)

Automated analysis of privacy policies has proved a fruitful research direction, with developments such as automated policy summarization, question answering systems, and compliance detection. Prior research has been limited to analysis of privacy policies from a single point in time or from short spans of time, as researchers did not have access to a large-scale, longitudinal, curated dataset. To address this gap, we developed a crawler that discovers, downloads, and extracts archived privacy policies from the Internet Archive's Wayback Machine. Using the crawler and following a series of validation and quality control steps, we curated a dataset of 1,071,488 English language privacy policies, spanning over two decades and over 130,000 distinct websites. Our analyses of the data paint a troubling picture of the transparency and accessibility of privacy policies. By comparing the occurrence of tracking-related terminology in our dataset to prior web privacy measurements, we find that privacy policies have consistently failed to disclose the presence of common tracking technologies and third parties. We also find that over the last twenty years privacy policies have become even more difficult to read, doubling in length and increasing a full grade in the median reading level. Our data indicate that self-regulation for first-party websites has stagnated, while self-regulation for third parties has increased but is dominated by online advertising trade associations. Finally, we contribute to the literature on privacy regulation by demonstrating the historic impact of the GDPR on privacy policies.