# Privacy Policies Across the Ages: Content and Readability of Privacy Policies 1996--2021

arXiv: https://arxiv.org/abs/2201.08739 · HTML: https://mlsanity.com/paper/2201.08739/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 48 references that are in the map.
- First posted on arXiv 21 Jan 2022.

## Builds on (most cited first, 5 of 5)

- [Polisis: Automated Analysis and Presentation of Privacy Policies Using Deep Learning](https://mlsanity.com/paper/1802.02561/) (2018)
- [Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset](https://mlsanity.com/paper/2008.09159/) (2020)
- [The Privacy Policy Landscape After the GDPR](https://mlsanity.com/paper/1809.08396/) (2018)
- [We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy](https://mlsanity.com/paper/1808.05096/) (2018)
- [An Automated Approach to Auditing Disclosure of Third-Party Data Collection in Website Privacy Policies](https://mlsanity.com/paper/1805.01187/) (2018)

## Built on by (most cited first, 2 of 2)

- [Automating Governing Knowledge Commons and Contextual Integrity (GKC-CI) Privacy Policy Annotations with Large Language Models](https://mlsanity.com/paper/2311.02192/) (2023)
- [PolicyLR: A Logic Representation For Privacy Policies](https://mlsanity.com/paper/2408.14830/) (2024)

## Abstract (arXiv)

It is well-known that most users do not read privacy policies, but almost all users tick the box to agree with them. In this paper, we analyze the 25-year history of privacy policies using methods from transparency research, machine learning, and natural language processing. Specifically, we collect a large-scale longitudinal corpus of privacy policies from 1996 to 2021 and analyze the length and readability of privacy policies as well as their content in terms of the data practices they describe, the rights they grant to users, and the rights they reserve for their organizations. We pay particular attention to changes in response to recent privacy regulations such as the GDPR and CCPA. Our results show that policies are getting longer and harder to read, especially after new regulations take effect, and we find a range of concerning data practices. Our results allow us to speculate why privacy policies are rarely read and propose changes that would make privacy policies serve their readers instead of their writers.