# PoliGraph: Automated Privacy Policy Analysis using Knowledge Graphs (Journal Version)

arXiv: https://arxiv.org/abs/2210.06746 · HTML: https://mlsanity.com/paper/2210.06746/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Oct 2022.

## Built on by (most cited first, 10 of 10)

- [Privacy Policy Analysis through Prompt Engineering for LLMs](https://mlsanity.com/paper/2409.14879/) (2024)
- [PolicyLR: A Logic Representation For Privacy Policies](https://mlsanity.com/paper/2408.14830/) (2024)
- [A Longitudinal Measurement of Privacy Policy Evolution for Large Language Models](https://mlsanity.com/paper/2511.21758/) (2025)
- [PrivPRISM: Automatically Detecting Discrepancies Between Google Play Data Safety Declarations and Developer Privacy Policies](https://mlsanity.com/paper/2603.09214/) (2026)
- [Unveiling Privacy Policy Complexity: An Exploratory Study Using Graph Mining, Machine Learning, and Natural Language Processing](https://mlsanity.com/paper/2507.02968/) (2025)
- [An LLM-enabled semantic-centric framework to consume privacy policies](https://mlsanity.com/paper/2509.01716/) (2025)
- [PrivSTRUCT: Untangling Data Purpose Compliance of Privacy Policies in Google Play Store](https://mlsanity.com/paper/2604.22157/) (2026)
- [A Systematic Evaluation of Traditional Privacy Policy Analysis Tools Against LLMs](https://mlsanity.com/paper/2607.17075/) (2026)
- [SoK: From Generation to Consumption of Privacy Documents in Software Systems](https://mlsanity.com/paper/2608.12511/) (2026)
- [Privacy Washing: Detecting Internal Contradictions in Privacy Policies](https://mlsanity.com/paper/2609.02055/) (2026)

## Abstract (arXiv)

Privacy policies disclose how an organization collects and handles personal information. Recent work has made progress in leveraging natural language processing (NLP) to automate privacy policy analysis and extract data collection statements from different sentences, considered in isolation from each other. In this paper, we view and analyze, for the first time, the entire text of a privacy policy in an integrated way. In terms of methodology: (1) we define PoliGraph, a type of knowledge graph that captures statements in a policy as relations between different parts of the text; and (2) we revisit the notion of ontologies, previously defined in heuristic ways, to capture subsumption relations between terms. We make a clear distinction between local and global ontologies to capture the context of individual policies, application domains, and privacy laws. We develop PoliGrapher, an NLP tool to automatically extract PoliGraph from the text using linguistic analysis. Using a public dataset for evaluation, we show that PoliGrapher identifies 40% more collection statements than prior state-of-the-art, with 97% precision. In terms of applications, PoliGraph enables automated analysis of a corpus of policies and allows us to: (1) reveal common patterns in the texts across different policies, and (2) assess the correctness of the terms as defined within a policy. We also apply PoliGraph to: (3) detect contradictions in a policy, where we show false alarms by prior work, and (4) analyze the consistency of policies and network traffic, where we identify significantly more clear disclosures than prior work. Finally, leveraging the capabilities of the emerging large language models (LLMs), we also present PoliGrapher-LM, a tool that uses LLM prompting instead of NLP linguistic analysis, to extract PoliGraph from the policy text, and we show that it further improves coverage.