mlsanityData to 7 Oct 2026

Jurisdiction as Structural Barrier: How Privacy Policy Organization May Reduce Visibility of Substantive Disclosures

arXiv 2601.20792 ↗First posted 28 Jan 2026cs.CY cs.CL cs.HCcited by 1

Not on the map. Why?

Abstract (arXiv)

Privacy policies are supposed to provide notice. But what if substantive information appears only where users skip it? We identify a structural pattern we call jurisdiction-siloed disclosure: information about data practices appearing in specific, actionable form only within regional compliance sections labeled "California Residents" or "EU/UK Users," while general sections use vague or qualified language for the same practices. Our audit of 123 major companies identifies 282 potential instances across 77 companies (62.6% of this purposive sample). A conservative estimate restricted to practice categories validated against OPP-115 human annotations finds 138 instances across 54 companies (44%); post-2018 categories central to our findings await independent validation. If users skip jurisdiction-labeled sections as information foraging theory predicts, users outside regulated jurisdictions would receive less specific information about practices affecting them--a transparency failure operating through document architecture rather than omission. We propose universal substantive disclosure: practices affecting all users should appear in the main policy body, with regional sections containing only procedural rights information. This standard finds support in analogous disclosure regimes (securities, truth-in-lending, nutritional labeling) where material information must reach all affected parties. Regulators could operationalize this through the FTC's "clear and conspicuous" standard and GDPR transparency principles. This work is hypothesis-generating: we establish that the structural pattern exists and ground the transparency concern in behavioral theory, but direct measurement of jurisdiction-specific section skipping remains the critical validation priority. We release our methodology and annotated dataset to enable replication.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 5 of its 50 references that are in the map. First posted on arXiv 28 Jan 2026.

Builds on

5 of 50 references.

References · 5

  1. 2023ChatGPT Outperforms Crowd-Workers for Text-Annotation Taskscited by 849
  2. 2018Polisis: Automated Analysis and Presentation of Privacy Policies Using Deep Learningcited by 50
  3. 2020Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influencecited by 27
  4. 2020Privacy at Scale: Introducing the PrivaSeer Corpus of Web Privacy Policiescited by 22
  5. 2019Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPRcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.