Jurisdiction as Structural Barrier: How Privacy Policy Organization May Reduce Visibility of Substantive Disclosures
Not on the map. Why?
Abstract (arXiv)
Privacy policies are supposed to provide notice. But what if substantive information appears only where users skip it? We identify a structural pattern we call jurisdiction-siloed disclosure: information about data practices appearing in specific, actionable form only within regional compliance sections labeled "California Residents" or "EU/UK Users," while general sections use vague or qualified language for the same practices. Our audit of 123 major companies identifies 282 potential instances across 77 companies (62.6% of this purposive sample). A conservative estimate restricted to practice categories validated against OPP-115 human annotations finds 138 instances across 54 companies (44%); post-2018 categories central to our findings await independent validation. If users skip jurisdiction-labeled sections as information foraging theory predicts, users outside regulated jurisdictions would receive less specific information about practices affecting them--a transparency failure operating through document architecture rather than omission. We propose universal substantive disclosure: practices affecting all users should appear in the main policy body, with regional sections containing only procedural rights information. This standard finds support in analogous disclosure regimes (securities, truth-in-lending, nutritional labeling) where material information must reach all affected parties. Regulators could operationalize this through the FTC's "clear and conspicuous" standard and GDPR transparency principles. This work is hypothesis-generating: we establish that the structural pattern exists and ground the transparency concern in behavioral theory, but direct measurement of jurisdiction-specific section skipping remains the critical validation priority. We release our methodology and annotated dataset to enable replication.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 5 of its 50 references that are in the map. First posted on arXiv 28 Jan 2026.
Builds on
5 of 50 references.
References · 5
- 2023ChatGPT Outperforms Crowd-Workers for Text-Annotation Taskscited by 849
- 2018Polisis: Automated Analysis and Presentation of Privacy Policies Using Deep Learningcited by 50
- 2020Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influencecited by 27
- 2020Privacy at Scale: Introducing the PrivaSeer Corpus of Web Privacy Policiescited by 22
- 2019Multiple Purposes, Multiple Problems: A User Study of Consent Dialogs after GDPRcited by 6
Built on by
Citing papers per year: 2026: 1.
1 paper.