# PrivacyAkinator: Articulating Key Privacy Design Decisions by Answering LLM-Generated Multiple-choice Questions

arXiv: https://arxiv.org/abs/2605.20206 · HTML: https://mlsanity.com/paper/2605.20206/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 23 of its 114 references that are in the map.
- First posted on arXiv 8 Apr 2026.

## Builds on (most cited first, 23 of 23)

- [RoBERTa: A Robustly Optimized BERT Pretraining Approach](https://mlsanity.com/paper/1907.11692/) (2019)
- [A Survey on Evaluation of Large Language Models](https://mlsanity.com/paper/2307.03109/) (2023)
- [A Survey on Recent Advances in LLM-Based Multi-turn Dialogue Systems](https://mlsanity.com/paper/2402.18013/) (2024)
- [Question Answering for Privacy Policies: Combining Computational and Legal Perspectives](https://mlsanity.com/paper/1911.00841/) (2019)
- [Polisis: Automated Analysis and Presentation of Privacy Policies Using Deep Learning](https://mlsanity.com/paper/1802.02561/) (2018)
- [CLEAR: Towards Contextual LLM-Empowered Privacy Policy Analysis and Risk Generation for Large Language Model Applications](https://mlsanity.com/paper/2410.13387/) (2024)
- [Using LLMs in Software Requirements Specifications: An Empirical Evaluation](https://mlsanity.com/paper/2404.17842/) (2024)
- [Goodbye Tracking? Impact of iOS App Tracking Transparency and Privacy Labels](https://mlsanity.com/paper/2204.03556/) (2022)
- [Empowering Users in Digital Privacy Management through Interactive LLM-Based Agents](https://mlsanity.com/paper/2410.11906/) (2024)
- [Augur: Mining Human Behaviors from Fiction to Power Interactive Systems](https://mlsanity.com/paper/1602.06977/) (2016)
- ["You don't need a university degree to comprehend data protection this way": LLM-Powered Interactive Privacy Policy Assessment](https://mlsanity.com/paper/2503.03587/) (2025)
- [Understanding How to Inform Blind and Low-Vision Users about Data Privacy through Privacy Question Answering Assistants](https://mlsanity.com/paper/2310.08687/) (2023)
- [Why developers cannot embed privacy into software systems? An empirical investigation](https://mlsanity.com/paper/1805.09485/) (2018)
- [I'm all Ears! Listening to Software Developers on Putting GDPR Principles into Software Development Practice](https://mlsanity.com/paper/2103.01371/) (2021)
- ["We are a startup to the core": A qualitative interview study on the security and privacy development practices in Turkish software startups](https://mlsanity.com/paper/2212.08396/) (2022)
- [Matcha: An IDE Plugin for Creating Accurate Privacy Nutrition Labels](https://mlsanity.com/paper/2402.03582/) (2024)
- [Privacy Impact Assessments in the Wild: A Scoping Review](https://mlsanity.com/paper/2402.11193/) (2024)
- [Technocracy, pseudoscience and performative compliance: the risks of privacy risk assessments. Lessons from NIST's Privacy Risk Assessment Methodology](https://mlsanity.com/paper/2310.05936/) (2023)
- [Automated Detection and Analysis of Data Practices Using A Real-World Corpus](https://mlsanity.com/paper/2402.11006/) (2024)
- [Analysis of LLMs vs Human Experts in Requirements Engineering](https://mlsanity.com/paper/2501.19297/) (2025)
- [Teaching Data Science Students to Sketch Privacy Designs through Heuristics (Extended Technical Report)](https://mlsanity.com/paper/2504.04734/) (2025)
- [SoK: Enhancing Privacy-Preserving Software Development from a Developers' Perspective](https://mlsanity.com/paper/2504.20350/) (2025)
- [Zero Data Retention in LLM-based Enterprise AI Assistants: A Comparative Study of Market Leading Agentic AI Products](https://mlsanity.com/paper/2510.11558/) (2025)

## Abstract (arXiv)

NIST's Privacy Risk Assessment Methodology (PRAM) provides a structured framework for privacy experts to assess privacy risks. However, its complexity and reliance on expert knowledge make it difficult for novice developers to use effectively. This paper explores methods to lower these barriers. We first performed an observational study with 12 participants using PRAM in real-world scenarios, and found that novice developers struggled most with articulating privacy-related design decisions. We then developed PrivacyAkinator, an interactive tool that helps developers articulate key privacy decisions by answering LLM-generated multiple-choice questions. PrivacyAkinator introduces three innovations: a universal privacy representation that abstracts privacy-related design decisions into data flows and stakeholder interactions; a domain-aware design space mined from 10K privacy-related news articles; and a dynamic question-generation workflow to prioritize relevant questions. Our user study with 24 participants suggests that developers using PrivacyAkinator identified 47% more key decisions in 73% less time compared to PRAM.