PrivSTRUCT：解构Google Play Store隐私政策中数据用途的合规性
PrivSTRUCT: Untangling Data Purpose Compliance of Privacy Policies in Google Play Store
AI总结：
本文提出PrivSTRUCT框架，通过解构隐私政策结构化信息，提升数据用途提取的准确性，发现开发者在使用全局定义用途时，第一方数据用途虚报概率更高。
摘要：
现有研究通常将隐私政策视为扁平文本，提取信息时忽视文档的逻辑层次。忽视部分标题的结构提示，常导致自动方法将不同数据实践混淆，尤其在将敏感数据项与特定用途关联时。为解决此问题，我们引入PrivSTRUCT，一种新的编码器-解码器联合框架，用于解构复杂的隐私披露。与最先进的工具PoliGrapher基准测试显示，PrivSTRUCT能够提取超过两倍的数据项和用途摘录，同时保留开发者定义的结构提示。通过对3756个Android应用的大规模数据集应用PrivSTRUCT，我们发现关键透明性缺口：当开发者依赖全局定义用途而非特定本地披露时，第一方数据用途虚报概率比第三方共享高20.4%和9.7%。令人担忧的是，敏感的第三方数据流，如用于分析的财务数据，经常被稀释并混合到通用或无关类别中，凸显了当前用途披露领域的持续失败。
英文摘要：
Existing research typically treats privacy policies as flat, uniform text, extracting information without regard for the document's logical hierarchy. Disregard for structural cues of section headings designed to guide the reader, often leads automated methods to entangle distinct data practices, particularly when linking sensitive data items to their specific purposes. To address this, we introduce PrivSTRUCT, a novel and systematic encoder and decoder combined framework that to untangle complex privacy disclosures. Benchmarking against the state-of-the-art tool PoliGrapher reveals that PrivSTRUCT robustly extracts more than x2 the number of data item and purpose excerpts while retaining developer-defined structural cues. By applying PrivSTRUCT to a large-scale dataset of 3,756 Android apps, we uncover a critical transparency gap: the probability of developers overstating a data purpose is 20.4% higher for first-party collection and 9.7% higher for third-party sharing when they rely on globally defined purposes rather than specific, locally scoped disclosures. Alarmingly, we find that sensitive third-party data flows such as sharing financial data for analytics are frequently diluted and entangled into generic or unrelated categories, highlighting a persistent failure in the current purpose disclosure landscape.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
