发表机构
Columbia University; New York University; University of Maine; Technical University of Munich（哥伦比亚大学; 纽约大学; 缅因大学; 慕尼黑工业大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本SoK从软件工程视角，系统分析2010-2025年290篇论文，梳理隐私文档全生命周期研究，识别趋势与开放机会，为相关研究提供统一基础。
AI 中文摘要
隐私文档（如隐私政策）是数字服务披露数据实践并获取用户同意的核心机制。过去数十年，隐私文档相关研究显著扩展，不仅涵盖传统隐私政策，还包含简短通知（如隐私标签）和界面级透明度机制。随着该研究领域持续发展，人们愈发难以清晰把握隐私文档在其生命周期内的创建、分析、评估与维护方式。本SoK从软件工程视角提供了面向生命周期的隐私文档统一视角，系统回顾并分析了2010年至2025年间发表的290篇论文，围绕五个研究问题组织内容，考察隐私文档如何被（1）定义与界定范围、（2）生成、（3）分析与提取、（4）检查不一致性与不合规性、（5）评估与改进可用性。基于研究发现，本研究识别出15项关键研究趋势和21个开放机会，进一步梳理出四个更广泛的研究方向，重点关注：（i）以AI为中心的平台面临的新兴挑战；（ii）对多样化且最新的数据基础的需求；（iii）基于大语言模型（LLM）的统一政策-代码分析；（iv）面向终端用户与开发者的双重可用性。本研究希望为未来隐私政策与隐私文档的相关研究提供共同基础。
英文摘要
Privacy documents (e.g., privacy policies) are a central mechanism through which digital services disclose data practices and seek user consent. Over the past decades, research on privacy documents has expanded significantly, encompassing not only traditional privacy policies but also short notices (e.g., privacy labels) and interface-level transparency mechanisms. As this research area continues to grow, it has become increasingly difficult to obtain a coherent view of how privacy documents are created, analyzed, evaluated, and maintained across their lifecycle. This SoK provides a unified, lifecycle-oriented view of privacy documents from a software engineering perspective. We systematically review and analyze 290 papers published between 2010 and 2025, organizing them around five research questions that examine how privacy documents are (1) defined and scoped, (2) generated, (3) analyzed and extracted, (4) checked for inconsistencies and noncompliance, and (5) evaluated and improved for usability. Building on our findings, we identify 15 key research trends and 21 open opportunities. We further chart four broader research directions that highlight (i) emerging challenges in AI-centric platforms, (ii) the need for diverse and up-to-date data foundations, (iii) LLM-based unified policy-code analysis, and (iv) dual usability for end-users and developers. We hope this SoK provides a shared foundation for future research on privacy policies and privacy documents.
CommentsThis SoK paper has been accepted by NDSS 2027
