Tootfinder

Layered, Overlapping, and Inconsistent: A Large-Scale Analysis of the Multiple Privacy Policies and Controls of U.S. Banks
Lu Xian, Van Tran, Lauren Lee, Meera Kumar, Yichen Zhang, Florian Schaub
https://arxiv.org/abs/2507.05415

Layered, Overlapping, and Inconsistent: A Large-Scale Analysis of the Multiple Privacy Policies and Controls of U.S. Banks
Privacy policies are often complex. An exception is the two-page standardized notice that U.S. financial institutions must provide under the Gramm-Leach-Bliley Act (GLBA). However, banks now operate websites, mobile apps, and other services that involve complex data sharing practices that require additional privacy notices and do-not-sell opt-outs. We conducted a large-scale analysis of how U.S. banks implement privacy policies and controls in response to GLBA; other federal privacy policy requ…

Call for Nominations: 16th Annual Privacy Papers for Policymakers Awards
https://fpf.org/blog/call-for-nominations-16th-annual-privacy-papers-for-policymakers-awards/
@…

Evaluating the Efficacy of Large Language Models for Generating Fine-Grained Visual Privacy Policies in Homes
Shuning Zhang, Ying Ma, Xin Yi, Hewu Li
https://arxiv.org/abs/2508.00321

Evaluating the Efficacy of Large Language Models for Generating Fine-Grained Visual Privacy Policies in Homes
The proliferation of visual sensors in smart home environments, particularly through wearable devices like smart glasses, introduces profound privacy challenges. Existing privacy controls are often static and coarse-grained, failing to accommodate the dynamic and socially nuanced nature of home environments. This paper investigates the viability of using Large Language Models (LLMs) as the core of a dynamic and adaptive privacy policy engine. We propose a conceptual framework where visual data …

An LLM-enabled semantic-centric framework to consume privacy policies
Rui Zhao, Vladyslav Melnychuk, Jun Zhao, Jesse Wright, Nigel Shadbolt
https://arxiv.org/abs/2509.01716 http…

An LLM-enabled semantic-centric framework to consume privacy policies
In modern times, people have numerous online accounts, but they rarely read the Terms of Service or Privacy Policy of those sites, despite claiming otherwise, due to the practical difficulty in comprehending them. The mist of data privacy practices forms a major barrier for user-centred Web approaches, and for data sharing and reusing in an agentic world. Existing research proposed methods for using formal languages and reasoning for verifying the compliance of a specified policy, as a potentia…

Every day, some 2 billion people around the world use privacy-protection tools supported by the Open Technology Fund.
When people in China escape their government’s firewalls and censorship software
—now so dense that the system has been called the “locknet”
—or when users in Cuba or Myanmar evade cruder internet blocks,
they can access material written in their own languages and read stories they would otherwise never see.
Both the access and some of the informa…

America Surrenders in the Global Information Wars
The U.S. is reorienting its foreign policy to protect governments that manipulate and suppress information.

CPPA fines Tractor Supply Company $1.4 million for privacy violations https://therecord.media/ccpa-tractor-supply-privacy-fine

Seems like a good day to revisit this post about privacy-preserving age verification. (tl;dr -> you can't have it) https://www.techdirt.com/2025/08/19/privacy‑preserving-age-verification-falls-apart-on-contact-with…

Privacy‑Preserving Age Verification Falls Apart On Contact With Reality
Here we go again. Whenever policy makers insist that there’s some “nerd harder” solution to tricky societal problems, actual experts have to spend a ridiculous amount of time explaining basic reali…

Practical Takeaways from FPF’s Privacy Enhancing Technologies Workshop
https://fpf.org/blog/practical-takeaways-from-fpfs-privacy-enhancing-technologies-workshop/
@…

Let's Measure the Elephant in the Room: Facilitating Personalized Automated Analysis of Privacy Policies at Scale
Rui Zhao, Vladyslav Melnychuk, Jun Zhao, Jesse Wright, Nigel Shadbolt
https://arxiv.org/abs/2507.14214

Let's Measure the Elephant in the Room: Facilitating Personalized Automated Analysis of Privacy Policies at Scale
In modern times, people have numerous online accounts, but they rarely read the Terms of Service or Privacy Policy of those sites despite claiming otherwise. This paper introduces PoliAnalyzer, a neuro-symbolic system that assists users with personalized privacy policy analysis. PoliAnalyzer uses Natural Language Processing (NLP) to extract formal representations of data usage practices from policy texts. In favor of deterministic, logical inference is applied to compare user preferences with t…

Anthropic requires users to accept new terms by September 28, including choosing whether new chats and coding sessions can be used to train AI models (Anthropic)
https://www.anthropic.com/news/updates-to-our-consumer-terms

Updates to Consumer Terms and Privacy Policy
Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.

Of course I'm biased, but I really love how @… updated their users about the updated privacy policy:
«With this update, we want to strengthen your rights that you have as a user […] Codeberg is a non-profit association registered in Berlin. Unlike traditional online platforms, we have neither an interest in selling your data, nor do we have an incentive to do so.»
Sent along with a link to the PR that'll update the policy and another link to delete your account if you disagree. 💪

#Anthropic plant, künftig neue #Chatverläufe und #Codingsitzungen zur Verbesserung seiner KI-Modelle zu nutzen-
Nutzer müssen nicht aktiv widersprechen. Die

Anthropic will start training its AI models on chat transcripts
Anthropic will start training its AI models on user data, including chat transcripts and coding sessions, and extending its data retention policy to five years for active users — unless users choose to opt out.

Spotify Privacy Quick Guide (Asking for a Friend) https://musictechpolicy.com/2025/09/06/spotify-privacy-quick-guide-asking-for-a-friend/

Spotify Privacy Quick Guide (Asking for a Friend)
Spotify’s defaults trade convenience for exposure. This quick guide explains what Spotify collects, why recent policy changes matter, and the specific settings that curb public-by-default leaks, ad…

Policy-Driven AI in Dataspaces: Taxonomy, Explainability, and Pathways for Compliant Innovation
Joydeep Chandra, Satyam Kumar Navneet
https://arxiv.org/abs/2507.20014 https://…

Policy-Driven AI in Dataspaces: Taxonomy, Explainability, and Pathways for Compliant Innovation
As AI-driven dataspaces become integral to data sharing and collaborative analytics, ensuring privacy, performance, and policy compliance presents significant challenges. This paper provides a comprehensive review of privacy-preserving and policy-aware AI techniques, including Federated Learning, Differential Privacy, Trusted Execution Environments, Homomorphic Encryption, and Secure Multi-Party Computation, alongside strategies for aligning AI with regulatory frameworks such as GDPR and the EU…

Google will pay $30M to settle a class action lawsuit alleging it violated kids' privacy on YouTube by collecting data without parental consent for targeted ads (Jonathan Stempel/Reuters)
https://www.reuters.com/sustainability/boa

FTC fines toy manufacturer for allowing Chinese third-party to collect kid’s data https://therecord.media/chinese-toy-manufacturer-fine-ftc-kids-data

You mean it fed directly into this promotional video. Having taken part as an invited expert on privacy and tech at the EU Parliament, I’ve seen firsthand how the points we raised at our meeting were entirely absent from the plenary session that followed and how the politicians went with their usual talking points and policies.
It’s good optics, though, right?
You want us to believe this? Publish actual changes in policy and link them to the contents of this meeting.

Google will pay $30M to settle a class action lawsuit alleging it violated kids' privacy on YouTube by collecting data without parental consent for targeted ads (Jonathan Stempel/Reuters)
https://www.reuters.com/sustainability/boa

Conflect: Designing Reflective Thinking-Based Contextual Privacy Policy for Mobile Applications
Shuning Zhang, Sixing Tao, Eve He, Yuting Yang, Ying Ma, Ailei Wang, Xin Yi, Hewu Li
https://arxiv.org/abs/2509.12578

Conflect: Designing Reflective Thinking-Based Contextual Privacy Policy for Mobile Applications
Privacy policies are lengthy and complex, leading to user neglect. While contextual privacy policies (CPPs) present information at the point of risk, they may lack engagement and disrupt tasks. We propose Conflect, an interactive CPP for mobile apps, guided by a reflective thinking framework. Through three workshops with experienced designers and researchers, we constructed the design space of reflective thinking-based CPP design, and identified the disconnect between context and action as the …

Private, Verifiable, and Auditable AI Systems
Tobin South
https://arxiv.org/abs/2509.00085 https://arxiv.org/pdf/2509.00085

Private, Verifiable, and Auditable AI Systems
The growing societal reliance on artificial intelligence necessitates robust frameworks for ensuring its security, accountability, and trustworthiness. This thesis addresses the complex interplay between privacy, verifiability, and auditability in modern AI, particularly in foundation models. It argues that technical solutions that integrate these elements are critical for responsible AI innovation. Drawing from international policy contributions and technical research to identify key risks in …

Have you read the new Wetransfer's terms of service?
"In order to allow us to operate, provide you with, and improve the Service and our technologies, we must obtain from you certain rights related to Content that is covered by intellectual property rights. You hereby grant us royalty a-free license to use your Content for the purposes of operating, developing, and improving the Service, all in accordance with our Privacy & Cookie Policy. (...) You hereby grant other users…

Meta shareholders suing Mark Zuckerberg and Meta leaders over Facebook's Cambridge Analytica privacy violations reach a settlement deal, ending an $8B trial (Reuters)
https://www.reuters.com/sustainability/boa…

Highlights from FPF’s July 2025 Technologist Roundtable: AI Unlearning and Technical Guardrails
https://fpf.org/blog/highlights-from-fpfs-july-2025-technologist-roundtable-ai-unlearning-and-technical-guardrails/

A Lightweight Privacy-Preserving Smart Metering Billing Protocol with Dynamic Tariff Policy Adjustment
Farid Zaredar, Morteza Amini
https://arxiv.org/abs/2508.14815 https://

A Lightweight Privacy-Preserving Smart Metering Billing Protocol with Dynamic Tariff Policy Adjustment
The integration of information and communication technology (ICT) with traditional power grids has led to the emergence of smart grids. Advanced metering infrastructure (AMI) plays a crucial role in smart grids by facilitating two-way communication between smart meters and the utility provider. This bidirectional communication allows intelligent meters to report fine-grained consumption data at predefined intervals, enabling accurate billing, efficient grid monitoring and management, and rapid …