Model(ing) Privacy: Empirical Approaches to Privacy Law & Governance

Abstract

Privacy can be difficult for people to conceptualize, including for the policymakers charged with designing, interpreting, and enforcing privacy law. In both consumer privacy law and Fourth Amendment jurisprudence, the privacy protections afforded to individuals are shaped by the ability of governmental decision-makers to assess privacy preferences, expectations and behaviors, which they are rarely in a position to do accurately. But while policymakers can have a hard time understanding the subtle factors influencing privacy decision-making or parsing seemingly contradictory privacy incentives, it is an area where new empirical approaches have begun to excel. Researchers have used empirical techniques like machine learning, natural language processing, and crowdsourcing to explain the complexities of privacy decision-making, and to illustrate the nuances of privacy preferences, expectations, and behaviors that many opinion surveys often fail to grasp. Recent work has focused on eliciting privacy norms through the use of crowdsourcing; modeling individual privacy preferences and expectations using machine learning; extracting necessary information from privacy policies through the use of natural language processing; modeling AI assistants based on context and user preferences to predict (or nudge) future user decisions; and creative combinations thereof. Modeling privacy preferences, expectations and behavior can provide judges, regulators, and legislators with a more accurate and nuanced sense of privacy norms for future cases and policy discussions. Encouraging the implementation of proactive privacy tools, such as automated annotation of privacy policies and nudging assistants, can help bridge the gap separating user expectations, user behavior, and how both are understood under existing laws. While the use of this research in privacy law and policy cannot fundamentally transform the structural flaws that skew regulators’ perceptions of societal norms, it can at least correct the worst of those excesses, and facilitate policy that reflects how people actually think about privacy in the modern age.