Privacy Washing: Detecting Internal Contradictions in Privacy Policies

Research has identified a phenomenon termed 'privacy washing' within privacy policies, where stated commitments are contradicted by other practices detailed within the same policy document. A four-stage analytical pipeline, employing natural language inference and multi-model verification, was used to detect these internal inconsistencies across two distinct corpora of website privacy policies. The study found consistent patterns of contradiction over an 11-year period, with third-party data sharing being the most frequently identified area of inconsistency.

Why it matters

The presence of internal contradictions in privacy policies poses significant risks to organizational credibility, consumer trust, and regulatory compliance. Organizations must address these inconsistencies to ensure transparency and uphold their stated data protection commitments, mitigating potential legal and reputational damage.

Key insights

• Privacy policies often contain internal contradictions, where commitments are undermined by other stated practices, a phenomenon termed 'privacy washing'.
• A four-stage analytical pipeline, utilizing statement extraction, compatibility filtering, natural language inference, and multi-model LLM verification, was developed to detect these contradictions.
• The methodology was applied to privacy policies collected in 2026 and 2015, revealing recurring categories of contradictions across the 11-year gap.
• Contradictions related to third-party data sharing represent the majority of confirmed cases in both analyzed corpora.
• The persistence of these contradiction patterns suggests an ongoing issue in policy drafting and adherence over time.

Source

arXiv — Computers and Society — https://arxiv.org/abs/2609.02055