Tech giants’ privacy policies falling short of GDPR

In BEUC’s study with researchers from the European University Institute in Florence, using artificial intelligence (AI) to help scan and analyse privacy policies, they analysed the privacy policies of 14 popular online companies taking GDPR requirements and the relevant European guidelines of data protection authorities as a basis.

The university researchers are training an automated evaluator of privacy policies, called ‘Claudette’ to scan companies’ privacy policies and detect clauses that potentially fail to meet GDPR requirements. 

The research suggested that one month after GDPR, the privacy policies of some of the biggest online services – including Facebook, Google and Amazon – leave much room for improvement, with none of the policies analysed fully meeting GDPR requirements.

In total, all the policies amounted to 3,659 sentences ( 80,398 words). Of these, 401 sentences ( 11%) were marked as containing unclear language, and 1,240 ( 33.9%) contained “potentially problematic” clauses or clauses providing “insufficient” information.

The identified problems included: not providing all the information which is required under the GDPR’s transparency obligations; processing of personal data not happening according to GDPR requirements; and policies formulated using vague and unclear language.

Monique Goyens, director general of The European Consumer Organisation, said: "A little over a month after the GDPR became applicable, many privacy policies may not meet the standard of the law. This is very concerning. It is key that enforcement authorities take a close look at this.

"This innovative research demonstrates that AI can also be used to keep companies in check and ensure people’s rights are respected. We are confident AI will be an asset for consumer groups to monitor the market and ensure infringements do not go unnoticed."