Smart Privacy Policy Assistant: An LLM-Powered System for Transparent and Actionable Privacy Notices
Sriharshini Kalvakuntla, Luoxi Tang, Yuqiao Meng, Zhaohan Xi
TL;DR
The paper tackles the widespread gap between consent and understanding of online privacy policies by introducing the Smart Privacy Policy Assistant, an LLM-powered end-to-end pipeline that ingests policies, breaks them into clauses, and maps them to a structured privacy schema. It then computes a monotonic risk score and generates clause-grounded explanations, delivering real-time warnings via browser extensions and mobile interfaces to support informed decisions. Key contributions include an interpretable analysis framework, a clause-grounded risk scoring mechanism, and extensive evaluation including clause-level and user-centered assessments. The approach enables more transparent, actionable privacy notices with practical implications for user decision-making, while acknowledging limitations in legal nuance, potential misinterpretations, and deployment latency.
Abstract
Most users agree to online privacy policies without reading or understanding them, even though these documents govern how personal data is collected, shared, and monetized. Privacy policies are typically long, legally complex, and difficult for non-experts to interpret. This paper presents the Smart Privacy Policy Assistant, an LLM-powered system that automatically ingests privacy policies, extracts and categorizes key clauses, assigns human-interpretable risk levels, and generates clear, concise explanations. The system is designed for real-time use through browser extensions or mobile interfaces, surfacing contextual warnings before users disclose sensitive information or grant risky permissions. We describe the end-to-end pipeline, including policy ingestion, clause categorization, risk scoring, and explanation generation, and propose an evaluation framework based on clause-level accuracy, policy-level risk agreement, and user comprehension.