Metraipolis › archive › dc_a2c4bc321bcc

PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA — arXiv:2609.09697

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.09697
License (as archived): CC0-1.0
Archived: 2026-10-16T07:54:39.906Z
SHA-256 of the archived text: d8f3366986fd21ccef2339bd4b08da1c2ee3d3529482bbc1eaf320387ca3dea5
Stable URL of this page: https://metraipolis.com/documento/dc_a2c4bc321bcc

How to cite

PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA — arXiv:2609.09697 — arXiv (en), https://arxiv.org/abs/2609.09697 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_a2c4bc321bcc (Metraipolis archive dc_a2c4bc321bcc, sha256 d8f3366986fd21ccef2339bd4b08da1c2ee3d3529482bbc1eaf320387ca3dea5)

BibTeX

@misc{dca2c4bc321bcc,
  title = {PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA — arXiv:2609.09697},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.09697},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_a2c4bc321bcc; sha256 d8f3366986fd21ccef2339bd4b08da1c2ee3d3529482bbc1eaf320387ca3dea5},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.09697. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Five years after the enforcement of the California Consumer Privacy Act (CCPA), understanding how website privacy practices evolve at scale in response to regulation remains a key challenge for both researchers and regulators. Prior work and regulatory efforts have focused on manual and case-specific enforcement, but there remain no scalable approaches to systematically audit two key user-facing facets of websites that are crucial signals for the CCPA: privacy disclosures and front-end user tracking behavior. In this paper, we present PrivAudit, an automated auditing framework that adopts a dual-lens approach to capture: (1) privacy disclosures through large language model-based analysis of privacy policies grounded in CCPA provisions, and (2) user-observable data collection behavior through automated browser measurements of cookie writes under diverse privacy configurations. We apply PrivAudit to 998 websites and report two broad findings. The law is associated with stronger privacy disclosures: CCPA-subject policies are more likely to disclose opt-out mechanisms, data-sharing practices, and user rights. On the other hand, cookie-based tracking remains pervasive, with both CCPA-subject and not-subject websites setting a total of 6,392 targeting cookies, 49% of which are third-party writes. Moreover, cookies show limited-to-moderate responsiveness to privacy signals and consent choices, even when websites claim to honor them in their disclosures. Our results highlight the need for multi-layered and scalable auditing approaches that combine policy analysis with behavioral evidence. PrivAudit can support these auditing workflows at scale by generating actionable signals and patterns for further manual review. We open-source PrivAudit and are engaging with regulators to support auditing in practice.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-10 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.09697 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-16T07:37:41.561Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-10?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).