Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper explores the use of large language models (LLMs) to conduct automated privacy policy audits across multiple languages, addressing the limitations of existing English-centric auditing pipelines. By assembling a corpus of privacy policies from all 24 official EU languages and validating translation fidelity, the authors demonstrate that their LLM-based classifier can effectively identify categories of personal data collection with high cross-lingual performance. The study reveals significant discrepancies in privacy policy transparency between public-sector and commercial apps, highlighting the critical need for multilingual auditing to uncover transparency gaps in diverse digital ecosystems.
English-only privacy audits mask significant transparency gaps in multilingual app ecosystems, as revealed by a large-scale analysis of Spanish mobile applications.
Automated analyses of privacy policies enable large-scale assessments of transparency in digital ecosystems, yet existing auditing pipelines remain predominantly English-centric. This limits their ability to systematically evaluate multilingual environments, as in the European Union, where many services disclose privacy practices only in local languages. This paper examines whether large language models (LLMs) can extend privacy policy analysis beyond English without requiring language-specific adaptation, thus empowering large-scale auditing in linguistically diverse app ecosystems. We assemble an evaluation corpus spanning all 24 official EU languages from translated versions of two established expert-annotated datasets (OPP-115 and MAPP) and assess translation fidelity through automated metrics and targeted legal-expert review. Our LLM-based classifier for identifying categories of personal data collection achieves stable cross-lingual performance, with macro-F1 scores ranging between 0.91 and 0.94. We then leverage this capability in a large-scale audit of 2,611 Android applications from the Spanish Google Play Store. Combining multilingual privacy policy analysis with the evaluation of corresponding privacy labels and runtime network traffic exposes an important linguistic barrier: public-sector apps predominantly provide privacy policies in Spanish, whereas popular commercial apps mostly provide them in English. We reveal systematic discrepancies between declared and observed practices, especially in public-sector apps. Overall, our results indicate how English-only privacy audits can systematically obfuscate transparency gaps in multilingual environments.