Search papers, labs, and topics across Lattice.
This systematic review analyzes 290 papers on privacy documents from 2010 to 2025, providing a comprehensive lifecycle-oriented perspective on their creation, analysis, evaluation, and maintenance. The study identifies 15 key research trends and 21 open opportunities, emphasizing the need for improved usability and compliance checks in privacy documentation. Key findings highlight emerging challenges in AI-centric platforms and propose directions for future research, including LLM-based policy analysis and dual usability considerations for both end-users and developers.
A unified framework reveals 15 critical trends and 21 unexplored opportunities in the lifecycle of privacy documents, spotlighting urgent challenges in AI-driven environments.
Privacy documents (e.g., privacy policies) are a central mechanism through which digital services disclose data practices and seek user consent. Over the past decades, research on privacy documents has expanded significantly, encompassing not only traditional privacy policies but also short notices (e.g., privacy labels) and interface-level transparency mechanisms. As this research area continues to grow, it has become increasingly difficult to obtain a coherent view of how privacy documents are created, analyzed, evaluated, and maintained across their lifecycle. This SoK provides a unified, lifecycle-oriented view of privacy documents from a software engineering perspective. We systematically review and analyze 290 papers published between 2010 and 2025, organizing them around five research questions that examine how privacy documents are (1) defined and scoped, (2) generated, (3) analyzed and extracted, (4) checked for inconsistencies and noncompliance, and (5) evaluated and improved for usability. Building on our findings, we identify 15 key research trends and 21 open opportunities. We further chart four broader research directions that highlight (i) emerging challenges in AI-centric platforms, (ii) the need for diverse and up-to-date data foundations, (iii) LLM-based unified policy-code analysis, and (iv) dual usability for end-users and developers. We hope this SoK provides a shared foundation for future research on privacy policies and privacy documents.
