Transparency in Privacy Policies

Privacy policies are a fundamental concept of the General Data Protection Regulation (GDPR). A privacy policy informs the customers how the organization collects, uses, stores, and shares personal information, and which privacy rights exist. However, a privacy policy can only fulfill this purpose if it is transparent for the customer. In this paper, we analyze 534 privacy policies from the German Top-100 web shops over 7 years, starting in 2016. We want to find out whether changes in data protection regulations and related events had an impact on transparency in privacy policies. Furthermore, we want to compare our results with international findings. We define transparency as readability and discoverability of mandatory information. We observed that the GDPR has increased the length of German privacy policies, but also the discoverability of mandatory information. However, the GDPR has not made the policy texts easier to read. This is in line with international studies, that used a different approach to analyze transparency.