Policymakers enact and revise privacy laws expecting meaningful benefits for their people in practice. While scholarship has measured the real-world impact of some privacy regulations—the EU and California most notably—limited empirical evidence exists for many of the more than 140 countries that have implemented some form of privacy legislation. Switzerland, a multilingual country bordered almost entirely by EU states, is one such example. This paper analyzes the extent to which a 2023 alignment of Swiss privacy law with EU privacy regulation affected website privacy policies in Switzerland. To address Switzerland's unique multilingual culture, we develop an LLM-based pipeline that extracts legally relevant information as document-level labels in a single inference without requiring translation. On a benchmark of 120 expert-annotated privacy policies in German, French, Italian, and English, our pipeline achieves F1 scores above 0.90 for most pairs of languages and legally relevant disclosures. Applying this pipeline to privacy policies we collected from more than 35,000 Swiss- and EU-facing websites before and after the 2023 privacy law revision, we find significant increases in both mandatory and voluntary disclosures of data subject rights among Swiss privacy policies. In exploring the mechanisms driving increased disclosure rates, we discover heavy use of automated privacy policy generators and find that generated policies are associated with up to 15 percentage points higher disclosure rates. These results provide large-scale empirical evidence of how regulatory change and novel drafting technologies impact the content of privacy policies in a unique multilingual environment.

Previous studies have demonstrated that privacy issues in mobile apps often stem from the integration of third-party libraries (TPLs). To shed light on factors that contribute to these issues, we investigate the privacy-related configuration choices available to and made by Android app developers who incorporate the Facebook Android SDK and Facebook Audience Network SDK in their apps. We compile these Facebook SDKs' privacy-related settings and their defaults. Employing a multi-method approach that integrates static and dynamic analysis, we analyze more than 6,000 popular apps to determine whether the apps incorporate Facebook SDKs and, if so, whether and how developers modify settings. Finally, we assess how these settings align with the privacy practices that developers disclose in the apps’ privacy labels and policies. We observe widespread inconsistencies between practices and disclosures in popular apps. These inconsistencies often stem from privacy settings, including a substantial number of cases in which apps retain default settings over alternatives that offer greater privacy. We observe fewer possible compliance issues in potentially child-directed apps, but issues persist even in these apps. We discuss remediation strategies that SDK and TPL providers could employ to help developers, particularly developers with fewer resources who rely heavily on SDKs. Our recommendations include aligning default privacy settings with data minimization principles and other conservative practices and making privacy-related SDK information both easier to find and harder to miss.

Many commercial websites use recommender systems to help customers locate products and content. Modern recommenders are based on collaborative filtering: they use patterns learned from users' behavior to make recommendations, usually in the form of related-items lists. The scale and complexity of these systems, along with the fact that their outputs reveal only relationships between items (as opposed to information about users), may suggest that they pose no meaningful privacy risk. In this paper, we develop algorithms which take a moderate amount of auxiliary information about a customer and infer this customer's transactions from temporal changes in the public outputs of a recommender system. Our inference attacks are passive and can be carried out by any Internet user. We evaluate their feasibility using public data from popular websites Hunch, Last. fm, Library Thing, and Amazon.