Technical Summary: Jurisdiction-Siloed Disclosure in Privacy Policies

1. The Problem: Structural Transparency Failure

The paper identifies a structural pattern in privacy policy organization termed jurisdiction-siloed disclosure. While privacy policies are intended to provide notice under the "notice and choice" framework, this study argues that substantive information about data practices often appears only within sections specifically labeled for users in regulated jurisdictions (e.g., "California Residents," "EU/UK Users," "Illinois Residents").

In this pattern:

• General Sections: Use vague, qualified, or conditional language regarding data practices (e.g., "We may share information...").
• Regional Sections: Contain specific, actionable, and definitive disclosures for the same practices (e.g., "We sell your personal information," "We collect biometric identifiers").

The authors argue that this organization creates a transparency failure not through omission, but through document architecture. Drawing on information foraging theory (Pirolli and Card, 1999) and empirical studies on selective reading (Obar and Oeldorf-Hirsch, 2020; Vu et al., 2007), the paper hypothesizes that users outside regulated jurisdictions will skip sections whose headings signal geographic irrelevance. Consequently, users in unregulated jurisdictions (e.g., a resident of Texas) may systematically miss specific disclosures about practices affecting them (e.g., data sales or biometric collection) because those disclosures are hidden behind jurisdiction-specific headings.

2. Methodology

The study is a hypothesis-generating content analysis of 123 major companies across 14 industries, selected to represent platforms with large user bases and significant regulatory exposure (e.g., Big Tech, AI/ML, Financial Services, Surveillance).

Data Collection

• Corpus: 123 privacy policies collected in January 2026 from primary English-language domains.
• Segmentation: Policies were segmented using HTML heading structures to preserve author-intended organization.

Classification Framework

The authors developed a taxonomy extending the OPP-115 corpus (Wilson et al., 2016) to include post-2018 regulatory categories.

• Substantive Categories: Sale/Sharing, Sensitive Data, Automated Decisions, First-Party Collection, Third-Party Sharing.
• Procedural/Regional Categories: Regional (jurisdiction-specific rights), International Specific.

Annotation Process

• Tooling: Three frontier Large Language Models (LLMs) from different providers (Claude Haiku 4.5, GPT-5.2, Gemini-3-flash) were used with a shared, iteratively refined classification prompt.
• Consensus: Final labels were determined by majority vote, achieving 98.7% usable consensus.
• Validation:
  • Internal: High inter-model agreement (Fleiss' Kappa = 0.858).
  • External (Pre-2016): Validated against OPP-115 human annotations (Cohen's Kappa = 0.629).
  • Limitation: Post-2018 categories (central to the findings) lack independent human validation. The authors explicitly note the "circularity problem" where classification rules were refined on the same corpus used for analysis.

Operational Definition of "Siloed"

A disclosure is classified as jurisdiction-siloed if:

1. Substantive content appears only within a REGIONAL section.
2. There is no equivalent disclosure in the universal (main) body of the policy.
3. Equivalence is defined semantically: the universal text must communicate the same specific practice. Vague language (e.g., "sharing with partners") is not equivalent to specific language (e.g., "selling data").

3. Key Contributions

1. Identification of a Structural Pattern: The paper operationalizes "jurisdiction-siloed disclosure" as a candidate structural pattern warranting systematic investigation, distinguishing it from traditional "dark patterns" which often involve interface manipulation rather than document organization.
2. Proposed Normative Standard: The authors propose Universal Substantive Disclosure, a standard requiring that substantive practices affecting all users be disclosed in the main policy body, while jurisdiction-specific sections should contain only procedural rights information (e.g., opt-out mechanisms).
3. Substantive/Procedural Framework: A distinction between procedural content (how to exercise rights, which varies by law) and substantive content (what the company does, which often does not vary), arguing that only the former should be siloed.
4. Dataset Release: An annotated dataset of 3,651 segments from 123 companies is released to enable replication and independent validation.

4. Results

The study presents preliminary prevalence estimates, acknowledging the need for independent validation of post-2018 categories.

• Prevalence:
  • Full Estimate: 282 potential instances of jurisdiction-siloed disclosure across 77 companies (62.6% of the sample).
  • Conservative Estimate: Restricted to pre-2016 categories validated against OPP-115, 138 instances were found across 54 companies (44% of the sample).
• Nature of Disclosures: 93.6% of identified siloed instances contain explicit substantive statements (e.g., "We sell...") rather than implied practices.
• Industry Distribution: The pattern appears across all sampled industries, with high prevalence in Big Tech (86%), AI/ML (78%), and Financial Services (75%).
• Case Studies: The paper details five cases (Clearview AI, Grindr, Thomson Reuters, Northrop Grumman, Roblox) illustrating how specific practices (biometric collection, data sales, automated hiring) are disclosed definitively only in regional sections, while general sections use hedged language.
• Inference Tiers: The authors categorize instances by the strength of the "universality inference" (i.e., whether the practice likely affects all users). 62.1% of instances fall into "Strongly" or "Moderately Inferred" tiers where legitimate regional variation is implausible (e.g., biometric databases, global ad-tech infrastructure).

5. Significance and Claims

The paper frames its contribution as hypothesis-generating rather than a definitive prevalence study.

• Structural vs. Content: The authors argue that current regulations focus on what is disclosed (content) but ignore where it is disclosed (structure). This creates a regulatory gap where companies can technically comply with disclosure mandates while placing material information in sections users are predicted to skip.
• Transparency Failure: The core claim is that if users skip jurisdiction-labeled sections (as behavioral theory predicts), the result is a "surveillance inequality" where users in unregulated jurisdictions receive systematically less specific information about practices affecting them, despite being subject to identical data practices.
• Regulatory Implications: The paper suggests that existing standards, such as the FTC's "clear and conspicuous" requirement and GDPR transparency principles, could be interpreted to require universal placement of substantive disclosures.
• Call for Validation: The authors explicitly state that direct measurement of user skipping behavior regarding jurisdiction-labeled sections is the critical validation priority. They invite the research community to replicate their methodology, perform independent human annotation, and conduct behavioral studies (e.g., eye-tracking) to confirm the phenomenon and its impact on user notice.

The paper concludes that structural transparency—attention to document architecture—is a necessary component of meaningful privacy disclosure, and that the proposed "Universal Substantive Disclosure" standard offers a pathway to align policy organization with the goals of the notice-and-choice framework.