SaTC 2.0: RES: Enforcing Privacy Opt-out Compliance for a Trustworthy Web

Commercial data sharing practices can put the privacy of individuals online at risk. Standardized privacy signals, such as Global Privacy Control (GPC), integrated into browser settings can be helpful. Yet such measures may not fully protect user privacy. Furthermore, as people increasingly interact with artificial intelligence (AI), there is a need to develop additional online privacy protections. This project contributes to the knowledge base on how to protect Internet users by developing methods for making opt-out rights enforceable on the Internet, including when users interact with chatbots or other forms of AI systems. The project team focuses on methodologies and applications for compliance measurement at scale, over time, and across jurisdictions. To identify compliance failures, the project team is using automated browsers to monitor network traffic and privacy signal propagation. The approach leverages statistical tests to study violations through a differential analysis of served advertisement content, evaluating how product and topic distributions differ between users who opt out and those who do not. Through cognitive walkthroughs, interviews, and other usability tests, the team is developing interactive visualization dashboards that transform complex technical evidence into actionable insights for organizations. The project team aims to further define privacy signals for the agentic web by embedding privacy requirements into agentic protocols. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.