Privacy auditing framework reveals mixed compliance with California law
PrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA
Cryptography and Security
Summary
It can be hard to check if websites really follow privacy laws like the CCPA, which protects users in California. The authors built a tool called PrivAudit that looks at both what websites say in their privacy policies and what cookies they place on users’ browsers. They found that while many websites explain user rights better, tracking cookies are still very common and users’ choices are often not fully respected. This shows the need for tools that look at policies and actual behavior to spot privacy problems.
What this means in practice
- •For privacy compliance teams: Automate large-scale audits of website privacy policies and cookie behavior to check CCPA compliance.
- •For web security teams: Identify discrepancies between stated privacy practices and actual tracking to strengthen user data protection.
Authors
Mohamed Moustafa Dawoud, Riya Aggarwal, Likith Rahul Krishnamurthy, Ram Sundara Raman
Abstract
Five years after the enforcement of the California Consumer Privacy Act (CCPA), understanding how website privacy practices evolve at scale in response to regulation remains a key challenge for both researchers and regulators. Prior work and regulatory efforts have focused on manual and case-specific enforcement, but there remain no scalable approaches to systematically audit two key user-facing facets of websites that are crucial signals for the CCPA: privacy disclosures and front-end user tracking behavior. In this paper, we present PrivAudit, an automated auditing framework that adopts a dual-lens approach to capture: (1) privacy disclosures through large language model-based analysis of privacy policies grounded in CCPA provisions, and (2) user-observable data collection behavior through automated browser measurements of cookie writes under diverse privacy configurations. We apply PrivAudit to 998 websites and report two broad findings. The law is associated with stronger privacy disclosures: CCPA-subject policies are more likely to disclose opt-out mechanisms, data-sharing practices, and user rights. On the other hand, cookie-based tracking remains pervasive, with both CCPA-subject and not-subject websites setting a total of 6,392 targeting cookies, 49% of which are third-party writes. Moreover, cookies show limited-to-moderate responsiveness to privacy signals and consent choices, even when websites claim to honor them in their disclosures. Our results highlight the need for multi-layered and scalable auditing approaches that combine policy analysis with behavioral evidence. PrivAudit can support these auditing workflows at scale by generating actionable signals and patterns for further manual review. We open-source PrivAudit and are engaging with regulators to support auditing in practice.