Chinese regulators have intensified their supervision over personal information collection and utilization, following the promulgation of the Personal Information Protection Law (PIPL) and other data protection regulations in November 2021. Whilst regulators primarily rely on data flows to identify suspicious activities in data collection and transfer during and after the use of apps, there is still a lack of protection measures to prevent privacy breaches. Privacy policies are important for enhancing the prevention and protection of the privacy rights and interests of app users, as well as for fostering self-regulation among operators. However, privacy policies are often lengthy and replete with vague expressions, making it difficult for users to read and thus inadequate for safeguarding users' information rights. It is crucial to address the power imbalance between operators and users and to assess the legality of app privacy policies formulated by operators. This paper introduces a methodology for evaluating the legality of privacy policies based on legal knowledge. First, we collected policy texts and constructed the Children's Privacy Policy Corpus (CCPP-181) that covers a variety of privacy policies for children's apps. Then, we proposed a legality evaluation method grounded in regulatory standards, and applied it to annotate CCPP-181 corpus annotation. After three rounds of annotation, 20.2% of the 1160 sentences in the corpus were identified to have legality problems. Based on the legal text analysis method, this paper analyzes the legality issues in app privacy policies, in order to eliminate the inequality of app privacy policies and protect user data security.
Privacy policy; personal information protection law; legality evaluation; legal text analysis