# AI-Based Analysis of Policies and Images for Privacy-Conscious Content Sharing
## 3 Information Retrieval for Privacy Policies  
In this section, we illustrate the technique for retrieving natural language (NL) information from raw privacy policies.  
Whenever they provide an online service, IT companies must publish a legal document written in natural language to describe what kind of personal data they will collect, and how they will use such data. Normally, this document, called _privacy policy_, is composed of many paragraphs, which could contain _practices descriptions_ such as the collection and use of data types (e.g., 'We collect identifier information from your device'), pledge of not collecting certain data types (e.g., 'We do not store any contact information with third parties'), or both. Certain paragraphs could also not contain any practice description at all. These privacy policies are then published in organization's websites to make them available to customers. In the following, we define key concepts that will be used in the rest of the paper.  
* A _data type_ is an attribute of personal information appearing in a privacy policy (e.g., 'location information' is the data type that describes the user's geographical location);
* A _privacy practice_ is an activity of accessing, collecting, or sharing personal information of a given data type;* A _privacy practice description_ is a statement written in natural language in a privacy policy, which explicitly indicates whether certain privacy practices are being performed or not by the service provider.  
Below we show an excerpt of a real-world privacy policy. The policy contains two privacy practice descriptions (highlighted in bold).  
**Example 1**.: _\"In some circumstances, Google also collects information about you from publicly accessible sources. For example, if your name appears in your local newspaper, Google's Search engine may index that article and display it to other people if they search for your name. We may also collect information about you from trusted partners, including marketing partners who provide us with information about potential customers of our business services, and security partners who provide us with information to protect against abuse.\" [21]_  
Of course, privacy violations can also occur as a consequence of sharing multimedia objects on social networks. Most online social networks allow users to define the visibility of shared contents. In particular, _private_ contents are visible only to users that are explicitly allowed by the user (e.g., because the are in a friendship relationship), while _public_ contents are visible to everyone. Incorrect settings in terms of the visibility of multimedia content may easily determine serious privacy issues [22].  
For the sake of this work, we consider each paragraph in a privacy policy as a unit of information to be classified. Each paragraph may either contain a practice description or not. Each practice description may be related to one or more data types. Hence, we treat this problem as a set of binary classification tasks. For each data type, we use a binary classifier to determine whether the paragraph contains a privacy practice which refers to that data type.