PrivaT5: A Generative Language Model for Privacy Policies (2024)

Abstract: In the era of of digital privacy, users often neglect to read privacy policies due to their complexity. To bridge this gap, NLP models have emerged to assist in understanding privacy policies. While recent generative language models like BART and T5 have shown prowess in text generation and discriminative tasks being framed as generative ones, their application to privacy policy domain tasks remains unexplored. To address that, we introduce PrivaT5, a T5-based model that is further pre-trained on privacy policy text. We evaluate PrivaT5 over a diverse privacy policy related tasks and notice its superior performance over T5, showing the utility of continued domain-specific pretraining. Our results also highlight challenges faced by these generative models in complex structured output label space, especially in sequence tagging tasks, where they fall short compared to lighter encoder-only models.1

heading: 1 Introduction
text: Privacy policies outline how companies collect, use, share and manage user data on their services or applications. They are governed by a framework of notice and choice in many jurisdictions (Landesberg et al., 1998), requiring website operators to post a notice about how they gather and process users’ information. Users then decide whether to accept or abstain from using the website or service. However, the effectiveness of this framework, even enshrined in regulations like GDPR, relies on users comprehending these policies, which is often not the case due to their length, legal complexity and reasoning over vagueness and ambiguity (Gluck et al., 2016; Reidenberg et al., 2016; FTC).
Moreover, the prevalence of data surveillance and misuse, exemplified by scandals involving companies like Facebook and Cambridge Analytica
1Our pre-trained PrivaT5 models are available at https: //github.com/TUMLegalTech/PrivaT5.
(Cadwalladr and Graham-Harrison, 2018), underscores the critical nature of privacy concerns in the digital era. This scenario provides an ideal context for advancements in NLP to provide users with tools to understand policy content and address their privacy inquiries effectively. Harnessing NLP advancements would benefit not only individuals but also assist companies in ensuring compliance and regulators in enforcing it across diverse software products and services (Ravichander et al., 2021). It’s important to note that privacy policies stand apart from closely related domains, like legal texts (Shankar et al., 2023) which are tailored for domain experts. Instead, privacy policies, as legal documents with legal implications, are generally composed by experts, yet intended to be comprehensible by everyday users.
There have been significant research effort devoted to automate the analysis of privacy policies under Usable Privacy Project (Sadeh et al., 2013). Some works include identification of policy segments commenting on specific data practices (Wilson et al., 2016), compliance analysis (Zimmeck et al., 2019), extraction of opt-out choices (Sathyendra et al., 2017; Bannihatti Kumar et al., 2020), text alignment (Ramanath et al., 2014), vague sentence detection (Lebanoff and Liu, 2018), question answering (QA) (Ahmad et al., 2020; Ravichander, 2019; Harkous et al., 2018), summarization (Keymanesh et al., 2020; Zaeem et al., 2018), readability analysis (Meiselwitz, 2013; Massey et al., 2013) and fine-grained structured information (Hosseini et al., 2020; Le et al., 2021; Bui et al., 2021).
Earlier works focusing on privacy policies utilized extensive feature engineering (Wilson et al., 2016; Sathyendra et al., 2017; Zimmeck et al., 2019), domain-specific word embeddings (Kumar et al., 2019) and with the rise of pre-trained models like BERT, the pretrain-then-finetune approach has gained prominence (Mousavi Nejad et al., 2020; Ravichander, 2019; Ahmad et al., 2020). More-
159
over, Gururangan et al. 2020 emphasized that further continuing the pre-training of language models on domain-specific corpora can further elevate model performance in tasks specific to that domain. This, coupled with the availability of extensive privacy policy corpora (Srinath et al., 2021; Amos et al., 2021), has paved the way for developing privBERT (Srinath et al., 2021). This model excels in privacy language understanding tasks, as evidenced by its performance on constructed benchmarks designed in the privacy domain, such as PrivacyGLUE (Shankar et al., 2023) and PLUE (Chi et al., 2023).
More recently, there has been growing interest in generative language models, such as BART (Lewis et al., 2020) and T5 (Raffel et al., 2020), due to their inherent effectiveness in natural language generation tasks like summarization, question answering, and simplification. These generative models enable a unified approach to both discriminative and generative tasks by framing various non-generative tasks in a text-to-text format. However, the privacy domain lacks dedicated generative models and the exploration of casting non-generative tasks into a generative format remains uncharted. To address this gap, we embark on pre-training T5 models on the Privaseer corpus, resulting in various PrivaT5 variants across small (60M parameters), base (220M parameters) and large (770M parameters) sizes. We systematically evaluate the performance of both PrivaT5 and T5 on a range of privacy policyrelated tasks to assess their capabilities along the axes of model size and pre-training corpus. Our results demonstrate the impact of pre-training using domain related corpora on the downstream task performance while highlighting the challenges of generative models dealing with structured output in information extraction tasks.

heading: 2 PrivacyT5
text: T5 is an encoder-decoder model initially pretrained in an unsupervised manner on the C4 corpus (Raffel et al., 2020). This pre-training involves replacing 15% of the tokens with sentinel tokens in a denoising objective, with consecutive tokens marked for removal being replaced by a single sentinel token. The resulting corrupted text serves as input to the model to predict the masked-out tokens. Then the model is further fine-tuned using supervised training on various downstream tasks, including those from the GLUE (Wang et al., 2018)
and SuperGLUE (Wang et al., 2019) benchmarks, casting them into text-to-text format for training.
To pre-train the PrivaT5 models, we initialize the model with T5 2 and continue pre-training with the PrivaSeer Corpus (Srinath et al., 2021), which encompasses 1,005,380 privacy policies originating from 995,475 distinct web domains with prominent ones like .com, .org, and .net comprising significant proportions of the corpus at 63%, 5%, and 3%, respectively. We pre-train small (60M), base (220M) and large (770M) versions of T5 to obtain privaT5 models of three sizes. Detailed hyperparameters related to pre-training can be found in App. D.

heading: 3 Experiments
text: We evaluate the models on the following privacy policy related downstream tasks. App. A and B describe dataset splits with their label space and illustrative instances respectively. OPP115 (Wilson et al., 2016; Mousavi Nejad et al., 2020) consists of 3432 sentences from 115 online privacy policies annotated with one or more privacy practices from ten categories to aid compliance analysis, leading to a multi-label classification. PI-Extract (Bui et al., 2021) focuses on extracting token spans representing data-related entities such as collected, not collected, not shared, and shared, akin to Named Entity Recognition. This dataset comprises 4064 sentences extracted from 30 privacy policy documents. Notably, the entities of various types may overlap, leading to a token-level multi-label classification approach. PolicyDetection (Amos et al., 2021) includes 1301 documents focusing on binary classification, categorizing as either privacy policies related or not. PolicyIE (Le et al., 2021) consists of 5250 sentences, each labelled with a privacy practice intent label (referred to as task IE-A), and the word spans annotated with a slot label (referred to as task IE-B) derived from 31 privacy policies of websites and mobile applications. IE-A has 5 intent classes and IE-B has 18 slot labels, categorized into 14 type-I slots for privacy practice participants and 4 type-II slots for details like purposes and conditions. Note that type-I and type-II slot values in IE-B can overlap resulting into a joint multi-label classification, while IE-A is a multi-class classification task. PrivacyQA (Ravichander, 2019) is comprised of 1750 questions related to the privacy policies of mobile applications. This task is framed as binary
2https://huggingface.co/docs/transformers/model_doc/t5
relevance prediction, where the objective is to determine whether a given sentence from a privacy policy is relevant to a specific question. PolicyQA (Ahmad et al., 2020) contains 25,017 reading comprehension style questions curated from 115 website privacy policies. Unlike PrivacyQA, which focuses on sentence-level answers from policy documents, PolicyQA adopts a setup similar to SQUAD (Rajpurkar et al., 2016), where it requires a shorter text span as the answer given the corresponding policy document and question. PolicySumm (Kumar et al., 2022; Gopinath et al., 2020) consists of 24000 section body, title pairs from privacy policies where the task involves generating section title given the content of section. Evaluation Metrics We report macro-F1 for all the classification tasks such as OPP115, PolicyDetection, PolicyIE-A, PrivacyQA. For PI-Extract and PolicyIE-B, we compute the macro-F1 scores for each entity obtained from token-level labels. For PolicyQA, we report the exact match which measures percentage of predictions that match any one of the ground truth answers exactly. For PolicySumm, we report ROUGE-1,2 and L scores.
Implementation Details We convert each of the task into text-to-text format where the model produces output in the form of text. The model is directly trained with a maximum likelihood objective using teacher forcing, regardless of the task, unifying the pre-training and fine-tuning objective. In case of multi-class/binary classification problem (such as PolicyDetection, PolicyIE-A, PrivacyQA), the output label is verbalized into text format (such as ‘Policy’ and ‘Not a Policy’ in case of PolicyDetection). In case of multi-label classification (such as OPP115), we verbalize the class labels into texts and concatenate the multiple labels using a delimiter. For sequence tagging (NER kind of task such as PolicyIE-B and PI-Extract), we use ‘Sentinel + Tag’ strategy described in Raman et al. 2022, where the sentinel tokens < extra_id_0 >, < extra_id_1 > etc are incorporated before each token wile feeding input to the model and the output is produced by generating respective sentinel token along with its output tag. For PrivacyQA and PolicySumm, we allow the model to generate the free-form text. Text-to-text transformations on illustrative examples are provided in Appendix C. We assess models performance on each of the task independently, referred to as Single Task Learning (STL), by initializing with {T5/PrivaT5}{Small/Base/Large} version and fine-tuning it on the task-specific training data. Further, we also assess the Multi Task Learning (MTL) ability, by jointly training on all the datasets. To specify which task the model should perform, we add a taskspecific (text) prefix to the original input sequence before feeding it to the model. To handle the im-
balance between tasks in MTL, we use exponential sampling of each task sampling rates. Fine-tuning hyperparameters can be found in Appendix E.

heading: 3.1 Experimental Results
text: We report the results on T5 and PrivaT5 models across small, base, large scales on STL and MTL settings in Table 1. We also report STL results on encoder only models such as BERT (Devlin et al., 2018), LegalBERT (Chalkidis et al., 2020) and PrivBERT (Srinath et al., 2021) which is continually pre-trained on PrivaSeer Corpus. T5 vs. PrivaT5: STL We observe that PrivaT5small consistently outperforms T5 across various tasks. The trend is maintained with PrivaT5-Base on most tasks, with the exception of PI-extract and PolicyDetection. Similarly, the large variant follows the same pattern, except for marginal differences on OPP115 and PI-Extract. This underscores the significance of continuous pre-training on domain-specific corpora to achieve superior performance in downstream tasks within that domain. However the degree of improvement varies across tasks. Contrary to expectation, we do not observe any straightforward correlation between size of the dataset and requirement of pre-training as one expects pre-training to benefit in low-data fine-tuning settings. This deviation along with performance decreases on certain configurations prompts a deeper exploration into the intricate dynamics at play during fine-tuning, challenging preconceived notions about the universality of pre-training benefits. T5 vs. PrivaT5: MTL Except on PolicyDetection in base setting, PrivaT5 outperforms T5 on all tasks in MTL. This clearly demonstrates the utility of domain-specific continued pre-training. Scaling T5 & PrivaT5: We observe a consistent trend of performance improvement as the scale of parameters increases (from small to base to large) for both T5 and PrivaT5 in both MTL and STL settings. Investigating how the scale of the model translates to the degree of enhancement in these tasks and uncovering the factors influencing these dynamics, presents an interesting direction. T5 vs. BERT BERT models employed possess 110M parameters, which is double of Small (60M) and half of Base (220M) version of T5. Interestingly, Small version underperforms compared to BERT models, with the Base version catching up, and the Large version attempting comparability across most tasks. Particularly, in tasks involving structured output spaces such as sequence tagging, BERT family models excel, while T5 encounters difficulties in grasping the syntax of complex output spaces. Addressing this challenge necessitates the design of effective decoding mechanisms or better textual transformations of structured output spaces, particularly for information extraction tasks using these generative models. A case in point is PolicyIE-B, where T5-large model despite with 770M parameters underperform compared to BERT family with 110M, highlighting ineffective handling of complex structured output space in generation paradigm, while it is easy to have a token-level classifier for BERT models. In case of PolicyQA, where BERT models can easily be extractive, T5 models generate text similar to the actual answer but aren’t inherently extractive. This results in a penalty for T5 models on matching metrics, highlighting the need for nuanced evaluation approaches for different models in various tasks. STL vs. MTL While MTL underperforms compared to STL in specific configurations, like OPP115 across Small, Base, and Large setups, it shines in contexts such as PolicyIE-A. Contrary to the anticipated positive transfer from MTL, especially in low-data settings through data ensembling, our findings mostly expose negative transfer, aligning with previous studies (Rosenstein et al., 2005; Caruana, 1997). This can be attributed to negative interference between unrelated tasks which dampens task synergies during training, urging a thorough exploration of improved task sampling or grouping strategies (Fifty et al., 2021; Guo et al., 2019; Xu et al., 2019), alongside different optimizations like gradient surgery (Yu et al., 2020) and gradient vaccine (Wang and Tsvetkov, 2021) to counteract negative transfers between tasks.

heading: 4 Conclusion
text: In this study, we introduce PrivaT5, a T5-based transformer model designed for privacy policy text across various scales: small (60M), base (220M), and large (770M). PrivaT5 is obtained by further pre-training T5 on PrivaSeer Corpus of contemporary website privacy policies. We demonstrate that domain-specific pre-trained PrivaT5 models outperform general T5 models on different privacy policy related tasks. Further, we notice that these generative models struggle to handle structured output spaces in case of sequence tagging tasks, indicating a potential avenue for future exploration.
Limitations
While this study offers insights into the effectiveness of PrivaT5 over T5 within privacy policy understanding, we acknowledge its limitations. Our pre-training relies on the PrivaSeer Corpus, which, while comprehensive, may not fully represent the entire spectrum of privacy policy variations. The model’s performance could be influenced by potential biases or gaps in the training data. PrivaT5’s training and evaluation primarily involve Englishlanguage privacy policies. Assessing its performance and generalization capabilities to policies in other languages remains an unexplored area, limiting its applicability in a global context. While our results point to challenges in structured output spaces, particularly in sequence tagging tasks, a deeper investigation into the root causes and potential mitigations is left for future research.
Ethics Statement
PrivaT5 inherits biases present in the training data, potentially perpetuating or amplifying existing biases in privacy policies. Investigating and mitigating these biases is crucial to ensure fair and unbiased model outcomes. The privacy policies used for training may contain sensitive information. While we do not foresee any inherent risks associated, precautionary measures, including data anonymization, are essential to ensure compliance with ethical standards and safeguard against unintended consequences.

heading: A Statistics of Downstream Tasks
text: Table 2 displays dataset splits and number of labels in each of the downstream tasks.

heading: B Examples from Downstream Tasks
text: Table 3 displays illustrative examples from each of the downstream task, along with each task label space.

heading: C Text-to-text transformation of downstream tasks
text: Table 4 provide text-to-text transformation of representative examples from each of the downstream task provided in Tab. 3.

heading: D Pre-training Hyperparameters
text: For all of our pre-trained models, we use a learning rate of 0.001, linear warmup of 2k steps, inverse square root learning rate decay and a maximum sequence length of 512. We employ a batch size of 32, 16 and 8 for small, base and large models respectively and is optimized end-to-end using Adafactor optimizer (Shazeer and Stern, 2018) with
OPP-115
Secure Online Ordering For your security, we only store your credit card information if you choose to set up an authorized account with one of our Sites. In that case, it is stored on a secure computer in an encrypted format. If you do not set up an account, you will have to enter your credit card information each time you order. We understand that this may be a little inconvenient for you, but some customers appreciate the added security. Labels: Data Retention, Data Security, Do Not Track, First Party Collection/Use, International and Specific Audiences Introductory/Generic, Policy Change, Practice not covered, Privacy contact information, Third Party Sharing/Collection, User Access, Edit and Deletion, User Choice/Control Output: Data Security; User Choice/Control; First Party Collection/Use
PI-Extract We may collect and share your IP address but not your email address with our business partners Subtask-I Labels: {B,I}-COLLECT, O Output: O O O O O B-COLLECT I-COLLECT I-COLLECT O O O O O O O O O O
Subtask-II Labels: {B,I}-NOT_COLLECT, O Output: O O O O O O O O O O B-NOT_COLLECT I-NOT_COLLECT I-NOT_COLLECT O O O O O
Subtask-III Labels: {B,I}-NOT_SHARE, O Output: O O O O O O O O O O B-NOT_SHARE I-NOT_SHARE I-NOT_SHARE O O O O O
Subtask-IV Labels: {B,I}-SHARE, O Output: O O O O O B-SHARE I-SHARE I-SHARE O O O O O O O O O O
PolicyDetection This website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text. . Labels: Not a Policy, Policy Output: Not a Policy
PolicyIE-A CMS websites keep data collected long enough to achieve the specified objective for which they were collected Labels: Data Collection/Usage, Data Security/Protection, Data Sharing/Disclosure, Data Storage/Retention, OtherOutput: Data Storage/retention Output: Data Storage/Retention PolicyIE-B We may also use or display your username and icon or profile photo on marketing purpose or press releases Subtask-I Labels: {B,I}-data-protector, {B,I}-data-protected, {B,I}-data-collector, {B,I}-data-collected, {B,I}-data-receiver, {B,I}-data-retained, {B,I}-data-holder, {B,I}-data-provider, {B,I}-data-sharer, {B,I}-data-shared, {B,I}-storage-place, {B,I}-retention-period, {B,I}-protect-against, {B,I}-action, O Output: B-data-collector O O B-action O O B-data-provider B-data-collected O B-data-collected I-data-collected I-data-collected I-data-collected O O O O O
Subtask-II Labels: {B,I}-purpose, {B,I}-polarity, {B,I}-method, {B,I}-condition, O Output: O O O O O O O O O O O O O O B-purpose I-purpose I-purpose I-purpose I-purpose
a corrupted token ratio of 15% with the mean noise span length of 3. Pre-training is carried out using Google Cloud TPU with 8 cores (v3.8) from TPU Research Cloud (TRC).3

heading: E Fine-tuning Hyperparameters
text: Each model is trained for 50 epochs, with early stopping and is optimized using Adafactor. We varied learning rate across {1e-3, 5e-4, 3e-4, 1e-4} to identify the optimal rate. Task-specific evaluation metrics are employed for best model selection, with macro-F1 scores for all the tasks except PolicyQA which relied on Exact Match scores. We employ a batch size of 32, 16 and 8 for small, base, and large respectively. All the experiments are carried out on TPU v3-8 device with maximal input sequence length of 512 and truncating lnger sequences beyond. For MTL, we use exponential sampling for data ensemble with α = 0.01.
3https://sites.research.google/trc
Task Name Input Output
OPP-115
OPP 115 Sentence: Secure Online Ordering For your security, we only store your credit card information if you choose to set up an authorized account with one of our Sites. In that case, it is stored on a secure computer in an encrypted format. If you do not set up an account, you will have to enter your credit card information each time you order. We understand that this may be a little inconvenient for you, but some customers appreciate the added security. Data Security; User Choice/Control; First Party Collection/Use
PI-Extract
PI Extract sentence: <extra_id_0>We <extra_id_1>may <extra_id_2>collect <extra_id_3>and <extra_id_4>share <extra_id_5>your <extra_id_6>IP <extra_id_7>address <extra_id_8>but <extra_id_9>not <extra_id_10>your <extra_id_11>email <extra_id_12>address <extra_id_13>with <extra_id_14>our <extra_id_15>business <extra_id_16>partners
<extra_id_5>B-COLLECT B-SHARE <extra_id_6>I-COLLECT I-SHARE <extra_id_7>I-COLLECT I-SHARE <extra_id_10>B-NOT_COLLECT B-NOT_SHARE <extra_id_11>I-NOT_COLLECT I-NOT_SHARE <extra_id_12>I-NOT_COLLECT I-NOT_SHARE
PolicyDetection Policy Detection : This website uses Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text. .
Not a Policy
PolicyIE-A Policy IE A : CMS websites keep data collected long enough to achieve the specified objective for which they were collected
Data Storage/Retention
PolicyIE-B
Policy IE B : <extra_id_0>We <extra_id_1>may <extra_id_2>also <extra_id_3>use <extra_id_4>or <extra_id_5>display <extra_id_6>your <extra_id_7>username <extra_id_8>and <extra_id_9>icon <extra_id_10>or <extra_id_11>profile <extra_id_12>photo <extra_id_13>on <extra_id_14>marketing <extra_id_15>purpose <extra_id_16>or <extra_id_17>press <extra_id_18>releases
<extra_id_0>B-data-collector <extra_id_3>B-action <extra_id_6>B-data-provider <extra_id_7>B-data-collected <extra_id_9>B-data-collected <extra_id_10>I-data-collected <extra_id_11>I-data-collected <extra_id_12>I-data-collected <extra_id_14>B-purpose <extra_id_15>I-purpose <extra_id_16>I-purpose <extra_id_17>I-purpose <extra_id_18>I-purpose
PrivacyQA
Privacy QA question: Does the app track my location? Context : We may collect and use information about your location (such as your country) or infer your approximate location based on your IP address in order to provide you with tailored educational experiences for your region, but we don’t collect the precise geolocation of you or your device.
Relevant

heading: Future Work
text: Further, we notice that these generative models struggle to handle structured output spaces in case of sequence tagging tasks, indicating a potential avenue for future exploration. Limitations
While this study offers insights into the effectiveness of PrivaT5 over T5 within privacy policy understanding, we acknowledge its limitations. Our pre-training relies on the PrivaSeer Corpus, which, while comprehensive, may not fully represent the entire spectrum of privacy policy variations. The model’s performance could be influenced by potential biases or gaps in the training data. PrivaT5’s training and evaluation primarily involve Englishlanguage privacy policies. Assessing its performance and generalization capabilities to policies in other languages remains an unexplored area, limiting its applicability in a global context. While our results point to challenges in structured output spaces, particularly in sequence tagging tasks, a deeper investigation into the root causes and potential mitigations is left for future research