Setting the Course, but Forgetting to Steer: Analyzing Compliance with GDPR's Right of Access to Data by Instagram, TikTok, and YouTube
Journal:
arXiv
Published Date:
Feb 16, 2025
Abstract
The comprehensibility and reliability of data download packages (DDPs)
provided under the General Data Protection Regulation's (GDPR) right of access
are vital for both individuals and researchers. These DDPs enable users to
understand and control their personal data, yet issues like complexity and
incomplete information often limit their utility. Also, despite their growing
use in research to study emerging online phenomena, little attention has been
given to systematically assessing the reliability and comprehensibility of
DDPs.
To bridge this research gap, in this work, we perform a comparative analysis
to assess the comprehensibility and reliability of DDPs provided by three major
social media platforms, namely, TikTok, Instagram, and YouTube. By recruiting
400 participants across four countries, we assess the comprehensibility of DDPs
across various requirements, including conciseness, transparency,
intelligibility, and clear and plain language. Also, by leveraging automated
bots and user-donated DDPs, we evaluate the reliability of DDPs across the
three platforms. Among other things, we find notable differences across the
three platforms in the data categories included in DDPs, inconsistencies in
adherence to the GDPR requirements, and gaps in the reliability of the DDPs
across platforms. Finally, using large language models, we demonstrate the
feasibility of easily providing more comprehensible DDPs.
