When technology professionals have questions about how privacy laws apply to the products they build, some turn to Reddit for answers.
A University of Maine-led research team investigated why these professionals seek guidance on the platform, which privacy requirements they find most challenging and how they assess advice from strangers.
Without clear legal guidance, developers may struggle to determine whether a new product or feature complies with privacy law. Uncertainty can delay product development, while mistakes can expose users’ information or result in legal penalties.
The research team included UMaine computer science doctoral students Sara Haghighi and Ali Pourghasemi Fatideh, master’s student Clark LaChance, and Travis Breaux of Carnegie Mellon University. UMaine associate professor of computer science Sepideh Ghanavati, who advised the graduate researchers, also co-authored the study.
“The primary question we aimed to answer was why professionals are using these online forums to begin with,” the researchers said. “Given that Reddit is an informal social media platform, understanding why professionals are seeking legal advice here is important.”
The study focused on two subreddits — topic-specific communities on Reddit — dedicated to the European Union’s General Data Protection Regulation, which protects personal information and governs how organizations handle it.
The team surveyed 223 Reddit users and analyzed 2,248 posts from the two communities. Survey respondents included software developers, privacy professionals, managers and others involved in understanding or implementing privacy requirements.
The study found that 73% of respondents sought outside legal advice at least occasionally. Those seeking advice included privacy experts. Among all respondents, 55% identified data protection impact assessments — evaluations of potential risks to people’s personal information — as a challenge. Another 49% cited requirements for reporting data breaches.
These requirements can be especially difficult for smaller companies without dedicated legal teams.
“In the real world, especially for smaller startups, many tech companies have no in-house legal guidance to help them understand these requirements,” the researchers said. “If we are able to understand where developers are struggling and what exactly they are struggling with, we can help create accessible resources that help them address confusion around the legal requirements that they face.”
Researchers also investigated how people evaluate the reliability of advice shared on Reddit. Many users examine a contributor’s posting history, review other users’ responses and compare the advice with official regulations or other sources.
“Users on these forums frequently make use of the various features present to verify responses,” the researchers said. “As a whole, only a small number of users never seek any sort of external verification. It seems that most users use these forums as a tool that guides them to a clear, informed, evidence-based answer.”
Researchers involved worked with the Privacy Engineering – Regulatory Compliance Lab (PERC_Lab) for their research, led by Ghanavati.
The challenges respondents identified in the survey differed from those most often discussed on Reddit. In the posts researchers analyzed, the most frequently discussed issue was consent, particularly obtaining permission to collect or use personal information through website cookies and other technologies.
The team presented its work at the 26th Privacy Enhancing Technologies Symposium in Calgary, Canada, in July.
The researchers said their findings offer insight into how people translate complex legal requirements into everyday technology decisions. Their work also highlights opportunities to improve privacy law education and develop specialized tools to help technology professionals meet those requirements.
“We hope that these findings help elucidate what the most common challenges are and, at a more granular level, how these users are actually seeking advice,” the researchers said. “Even though this research focuses primarily on developers and professionals, learning more about these challenges benefits everybody.”
Story by William Bickford, graduate student writer
Contact: Marcus Wolf, 207.581.3721; [email protected]
Source: umaine.edu
