Assessing Transparency in Data Retention Practices: An IPTC Analysis of Mobile Application Privacy Policies
Researchers from the Information Processing and Telecommunications Center (IPTC) at Universidad Politécnica de Madrid, in collaboration with Carnegie Mellon University (CMU), present a systematic study on the degree of transparency exhibited by mobile applications in disclosing data retention practices. Employing advanced natural language processing techniques, including large language models such as ChatGPT, the research analyzed hundreds of privacy policies to assess compliance with the requirements of the European Union’s General Data Protection Regulation (GDPR).
The study reveals a pronounced lack of transparency. Only 16% of the applications examined provide explicit and unambiguous retention periods, while over half fail to meet the GDPR’s obligations to specify either defined timeframes or clear criteria for data storage. In certain cases, widely used applications with millions of users report indefinite retention of personal data without presenting a legitimate justification. These findings underscore significant risks to the rights of individuals, including heightened exposure to data breaches and misuse, as well as the erosion of users’ capacity to make informed choices regarding digital services.
The project was led by José María del Alamo and David Rodríguez, researchers at IPTC, whose expertise in data protection and information processing guided both the methodological design and the interpretation of the results. David Rodríguez also provides a detailed explanation of the study and its societal implications in the video “¿Tus datos personales, cedidos para siempre?” available at YouTube
Beyond its empirical contribution, the research demonstrates the potential of artificial intelligence to support regulatory oversight and compliance monitoring. The proposed methodology is transferable to other domains of regulatory interest, including the auditing of contractual terms, evaluation of corporate compliance documentation, and strengthening of consumer protection frameworks. By advancing knowledge and providing actionable tools, IPTC researchers contribute to promoting transparency, accountability, and trust within digital ecosystems.
José María del Álamo, IP Project: GS /ORCID/ LinkedIn
David Rodríguez Torrado: GS / ORCID / LinkedIn
Forward information: www.iptc.upm.es
Share this:
