GenAIPABench: A Benchmark for Generative AI-based Privacy Assistants

1 INTRODUCTION

• Complex privacy policies and regulations make it difficult for users to understand their rights and protections.Organizations commonly provide privacy policies to explain how user data is managed.Source: §1 · p. 1
• Generative AI’s human-like text generation and contextual capabilities create potential for a new generation of privacy assistants.Earlier privacy assistants transform policies into accessible information and support users in managing data privacy.Source: §1 · p. 1
• Privacy-focused evaluation is difficult because ground truth is unclear, objectives are multidimensional, and user perceptions may diverge from technical metrics.GenAI responses may also contain incorrect information or misleading references [21].Source: §1 · p. 1
• GenAIPABench combines privacy documents, annotated questions, response metrics, and an evaluator; the paper assesses ChatGPT, BARD, and Bing Chat.The benchmark is presented as the first for evaluating GenAIPAs, to the authors’ knowledge.Source: §1 · p. 2

Privacy Benchmarks

• PrivacyQA provides 1,750 mobile-app privacy-policy questions with over 3,500 expert annotations, while OPP-115 contains 115 website policies annotated with information types.PrivacyQA’s queries are tailored to the included mobile applications.Source: §2 · p. 2

genAI Evaluation

• Prior generative-AI evaluation spans optimized language models, user-preference tasks, text-quality judgments, agent benchmarks, and evaluations that identify model errors [25].The cited work motivates diverse evaluation metrics for safe and effective deployment [25].Source: §2 · p. 2

Related work

• The benchmark content is available only in English.Source: §2 · p. 2

General Question-answering Benchmarks

• Question-answering benchmarks such as SQuAD, TriviaQA, and HELM assess answer quality with metrics including accuracy, precision, recall, and F1.TriviaQA contains over 650,000 question-answer pairs and requires retrieval and integration across sources.Source: §2 · p. 2

3 THE GENAIPABENCH BENCHMARK

• GenAIPABench targets policy questions, regulation questions, and summaries, using privacy documents, question variations, annotated answers, and an evaluation tool.The benchmark includes five privacy policies and two regulations, with content knowledge intended to support uniform comparisons across models.Source: §3 · p. 2, Figure 1 · p. 3
• The corpus contains 32 policy questions and six regulation questions, with paraphrased variants to test responses across different linguistic scenarios.The questions address topics including data collection, storage, sharing, and user rights.Source: §3 · pp. 2–3
• Human analysts assess answers for accuracy, relevance, clarity, completeness, and reference, using answers curated and cross-checked by two experts.Each expert prepared answers for assigned documents, then reciprocally reviewed them against the source policies.Source: §3 · p. 3
• The evaluator generates document-introduction prompts and questions, supports API execution and answer collection, and tests prompts with no document, an accompanying document, or a summarized document.Document portions may be segmented for token limits; conversations are reset between prompt types and after configurable repetitions.Source: §3 · p. 3

4.1 Privacy Policy Questions

• Policy questions span privacy categories including data minimization, security, privacy by design, and responsiveness.The section also covers transparency, accessibility and empowerment, compliance and accountability, and user control.Source: §4.1 · pp. 4–5
• Questions about policies draw on general user concerns gathered from FAQs and online forums, plus individual-specific questions selected from a user study.Four questions are included per category; the authors cite the manual effort required to generate and validate ground-truth answers as the reason for limiting the count.Source: §4.1 · p. 4
• The corpus includes paraphrased variants to test whether assistants handle diverse wording while preserving the original question’s meaning.Three variants per general question were selected from ten automatically generated with QuillBot; individual-specific variants were manually selected from other users’ questions.Source: §4.1 · p. 4

4.2 Privacy Regulation Questions

• Regulation questions cover applicability, fines, compliance, encryption, personal and sensitive information, and individual rights.The evaluator substitutes a specific regulation for the placeholder, and these questions also include paraphrases.Source: §4.2 · p. 6

• Relevance measures how well an answer aligns with the user’s question.The section connects relevant answers with informed privacy decisions and says irrelevant answers may obstruct users’ comprehension of their rights and responsibilities.Source: §5 · p. 6
• Accuracy measures whether the information an AI system provides is correct.The section notes that inaccurate responses can misguide privacy-related actions and diminish trust in the system.Source: §5 · p. 6
• Clarity assesses whether responses communicate clearly and coherently, without ambiguity or unnecessary technical terms.The section highlights the complexity of privacy policies and the importance of explanations suited to users’ comprehension levels.Source: §5 · p. 6
• Completeness measures whether an answer fully addresses the question and includes necessary details.The scoring gives +1 for a comprehensive response, +0.5 when minor information is missing, and -1 for an incomplete response or one missing important details.Source: §5 · pp. 6–7
• Reference evaluates whether an answer cites or mentions the relevant policy section accurately.The score is +1 for a correctly cited relevant section, +0.5 for mentioning a section without an explicit citation, and -1 for an incorrect reference; if the document lacks an answer, citing a section scores -1.Source: §5 · pp. 6–7
• Each response is assessed for relevance, accuracy, clarity, completeness, and reference on a scale from +1 to -1.Relevant, entirely correct, and clear responses receive +1; partial responses receive +0.5; irrelevant, incorrect, or confusing responses receive -1.Source: §5 · p. 6
• The overall score aggregates positive and partial points, then normalizes the result using minimum and maximum scores of -5 and 5.The stated normalization maps the score to a 1–10 scale.Source: §5 · p. 7

6 EXPERIMENTS

• The evaluation covered ChatGPT-4, Bard, and BingAI across five privacy policies and two major privacy regulations.The analysis used policy statistics including unique-word frequency, estimated reading time, and reading level.Source: §6 · p. 7

6.1 Assessing the Quality of Responses to Privacy Policy Questions

• ChatGPT-4 and BingAI generally outperformed Bard on explicit-policy questions, while Bard’s performance diminished as question complexity increased.BingAI stood out on user- and FAQ-generated questions for Spotify, Twitter, and Airbnb policies.Source: §6.1 · p. 7, Figure 2 · p. 8

6.2 Assessing Robustness through Paraphrased Questions

• On paraphrased questions, ChatGPT-4 showed consistent strengths, BingAI excelled in some areas but had referencing challenges, and Bard’s results mixed highs and lows.The experiment assessed whether systems gave similar responses to paraphrased question variants.Source: §6.2 · p. 9, Figure 3 · p. 10

6.3 Assessing the Ability to Recall Learned Privacy Policy Knowledge

• Without the policy supplied, BingAI showed high proficiency but low referencing scores; Bard was more variable, and ChatGPT’s performance was inconsistent across criteria.The systems had to rely on learned information or obtain the policy online if supported.Source: §6.3 · p. 9, Figure 4 · p. 11

6.4 Assessing the Quality of Responses to Privacy Regulation Questions

• For CCPA and GDPR questions, ChatGPT-4 and BingAI excelled, while Bard’s accurate-reference difficulties placed it behind them.ChatGPT-4 and BingAI answered all six questions accurately, relevantly, comprehensively, and with correct references to regulation details.Source: §6.4 · p. 11, Figure 5 · p. 12

7 DISCUSSION

• BingAI was most consistent across most metrics, all systems scored fairly highly on organization-policy questions, and they generally scored higher on the two privacy regulations.The authors note BingAI and ChatGPT-4 share an underlying model but are different chatbots, suggesting robust layers such as appropriate referencing matter.Source: §7 · p. 12
• Paraphrased questions reduced system performance, and coherent, relevant answers could still be factually incorrect, incomplete, or supported by outdated or incorrect references.Reference problems were observed even when the current privacy policy was explicitly provided.Source: §7 · p. 12
• Questions with explicitly defined policy content generally scored higher, while transparency and individual-user questions seemed easier than compliance and accountability questions.Table 2 presents the five highest- and lowest-scoring questions across systems; the authors note exceptions to the general pattern for particular questions.Source: §7 · p. 12, Table 2 · p. 12
• Facebook and Airbnb policies received the highest average scores, while Uber and Spotify received the lowest; the shortest policy was highest-scoring and the longest lowest-scoring.The authors identify policy length as a decisive factor in the ranking; Airbnb scored higher than Uber despite having a reading level two levels above it.Source: §7 · p. 12

8 CONCLUSION AND FUTURE WORK

• GenAIPABench combines questions about privacy policies and regulations, evaluation metrics, and annotated privacy documents to assess future GenAIPAs.The evaluation of ChatGPT, Bard, and BingAI showed promise but also highlighted work needed on complex queries, accuracy, consistency, and proper sourcing.Source: §8 · p. 12
• The benchmark includes only English-language policies and questions, and planned expansion includes more annotated answers for additional documents and languages.The authors also plan infrastructure for periodic evaluation of current and future genAI and GenAIPA systems.Source: §8 · pp. 12–13

Appendix A EVALUATOR

• The evaluator runs privacy-policy questions under four initializations: company name, privacy document, a summary based on company name, or a summary based on the document.Company-name initialization tests responses based on prior knowledge; document initialization supplies the policy in segments, while the summary setups test responses using condensed policy context or prior knowledge.Source: Appendix A · p. 14
• For each run, the evaluator shuffles the questions, collects responses separately by initialization, and aggregates them across runs for analysis.The procedure is intended to capture response variation under distinct contextual setups.Source: Appendix A · p. 14
• An analyst scores responses for relevance, accuracy, clarity, completeness, and reference to policy sections, then averages scores across runs and categorizes them as Green, Yellow, or Red.The average categories are stored for each run.Source: Appendix A · p. 14

Appendix B ADDITIONAL EXPERIMENTS

• Additional experiments report results from evaluating ChatGPT-4, Bard, and BingAI using GenAIPABench.Source: Appendix B · p. 15

B.1 Assessing the Quality of Privacy Policy Summaries

• ChatGPT-4 performed consistently across policies, while Bard and BingAI varied more with question complexity and struggled on complex or user-generated questions.The systems also had difficulty citing references accurately.Source: §B.1 · pp. 15–16
• ChatGPT-4’s policy median scores ranged from 77.5 on Uber to 97.75 on Facebook, where the policy had 46.8% non-existing content.It scored 79.75 on Spotify, 84.25 on Twitter, and 82 on Airbnb.Source: §B.1 · p. 15
• Bard’s policy medians ranged from 64 on Twitter to 82 on Spotify; about half of its reference-metric questions scored below -0.6.Its relevance and clarity were stronger on simpler FAQ questions than on more complex questions.Source: §B.1 · p. 15
• BingAI’s Uber median was 73 for user-generated questions, and 75% of its reference-metric questions scored below 0.Its median varied from 28 to 100 within a policy, while its Airbnb median was 97.75.Source: §B.1 · p. 16