Privacy Policy Feature Extraction for Direct- to-Consumer Genetic Testing

Background: Direct-to-consumer genetic testing (DTC-GT) has gained popularity in recent years due to social media marketing. However, while DTC-GT services collect highly sensitive genetic and biological data, their privacy policies are often lengthy,
vague and difficult to understand for consumers, leading to privacy concerns. Existing research deals with the analysis of privacy policies in general but there is no domain-specific, automated tool to extract and assess privacy policy content in DTC-GT. This paper aims to close that gap, presenting a framework for the automated analysis of privacy policies of DTC-GT companies using the Longformer model.
Objective: The study focuses on the extraction of content of DTC-GT privacy policies by dividing them into 22 categories adapted to DTC-GT. Furthermore, an evaluation framework across multiple dimensions is developed to assess the extraction of critical privacy related features.
Methods: The model training consists of three steps, including the already existing pretraining of the Longformer model, an unsupervised domain adaption and a supervised fine-tuning. The unsupervised adaption uses 16,062 health-related privacy policies to provide exposure to domain-specific legal terminology. ... mehr29 DTC-GT policies were manually labeled of which 19 were used for the supervised fine-tuning.
Results: The model was evaluated on the 10 remaining manually labeled DTC-GT privacy policies, extracting content into 22 categories (220 possible scores). Since 58 pairs lacked content, 162 scores were analyzed. A custom evaluation assessed completeness, semantic similarity, precision, and information density. Based on weighted scores, results were labeled EXCELLENT (≥ 0.80), FAIR (0.60–0.79), POOR (0.40–0.59), or INADEQUATE (< 0.40). Most extractions (n = 59) were FAIR, 7 were EXCELLENT and 39 POOR. Best results appeared in categories related to company sale (mean = 0.79) and data deletion (mean = 0.72). Weakest in research and storage (means ~0.42). Top companies were 24Genetics (0.76), GenePlanet (0.67), and MyHeritage (0.67). A negative correlation (r = –0.73) between policy length and information density suggests that lengthy, vague policies reduce extraction quality.
Conclusion: The results demonstrate that while the framework effectively extracts policy content, the variability and vagueness within policies pose challenges for achieving consistent semantic and syntactic quality. In addition, by showing that essential content cannot be extracted due to its absence across various categories, significant privacy concerns are underlined.