arXiv cs.CY· Eman Alashwali, Abeer Alhuzali·· 2 天前AI 评分22
沙特电商网站 PDPL 合规性评估：人类与 LLM 分析的发现与经验
Evaluating PDPL Compliance in E-Commerce Websites: Insights and Lessons Learned from Human and LLM Analyses
AI 导读
研究分析了 100 个在沙特运营的电商网站对 PDPL 的合规情况，仅 31% 的网站在隐私政策中声明了数据保留期限、数据销毁权、数据副本获取权和投诉机制全部四项。排名靠前及托管于本地电商平台的网站不合规率显著更高。研究还使用 GPT-5 探索 LLM 自动化分析隐私政策的潜力。
正文 · 原文
Abstract:In 2024, Saudi Arabia's Personal Data Protection Law (PDPL) came into force. However, little work has been done to assess its implementation. In this paper, we analyzed 100 e-commerce websites operating in Saudi Arabia against the PDPL, examining the presence of a privacy policy and, if present, the policy's declarations of four items pertaining to personal data rights and practices: 1) personal data retention period, 2) the right to request the destruction of personal data, 3) the right to request a copy of personal data, and 4) a mechanism for filing complaints. Our results show that, despite national awareness and support efforts, a significant fraction of e-commerce websites in our dataset are not fully compliant with the examined PDPL requirements at the privacy policy level: only 31% of websites in our dataset declared all four examined items in their privacy policies. Second, the majority of top-ranked e-commerce websites in our dataset (based on search results order) and those hosted on local e-commerce hosting platforms exhibited significantly higher non-compliance rates than mid- to low-ranked websites and those not hosted on local e-commerce platforms. Third, we explored the use of Large Language Models (LLMs) as an automated tool for privacy policy analysis to measure compliance with the PDPL, using the GPT-5 model. We highlight the potential of LLMs and suggest considerations that can inform future benchmarks aimed at improving LLM-based automated analysis for privacy policies. Our results provide a step forward in understanding implementation barriers to data protection laws, especially in non-Western contexts. We provide recommendations for policymakers, regulators, website owners, and developers seeking to improve data protection practices and automate compliance monitoring.
| Subjects: | Human-Computer Interaction (cs.HC); Computers and Society (cs.CY) |
| Cite as: | arXiv:2602.18616 [cs.HC] |
| (or arXiv:2602.18616v5 [cs.HC] for this version) | |
| https://doi.org/10.48550/arXiv.2602.18616 arXiv-issued DOI via DataCite |
|
| Journal reference: | IEEE Access, vol. 14, pp. 147622-147642, 2026 |
| Related DOI: | https://doi.org/10.1109/ACCESS.2026.3730247
DOI(s) linking to related resources |
Submission history
From: Eman Alashwali [view email]
[v1]
Fri, 20 Feb 2026 21:13:58 UTC (205 KB)
[v2]
Thu, 26 Feb 2026 21:56:24 UTC (205 KB)
[v3]
Tue, 31 Mar 2026 21:01:00 UTC (392 KB)
[v4]
Sun, 4 Oct 2026 16:48:57 UTC (312 KB)
[v5]
Thu, 15 Oct 2026 14:18:59 UTC (312 KB)
来源：arXiv cs.CY · arxiv.org