2.1. Key features of managerialisation of data protection law

Data protection compliance officers (which include DPOs), and a business’s legal professionals play an important gatekeeping and filtering role within businesses, where DPOs are tasked to interpret the GDPR’s obligations into practice (Waldman, Reference Waldman2021). The GDPR infuses these professionals with clear and exclusive competence to determine the law’s meaning for their employer and for users of that business’s services (Art. 37 GDPR concerns the designation of the data protection officer (‘DPO’); Art. 38 GDPR concerns the position of the DPO in an organisation, while Art. 39 GDPR concerns task descriptions of the DPO). A DPO’s interpretations may be operationalised in that businesses’ “best practices” being formalised through, for instance, codes of conduct, terms and conditions, privacy notices, internal privacy protocols, and so forth (Waldman, Reference Waldman2021). These “formalised practices” become, through a managerialisation process of data protection law, in the end points of reference for regulators and courts (Waldman, Reference Waldman2021).

Waldman describes the process of managerialisation of a law through essentially six stages of “legal endogeneity,” a concept minted by Edelman in the context of non-discrimination law (Edelman, Reference Edelman2016). Legal endogeneity in data protection law refers, according to Waldman, to privacy professionals’ developing practical comprehensions of data protection law that might align with multiple societal incentives, but with the bottom line being that the DPO’s interpretations primarily remain manageable, in line with the businesses’ commercial interests, technological constraints, efficiency and cost-saving priorities (Edelman Reference Edelman2016; Norris and L’Hoiry, Reference Norris, L’Hoiry, Norris, de Hert, L’Hoiry and Galetta2017; Waldman, Reference Waldman2021; Mahieu, Reference Mahieu2023). Such interpretations and implementations may subsequently occur as “best practices,” which then become points of reference for courts (Edelman, Reference Edelman2004; Edelman, Reference Edelman2016; Waldman Reference Waldman2021; Mahieu, Reference Mahieu2023). Managerialisation of data protection law, Waldman argues, ultimately results into twisted interpretations undermining compliance.

The process of managerialisation of data protection law often occurs in six steps (Edelman, Reference Edelman2016; Waldman, Reference Waldman2021):

• – First, vague legal provisions in a law may allow DPOs leeway when interpreting and implementing their comprehension of the law. These interpretations are likely applied whenever DPOs (and other legal professionals) co-design technical implementations with technologists (Edelman Reference Edelman2016; Waldman, Reference Waldman2021).

• – Second, DPOs and other legal professionals may create procedural safe harbours for businesses, giving them a process-oriented escape from adherence to substantive legal requirements. Such process-oriented safe harbours may help shield a business from liability. Safe harbours may be established through best practices, codes of conduct, protocols, policies and other practices. Such process-oriented rules may provide a business’s legal professionals, consultants, and compliance experts, besides the DPO, with opportunities to define what the law means and to further fortify the business’s interests (Edelman, Reference Edelman2016; Waldman Reference Waldman2021).

• – Third, DPOs and legal professionals may produce understandings of the law that seemingly comply with their process, with the bottom line that these understandings do not only avoid conflict with the business’s core interests, but also that their readings shape the law’s understanding in such a way that it benefits the business and its interests (Cohen, Reference Cohen2019; Edelman, Reference Edelman2016; Waldman, Reference Waldman2021).

• – Fourth, the DPO’s and legal professionals’ interpretations of the law are operationalised into internal rules primarily adapted to the businesses’ interests and values, leading to compliance becoming managerialised into a set of procedural steps to fit the businesses’ interests and operations (Edelman, Reference Edelman2016; Waldman, Reference Waldman2021).

• – Fifth, this managerialisation of the law gives rise to a “symbolic structure,” implying that the businesses’ reading, as instilled by the DPO, produces legal compliance (Edelman, Reference Edelman2016; Waldman, Reference Waldman2021).

• – Sixth, the managerialised processes finally generate forms of deference to formal compliance structures, where courts may turn to these structures while perceiving these as actual adherence to the law, instead of looking at the law’s substantive compliance requirements (Edelman, Reference Edelman2016; Waldman, Reference Waldman2021).

• – As a last step, interpretations as shaped by the DPO, other legal professionals and technical experts may be operationalised in technical tools, such as DDPs.

The augmented drive towards automating and outsourcing data protection law compliance by way of using DDPs is inherently connected to the managerialisation of privacy law (Waldman, Reference Waldman2021; Mahieu, Reference Mahieu2023). Automating access requests often results in further limiting interpretations of what data protection law demands, given “privacy technologies embody particular visions of what privacy laws require” (Waldman, Reference Waldman2021). This obviously applies to the manner in which DDPs can be used to automate responses to access requests.

Where DPOs participate in developing DDPs, their interpretation of access rights will likely be constrained to what the business considers technically feasible and what can be coded efficiently, meaning that this process may be perceived as a negotiation between what the legal obligation prescribes and what is manageable, particularly within the limits of technology (Norris and L’Hoiry, Reference Norris, L’Hoiry, Norris, de Hert, L’Hoiry and Galetta2017; Mahieu, Reference Mahieu2023). Where a controller’s DDP cannot respond to a subject’s request, controllers may argue that “access requests may be “out of tune” with their policies and processes, and need to be adapted so that both data subject and controller were singing the same tune” (Norris and L’Hoiry, Reference Norris, L’Hoiry, Norris, de Hert, L’Hoiry and Galetta2017).

Such uses of technical tools should however not be misunderstood as being attempts to facilitate requests in a unified and efficient manner; instead, they may reveal an implicit refusal by controllers to accept requests in any format other than the format prescribed by the controller themselves (Norris and L’Hoiry, Reference Norris, L’Hoiry, Norris, de Hert, L’Hoiry and Galetta2017). This also occurred from our empirical findings. Yet, this practice is not compliant with data protection law. As our empirical research will indicate, there are also processes blocking any attempt to obtain individualised answers about a controller’s processing of one’s personal data, as all responses to access requests are pre-modelled, automated and not designed to respond to specific queries (Norris and L’Hoiry, Reference Norris, L’Hoiry, Norris, de Hert, L’Hoiry and Galetta2017). Following our empirical section, we discuss in Section 5 whether the results demonstrate the presence of managerialisation in access rights responses as provided by the online platforms under review.

2.2. Key features of interpretative entrepreneurship

Interpretive entrepreneurship entails businesses to proactively influence and shape how others, i.e., regulators, courts, agencies or the public at large, understand and interpret laws that apply to them (Durkee, Reference Durkee2021). Interpretive entrepreneurship can drive legal change. Durkee elucidates this practice with an example of a trade association actively trying to influence either the legislative process (i.e., through lobbying activities), or through forcefully seeking to shape interpretations of existing international law in contexts of international aircraft financing, of appropriation by claim of sovereignty under the Outer Space Treaty or in the context of front-of-package nutritional labelling (Durkee, Reference Durkee2021).

Notably, interpretive entrepreneurship in the context of adopted law is to be distinguished from a business’s mere defending its interpretation in court in a conflict about non-compliance; instead, interpretive entrepreneurship involves a business’s attempt to proactively influence the interpretation of an existing law, outside contentious contexts.

In the context of the GDPR’s access rights, some businesses were for instance less successful in their interpretive entrepreneurship efforts to push their own interpretations into the legislative process (or lobbying process) of the development of the EDPB’s “Guidelines on the right of access.” The EDPB is the EU oversight body tasked with developing guidance of the GDPR’s norms. Through active lobbying, businesses overtly attempted to influence the interpretation of the right of access, yet others successfully counterbalanced businesses’ understandings of the right to access during the public consultations (Ausloos, Veale and Mahieu, Reference Ausloos, Veale and Mahieu2019).

Businesses have also vigorously tried to shape the right of access since the adoption of the GDPR or EDPB regulatory guidelines, imposing their own de facto interpretations of the right of access and how to operationalise it. Businesses’ proactive shaping of their compliance with the right of access can occur by, for instance, interpreting the right of access in a business-friendly manner whilst convincing data subjects that their comprehension of the right is correct.

Businesses’ interpretations of GDPR compliance may not only occur through legal means in their privacy notices required prior to collecting a data subject’s consent. In the context of access rights, businesses may look to fortify their own interpretations by implementing these into technical means, including DDPs. This way, businesses can try to acquaint or even oblige data subjects to take up these technical means. Meanwhile, they create to opportunities to obfuscate the businesses’ entrepreneurial interpretation of their legal duties through DDPs (Toh, Reference Toh2021; Dewitte and Ausloos, Reference Dewitte and Ausloos2024), because individual data subjects often lack tech-savviness to understand and interpret what such DDP offers them, and whether it complies with their access rights (Giannopoulou et al., Reference Giannopoulou, Ausloos, Delacroix and Janssen2022). Whether interpretive entrepreneurship practices occurred in the context of data access rights will be evaluated after our empirical research in the discussion section.

2.3. Differences and relatedness between concepts

Managerialisation of data protection law and interpretive entrepreneurship share similarities and differences. Managerialisation of data protection law seems ultimately a logic, but, in principle, unintentional corollary of the legal obligation for organisations to establish internal privacy professionals tasked with the interpretation and implementation of some broadly applicable and vague data protection provisions in a business organisational environment. In such environment, professionals may ultimately prioritise commercial interests and values before data protection values if these reduce or constrain the business’s profit interests and values. This way, law is gradually but irrefutably transformed by the very organisational institutions that it is designed to control (Waldman, Reference Waldman2021). Interpretive entrepreneurship prospers primarily through a business’s proactive, intentional act of shaping interpreting access rights vis-à-vis, primarily, data subjects.

At a higher abstraction level, managerialisation and interpretive entrepreneurship show similarities. In both concepts, business’s values—cost reduction, efficiency, commercial interests—may dominate values data protection law seeks to protect, whilst the value proposition of data protection law has shifted from what helps data subjects to what helps businesses (Waldman, Reference Waldman2021). Where tech-driven businesses nowadays establish what data protection law requires and design those requirements into compliance tools, occurs a place where the discourse of law has become the law of engineering—disempowering data subjects while undermining the aim of the law (Breaux et al., Reference Breaux, Vail and Anton2006).

Managerialisation of data access and interpretive entrepreneurship may also be seen as two sides of the same coin, with managerialisation paving the way, i.e., creating conditions, for interpretive entrepreneurship.

2.4. Inadequate regulatory ecosystems

The GDPR’s regulatory ecosystem consists, besides national lawmakers and courts and the EU legislator and the Court of Justice of the European Union (“CJEU”), of 27 national data protection authorities (“DPA”) and the earlier mentioned EDPB, the latter being tasked with monitoring and ensuring correct application of the GDPR across the EU (Art. 70(1) GDPR). Through laws and guidance, the EDPB and national DPA’s aim to shape desired behaviour of businesses. However, inadequacies in the regulatory ecosystem might give rise to opportunities for the managerialisation of data protection law as well as for interpretive entrepreneurship practices. We discuss these next.

The GDPR has open, abstract provisions potentially resulting in ambiguities when applied in concrete situations, making it a law where managerialisation and interpretive entrepreneurship could be expected. These ambiguities may not only apply to regulators or courts enforcing (Golla, Reference Golla2017), but also to controllers having to apply these (Lucas, Fuller and Packard, Reference Lucas, Fuller and Packard2022).

The GDPR’s open-natured transparency obligations and data access rights are often referred to as “principles-based” provisions, allowing regulators to operate flexibly across sectors, situations and technologies (Black et al., Reference Black, Hopper and Band2007). Principles-based provisions, in contrast to prescriptive and detailed rules-based provisions (Maxwell, Reference Maxwell2015), were at the time of the GDPR’s conception considered most appropriate, as the law was designed in the highly dynamic field of emerging technologies, whilst it needed to operate across nearly all societal sectors. The principles-based nature of key provisions enabling data access meant the legislator has left much of their initial interpretation and implementation, as well as compliance with the GDPR’s obligations, to controllers. To compare, the EU legislator also decided to establish “risk-based” provisions pursuing the reduction and management of risks in the GDPR; its risk-based provisions have also meant that the regulator has left much of their primary execution, including the assessment and mitigation of risks, as well as compliance with GDPR’s requirements, to controllers; see for instance Art. 35 GDPR (where controllers are required to perform data protection impact assessments whenever their data processing entails high risks, with the nature of these risks being assessed by the controller themselves).

Second, law enforcement is often supported by some form of regulatory guidance, such as that by the EDPB, clarifying the law’s interpretation, while enforcement itself occurs through proscriptions, prohibitions, bans, sanctions, or penalties, and criteria for enforcing those. But ambiguous law can also be problematic for DPAs to enforce, particularly where 27 DPAs across the EU enforce the GDPR. The EDPB aims to prevent a patchwork of interpretations from occurring by issuing guidance, but the de facto enforcement might be insufficient, imperfect, uncertain, and vary across national DPAs (Lintvedt, Reference Lintvedt2022; Mahieu, Reference Mahieu2023; European Center for Digital Rights, 2024; Lin, Reference Lin2024).

Enforcement issues can occur from a regulator lacking resources to identify and punish all breaches (Pedriana and Stryker, Reference Pedriana and Stryker2004). Inactive or misinterpreted enforcement may open opportunities for businesses to interpret legal compliance as they themselves deem appropriate. Such business practices might particularly emerge in a highly competitive market with businesses wary of waiting for regulatory guidance (Rao and Georgi, Reference Rao and Georgi2006). When a law’s interpretation is broadly agreed amongst regulators but enforcement is weak, businesses might consider exploiting inadequate enforcement to engage in interpretive entrepreneurship (Lintvedt, Reference Lintvedt2022).

Inadequate enforcement can also be politically motivated: public actors might, for instance, choose to not enforce regulation over which they have discretion, for instance, if they cast doubt over the law in question (Shepherd et al., Reference Shepherd, Johansson, Malmström and Wincent2007) or where enforcement is not intuitive given other national economic and policy interests, such as were Big Tech businesses made Ireland their main establishment. The Irish regulator got, however, under attack for not effectively regulating and enforcing the GDPR on these businesses, with criticism coming from NGO’s, members of the European Parliament and member states (Lin, Reference Lin2024). Policymakers can also deliberately reduce resources effectively leading to understaffing of regulatory bodies’ enforcement and yield a “light-touch” approach to regulatory enforcement (Li and Newman, Reference Li and Newman2022).

Yet, over the past years the EDPB and the CJEU have issued respectively a growing body of GDPR-guidance and case law, explicating the vague provisions towards more consolidated interpretations, with the EDPB monitoring and ensuring correct application by DPAs across the EU. These developments are discussed in Section 3.

3.1. Right to information

The GDPR notably requires platform controllers to inform data subjects ex ante about their intentions. Art. 13 GDPR lists the type of information that a privacy notice should comprise whenever personal data is directly captured from the data subject; Art. 14 GDPR prescribes information privacy notices must contain whenever personal data were obtained from other sources. Controllers must inform data subjects about the envisaged personal data they seek to access, and the third parties they might share personal data with (EDPB, 2018a; Dewitte and Ausloos, Reference Dewitte and Ausloos2024). Controllers may inform data subjects through a privacy notice (EDPB, 2018a), which is in principle form-free, but must be written in concise and accessible form, in clear and plain language (Art. 12(1) GDPR). Ex ante information requirements apply regardless of the complexity of the processing operations and are intended to make data subjects aware of the processing operations, understand its purposes and lawfulness, which third parties may share/access their data, and what data rights are available to them.

3.2. Right of access

Most importantly for our purpose here, the GDPR also grants data subjects an ex post right to (i) request confirmation that personal data concerning them are being processed; (ii) individualised details on the relevant processing operations, and (iii) a copy of the personal data involved (Art. 15 GDPR). The right of access provides data subjects, at an individualised level, access to the personal data that are being processed, and information on how. It complements the ex ante transparency provisions, by requiring controllers to communicate granular information about the processing of that specific subject’s personal data (EDPB, 2023, par. 23; RW v Österreichische Post AG 2023a; Zanfir-Fortuna, Reference Zanfir-Fortuna and Kunert2020; Ausloos, Veale and Mahieu, Reference Ausloos, Veale and Mahieu2019).

Controllers need to accommodate access requests within one month, in a concise and intelligible manner using clear and plain language (Art. 12(1)-(3) GDPR). The GDPR entitles subjects to full disclosure (Art. 15(3) GDPR) of all personal data the controller processes regarding them, as well as information on how they do so (EDPB, 2023). The exact list of information that must be communicated upon request is listed in Article 15 and notably includes “a copy of the personal data undergoing processing” (Article 15(3); (Österreichische Datenschutzbehörde 2023c); the specific recipients with whom data have been shared (RW v Österreichische Post 2023a). The right of access cannot be made conditional on a motivation (FT v DW 2023b). Responses to access requests must be complete and can only be restricted in very limited circumstances as permitted by law (Arts. 12(1), 12(5) (manifestly ill-founded or excessive access requests), 15(3), 15(4) and 23 (restrictions); EDPB, 2023).

The GDPR obliges controllers to facilitate data rights exercises by setting up modalities for access (Art. 12(2) GDPR), depending on the way in which data subjects interact with the controller (EDPB, 2018a). Large online platform controllers increasingly operationalise access rights through technical self-service tools, or DDPs (Boeschoten et al., Reference Boeschoten, Araujo, Ausloos, Möller and Oberski2022). While the GDPR does not prescribe the use of DDPs, these can, in theory, be useful tools to communicate information to which data subjects are entitled.

Table 1 lists a selection of information items that controllers are required to share upon request but are in practice generally interpreted and implemented unilaterally by the controller. For instance, a copy of the personal data undergoing processing, or the source from which the personal data originate, needs to be assessed and formulated by the controller, given that these elements are contingent on a controller’s specific data processing purposes and means. Mentioning, for instance, the controller’s identity and contact details or the existence of a right to withdraw someone’s consent does not need interpretation. These items are therefore not included in Table 1.

Table 1.

Selection of items that must be provided to data subjects under Arts. 13-15 GDPR that are subject to interpretation by controllers. The numbers and letters in rackets in the columns under the GDPR Articles refer to the specific paragraphs within the Article mentioned

Table 1. Long description

The table consists of four columns. The first column lists Controller information obligations. The second and third columns are grouped under Ex ante, covering Art. 13 and Art. 14. The fourth column is under Ex post, covering Art. 15.

* Purposes of the data processing: Art. 13 1 c, Art. 14 1 c, Art. 15 1 a.

* Categories of personal data concerned: Art. 14 1 d, Art. 15 1 b.

* Legitimate interests pursued by the controller or third party under Art. 6 1 f: Art. 13 1 d, Art. 14 2 b.

* Recipients or categories of recipients: Art. 13 1 e, Art. 14 1 e, Art. 15 1 c.

* Details on data transfers to third countries: Art. 13 1 f, Art. 14 1 f, Art. 15 2.

* Retention period or criteria: Art. 13 2 a, Art. 14 2 a, Art. 15 1 d.

* Right to request access, rectification, erasure, objection, and portability: Art. 13 2 b, Art. 14 2 c.

* Right to withdraw consent under Art. 6 1 a or 9 2: Art. 13 2 c, Art. 14 2 b.

* Source of personal data and publicly accessible sources: Art. 14 2 f, Art. 15 1 g.

* Existence of automated decision-making and profiling under Art. 22 1 and 4: Art. 13 2 f, Art. 14 2 g, Art. 15 1 h.

* A copy of the personal data undergoing processing: Art. 15 3.

3.3. GDPR transparency in practice

Despite the specific list of information items in articles 13–15 GDPR (Table 1), notions of more open principles such as “transparency” and “completeness” have been exploited for interpretive entrepreneurship. Over the years, though, the CJEU, the EDPB as well as member state courts and national supervisory authorities have issued authoritative interpretations in court cases and regulatory guidance. For example, the CJEU confirmed in 2023 that the right of access entitles data subjects to be informed of the identity of the specific recipients to whom their personal data will be or might have been disclosed (Österreichische Post 2023a). The CJEU also underscored the importance of ensuring a strong and easy exercise of access rights (FashionID 2019; EDPB, 2023). Several member state courts affirmed a subject’s right to be meaningfully informed about the logic involved in a controller’s profiling (Uber Drivers v. Uber (2021a); Ola Drivers v. Ola (2021b); Dun & Bradstreet 2025).

Although adequate compliance with transparency and data access rights is increasingly important to inform and empower individuals, communities, and society more broadly, these rights remain the site of managerialisation and/or interpretative entrepreneurship—despite case law and regulatory guidance:

• • ex-ante: in privacy notice design, i.e., what is included, how is it formulated, how is it presented, and/or

• • ex post: in responses to access rights, i.e., completeness, specificity (individualised information rather than generic).

The presence of mangerialisation of data access rights might be illustrated by the Swedish DPA decision, stating that Spotify did not provide, upon an access request, individualised information about the purposes of the processing for which the subject’s personal data were used, what categories of the subject’s personal data were actually processed, the specific period for which the subject’s personal data were stored, or the specific sources the subject’s personal data were retrieved from, and so forth (Integritetsskydds myndigheten (Swedish Privacy Protection Authority) 2025). In short, information present in Spotify’s DDP contained generic, standardised information, instead of individualised information to which subjects are entitled.

To repeat, managerialisation of access rights occurs through a business’s privacy professionals and internal compliance practices translating legal obligations into business-friendly interpretations prioritising efficiency, cost reduction, and commercial interests. In this process, data protection compliance shifts from substantive adherence to procedural conformity. Automation through DDPs reinforces this shift by embedding narrow, efficiency-driven interpretations of access rights into technology—the DDP. As a result, Spotify’s responses are standardised, automated and limited to controller-defined formats, often preventing individualised responses, reflecting the presence of managerialisation of data access rights.

Interpretive entrepreneurship came to light in, for instance, the context of Netflix’s non-personalised and incomplete responses to a subject’s access requests (Autoriteit Persoonsgegevens, 2024). Netflix provided too little information to subjects, as the information provided was unclear about the following aspects: the purposes of and the legal basis for collecting and using personal data (Art. 15(1)(a) GDPR); which personal data were shared by Netflix with third parties, and why this was precisely done (Art. 15(1)(c) GDPR); how long Netflix retained the data (Art. 15(1)(d) GDPR); and how Netflix ensures that personal data remain safe when transmitting them to countries outside the EU (Art. 15(2) GDPR; EDPB, 2025).

Netflix argued that the transparency obligations arising from the GDPR contain open norms, and that, being aware of that the EDPB’s guidelines provided a more detailed interpretation, “Netflix had a certain degree of latitude to communicate […] the information to be provided for this purpose at an appropriate level of transparency,” whereas, according to Netflix, the “stringent approach of the Dutch DPA leads to legal uncertainty for Netflix because it is left in the dark with regard to the way it should act” (Autoriteit Persoonsgegevens, 2024, paras 11 and 12). This line of argument indicates the business’s effort to actively shape, vis-à-vis the regulator, the meaning and application of their transparency obligations to their advantage, i.e., exploiting legal ambiguity and promoting favourable interpretations even after publications of the EDPB’s guidance on both transparency (EDPB, 2018a) and access rights (EDPB, 2023).

We derive that there may be intention towards interpretive entrepreneurship behind this proactive processing from the fact that the EDPB already issued detailed guidelines stipulating how transparency obligations under the GDPR (EDPB, 2018a) must be complied with, and from the fact that Netflix’s data processing remains mostly unclear for most data subjects: as Netflix’s privacy notices and responses do not properly inform subjects, no questions may arise. Average users of online platforms are generally hardly in a position to bring non-compliance to light and to start proceedings (Giannopoulou et al., Reference Giannopoulou, Ausloos, Delacroix and Janssen2022). It took NOYB, a privacy and data protection expert organisation, to file a complaint at the Austrian DPA (Schrems 2015).

In recent years, several empirical studies have exposed issues with the interpretation, operationalisation and compliance of the GDPR’s transparency provisions (Mahieu et al., Reference Mahieu, Asghari, Parsons, van Hoboken, Crete-Nishihata, Hilts and Anstis2021; Potter et al., Reference Potter, Corren, Garrido and Hoofnagle2023; Dewitte and Ausloos, Reference Dewitte and Ausloos2024). Regarding controller interpretations and applications of GDPR’s ex ante obligations, various technical studies into smartphone app data leakages have demonstrated non-compliance with these obligations; i.e., discrepancies between privacy notices and leaked data (Kollnig et al., Reference Kollnig, Binns, Kleek, Zhao, Lyngs, Tinsman and Shadbolt2021; Kollnig et al., Reference Kollnig, Binns and Shadbolt2022; Krämer, Reference Krämer2024). Other studies revealed numerous issues with how ex post access rights are operationalised; i.e., communications being inadequate, the form of responses being inconsistent, or controllers not complying with the GDPR’s completeness requirements (Adamu Habu and Henderson, Reference Adamu Habu and Henderson2023; Hudig et al., Reference Hudig, Mandalari, Norval, Haddadi, Binns and Singh2023; Dewitte and Ausloos, Reference Dewitte and Ausloos2024; Hase et al., Reference Hase, Ausloos, Boeschoten, Pfiffner, Janssen, Araujo, Carrière, de Vreese, Haßler, Loecherbach, Kmetty, Möller, Ohme, Schmidbauer, Struminskaya, Trilling, Welbers and Haim2024). In this article, we aim to provide further evidence of such discrepancies, using an empirical study designed to investigate managerialisation and interpretative entrepreneurship.

4.1. Data and methods

The data for both studies originate from DDPs and the corresponding privacy notices of eight major social media online platforms. We selected these 8 platforms as these are commonly used in current data donation studies (Hase et al, Reference Hase, Ausloos, Boeschoten, Pfiffner, Janssen, Araujo, Carrière, de Vreese, Haßler, Loecherbach, Kmetty, Möller, Ohme, Schmidbauer, Struminskaya, Trilling, Welbers and Haim2024), for research into specific platforms see Meta including Facebook (Couto and Garimella, Reference Couto and Garimella2024; Keusch et al., Reference Keusch, Pankowska, Cernat and Bach2024; Kmetty et al., Reference Kmetty, Stefkovics, Számely, Deng, Kellner, Pauló, Omodei and Koltai2025) and Instagram (Razi et al., Reference Razi, Alsoubai, Kim, Naher, Ali, Stringhino, De Choudhury and Wisniewski2022; Van Driel et al., Reference Van Driel, Giachanou, Pouwels, Boeschoten, Beyens and Valkenburg2022); Google including Google search (Reber et al., Reference Reber, Krafft, Krafft, Zweig and Couturier2020; Welbers et al., Reference Welbers, Loecherbach, Lin and Trilling2024), Google Semantic Location History and YouTube; Netflix (Van Es and Nguyen, Reference Van Es and Nguyen2025; Kreling et al., Reference Kreling, Dietrich, Gilbert and Reinecke2026); Spotify (Silber et al., Reference Silber, Breuer, Beuthner, Gummer, Keusch, Siegers and Stier Sand Weiß2022); TikTok (Jurg et al., Reference Jurg, Vis, Picone, Ex, Nieuwenhuizen, Veerbeek, Peeters, Pihl, Choudhury, Kone, Flannagan and Wang2024; Zannettou et al., Reference Zannettou, Nemes-Nemeth, Ayalon, Goetzen, Gummadi, Redmiles and Roesner2024); WhatsApp (Kohne and Montag, Reference Kohne and Montag2024; Chauchard and Garimella, Reference Chauchard, Garimella, Udupa and Wasserman2025; Corten et al., Reference Corten, Boeschoten, Carrière, Jongerius, Struminskaya, Mulder, Zahedi, Najafabadi and Mendrik2025); and X/Twitter (this was an often researched platform as researchers could use the Twitter API, see Sinnenberg et al., Reference Sinnenberg, Buttenheim, Padrez, Mancheno, Ungar and Merchant2017; Trupthi et al., Reference Trupthi, Pabboju and Narasimha2017). All DDPs were collected as part of the study by Carrière et al., (Reference Carrière, Boeschoten, Struminskaya, Janssen, de Schipper and Araujo2024). The authors created two accounts on each platform and used these accounts weekly in January–May 2023.

For each platform, a list of (main) actions to be performed on a platform was constructed, such as create a post, post a comment, send a friend request (see Online Annex A). We refer to those as action lists in the remainder of this article. As a result, functionalities of the platform that were not in the list have not been used. Overall, 263 different actions were performed weekly for 5 months that generated the basis for the analysis. For each platform, one account was only accessed using Android devices, while the other was only accessed using Apple devices. The researchers requested a DDP for each account weekly or biweekly. This resulted in 9–15 DDPs per account (see Carrière et al., Reference Carrière, Boeschoten, Struminskaya, Janssen, de Schipper and Araujo2024 for details on obtained DDPs per account). In this article, we selected a DDP of each platform that was collected between May 15, 2023, and May 25, 2023, as these contained the most recent data.

In addition, we retrieved the privacy notice for each platform effective at the date on which the corresponding DDP was obtained. The privacy notices of each online platform were searched by using a way-back machine (https://web.archive.org). This provided us with the privacy notice valid on the exact date the DDP was obtained; the DDPs and privacy policies are therefore not different in terms of time. The privacy notices can be found in the Online Annex of this article.

In Study 1, we used the complete privacy notices. For Study 2, we were only interested in the privacy notice sections in which the platforms describe the exact data that they collect about their users. Based on the descriptions in these sections, we compiled a list of data types that they claim to collect for each platform, using the same wording as the platforms used in their privacy notice. Examples of data types are “messages sent,” “post made,” and “login information.” In the remainder of this article, these lists of data types are referred to as “description lists” (see Online Annex B).

4.2. Privacy notices & DDPs (Study 1)

4.2.2. Results—evaluation of the privacy notices

The results of our evaluation of the platforms’ privacy notices are summarised in Table 2.

Table 2.

Evaluation of the presence of each GDPR element in platforms’ privacy notices

Table 2. Long description

The table consists of 8 rows of G D P R provisions and 8 platform columns.

1. Purposes of data processing (13 1 c, 14 1 c): Present for Facebook, Instagram, Netflix, Spotify, WhatsApp, and X/Twitter. Unclear for Google and TikTok.

2. Categories of personal data (14 1 d): Present for Netflix, Spotify, and TikTok. Unclear for Facebook, Google, Instagram, WhatsApp, and X/Twitter.

3. Legitimate controller interests for processing (13 1 d, 14 2 b): Present for Netflix, Spotify, TikTok, WhatsApp, and X/Twitter. Unclear for Facebook, Google, and Instagram.

4. Recipients or categories of recipients (13 1 e, 14 1 e): Present for all eight platforms.

5. Data transfers to third countries (13 1 f, 14 1 f): Present for all platforms except Google, which is Unclear.

6. Retention periods (13 2 a, 14 2 a): Present for Facebook and Instagram. Unclear for Google, Netflix, Spotify, TikTok, WhatsApp, and X/Twitter.

7. Sources of data (14 2 f): Present for Facebook, Instagram, Netflix, Spotify, TikTok, and X/Twitter. Unclear for Google and WhatsApp.

8. Presence of Automated Decision Making (13 2 f, 14 2 g): Unclear for all eight platforms.

We first introduce each GDPR element followed by relevant findings from our evaluation analysis.

Under the GDPR, information about the purposes of data processing should be specific and explicit Art. 5 (1)(b) GDPR. We noted that Facebook, Instagram, Netflix, Spotify, WhatsApp and X/Twitter stipulate sufficiently specific and explicit information in their privacy notices. Google was categorised as unclear, as this platform lists a range of purposes for all of its services (e.g., YouTube, Google Search, Google Fit) without specifying which purpose applies to which service. TikTok was categorised unclear as well, because it listed several open-formulated purposes (operate, provide, develop and improve the platform) followed by “including,” the latter suggesting an open, non-exhaustive list of purposes. The GDPR requires the processing purposes to be specific. “We use your information to operate, provide, develop and improve the platform, including for the following purposes.” The term “including” again indicates that the platform does not provide a specific and exhaustive list of data processing purposes.

The GDPR requires controllers to specify the categories of personal data they aim to collect and process. The GDPR does not prescribe a predefined taxonomy of different personal data types, but it acknowledges so-called special category data, the processing of which poses significant risks to someone’s fundamental rights such as privacy or non-discrimination. Processing data revealing, for instance, a person’s ethnicity, sexual preference or political opinion is generally prohibited, unless the data subject has given their explicit consent (or under several other restrictive requirements as specified in Art. 9(2) GDPR).

Six of the platforms’ privacy notices list categories of user data they collect and process in an unclear manner. For instance, Facebook uses ambiguous language by non-exhaustively describing the data categories they process. Their use of the term “such as” gives rise to uncertainty about the exact data they gather. In another example, Google provides one single privacy notice for a range of platforms (e.g., YouTube, Google Fit, Google Search); it therefore remains unclear what categories of data are exactly processed whenever one of Google’s services is used. Facebook and Google’s privacy notices are therefore not compliant, as they operationalise diluted interpretations of GDPR’s ex ante information requirements. TikTok’s privacy notice acknowledges that it processes personal data “such as,” leaving the type of personal data processed open.

Controllers can process personal data if this is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where these interests are overridden by the interests or fundamental rights of data subjects (Art. 6(1)(f) GDPR). Controllers must mention the specific purposes they pursue (e.g., fraud detection, commercial purposes) in their privacy notice. Seven platforms, except Google, describe in their privacy notices what legitimate interests they follow whenever they process data based on this lawful ground, implying that their privacy notices at this point comply with the GDPR. Google’s privacy notice scores at this point “unclear” as it lists legitimate interests in a non-exhaustive manner (“we process your information for things like”).

The GDPR’s transparency requirements oblige controllers to provide data subjects with information as concrete as possible about the (categories of) recipients. Controllers should thus name the recipients, unless it is only possible to indicate the category of recipients (EDPB, 2023; Österreichische Post AG 2023a). Where the identity of recipients is unknown at the time of formulating the privacy notice, controllers must inform subjects about possible categories of recipients (e.g., “advertisement brokers”) in respect of the principles of transparency and fairness (Arts. 13(1)(e) and 14(1)(e); EDPB, 2018a).

All platform privacy notices present recipients with whom personal data may be shared with, with recipients being described in generic categories (e.g., “advertisers” or “partners using our analytic services”). All platforms except Facebook also describe what data categories are shared with each category of recipients. The GDPR’s ex ante requirement indeed permits controllers to mention categories, however, when responding to ex post access requests, controllers must provide subjects specific, individualised information.

Platform controllers must, where possible, inform data subjects about the envisaged data retention period. If this is not possible, the criteria used to determine that period must be provided (EDPB, 2023). If the time of deletion of information cannot be specified, the duration of storage periods and the beginning of this period or the triggering event (e.g., termination of a contract, expiration of a warranty period, etc.) must be described (EDPB, 2023). Statements such as “deletion after expiry of the statutory storage periods” are not sufficient (EDPB, 2023). Whenever personal data are subject to different deletion periods (given that not all data is subject to legal storage obligations), the deletion periods must be stated in relation to the respective processing operations and categories of data (EDPB, 2023).

Six platform privacy notices provide information about data retention, but none of them explicitly describe the retention period for each of the data types they collect, so we evaluated their notices as Unclear. Facebook and Instagram’s notices do not contain specific terms but describe in what contexts and uses help specify data retention periods.

Whenever a data controller transfers personal data to third countries or international organisations (i.e., those outside the GDPR’s scope of application), controllers must provide information about the existence or absence of an adequacy decision by the European Commission, or refer to other appropriate safeguards, such as whenever binding corporate rules (“BRC”) apply. Most platforms describe in their privacy notice a general mention that data is transferred to third countries, and refer, where that applies, to the relevant European Commission adequacy decision or to BRC. The privacy notice of Netflix (in Dutch) points to the “UK GDRP (sic) legislation and Netflix’s international policies,” raising questions why the EU GDPR is not mentioned, whereas neither adequacy decisions nor BRC are referred to. We therefore evaluate Netflix as “Unclear.”

The GDPR distinguishes between two sources of data through which controllers can obtain personal data: directly from the data subject, or indirectly, via another source. Where data are obtained indirectly, controllers should indicate in their privacy notice from which source the data originate, and if applicable, whether the data came from publicly accessible sources. All platform privacy notices distinguish between personal data collected directly from data subjects and data that is collected via partners or public information.

Last, data subjects are entitled to be meaningfully informed about the existence and underlying logic of automated decision-making (“ADM”) including profiling, concerning their personal data, and the envisaged consequences this processing could have for them (EDPB, 2018a; EDPB, 2018b; EDPB, 2023). None of the platform privacy notices explicitly mention ADM or profiling in their data processing, leaving the underlying logic undisclosed. Although users are not informed about ADM, the data-processing activities as described in the platforms’ privacy notices imply its use, particularly for personalising content and services (Facebook, Google, Instagram, TikTok), ads (Instagram, Spotify, X/Twitter) and recommendations (Netflix) across platforms.

Overall, the required information remains most of the time unclear. The results align with problems with transparency and completeness as demonstrated by others (Kollnig et al., Reference Kollnig, Binns, Kleek, Zhao, Lyngs, Tinsman and Shadbolt2021; Kollnig et al., Reference Kollnig, Binns and Shadbolt2022; Adamu Habu and Henderson, Reference Adamu Habu and Henderson2023; Hudig et al., Reference Hudig, Mandalari, Norval, Haddadi, Binns and Singh2023; Dewitte and Ausloos, Reference Dewitte and Ausloos2024; Hase et al., Reference Hase, Ausloos, Boeschoten, Pfiffner, Janssen, Araujo, Carrière, de Vreese, Haßler, Loecherbach, Kmetty, Möller, Ohme, Schmidbauer, Struminskaya, Trilling, Welbers and Haim2024; Krämer, Reference Krämer2024). That said, we argue that the frequent evaluations “Unclear,” in which information is provided in an incomplete or ambiguous manner, may underscore the likelihood of platforms unilaterally interpreting GDPR’s ex ante requirements into their privacy notices as they prefer, arguably creating leeway to circumvent legal obligations. This intention became, for instance, explicit when Neflix defended its interpretation of the GDPR’s ex ante information rights in front of the Dutch DPA:

Netflix argues that the transparency obligations under the GDPR contain open standards. According to Netflix, however, the AP [Dutch Supervisory Authority, 2024, H.J.] appears to apply a more stringent interpretation of those obligations. Although these obligations are further elaborated in the Guidelines of the European Data Protection Board […], Netflix believes that a controller has a certain degree of freedom to communicate the processing of personal data and the information to be provided for that purpose at an appropriate level of transparency […]. Netflix believes that it has aligned its working methods with these obligations and that it therefore complies […]. The AP’s (stringent) interpretation leads to legal uncertainty for Netflix because it remains unclear how it should act (Dutch Supervisory Authority, 2024, nr 11). (Note: this text, originally published in Dutch, was translated into English by the first author).

More generally, unclear privacy notices contrast with the EDPB’s guidelines on Automated processing of personal data (EDPB, 2018a); Transparency (EDPB, 2018b) and Data access rights (EDPB, 2023), where compliance with the GDPR’s ex ante obligations for controllers are explained in a detailed manner (enriched with a range of practical examples). Ignoring these guidelines implies an intentional act of non-compliance. This practice occurs particularly at large online businesses with high-end qualified legal teams, which should be well aware of what a compliant privacy notice requires. One may therefore consider the online platforms’ privacy notices, at the point where elements remain incomplete and/or unclear or are missing, as acts of interpretive entrepreneurship. It is also unobtrusive, because the act is executed in a silent, not-easy-to-discover manner for average online platform users.

The privacy notice, however, is not what we specifically look at; our focus is on interpretive entrepreneurship of legal obligations in GDPR’s ex post requirements, which we discuss next. The platform privacy notice is nevertheless relevant to identify the existence of interpretive entrepreneurship by a platform, with the privacy notice serving as our sole benchmark.

4.2.3. Results—evaluation of inconsistencies of platform DDPs

As discussed, opposite GDPR’s ex ante generic information obligations, online platforms must in their ex post communication provide the data subject access to a complete copy of their personal data being processed by the controller, i.e., granular, individualised information on how, e.g., explaining for what specific and explicit purpose(s) they processed thát data subject’s data (Art. 15(3), EDPB, 2023, para 114). In other words, this ex post obligation typically contrasts with the privacy notice offering generic information applying to all data subjects. That ex post information must, moreover, be communicated in a concise, transparent, intelligible and easily accessible form, using clear and plain language, as required by Art. 12(1). To repeat, the ex post transparency obligations complement the GDPR’s generic ex ante transparency obligations by requiring controllers to communicate granular information. Table 3 presents our evaluation of the information as communicated by eight online platforms.

Table 3.

Evaluation of each platform’s individualised information in DDPs

Table 3. Long description

The table consists of 8 rows of data criteria and 10 columns. The columns are: G D P R Article, Facebook, Google, Instagram, Netflix, Spotify, TikTok, WhatsApp, and X forward slash Twitter.

* Purposes of data processing (15 1 a): Missing for Facebook, Instagram, TikTok, WhatsApp. Unclear for Google, Netflix, Spotify, X forward slash Twitter.

* Categories of personal data (15 1 b): Missing for TikTok. Unclear for all other platforms.

* Recipients or categories of recipients (15 1 c): Missing for Facebook, Google, Instagram, TikTok, WhatsApp. Unclear for Netflix, Spotify, X forward slash Twitter.

* Retention periods (15 1 d): Missing for Facebook, Instagram, TikTok, WhatsApp, X forward slash Twitter. Unclear for Google, Netflix, Spotify.

* Sources of data (15 1 g): Missing for Facebook, Google, Instagram, TikTok. Unclear for Netflix, Spotify, WhatsApp, X forward slash Twitter.

* Automated Decision Making (15 1 h): Missing for Facebook, Google, TikTok, WhatsApp. Unclear for Instagram, Netflix, Spotify, X forward slash Twitter.

* Data transfers to third countries (15 2): Missing for Facebook, Google, Instagram, TikTok, WhatsApp. Unclear for Netflix, Spotify, X forward slash Twitter.

* A copy of the personal data undergoing processing (15 3): Unclear for all eight platforms.

The files in each of the online platform DDPs were scrutinised to determine their compliance with the elements in Art. 15 GDPR that need interpretation. The main findings are presented next.

In their DDP, Facebook, Google, Instagram, TikTok and WhatsApp all provide data subjects with a copy of personal data but without expressing any granular, individualised information. We therefore evaluate the categories of personal data in these platform DDPs as “Unclear” for almost every element.

Facebook, Google, Instagram and WhatsApp do include an index page to their DDP. On this index page, they discuss in a generic manner what kind of data can be found in each of the DDP’s files, but with this generic information, the individualised information the subject is entitled to likely remains incomplete, and therefore “Unclear.”

Instagram’s DDP refers individuals to its folders “autofill_information,” “device information,” “information_about_you,” and “personal information.” The term “autofill” might imply something about categories of data (e.g., referring to capabilities to automatically fill information), yet one is left to speculate what this category means. This is an example of terminology not meeting the requirement of information being communicated in a concise, transparent, intelligible and easily accessible manner, using clear and plain language as prescribed by Art. 12(1) GDPR.

Notably, Facebook’s and Instagram’s index pages are only present in the DDP if the data subject requests a copy in HTML format, meaning that no information about the categories of processed data or guidance in the DDP is provided when this is requested in JSON format. Data subjects are not informed about this difference, meaning that some may have no access at all to information they are entitled to.

Netflix’ DDP offers additional documentation describing purposes of processing, (categories of) recipients, data transfers to third countries, sources of data, and ADM. This description equals the one in the privacy notice, i.e., it does not provide granular, individualised information, i.e. information that is specific to the requesting data subject. Netflix’s documentation also describes what categories of data are present in each file. Again, it remains unclear whether this information is individualised, and hence complete; we therefore evaluate Netflix for the elements mentioned as “Unclear.” The other GDPR elements (legitimate controller interest and retention period) are not discussed in the documentation; we therefore evaluated them as “Unclear.”

Similarly, X/Twitter provides additional “read-me”-documentation in their DDP describing what categories of data can be found in each file. It is however unclear whether this information is individualised. Additionally, X/Twitter’s documentation refers to their privacy notice for more information about purposes of data processing, (categories of) recipients, data transfers to third countries, and sources of data. Information on the retention period is not discussed in the document; we therefore evaluate this information as “Missing.”

Spotify’s DDP provides a document linking to web pages with additional information about a DDP’s content, yet these web pages are exactly equal Spotify’s privacy notice in all GDPR’s elements. Although Spotify’s additional information provision relating to the categories of data is a bit more extensive, we are not sure whether it is complete: this information largely copies the text of Art. 15 GDPR, and remains therefore mostly of a generic nature, meaning that the information is likely not specific about the requesting individual. We therefore evaluated Spotify’s information provision as “Unclear.”

Taken together, we find that none of the online platforms communicates information specified and individualised to the requesting data subject, leaving questions as to whether the completeness requirement is met. Mere cross-referencing to generic information in privacy notices raises further suspicions of controllers circumventing the GDPR’s completeness obligation. Compliance with Art. 12(1) GDPR also requires that controllers communicate information in transparent and accessible ways; yet this also seemed problematic.

Frequent evaluations as “Missing” or “Unclear” moreover highlight the probability of interpretative entrepreneurship being accommodated by using DDPs as the self-proclaimed method for responding to data access requests. We explain this next.

By using their own, constrained interpretations, the online platforms seemingly aim to circumvent the law, while giving the impression that they comply with their obligations under the GDPR. Through this practice, they may try and avoid, for instance, having to invest resources in gathering and sharing information and/or avoid having to open themselves up to critical scrutiny by data subjects, but also to investigative journalists, or academic researchers.

One may arguably have several reasons to consider why interpretive entrepreneurship may apply to these online platforms where access rights are concerned, instead of lack of competence. Generally, the online platforms under scrutiny are nowadays among the most powerful actors in the world, in particular where power and control over data of individual users are concerned. It is no surprise that platform activities are under critical scrutiny, given that their non-compliance has an impact on people (Janssen et al., Reference Janssen, Cobbe and Singh2020). The GDPR, by providing data subjects with rights to access their personal data, explicitly aims to make data processing more transparent to the individual, and to make that processing open to judgement by the data subject and others, including supervisory authorities or courts. Moreover, well-informed data subjects are better positioned to exercise their data rights such as to have their personal data being corrected (Art. 16 GDPR), erased (Art. 17 GDPR), or ported (Art. 20 GDPR) to another controller, or to decide to withdraw their consent or to terminate their contract with a specific platform.

The example of Facebook’s and Instagram’s index pages being present only in the DDP if the data subject explicitly requests a copy in HTML format, instead of also providing similar information in its JSON format without informing subjects about it, is clearly at odds with a platform’s obligation to provide access in a concise, transparent and easily accessible form, meaning that the controller must present the information efficiently and succinctly so that the data subject can understand the information (EDPB, 2023, p.139). As explained in Section 3.3, the CJEU, the EDPB, member state courts and member state supervisory authorities earlier issued authoritative interpretations in court cases and regulatory guidance. Online platforms are expected to know and to apply the law as explicated by these authorities that filled interpretation gaps where access rights are concerned. The current DDP formats do not comply with the GDPR.

Netflix’s DDP offers additional documentation describing purposes of data processing, (categories of) recipients, data transfers to third countries, sources of data, and ADM. Descriptions equalling the privacy notice hardly ever provides individualised information, rendering these practices knowingly non-compliant. The EDPB emphasised that, for instance, information on the purpose needs to be specific as to the precise purpose(s) in the actual case of the data subject, meaning that it is not enough to list the general purposes mentioned in the privacy notice (EDPB, 2023, paras 23, 35, 114).

Information about categories of data should be specified to the data subject’s situation, such that categories that have turned out not to be relevant in the opinion of the requesting subject should be eliminated (EDPB, 2023, p.115). Netflix’s documentation (“Netflix Membership Information Request Response”) describes what categories of personal data are present in each file. It however remains unclear whether this information in the DDP is specified to the data subject’s access request. We therefore evaluate Netflix for the elements “purposes” and “category of data” as “Unclear.” This also applies to the other GDPR elements. Again, online platforms are expected to know how to comply with the law as explicated by the EDPB.

Similarly, X/Twitter provides additional “read-me”-documentation in their DDP describing what categories of personal data can be found in each file. It is however unclear whether this information is individualised. Additionally, X/Twitter’s documentation refers to their privacy notice for more information about purposes of data processing, (categories of) recipients, data transfers to third countries, and sources of data. Information about retention periods is not present in the document; we therefore evaluate this information as “Missing.”

Spotify’s DDP provides a document linking to web pages with additional information about a DDP’s content, yet these web pages are exactly equal Spotify’s privacy notice in all GDPR’s elements. Although Spotify’s additional information provision relating to the categories of data is more extensive, we are not sure whether it is complete as this information is not individualised. We therefore evaluated Spotify’s overall information provision as “Unclear.”

Taken together, we find that none of the platforms communicate individualised information to which subjects are entitled through their DDP, infringing the completeness requirement (Art. 15(3) GDPR), while other providing information do not meet the clear and plain language requirement of Art. 12(1) GDPR. Frequent evaluations as “Unclear” moreover highlights the probability of interpretative entrepreneurship being accommodated using DDPs as the self-proclaimed method for responding to data access requests.

4.3. Completeness of DDPs (Study 2)

4.3.1. Methodology

For the comparison of contents between the privacy notices and the corresponding DDPs, we analysed the platform’s description lists. For each listed data type, we checked the presence of a corresponding activity in the platform’s action list (see Section 4.1) that would logically result in the creation of this data type in the DDP. For example, the action “send a private message” would correspond with the data type “message sent.” For data types that could not be linked to any activity in the action list, it is impossible to determine whether the data were not generated (i.e., the required functionalities of the platform were not used), or if the data are missing from the DDP. Therefore, these data types were excluded from further analysis.

For all data types in the platform’s description list for which we expect data to be present in the DDP (i.e., data for which a corresponding activity was found in the action list or data that is innate to using the platform, such as signup data), we investigated the DDP to find data that corresponded with the description. We next assessed for each DDP whether data were present in the DDP that could not be linked to any of the data types in the corresponding description list.

As data types can be present in the DDP and/or in the privacy notice, four potential outcomes are possible for each data type (Table 4).

1. 1. Consistent data: a data type is described in the privacy notice and present in the DDP. This potentially indicates that a DDP contains a complete data copy, assuming the privacy notice, our benchmark to evaluate the completeness of the DDP, is transparent and complete.

2. 2. Incomplete data: a data type is described in the privacy notice but missing in the DDP, i.e., the DDP contains less information than the privacy notice indicates, meaning that the completeness requirement is not met (assuming that the privacy notice itself is transparent and complete).

3. 3. Non-transparent data: a data type is not described in the privacy notice, but is present in the DDP; i.e., the DDP contains more information compared to the privacy notice. Here, neither the privacy notice nor the DDP meet the transparency requirements.

4. 4. Unknown data: a data type is neither described in the privacy notice, nor present in the DDP, but indications exist that personal data are processed. This applies, for example, to a platform’s monitoring of app-traffic with the aim to identify data leakage (Adamu Habu and Henderson, Reference Adamu Habu and Henderson2023; Hudig et al., Reference Hudig, Mandalari, Norval, Haddadi, Binns and Singh2023; Dewitte and Ausloos, Reference Dewitte and Ausloos2024). A platform’s data collection in this category would clearly violate both the completeness and transparency requirements. Our methodology only allows us to observe the DDP content and privacy notice, so we cannot identify unknown data types in this article.

Table 4.

Four possible categories of controller data types, as reflected in their privacy notice and DDP

Table 4. Long description

The matrix is defined by two axes. The horizontal X axis represents the Privacy Notice, with No on the left and Yes on the right. The vertical Y axis represents the D D P, with No at the bottom and Yes at the top. This creates four quadrants.

* Top-Left Quadrant: Yes in D D P and No in Privacy Notice. This is labeled as Hidden Data, representing data types that are processed but not disclosed to the user.

* Top-Right Quadrant: Yes in D D P and Yes in Privacy Notice. This is labeled as Disclosed Data, representing data types that are both processed and transparently disclosed.

* Bottom-Right Quadrant: No in D D P and Yes in Privacy Notice. This is labeled as False Claims, representing data types that the notice claims are processed but are not found in the D D P.

* Bottom-Left Quadrant: No in D D P and No in Privacy Notice. This is labeled as Irrelevant Data, representing data types that are neither processed nor mentioned.

After evaluating all data types occurring in the platform’s description lists, we contacted platforms whose data types we evaluated as “incomplete.” We followed the instructions provided by the platform’s privacy notice in case of privacy-related questions. Netflix and Spotify provided an e-mail address, TikTok provided a contact form, and all other platforms first provided a contact form and requested us to reply to an e-mail after filling their contact form. In these contact attempts, we requested the platform to provide us with the data types that we evaluated as missing in the DDP.

4.3.2. Results

Figure 1 summarises the comparison between privacy notices and corresponding DDPs. These numbers do not substantively demonstrate which data type belongs to which category. As our aim concerns mere indication of interpretative entrepreneurship being present, we treat each data description as equally important. In Section 2 of the Codebook (https://osf.io/mncrd/) we demonstrate for each platform what data types were classified as consistent, incomplete, or non-transparent data types.

Figure 1.

Percentages of consistent, incomplete, and non-transparent data types per platform. The percentages are relative to the number of total data type descriptions of a platform in their privacy notice and data download package.

Figure 1 Long description

The X axis represents percentages from 0 to 100. The Y axis lists platforms from top to bottom. Each bar is divided into three segments: blue for Consistent data types, orange for Incomplete data types, and grey for Non-transparent data types.

* X forward slash Twitter: Consistent 44 percent, Incomplete 7 percent, Non-transparent 49 percent.

* WhatsApp: Consistent 39 percent, Incomplete 43 percent, Non-transparent 18 percent.

* TikTok: Consistent 62 percent, Incomplete 13 percent, Non-transparent 25 percent.

* Spotify: Consistent 87 percent, Incomplete 6 percent, Non-transparent 7 percent.

* Netflix: Consistent 68 percent, Incomplete 21 percent, Non-transparent 11 percent.

* Instagram: Consistent 42 percent, Incomplete 20 percent, Non-transparent 38 percent.

* Google: Consistent 56 percent, Incomplete 9 percent, Non-transparent 35 percent.

* Facebook: Consistent 41 percent, Incomplete 13 percent, Non-transparent 46 percent.

Most data types can be classified as consistent data types, indicating that these data are present in both the privacy notice and the DDP. The shares of data types classified as consistent data types are still far from 100% (39%–86%), as each platform has data types that are classified as incomplete data types (e.g., passwords, cookie information, and battery information) or non-transparent data types. The proportion of incomplete data types ranges from around 6% (Spotify and X/Twitter) to 43% (WhatsApp). The presence of these inconsistent data types shows that privacy notices and DDPs of the studied platforms have problems in their alignment.

Notably, in the follow-up contact with the platforms through email, we obtained no additional data. Facebook, Instagram, and TikTok never replied to the email. X/Twitter, WhatsApp, and Google did not answer the questions posed in the email; they instead referred to the privacy notice (X/Twitter) or their DDP-requesting process (WhatsApp and Google). Netflix and Spotify indicated in their responses why they were unable to provide the requested data. The anonymised e-mail messages and responses can be found in Section 3 of the Codebook (https://osf.io/mncrd/).

Furthermore, we found that Facebook, Instagram and X/Twitter refer users back to their DDP-requesting process whenever they fill the form to ask data protection or other GDPR-related follow-up questions. Since the platforms both in the contact process and in their e-mail responses refer data subjects back to their DDP as the main method of a data access request, they actively direct data subjects to request data (again) through DDPs. This practice underpins our impression that, given data subjects are not offered alternatives outside the DDP, platforms can actively shape and enforce their own interpretation of their duties under the GDPR by using their DDP.