{"id":"https://openalex.org/W4366549958","doi":"https://doi.org/10.1145/3544548.3580637","title":"Investigating Deceptive Design in GDPR\u2019s Legitimate Interest","display_name":"Investigating Deceptive Design in GDPR\u2019s Legitimate Interest","publication_year":2023,"publication_date":"2023-04-19","ids":{"openalex":"https://openalex.org/W4366549958","doi":"https://doi.org/10.1145/3544548.3580637"},"language":"en","primary_location":{"id":"doi:10.1145/3544548.3580637","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3544548.3580637","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3544548.3580637","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3544548.3580637","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5009074508","display_name":"Lin Kyi","orcid":"https://orcid.org/0000-0002-4753-3889"},"institutions":[{"id":"https://openalex.org/I4210096592","display_name":"Max Planck Institute for Security and Privacy","ror":"https://ror.org/00bj0r217","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210096592"]}],"countries":["DE"],"is_corresponding":true,"raw_author_name":"Lin Kyi","raw_affiliation_strings":["Max Planck Institute for Security and Privacy, Germany"],"raw_orcid":"https://orcid.org/0000-0002-4753-3889","affiliations":[{"raw_affiliation_string":"Max Planck Institute for Security and Privacy, Germany","institution_ids":["https://openalex.org/I4210096592"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013973517","display_name":"Sushil Ammanaghatta Shivakumar","orcid":"https://orcid.org/0000-0002-7042-7232"},"institutions":[{"id":"https://openalex.org/I4210096592","display_name":"Max Planck Institute for Security and Privacy","ror":"https://ror.org/00bj0r217","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210096592"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Sushil Ammanaghatta Shivakumar","raw_affiliation_strings":["Max Planck Institute for Security and Privacy, Germany"],"raw_orcid":"https://orcid.org/0000-0002-7042-7232","affiliations":[{"raw_affiliation_string":"Max Planck Institute for Security and Privacy, Germany","institution_ids":["https://openalex.org/I4210096592"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065745449","display_name":"Cristiana Santos","orcid":"https://orcid.org/0000-0003-0712-2038"},"institutions":[{"id":"https://openalex.org/I193662353","display_name":"Utrecht University","ror":"https://ror.org/04pp8hn57","country_code":"NL","type":"education","lineage":["https://openalex.org/I193662353"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Cristiana Teixeira Santos","raw_affiliation_strings":["School of Law, Utrecht University, Netherlands"],"raw_orcid":"https://orcid.org/0000-0003-0712-2038","affiliations":[{"raw_affiliation_string":"School of Law, Utrecht University, Netherlands","institution_ids":["https://openalex.org/I193662353"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058923617","display_name":"Franziska Roesner","orcid":"https://orcid.org/0000-0001-8735-4810"},"institutions":[{"id":"https://openalex.org/I201448701","display_name":"University of Washington","ror":"https://ror.org/00cvxb145","country_code":"US","type":"education","lineage":["https://openalex.org/I201448701"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Franziska Roesner","raw_affiliation_strings":["Paul G. Allen School of Computer Science & Engineering, University of Washington, United States"],"raw_orcid":"https://orcid.org/0000-0001-8735-4810","affiliations":[{"raw_affiliation_string":"Paul G. Allen School of Computer Science & Engineering, University of Washington, United States","institution_ids":["https://openalex.org/I201448701"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044488954","display_name":"Frederike Zufall","orcid":"https://orcid.org/0000-0003-4529-1596"},"institutions":[{"id":"https://openalex.org/I4210136328","display_name":"Max Planck Institute for Behavioral Economics","ror":"https://ror.org/02x1q2477","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210136328"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Frederike Zufall","raw_affiliation_strings":["Max Planck Institute for Research on Collective Goods, Germany"],"raw_orcid":"https://orcid.org/0000-0003-4529-1596","affiliations":[{"raw_affiliation_string":"Max Planck Institute for Research on Collective Goods, Germany","institution_ids":["https://openalex.org/I4210136328"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5087294637","display_name":"Asia J. Biega","orcid":"https://orcid.org/0000-0001-8083-0976"},"institutions":[{"id":"https://openalex.org/I4210096592","display_name":"Max Planck Institute for Security and Privacy","ror":"https://ror.org/00bj0r217","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210096592"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Asia J. Biega","raw_affiliation_strings":["Max Planck Institute for Security and Privacy, Germany"],"raw_orcid":"https://orcid.org/0000-0001-8083-0976","affiliations":[{"raw_affiliation_string":"Max Planck Institute for Security and Privacy, Germany","institution_ids":["https://openalex.org/I4210096592"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5009074508"],"corresponding_institution_ids":["https://openalex.org/I4210096592"],"apc_list":null,"apc_paid":null,"fwci":14.6433,"has_fulltext":true,"cited_by_count":26,"citation_normalized_percentile":{"value":0.98868835,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"16"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},"topics":[{"id":"https://openalex.org/T11045","display_name":"Privacy, Security, and Data Protection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13364","display_name":"Digitalization, Law, and Regulation","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ambiguity","display_name":"Ambiguity","score":0.7957944869995117},{"id":"https://openalex.org/keywords/general-data-protection-regulation","display_name":"General Data Protection Regulation","score":0.789991021156311},{"id":"https://openalex.org/keywords/enforcement","display_name":"Enforcement","score":0.7009338140487671},{"id":"https://openalex.org/keywords/flexibility","display_name":"Flexibility (engineering)","score":0.6865845322608948},{"id":"https://openalex.org/keywords/european-union","display_name":"European union","score":0.6183927059173584},{"id":"https://openalex.org/keywords/data-protection-act-1998","display_name":"Data Protection Act 1998","score":0.5113796591758728},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.48428601026535034},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.48342859745025635},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.437890887260437},{"id":"https://openalex.org/keywords/law-and-economics","display_name":"Law and economics","score":0.4162508249282837},{"id":"https://openalex.org/keywords/political-science","display_name":"Political science","score":0.36707618832588196},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.3315030336380005},{"id":"https://openalex.org/keywords/law","display_name":"Law","score":0.2996244728565216},{"id":"https://openalex.org/keywords/international-trade","display_name":"International trade","score":0.10068020224571228},{"id":"https://openalex.org/keywords/sociology","display_name":"Sociology","score":0.0899060070514679},{"id":"https://openalex.org/keywords/economics","display_name":"Economics","score":0.08553385734558105}],"concepts":[{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.7957944869995117},{"id":"https://openalex.org/C3090818","wikidata":"https://www.wikidata.org/wiki/Q1172506","display_name":"General Data Protection Regulation","level":3,"score":0.789991021156311},{"id":"https://openalex.org/C2779777834","wikidata":"https://www.wikidata.org/wiki/Q4202277","display_name":"Enforcement","level":2,"score":0.7009338140487671},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.6865845322608948},{"id":"https://openalex.org/C2910001868","wikidata":"https://www.wikidata.org/wiki/Q458","display_name":"European union","level":2,"score":0.6183927059173584},{"id":"https://openalex.org/C69360830","wikidata":"https://www.wikidata.org/wiki/Q1172237","display_name":"Data Protection Act 1998","level":2,"score":0.5113796591758728},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.48428601026535034},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.48342859745025635},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.437890887260437},{"id":"https://openalex.org/C190253527","wikidata":"https://www.wikidata.org/wiki/Q295354","display_name":"Law and economics","level":1,"score":0.4162508249282837},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.36707618832588196},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.3315030336380005},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.2996244728565216},{"id":"https://openalex.org/C155202549","wikidata":"https://www.wikidata.org/wiki/Q178803","display_name":"International trade","level":1,"score":0.10068020224571228},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0899060070514679},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.08553385734558105},{"id":"https://openalex.org/C187736073","wikidata":"https://www.wikidata.org/wiki/Q2920921","display_name":"Management","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3544548.3580637","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3544548.3580637","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3544548.3580637","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3544548.3580637","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3544548.3580637","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3544548.3580637","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/8","display_name":"Decent work and economic growth","score":0.6499999761581421}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4366549958.pdf","grobid_xml":"https://content.openalex.org/works/W4366549958.grobid-xml"},"referenced_works_count":43,"referenced_works":["https://openalex.org/W1763552200","https://openalex.org/W1967039550","https://openalex.org/W2040128470","https://openalex.org/W2123156394","https://openalex.org/W2497080131","https://openalex.org/W2599676162","https://openalex.org/W2618872266","https://openalex.org/W2795529671","https://openalex.org/W2809212282","https://openalex.org/W2883192208","https://openalex.org/W2904027722","https://openalex.org/W2940588539","https://openalex.org/W2943207870","https://openalex.org/W2962940036","https://openalex.org/W2970592824","https://openalex.org/W2970983524","https://openalex.org/W3000190958","https://openalex.org/W3015767612","https://openalex.org/W3017863658","https://openalex.org/W3028613655","https://openalex.org/W3032324689","https://openalex.org/W3080293527","https://openalex.org/W3080917700","https://openalex.org/W3088787638","https://openalex.org/W3094598403","https://openalex.org/W3105350924","https://openalex.org/W3106386337","https://openalex.org/W3123803990","https://openalex.org/W3123972834","https://openalex.org/W3129136847","https://openalex.org/W3145890941","https://openalex.org/W3154337097","https://openalex.org/W3175349171","https://openalex.org/W3202785370","https://openalex.org/W4200251246","https://openalex.org/W4235610140","https://openalex.org/W4247817574","https://openalex.org/W4288072557","https://openalex.org/W4288086176","https://openalex.org/W4288086187","https://openalex.org/W4296935375","https://openalex.org/W4307853476","https://openalex.org/W4390425618"],"related_works":["https://openalex.org/W2917102635","https://openalex.org/W3023256691","https://openalex.org/W2789497412","https://openalex.org/W2883729192","https://openalex.org/W2910484607","https://openalex.org/W2794700933","https://openalex.org/W2901967497","https://openalex.org/W3048759155","https://openalex.org/W3000605968","https://openalex.org/W3171079982"],"abstract_inverted_index":{"Legitimate":[0],"interest":[1],"is":[2],"one":[3],"of":[4,24,36,56],"the":[5,12,25,34,45],"six":[6],"grounds":[7],"for":[8],"processing":[9],"data":[10,47],"under":[11],"European":[13],"Union\u2019s":[14],"General":[15],"Data":[16],"Protection":[17],"Regulation":[18],"(GDPR).":[19],"The":[20],"flexibility":[21],"and":[22,41],"ambiguity":[23],"term":[26],"\"legitimate":[27],"interests\"":[28],"can":[29,52],"be":[30,53],"problematic;":[31],"coupled":[32],"with":[33],"lack":[35],"enforcement":[37],"from":[38,44],"legal":[39],"authorities":[40],"different":[42],"interpretations":[43],"various":[46],"protection":[48],"authorities,":[49],"legitimate":[50],"interests":[51],"taken":[54],"advantage":[55],"as":[57],"a":[58],"loophole":[59],"to":[60],"collect":[61],"more":[62],"user":[63],"data.":[64]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":16},{"year":2023,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}