GPPI: A 527-item GDPR privacy preference bank from 99 articles

Researchers at the University of Central Florida and collaborators have introduced the GDPR-grounded Privacy Preference Item bank (GPPI), a comprehensive measurement instrument designed to modernize how user privacy preferences are assessed. The team started by extracting 669 statements from all 99 articles of the GDPR, then validated them through a two-round expert review that achieved full consensus on accuracy. Semantic clustering grouped these items into 10 parent themes and 87 subthemes, which were then refined via a consensus review with 50 privacy experts (5 per theme) using a 4/5 vote retention threshold. The final bank contains 527 items organized into 9 parent themes and 73 subthemes (18 to 112 items per parent theme, 1 to 29 per subtheme), with a mean pairwise expert agreement of approximately 85%.

Existing privacy measurement instruments such as CFIP, IUIPC, and PAQ predate GDPR by over a decade and focus on general privacy concerns rather than preferences for specific regulatory mechanisms like data portability, erasure, or rights regarding automated decision-making. GPPI fills this gap by enabling researchers and practitioners to measure whether users actually value the protections mandated by GDPR. The bank supports targeted measurement across multiple granularities—from broad themes down to specific subthemes—allowing for nuanced user segmentation and policy evaluation. This work introduces a complementary dimension to privacy research, aligning user preferences directly with regulatory frameworks, and provides a validated, open tool for improving consent interfaces, policy design, and compliance strategies.