Do We Really Know Where Our Data is Going?

A Reflection on Contextual Integrity and Its Potential in Bangladesh

Endless Terms & Conditions

We all do it. Whenever a new app asks for permissions, we hit “I Agree” without reading a single line. Privacy policies are usually so long and packed with legal jargon that reading them feels like an impossible task.

Recently, I read a research paper titled “Going Against the (Appropriate) Flow: A Contextual Integrity Approach to Privacy Policy Analysis” by Yan Shvartzshnaider and his team [1]. This paper completely changed how I look at privacy policies. Here is my reflection on the most interesting, surprising, and thought-provoking takeaways from this study, complete with visual concepts, code, and local applications for Bangladesh.

Figure 1: The illusion of informed consent—blindly agreeing to terms we rarely read or understand.

1. The Most Interesting Thing: Treating Privacy as a Formula

The most fascinating idea in this paper is the use of the Contextual Integrity (CI) framework to analyze privacy statements [1]. Instead of viewing privacy policies as endless walls of legal text, the authors show that every data collection sentence can be broken down into five core parameters [1]:

1. Sender: Who is sending the data? [1]
2. Recipient: Who is receiving the data? [1]
3. Subject: Whose data is it? (Usually the user) [1]
4. Attribute: What type of data is being shared? [1]
5. Transmission Principle: Under what condition is it shared? (e.g., with consent or legally required) [1]

Figure 2: The 5-Tuple Contextual Integrity framework visualized.

Making it Tangible with Data

To see how clean this approach is, consider how a single policy statement transforms into a structured JSON data object:

{
  "policy_statement": "Advertisers may send Facebook your off-platform purchase history using our social plugins.",
  "contextual_integrity_5_tuple": {
    "sender": "Advertisers / Third-party Apps",
    "recipient": "Facebook",
    "subject": "User",
    "attribute": "Off-platform Purchase History",
    "transmission_principle": "Via Social Plugins / SDKs"
  }
}

Relevance to Bangladesh:

As Bangladesh advances its digital footprint and drafts its own Data Protection Act, local tech platforms (like mobile financial services and ride-sharing apps) are processing massive amounts of user data daily. Using this 5-parameter model, regulators and developers in Bangladesh could easily audit local privacy policies to see if companies are truly being transparent or hiding behind vague language like “we may share certain data as needed” [1].

2. The Most Surprising Thing: The Trap of “Parameter Bloating”

I used to think that a longer privacy policy meant the company was being more thorough and transparent. This paper proved me completely wrong through a concept called Parameter Bloating [1].

Get Md Abu Rayhan Prince’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The researchers showed that tech companies often list multiple senders, recipients, and attributes inside a single sentence [1]. While it looks like they are giving you details, it actually creates a mathematical nightmare [1].

Figure 3: Parameter Bloating—a single sentence exploding into hundreds of possible data flows

The Math Behind the Confusion

In one real example from Facebook’s policy, a single sentence contained 3 senders, 1 subject, 6 attributes, 1 recipient, and 7 transmission principles [1]. We can write a simple Python script to calculate how many possible data-sharing combinations that create:

# Calculating parameter bloating permutations from one policy sentence
senders = ["Advertisers", "Developers", "Publishers"]  # 3
recipients = ["Facebook"]  # 1
subjects = ["User"]  # 1
attributes = [
    "Device Info",
    "Websites Visited",
    "Purchases",
    "Ads Seen",
    "Usage Data",
    "Location",
]  #6 attributes
transmission_principles = [
    "Plugins",
    "API",
    "SDK",
    "Pixel",
    "Login",
    "Logged Out",
    "Logged In",
]  #7 transmission principles

# Permutations calculation
total_combinations = (
    len(senders)
    * len(recipients)
    * len(subjects)
    * len(attributes)
    * len(transmission_principles)
)

print(f"Total possible data flows: {total_combinations}")
# Output: Total possible data flows: 126

That is 126 possible data flows from a single sentence [1]. Some sentences in the study even created up to 492 combinations [1].

Action Steps for Bangladesh:

This high cognitive load makes it impossible for an average user to understand their privacy choices [1]. In Bangladesh, where digital literacy varies widely, local startups should avoid dumping long, bloated text on users. Instead, UI/UX designers can present privacy terms in simple visual tables that clearly separate who gets what data and why.

3. An Unanswered Question: Cultural Privacy Norms

After absorbing the paper, one major question remained on my mind:

“How well does this Contextual Integrity model — which relies heavily on societal norms — align with the unique cultural context of Bangladesh?”

Figure 4: Individualistic Western privacy norms vs. collective social structures in Bangladesh.

Why this question arose:

Contextual Integrity states that privacy is violated when data sharing breaks established societal expectations [1]. However, this framework was designed primarily around Western privacy concepts. Bangladesh has a deeply collective society where personal boundaries, family involvement, and community sharing operate differently than in Western nations. What might be seen as a privacy breach in New York might be considered normal helpfulness in Dhaka.

Steps to find the answer:

To explore this gap, I plan to create a small survey presenting different digital scenarios to smartphone users in Bangladesh. For example: “How do you feel if a local delivery app shares your order habits with a neighboring vendor to offer family discounts?” By mapping out these responses, we can begin defining local digital privacy expectations instead of blindly adopting Western frameworks.

Final Thoughts

Privacy policies should not be legal shields designed to confuse us. Breaking them down into clear, contextual flows gives control back to the user [1]. As Bangladesh continues its digital growth, adopting structured frameworks like Contextual Integrity can help build a safer, more transparent internet for everyone.

Reference

[1] Y. Shvartzshnaider, N. Apthorpe, N. Feamster, and H. Nissenbaum, “Going against the (appropriate) flow: A contextual integrity approach to privacy policy analysis,” in Proceedings of the AAAI Conference on Human Computation and Crowdsourcing, vol. 7, pp. 162–170, 2019, doi: 10.1609/hcomp.v7i1.5266.