PhD Candidate: Maaz Bin Musa
Abstract
The past decade has marked a significant shift in how users perceive online privacy. As data extraction and tracking practices have intensified, public concern over privacy has grown in parallel, fueling widespread interest in protecting personal information. In response, the privacy research community has developed a range of privacy-enhancing technologies (PETs) aimed at empowering users to safeguard their data. However, many of these tool’s struggle to keep up with evolving web standards and remain limited to client-side (browser-based) analysis.
In parallel, online privacy has emerged as a rare bipartisan policy issue, leading to landmark regulations such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States. These frameworks establish user rights over personal data and impose compliance obligations on data-collecting entities. Despite their significance, regulatory impact has been uneven due to vague statutory language and limited enforcement capacity.
To meaningfully improve the state of online privacy, it is essential to identify who is collecting user data and how it is being shared. Equally important is the development of intelligent, scalable tools to support regulatory oversight. This thesis addresses both challenges in two parts. First, I design tools that increase transparency in the data-sharing ecosystem by identifying data consumers and tracing information flows. Second, I propose automated tools for large-scale compliance auditing. These contributions are grounded in collaboration with legal experts and involve the systematic design and evaluation of regulation-aware tools optimized for real-world deployment. Together, they represent a meaningful step toward enhancing user privacy and strengthening regulatory accountability.
Advisor: Rishab Nithyanand