Heuristic Techniques for Assessing Internet Privacy: A Comprehensive Review and Analysis

While Internet privacy is a subjective term that is challenging to define, describe, and quantify, assessing the level of privacy provided by data processors offering services over the Internet is essential for detecting privacy flaws and enabling continuous improvement. Moreover, assessing Internet privacy is fundamental for estimating the risk of personal data disclosure, the degree of compliance with privacy regulations, and the effectiveness of implemented protection mechanisms. Remarkably, the absence of a standardized criterion for this assessment has led to the proliferation of diverse heuristic techniques applied with different approaches. In this paper, we conduct an in-depth analysis and introduce a novel taxonomy for categorizing existing heuristic techniques to assess Internet privacy. Moreover, we scrutinize various protection mechanisms designed to enhance users’ privacy. We cover this broad topic across all domains of application and levels of automation, considering all relevant papers regardless of publication year, ultimately providing a comprehensive review of this important field of knowledge. Leveraging our proposed classification framework, we systematically organize and categorize 160 papers carefully selected from 934 candidates, elucidating existing gaps and challenges while foreseeing future research directions. Overall, our findings reveal that most studies predominantly rely on information measurement methods for assessing Internet privacy. Although most heuristic techniques are based on automatic mechanisms, they are applied with a clear focus on the traditional use of Internet services through a web browser, demanding more research efforts for other domains. The development of new technologies that incorporate privacy-by-default and include telemetry modules in their architectures will be essential for assessing and enhancing users’ privacy when delivering services over the future Internet.