P-VERITAS: Privacy Verification and Traffic Analysis System

In today’s interconnected digital landscape, web services often leak personal data to third parties, track user behaviour, and erode the fundamental right to digital autonomy. Preventing services from processing personal data in ways that violate privacy principles is a key concern for organisations, regulators, and individuals. Validating actual data processing behaviour against stated privacy documentation is therefore an important part of privacy assessment. However, technical verification is often time-consuming, error-prone, and requires specialist knowledge.

To alleviate this, I designed and developed P-VERITAS (Privacy VERIfication and Traffic Analysis System), a novel, open-source, AI-enhanced tool designed to support technical privacy assessments. P-VERITAS assists privacy investigators in analysing network traffic, identifying personal data flows, mapping endpoints, detecting tracking behaviours, and cross-referencing observations with privacy documentation to guide evidence-based Data Protection Impact Assessments (DPIAs).

Technical verification in DPIAs traditionally requires manually inspecting thousands of network flows, decoding values, grouping endpoints, and cross-referencing privacy policies, cookie declarations, and subprocessor lists, a process that is time-consuming and error-prone. P-VERITAS automates these tasks into a coherent workflow combining network observation, documentation comparison, and AI-assisted evaluation of privacy risks.

Evaluated across six real-world web service cases, repeated-run analysis, manual benchmarking, and expert review by three privacy technology specialists, P-VERITAS demonstrated solid performance across plausibility, completeness, consistency, traceability, and usefulness. The specialists awarded the prototype a mean System Usability Scale (SUS) score of 73.3, noting it saves time while delivering structured, evidence-based overviews of privacy risks. They also highlighted areas for future work, such as clearer AI explanations and enhanced endpoint visualisations.

Overall, P-VERITAS provides a practical, evidence-based framework for technical privacy assessments. It demonstrates that AI-enhanced network traffic analysis can improve DPIA efficiency and accuracy while maintaining the transparency and traceability required for specialist review.