An AI-powered Chrome extension that analyzes privacy policies in real-time — giving you a risk score (A–F) and color-coded Privacy Nutrition Labels before you hand over your data. Now powered by Google Gemini.
Built as part of Clemson University CPSC4180 (Human-Centered Computing).
| Feature | Status |
|---|---|
| Auto-detects privacy policy pages |  |
| Risk Score (A–F) with sub-factor breakdown | |
| Privacy Nutrition Labels (8 practices, color-coded) | |
| Manual trigger via popup | |
| Secure API key storage (Chrome storage, not hardcoded) | |
| Hover tooltips with per-label detail | |
| Automated summaries (5 categories) | Checkpoint 2 |
| Interactive Q&A | Checkpoint 2 |
| Clause highlighting | Checkpoint 2 |
privacy-shield-extension/
├── manifest.json # Chrome Extension Manifest V3
├── background.js # Service worker — Gemini API calls, key storage
├── content.js # Injected into pages — detects policies, injects sidebar
├── popup.html # Extension popup — API key entry + manual trigger
├── popup.js # Popup logic
├── sidebar.html # Sidebar UI (loaded as iframe)
├── sidebar.css # Sidebar styles
├── sidebar.js # Sidebar logic — renders results
├── icons/ # Extension icons (see setup below)
└── README.md
- Google Chrome (or any Chromium-based browser)
- A Google Gemini API key — uses
gemini-2.0-flash(free, no credit card required)
git clone https://github.com/YOUR_USERNAME/privacy-shield-extension.git
cd privacy-shield-extensionThe extension needs three icon sizes. You can use any placeholder PNGs to start:
# Quick option: generate placeholder icons with ImageMagick (if installed)
convert -size 16x16 xc:#3dd68c icons/icon16.png
convert -size 48x48 xc:#3dd68c icons/icon48.png
convert -size 128x128 xc:#3dd68c icons/icon128.pngOr just drop any three PNG files named icon16.png, icon48.png, icon128.png into the icons/ folder.
- Open Chrome and go to
chrome://extensions - Enable Developer mode (toggle in top-right)
- Click "Load unpacked"
- Select the
privacy-shield-extension/folder - The PrivacyShield icon (
) will appear in your Chrome toolbar
- Click the NutriPolicy icon () in the toolbar
- Paste your
AIza...Gemini API key - Click Save
Navigate to any privacy policy page. The sidebar will appear automatically within ~1 second.
Good test URLs:
- https://www.google.com/privacy
- https://www.facebook.com/privacy/policy/
- https://twitter.com/en/privacy
- https://www.apple.com/legal/privacy/
- https://www.amazon.com/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ
Click the NutriPolicy icon () → "Analyze This Page" to force analysis on any page.
Risk Score (A–F)
| Grade | Meaning |
|---|---|
| A | Strong user protections, minimal collection |
| B | Mostly good, minor concerns |
| C | Mixed — some concerning practices |
| D | Several high-risk practices |
| F | Aggressive collection, sells data, mandatory arbitration |
Sub-factors: Each factor (Data Collection, 3rd-Party Sharing, Retention, User Control, Tracking, Arbitration) is rated Low / Medium / High.
Privacy Nutrition Labels: 8 standardized practices rated as:
- Safe — user-friendly practice
- ● Neutral — standard/unclear
- ● Concern — warrants attention
- ● High Risk — significant privacy concern
Hover over any label tile to see a plain-English explanation.
[Page Content Script]
│ detects privacy policy page
│ extracts policy text
▼
[Sidebar iframe (sidebar.html)]
│ sends ANALYZE_POLICY message
▼
[Background Service Worker (background.js)]
│ retrieves stored API key
│ calls OpenAI gpt-4o-mini
│ parses JSON response
▼
[Sidebar renders results]
The API key is stored in chrome.storage.local — it never touches a server and is not logged anywhere. Policy text is sent to OpenAI's API (same as using ChatGPT).
Per the research protocol, the following will be evaluated:
- AI accuracy: Ground-truth annotations on 20–30 policies; ROUGE + BERTScore + expert Likert ratings
- Risk scoring F1: Target ≥ 0.80 against human-labeled ground truth
- Hallucination rate: Target < 5%
- Usability: SUS with n=6 think-aloud sessions
- Trust calibration: User confidence vs. actual accuracy plot
- Policy text is truncated to ~12,000 characters for API cost control
- Some heavily JavaScript-rendered policy pages may not extract cleanly
- Detection heuristics are keyword-based — may trigger on unrelated pages with "privacy" in the URL
- No caching — each page visit triggers a new API call
This is a research prototype. Issues and PRs welcome. Planned for open-source release post-publication.
PrivacyShield provides AI-generated analysis for informational purposes only. It is not legal advice. Always consult the original policy and a qualified attorney for legal decisions.
MIT