Pith. sign in

REVIEW 3 major objections 6 minor 110 references

Developer discussions about privacy-law compliance in open-source repositories concentrate on consent, cookie management, and a few user rights, and they can be organized into a taxonomy of 24 categories across six clusters.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Across 32,820 GitHub issues, developer privacy-law compliance discussions center on consent, user-rights functionality, bugs, and cookies, with erasure, opt-out, and access the most-discussed legal rights.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection A solid, transparent taxonomy paper whose central frequency claims are conditional on issues that mention a law in title/body — worth reviewing, but the sample-frame overstatement needs fixing. the 3 major comments →

arxiv 2512.10618 v2 pith:MQQSRL33 submitted 2025-12-11 cs.SE

Analyzing developer discussions on EU and US privacy legislation compliance in GitHub repositories

Georgia M. Kapitsaki , Maria Papoutsoglou , Christoph Treude , Ioanna Theophilou This is my paper
classification cs.SE
keywords GDPRCCPAprivacy law complianceGitHub issuesopen source softwareuser rightstaxonomydeveloper discussions
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that when open-source developers discuss compliance with privacy laws such as the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), their concerns fall into a small, recurring set of patterns, captured in a taxonomy of 24 categories grouped into six clusters. The authors mined 32,820 closed GitHub issues mentioning these laws, manually coded a representative sample of 1,186 issues, and found that consent, cookies, and functionality for the rights to erasure, opt-out, and access dominate the conversation, while most other statutory rights and principles are rarely mentioned. Law-relevant issues also attract more comments and stay open longer than ordinary issues. If the picture is right, the taxonomy gives practitioners a concrete checklist of where compliance effort actually goes, and it exposes the rights and principles that open-source projects tend to neglect.

Core claim

The central claim is that a taxonomy of 24 discussion categories in six clusters—features/bugs, consent-related, documentation, data storing/sharing, adaptability, and general compliance—accurately describes the concerns open-source developers raise when working on privacy-law compliance in GitHub issues. The authors selected 32,820 issues mentioning privacy laws, filtered them through manual verification and a fine-tuned classifier, and then manually coded 1,186 issues (plus relevant commits and code changes) to build the taxonomy bottom-up. Their key finding is a lopsided distribution: user consent and cookie preference management are the top concerns, followed by bugs in law-related funct

What carries the argument

The central instrument is the 24-category taxonomy itself, derived through iterative bottom-up coding: two coders independently labeled 20% of the sample to propose categories, then coded the remaining 80% against the agreed set, with a third author resolving disagreements. Category frequencies and the cluster structure are what carry every subsequent claim; the RQ2 right/principle analysis supplies the legal vocabulary, and the RQ1 comparison with non-law issues supplies the behavioral contrast, but the taxonomy is the paper's reusable output. Its six clusters map directly onto activities a maintainer would recognize: consent dialogs, cookie banners, erasure flows, policy pages, regional la

Load-bearing premise

The whole analysis rests on treating closed GitHub issues that mention a law's name as a faithful record of the compliance work developers actually did—any compliance effort discussed in pull requests, code comments, external issue trackers, or private channels is invisible to the dataset.

What would settle it

Ask a random sample of maintainers of the 13,227 repositories whether their most time-consuming privacy-compliance work ever appeared in a GitHub issue mentioning the law. If a large share say it happened in code reviews, external trackers, or private discussions, the taxonomy's frequency rankings would not describe real effort. A cheaper version: run the same manual coding on pull requests that mention GDPR or CCPA and check whether the category distribution matches the issue-based one; a mismatch would mean the issue-level picture is systematically skewed.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Practitioners can treat consent handling, cookie preference management, erasure/opt-out/access functionality, and privacy-policy pages as the high-traffic zones of compliance work and allocate review effort accordingly.
  • Because several statutory rights (rectification, restriction of processing, data portability, objection) and most GDPR principles appear rarely, open-source systems may be systematically under-implementing those obligations; educators and policymakers gain a concrete gap list.
  • The finding that law-relevant issues draw more comments and stay open longer than ordinary issues implies that compliance changes are slower and more contentious, so project maintainers should plan extra review bandwidth for them.
  • The nine taxonomy categories with no overlap in prior work (e.g., logging functionality, law compliance tests) give future mining studies finer-grained labels to detect compliance activity that earlier categorizations missed.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper leaves implicit is to turn the 1,186 manually labeled issues into a training set for automatically classifying new issues into the 24 categories, enabling a live view of compliance attention across the open-source ecosystem.
  • The dominance of consent and cookies may reflect the visibility of banner-style interfaces rather than the legal weight of those obligations; a testable extension is comparing issue frequency with actual legal risk, e.g., which categories correlate with regulatory enforcement actions.
  • The taxonomy could be applied to pull requests and code comments, where the paper itself notes much compliance work may happen; if the category distribution shifts there, the issue-based rankings understate true effort for data minimization and security.
  • Since the dataset stops in June 2024, re-running the coding on issues from 2025 onward or on issues mentioning newer laws would show whether the concern distribution is stable or drifting as enforcement evolves.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper mines GitHub issues that mention EU/US privacy laws (GDPR, CCPA, CPRA, DPA), applies filtering, manual verification, and BERT-based binary classification to obtain 32,820 closed, non-bot issues, and then analyzes them to answer three research questions. RQ1 characterizes law-relevant issues and finds they receive more comments and stay open longer than non-law issues. RQ2 uses keyword-based and manual analysis to measure mentions of user rights and principles, finding that right to erasure, right to opt-out, and right to access are most frequent, and that consent and cookies dominate. RQ3 builds a bottom-up taxonomy of 24 concern categories in six clusters, with user consent and user rights functionality as the most common categories. The paper argues the taxonomy is a reusable instrument for practitioners, educators, and researchers.

Significance. If the results hold, this is a useful empirical contribution: it provides a relatively large, openly available dataset and a taxonomy of developer concerns about privacy-law compliance in OSS issue trackers. The study's strengths include two independent coders with reported Cohen's kappa, external expert validation, per-law manual verification with precision estimates, a fine-tuned BERT classifier with reported accuracy, and a replication package. The taxonomy itself is plausible and connects to prior work. However, the prevalence claims—the headline that 'most discussions concern user consent, user rights functionality, bugs and cookie management'—depend on the representativeness of the manual sample, which is currently a load-bearing gap. The statistical analysis of category differences also contains a reporting error. With those issues fixed, the paper would be a solid candidate for publication.

major comments (3)
  1. [§3.7, §4.2, §6] The manual sample for RQ2/RQ3 is drawn only from the 23,063 issues that mention a law in the title or body, excluding the approximately 9,757 issues (about 30% of the 32,820 dataset) where the law is mentioned only in comments. Section 4.2 states the sample is 'approximately 5% of the total of 23,063 issues,' but Section 6 calls it '5% of the whole dataset,' which is inaccurate (1,186/32,820 ≈ 3.6%). More importantly, there is no evidence that comment-only law-mention issues have the same distribution of concerns. The frequency claims in the abstract and RQ3, such as 'most discussions concern user consent, user rights functionality, bugs and cookie management,' are therefore not yet supported for the full dataset. Please either restrict the prevalence claims to the title/body subset, or sample and code comment-only issues to demonstrate that the concern mix is stable.
  2. [§3.3, §4.2 (Table 8)] The keyword lists for rights and principles were refined iteratively using terminology encountered in the same issues that are then counted with those lists. Section 3.3 says keywords were added 'every time a different mention of a user right was encountered' during dataset filtering and manual verification. The paper only reports a comparison of the final list with and without ChatGPT enrichment; it does not compare the initial published list against the final expanded list. This makes it difficult to rule out inflation of the automated RQ2 frequencies. A concrete test would be to report counts using the initial list and the final list separately, or to validate the final list on a held-out sample not used for keyword expansion.
  3. [§4.3 (Kruskal-Wallis tests)] The Kruskal-Wallis tests comparing categories are reported as χ2(2) = 82.588 and χ2(2) = 77.618. With 24 categories, the degrees of freedom should be 23, not 2. This appears to be a typo, but as reported the test statistic and p-value are uninterpretable. Since this analysis underpins the RQ3 finding that 'law violation concerns and design for law compliance trigger more comments' and that categories differ in time-to-close, please correct the degrees of freedom and confirm that the significance conclusion remains valid.
minor comments (6)
  1. [Abstract vs. §4.3] The abstract names the six clusters as 'user rights and consent, compliance implementation, documentation, data storing/sharing, general compliance, and contextual adaptability,' while Section 4.3 names them 'features/bugs, consent related, documentation, data storing/sharing, adaptability, and general compliance.' The terminology should be consistent.
  2. [§6] The statement that the manual sample is '5% of the whole dataset' is arithmetically incorrect; 1,186 is about 3.6% of 32,820. Please correct and reconcile with the 23,063 figure in §4.2.
  3. [Table 8] The automated percentages in Table 8 are computed over 32,820 issues (including comment-only law mentions), while the manual percentages are over 1,110 relevant issues from the title/body subset. This denominator mismatch makes direct automated-versus-manual comparisons misleading. Please clarify the denominators in the table or in the text.
  4. [§4.2] The sentence 'Manual analysis allows for a closer inspection for user rights and showed that it is a more suitable approach' is grammatically awkward and should be rephrased.
  5. [§2.3] Reference [14] is cited with the author name 'Hennig' in the text; the reference list spells it 'Hennig' in [14] but 'Henning' in [28]. Please standardize the spelling.
  6. [§4.3] The paper says six full working days per coder correspond to 2,490 minutes. At 8 hours/day this would be 2,880 minutes, so either the days or the minutes should be adjusted.

Circularity Check

0 steps flagged

No significant circularity: the taxonomy is an inductively derived description, not a fitted prediction, and self-citations are not load-bearing.

full rationale

The paper's derivation chain is empirical and self-contained. RQ1 compares directly collected issue statistics; RQ2 couples a keyword search with a separate manual thematic coding of a representative sample, with the manual analysis independently confirming the automated findings; RQ3 builds a bottom-up taxonomy from the same issues, so the reported category frequencies are descriptive statistics of the coded sample rather than predictions forced by the coding scheme. The only self-referential element is the keyword list in Section 3.3, which was iteratively refined using terminology encountered in the dataset and seeded by the authors' prior work [29,35]; this could affect automated recall, but the paper reports that ChatGPT enrichment made no difference and the main rights findings are corroborated by the manual codings in Section 4.2, so no central claim reduces to its inputs by construction. Section 6 explicitly acknowledges that manual percentages may differ for the full dataset and that external issue trackers, pull requests, and code comments were excluded; that is a selection-bias and generalizability threat, not a circular step. Self-citations [29,35] supply a starting keyword list, not an unverified theorem invoked to force the paper's conclusions. No equation-level, definitional, or fitted-parameter reduction is present.

Axiom & Free-Parameter Ledger

0 free parameters · 3 axioms · 0 invented entities

No free parameters are fitted; this is an empirical study. The load-bearing assumptions are representativeness of GitHub issues as a data source, representativeness of the manual sample, and adequacy of the keyword lists. The keyword-list circularity is the most important ledger item and is partially mitigated by independent manual coding.

axioms (3)
  • domain assumption Closed GitHub issues that mention privacy-law names are a valid proxy for the compliance concerns developers actually act on.
    The entire study uses issue discussions rather than source code execution, industrial trackers, or pull-request discussions to characterize compliance concerns (Sections 1, 3.7, 6).
  • domain assumption The manual sample of 1,186 issues selected from issues with law names in title/body is representative of the full 32,820-issue dataset.
    The taxonomy and the RQ2/RQ3 percentages are derived from this 5% sample; the authors acknowledge in Section 6 that percentages may differ in the full dataset.
  • domain assumption The author-built keyword lists (564 for user rights, 79 for principles) capture the terminology developers use for legal concepts.
    Automated RQ2 counts depend on the completeness of these lists, which were expanded iteratively from the dataset, prior work, and ChatGPT suggestions (Section 3.3).

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Analyzing developer discussions on EU and US privacy legislation compliance in GitHub repositories." pith.science (2026). https://pith.science/paper/MQQSRL33

@misc{pith2026251210618,
  author       = {Pith},
  title        = {Pith review of: Analyzing developer discussions on EU and US privacy legislation compliance in GitHub repositories},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MQQSRL33}},
  note         = {Machine review of arXiv:2512.10618}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Context: Privacy legislation has impacted the way software systems are developed, prompting practitioners to update their implementations. Specifically, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have forced the community to focus on users' data privacy.\\ Objectives: Relying on the vast amount of data on developer issues available in GitHub repositories, our aim is to gather empirical evidence on the issues developers of Open Source Software discuss to comply with privacy legislation.\\ Method: We examined such discussions by mining and analyzing 32,820 issues from GitHub repositories. We partially analyzed the dataset automatically to identify law user rights and principles indicated, and manually analyzed a sample of 1,186 issues based on the type of concern addressed.\\ Results: We devised 24 discussion categories placed in six clusters: user rights and consent, compliance implementation, documentation, data storing/sharing, general compliance, and contextual adaptability. Developers mainly focus on specific user rights from the legislation (right to erasure, right to opt-out, right to access), addressing other rights less frequently, while most discussions concern user consent, user rights functionality, bugs and cookie management.\\ Conclusion: The created taxonomy can help practitioners understand which issues are discussed for law compliance, so that they ensure they address them first in their systems. In addition, the educational community can reshape curricula to better educate future engineers on the privacy law concerns raised, and the research community can identify gaps and areas for improvement to support and accelerate data privacy law compliance.

Figures

Figures reproduced from arXiv: 2512.10618 by Christoph Treude, Georgia M. Kapitsaki, Ioanna Theophilou, Maria Papoutsoglou.

Figure 1
Figure 1. Figure 1: Examples of privacy law compliance discussions in issues (usernames are hidden): [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Methodological process. reported, what issues are reported, by whom, and how developers react. This work analyzed a smaller sample of collected issues and focused on developers’ interaction, and not on the connection with user rights and principles, and specific concerns. 2.4. Relation to previous works Previous works have analyzed privacy issues using other sources of data (e.g., Reddit [7, 8], Stack Over… view at source ↗
Figure 3
Figure 3. Figure 3: Issues per year in dataset. Variable Issue type Mean Std. deviation # comments law-relevant 4.65 30.992 non-law relevant 1.37 5.269 # days issue open law-relevant 69.02 189.235 non-law relevant 38.99 171.609 [PITH_FULL_IMAGE:figures/full_fig_p017_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Privacy law compliance concerns taxonomy. Color bars on the right of each category [PITH_FULL_IMAGE:figures/full_fig_p021_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

110 extracted references · 1 canonical work pages

  1. [1]

    Voigt, A

    P. Voigt, A. Von dem Bussche, The eu general data protection regula- tion (gdpr), A Practical Guide, 1st Ed., Cham: Springer International Publishing 10 (3152676) (2017) 10–5555

    2017

  2. [2]

    Goldman, An introduction to the california consumer privacy act (ccpa), Santa Clara Univ

    E. Goldman, An introduction to the california consumer privacy act (ccpa), Santa Clara Univ. Legal Studies Research Paper (2020)

    2020

  3. [3]

    E. T. V. de Castro, G. R. Silva, E. D. Canedo, Ensuring privacy in the application of the brazilian general data protection law (lgpd), in: Pro- ceedings of the 37th ACM/SIGAPP Symposium on Applied Computing, 2022, pp. 1228–1235

    2022

  4. [4]

    Determann, J

    L. Determann, J. Tam, The california privacy rights act of 2020: a broad and complex data processing regulation that applies to businesses world- wide, Journal of Data Protection & Privacy 4 (1) (2020) 7–21. 32

    2020

  5. [5]

    U. Trade, Development, Data protection and pri- vacy legislation worldwide,https://unctad.org/page/ data-protection-and-privacy-legislation-worldwide, [Online; accessed 4-Nov-2025] (n.d.)

    2025

  6. [6]

    H. Li, L. Yu, W. He, The impact of gdpr on global technology development (2019)

    2019

  7. [7]

    T. Li, E. Louie, L. Dabbish, J. I. Hong, How developers talk about per- sonal data and what it means for user privacy: A case study of a developer forum on reddit, Proceedings of the ACM on Human-Computer Interac- tion 4 (CSCW3) (2021) 1–28

    2021

  8. [8]

    Parsons, M

    J. Parsons, M. Schrider, O. Ogunlela, S. Ghanavati, Understanding devel- opers privacy concerns through reddit thread analysis, in: Joint Proceed- ings of REFSQ-2023 Workshops, Doctoral Symposium, Posters & Tools Track, and Journal Early Feedback Track, Vol. 3378 of CEUR Workshop Proceedings, 2023,©2023 CC BY 4.0. URLhttps://ceur-ws.org/Vol-3378/NLP4RE-paper5.pdf

    2023

  9. [9]

    M.Tahaei, K.Vaniea, N.Saphra, Understandingprivacy-relatedquestions on stack overflow, in: Proceedings of the 2020 CHI conference on human factors in computing systems, 2020, pp. 1–14

    2020

  10. [10]

    Franke, H

    L. Franke, H. Liang, S. Farzanehpour, A. Brantly, J. C. Davis, C. Brown, An exploratory mixed-methods study on general data protection regula- tion (gdpr) compliance in open-source software, in: Proceedings of the 18th ACM/IEEE International Symposium on Empirical Software Engi- neering and Measurement, 2024, pp. 325–336

    2024

  11. [11]

    Kapitsaki, M

    G. Kapitsaki, M. Papoutsoglou, Gdpr indications in commits messages in github repositories, in: Proceedings of the 2024 IEEE/ACM 46th Inter- national Conference on Software Engineering: Companion Proceedings, 2024, pp. 350–351

    2024

  12. [12]

    Datler, Intended compliance: An automated analysis of gdpr-related github issues, Master’s thesis, ETH Zurich (2023)

    E. Datler, Intended compliance: An automated analysis of gdpr-related github issues, Master’s thesis, ETH Zurich (2023)

    2023

  13. [13]

    Sangaroonsilp, H

    P. Sangaroonsilp, H. K. Dam, M. Choetkiertikul, C. Ragkhitwetsagul, A. Ghose, A taxonomy for mining and classifying privacy requirements in issue reports, Information and Software Technology 157 (2023) 107162

    2023

  14. [14]

    Hennig, L

    A. Hennig, L. Schulte, S. Herbold, O. Kulyk, P. Mayer, The whos, whats, and whys of issues related to personal data and data protection in open- source projects on github, Empirical Software Engineering 31 (1) (2026) 1–51

    2026

  15. [15]

    2261614823,https://github.com/dcsndevs/zitmall/issues/6, [On- line; accessed 4-Nov-2025] (2024). 33

    2025

  16. [16]

    2261182415,https://github.com/nopSolutions/nopCommerce/ issues/7155, [Online; accessed 4-Nov-2025] (2024)

    2025

  17. [17]

    Tahaei, T

    M. Tahaei, T. Li, K. Vaniea, Understanding privacy-related advice on stack overflow, Proceedings on Privacy Enhancing Technologies (2022)

    2022

  18. [18]

    Z. S. Li, C. Werner, N. Ernst, D. Damian, Gdpr compliance in the context of continuous integration, arXiv preprint arXiv:2002.06830 (2020)

    Pith/arXiv arXiv 2002

  19. [19]

    Kretschmer, J

    M. Kretschmer, J. Pennekamp, K. Wehrle, Cookie banners and privacy policies: Measuring the impact of the gdpr on the web, ACM Transactions on the Web (TWEB) 15 (4) (2021) 1–42

    2021

  20. [20]

    Bouhoula, K

    A. Bouhoula, K. Kubicek, A. Zac, C. Cotrini, D. Basin, Automated large- scale analysis of cookie notice compliance, in: USENIX Security Sympo- sium, 2023

    2023

  21. [21]

    Van Nortwick, C

    M. Van Nortwick, C. Wilson, Setting the bar low: Are websites comply- ing with the minimum requirements of the ccpa?, Proc. Priv. Enhancing Technol. 2022 (1) (2022) 608–628

    2022

  22. [22]

    Vanezi, D

    E. Vanezi, D. Kouzapas, G. M. Kapitsaki, T. Costi, A. Yeratziotis, C. Met- touris, A. Philippou, G. A. Papadopoulos, Gdpr compliance in the design of the inform e-learning platform: a case study, in: 2019 13th Interna- tional Conference on Research Challenges in Information Science (RCIS), IEEE, 2019, pp. 1–12

    2019

  23. [23]

    Hadar, T

    I. Hadar, T. Hasson, O. Ayalon, E. Toch, M. Birnhack, S. Sherman, A. Balissa, Privacy by designers: software developers’ privacy mindset, Empirical Software Engineering 23 (2018) 259–289

    2018

  24. [24]

    Diepenbrock, J

    A. Diepenbrock, J. Fleck, S. Sachweh, An analysis of stack exchange ques- tions: Identifying challenges in software design and development with a focus on data privacy and data protection, in: Proceedings of the 18th International Conference on Availability, Reliability and Security, 2023, pp. 1–7

    2023

  25. [25]

    T. F. Bissyandé, D. Lo, L. Jiang, L. Réveillere, J. Klein, Y. Le Traon, Got issues? who cares about it? a large scale investigation of issue trackers from github, in: 2013 IEEE 24th international symposium on software reliability engineering (ISSRE), IEEE, 2013, pp. 188–197

    2013

  26. [26]

    Khalajzadeh, M

    H. Khalajzadeh, M. Shahin, H. O. Obie, J. Grundy, How are diverse end- user human-centric issues discussed on github?, in: Proceedings of the 2022 ACM/IEEE 44th International Conference on Software Engineering: Software Engineering in Society, 2022, pp. 79–89

    2022

  27. [27]

    Guber, I

    J. Guber, I. Reinhartz-Berger, M. Litvak, Empirical exploration of open- source issues for predicting privacy compliance, in: International Confer- ence on Conceptual Modeling, Springer, 2023, pp. 63–73. 34

    2023

  28. [28]

    Henning, L

    A. Henning, L. Schulte, S. Herbold, O. Kulyk, P. Mayer, Understanding issues related to personal data and data protection in open source projects on github, arXiv preprint arXiv:2304.06367 (2023)

    arXiv 2023

  29. [29]

    G. M. Kapitsaki, M. Papoutsoglou, Evolution of repositories and privacy laws: commit activities in the gdpr and ccpa era, Journal of Systems and Software (2025) 112515

    2025

  30. [30]

    Franke, H

    L. Franke, H. Liang, A. Brantly, J. C. Davis, C. Brown, A first look at the general data protection regulation (gdpr) in open-source software, in: Proceedings of the 2024 IEEE/ACM 46th International Conference on Software Engineering: Companion Proceedings, 2024, pp. 268–269

    2024

  31. [31]

    AI, Ccpa vs gdpr,https://securiti.ai/ccpa-vs-gdpr/, [Online; ac- cessed 4-Nov-2025] (n.d.)

    S. AI, Ccpa vs gdpr,https://securiti.ai/ccpa-vs-gdpr/, [Online; ac- cessed 4-Nov-2025] (n.d.)

    2025

  32. [32]

    Perera, W

    H. Perera, W. Hussain, D. Mougouei, R. A. Shams, A. Nurwidyantoro, J. Whittle, Towards integrating human values into software: Mapping principles and rights of gdpr to values, in: 2019 IEEE 27th international requirements engineering conference (RE), IEEE, 2019, pp. 404–409

    2019

  33. [33]

    Pantelic, K

    O. Pantelic, K. Jovic, S. Krstovic, Cookies implementation analysis and the impact on user privacy regarding gdpr and ccpa regulations, Sustain- ability 14 (9) (2022) 5015

    2022

  34. [34]

    Matte, N

    C. Matte, N. Bielova, C. Santos, Do cookie banners respect my choice?: Measuring legal compliance of banners from iab europe’s transparency and consent framework, in: 2020 IEEE Symposium on Security and Privacy (SP), IEEE, 2020, pp. 791–809

    2020

  35. [35]

    Kapitsaki, M

    G. Kapitsaki, M. Papoutsoglou, Github data privacy commits from jss 2025, Zenodo (2025). doi:10.5281/zenodo.15532947. URLhttps://doi.org/10.5281/zenodo.15532947

    work page doi:10.5281/zenodo.15532947 2025

  36. [36]

    Kapitsaki, M

    G. Kapitsaki, M. Papoutsoglou, A privacy policies dataset in greek in the gdpr era, in: Proceedings of the 27th Pan-Hellenic Conference on Progress in Computing and Informatics, 2023, pp. 199–205

    2023

  37. [37]

    A. D. Kounoudes, G. M. Kapitsaki, I. Katakis, i-right: Identifying and classifying gdpr user rights in fitness tracker and smart home privacy policies, in: International Conference on Web Information Systems En- gineering, Springer, 2024, pp. 243–254

    2024

  38. [38]

    W. B. Tesfay, P. Hofmann, T. Nakamura, S. Kiyomoto, J. Serna, Priva- cyguide: towards an implementation of the eu gdpr on internet privacy policy evaluation, in: Proceedings of the fourth ACM international work- shop on security and privacy analytics, 2018, pp. 15–21

    2018

  39. [39]

    Krippendorff, Content analysis: An introduction to its methodology, Sage publications, 2018

    K. Krippendorff, Content analysis: An introduction to its methodology, Sage publications, 2018. 35

    2018

  40. [40]

    Kapitsaki, M

    G. Kapitsaki, M. Papoutsoglou, C. Treude, I. Theophilou,https:// github.com/gkapi/github-privacy-law-issues-analysis(2025)

    2025

  41. [41]

    W. Xiao, H. He, W. Xu, X. Tan, J. Dong, M. Zhou, Recommending good first issues in github oss projects, in: 2022 IEEE/ACM 44th International Conference on Software Engineering (ICSE), IEEE, 2022, pp. 1830–1842

    2022

  42. [42]

    GitHub, Github terms of service,https://docs.github.com/ en/site-policy/github-terms/github-terms-of-service# h-api-terms, [Online; accessed 4-Nov-2025] (2025)

    2025

  43. [43]

    Golzadeh, A

    M. Golzadeh, A. Decan, D. Legay, T. Mens, A ground-truth dataset and classification model for detecting bots in github issue and pr comments, Journal of Systems and Software 175 (2021) 110911

    2021

  44. [44]

    Abdellatif, M

    A. Abdellatif, M. Wessel, I. Steinmacher, M. A. Gerosa, E. Shihab, Both- unter: An approach to detect software bots in github, in: Proceedings of the 19th International Conference on Mining Software Repositories, 2022, pp. 6–17

    2022

  45. [45]

    543994405,https://github.com/sopel-irc/sopel/issues/1796, [On- line; accessed 4-Nov-2025] (2019)

    2025

  46. [46]

    R. F. Woolson, J. A. Bean, P. B. Rojas, Sample size for case-control studies using cochran’s statistic, Biometrics (1986) 927–932

    1986

  47. [47]

    Hazra, Using the confidence interval confidently, Journal of thoracic disease 9 (10) (2017) 4125

    A. Hazra, Using the confidence interval confidently, Journal of thoracic disease 9 (10) (2017) 4125

    2017

  48. [48]

    1338777555,https://github.com/mild-blue/txmatching/issues/ 968, [Online; accessed 4-Nov-2025] (2022)

    2025

  49. [49]

    Buckland, F

    M. Buckland, F. Gey, The relationship between recall and precision, Jour- nal of the American society for information science 45 (1) (1994) 12–19

    1994

  50. [50]

    1584610407,https://github.com/10up/ElasticPress/issues/3316, [Online; accessed 4-Nov-2025] (2023)

    2025

  51. [51]

    1831381900,https://github.com/matomo-org/ matomo-for-wordpress/issues/826, [Online; accessed 4-Nov-2025] (2023)

    2025

  52. [52]

    976127507,https://github.com/remote-job-boards/ software-engineering/issues/6892, [Online; accessed 4-Nov-2025] (2021)

    2025

  53. [53]

    717725840,https://github.com/openNDS/openNDS/issues/62, [On- line; accessed 4-Nov-2025] (2020)

    2025

  54. [54]

    417761578,https://github.com/wazuh/wazuh-qa/issues/50, [Online; accessed 4-Nov-2025] (2019). 36

    2025

  55. [55]

    2259722815,https://github.com/Cloud-Officer/homebrew-ci/pull/ 13(Pull request referenced in issue), [Online; accessed 4-Nov-2025] (2023)

    2025

  56. [56]

    414409874,https://github.com/AdguardTeam/AdguardFilters/ issues/30152, [Online; accessed 4-Nov-2025] (2019)

    2025

  57. [57]

    339804610,https://github.com/webcompat/web-bugs/issues/17681, [Online; accessed 4-Nov-2025] (2018)

    2025

  58. [58]

    1756361083,https://github.com/woocommerce/woocommerce/issues/ 38711, [Online; accessed 4-Nov-2025] (2023)

    2025

  59. [59]

    651987626,https://github.com/remote-job-boards/ software-engineering/issues/709, [Online; accessed 4-Nov-2025] (2020)

    2025

  60. [60]

    2353883551,https://github.com/qiaoyuet/arxiv_daily/issues/ 121, [Online; accessed 4-Nov-2025] (2024)

    2025

  61. [61]

    Devlin, M.-W

    J. Devlin, M.-W. Chang, K. Lee, K. Toutanova, Bert: Pre-training of deep bidirectional transformers for language understanding, in: Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), 2019, pp. 4171–4186

    2019

  62. [62]

    Zhang, Y

    J. Zhang, Y. Huang, S. Liu, Y. Gao, X. Hu, Do bert-like bidirectional models still perform better on text classification in the era of llms?, arXiv preprint arXiv:2505.18215 (2025)

    Pith/arXiv arXiv 2025

  63. [63]

    Tufano, A

    R. Tufano, A. Mastropaolo, F. Pepe, O. Dabić, M. Di Penta, G. Bavota, Unveiling chatgpt’s usage in open source projects: A mining-based study, in: 2024 IEEE/ACM 21st International Conference on Mining Software Repositories (MSR), IEEE, 2024, pp. 571–583

    2024

  64. [64]

    Chandra, L

    Y. Chandra, L. Shang, Inductive coding, in: Qualitative research using R: A systematic approach, Springer, 2019, pp. 91–106

    2019

  65. [65]

    Galster, A

    M. Galster, A. Mitrovic, S. Malinen, J. Holland, What soft skills does the software industry* really* want? an exploratory study of software posi- tions in new zealand, in: Proceedings of the 16th ACM/IEEE Interna- tional Symposium on Empirical Software Engineering and Measurement, 2022, pp. 272–282

    2022

  66. [66]

    Kapitsaki, L

    G. Kapitsaki, L. Chatzivasili, M. Papoutsoglou, M. Galster, An ex- ploratory study on soft skills present in software positions in cyprus: a quasi-replication study, in: Proceedings of the 18th ACM/IEEE Interna- tional Symposium on Empirical Software Engineering and Measurement, 2024, pp. 200–211. 37

    2024

  67. [67]

    Cohen, Statistical power analysis for the behavioral sciences, routledge, 2013

    J. Cohen, Statistical power analysis for the behavioral sciences, routledge, 2013

    2013

  68. [68]

    188962803,https://github.com/eclipse-vertx/vertx-auth/issues/ 102, [Online; accessed 4-Nov-2025] (2016)

    2025

  69. [69]

    1356890981,https://github.com/rusq/slackdump/issues/126, [On- line; accessed 4-Nov-2025] (2022)

    2025

  70. [70]

    J. R. Landis, G. G. Koch, The measurement of observer agreement for categorical data, biometrics (1977) 159–174

    1977

  71. [71]

    515712760,https://github.com/icgc-argo/platform-ui/issues/ 839, [Online; accessed 4-Nov-2025] (2019)

    2025

  72. [72]

    462094859,https://github.com/cubecart/v6/issues/2338, [Online; accessed 4-Nov-2025] (2019)

    2025

  73. [73]

    328761675,https://github.com/MFlisar/GDPRDialog/issues/49, [Online; accessed 4-Nov-2025] (2018)

    2025

  74. [74]

    251140333,https://github.com/arx-deidentifier/arx/issues/126, [Online; accessed 4-Nov-2025] (2017)

    2025

  75. [75]

    315863357,https://github.com/dokuwiki/dokuwiki/issues/2321, [Online; accessed 4-Nov-2025] (2018)

    2025

  76. [76]

    327781012,https://github.com/nextcloud/registration/issues/ 140, [Online; accessed 4-Nov-2025] (2018)

    2025

  77. [77]

    297623638,https://github.com/Automattic/wp-calypso/issues/ 22512, [Online; accessed 4-Nov-2025] (2018)

    2025

  78. [78]

    319506778,https://github.com/schibsted/account-sdk-android/ issues/153, [Online; accessed 4-Nov-2025] (2018)

    2025

  79. [79]

    339454214,https://github.com/Kunena/Kunena-Forum/issues/6032, [Online; accessed 4-Nov-2025] (2018)

    2025

  80. [80]

    453600833,https://github.com/pubpub/pubpub/issues/390, [Online; accessed 4-Nov-2025] (2019)

    2025

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.