{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T05:57:49Z","timestamp":1785304669758,"version":"3.55.0"},"reference-count":0,"publisher":"Privacy Enhancing Technologies Symposium Advisory Board","issue":"1","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["PoPETs"],"abstract":"<jats:p>We develop the first language-based, Privacy by Design approach that provides support for a rich class of privacy policies. The policies are user-defined, rather than programmer-defined, and support fine-grained information flow restrictions (considering individual application inputs and outputs) with temporal constraints.  Our approach, called Taint, Track, and Control (TTC), combines dynamic information-flow control and runtime verification to enforce these policies in the presence of malicious users and developers.\nWe provide TTC's semantics and proofs of its correct enforcement, formalized in the Isabelle\/HOL proof assistant.  We also implement our approach in a web development framework and port three baseline applications from previous work into this framework for evaluation.  Overall, our approach enforces expressive user-defined privacy policies with practical runtime performance.<\/jats:p>","DOI":"10.56553\/popets-2024-0034","type":"journal-article","created":{"date-parts":[[2023,10,22]],"date-time":"2023-10-22T21:01:15Z","timestamp":1698008475000},"page":"597-616","source":"Crossref","is-referenced-by-count":5,"title":["User-Controlled Privacy: Taint, Track, and Control"],"prefix":"10.56553","volume":"2024","author":[{"given":"Fran\u00e7ois","family":"Hublet","sequence":"first","affiliation":[{"name":"ETH Z\u00fcrich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Basin","sequence":"additional","affiliation":[{"name":"ETH Z\u00fcrich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sr\u0111an","family":"Krsti\u0107","sequence":"additional","affiliation":[{"name":"ETH Z\u00fcrich"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"35752","published-online":{"date-parts":[[2024,1]]},"container-title":["Proceedings on Privacy Enhancing Technologies"],"original-title":[],"deposited":{"date-parts":[[2023,10,22]],"date-time":"2023-10-22T21:02:02Z","timestamp":1698008522000},"score":1,"resource":{"primary":{"URL":"https:\/\/petsymposium.org\/popets\/2024\/popets-2024-0034.php"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,1]]},"references-count":0,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,1]]}},"alternative-id":["10.56553\/popets-2024-0034"],"URL":"https:\/\/doi.org\/10.56553\/popets-2024-0034","relation":{},"ISSN":["2299-0984"],"issn-type":[{"value":"2299-0984","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,1]]}}}