Study Maps How Developers Tackle Privacy Law Compliance in Open Source

Developers across open-source projects are wrestling with how to implement privacy rules into their code, but not all legal requirements get equal attention. A new study examined the real-world conversations happening on GitHub to reveal which privacy concerns developers prioritize—and which ones they're overlooking.

The Research Approach#

Researchers mined 32,820 GitHub issues to understand what developers discuss when building privacy compliance into their systems. They focused on conversations related to two major regulations: the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), which have fundamentally reshaped how software teams handle user data.

The team used a hybrid approach: automatic tools flagged issues mentioning specific legal rights and principles, while human analysts manually examined a sample of 1,186 issues to categorize the types of problems developers faced.

What Developers Are Actually Discussing#

The study identified 24 distinct discussion categories organized into six broader clusters: user rights and consent, compliance implementation, documentation, data storage and sharing, general compliance, and contextual adaptability.

The findings reveal an uneven distribution of focus. Developers concentrate heavily on a narrow set of user rights—particularly the right to erasure, right to opt-out, and right to access—while spending far less time on other legal obligations. Across the issues analyzed, the most common discussions centered on:

• User consent mechanisms
• User rights functionality (implementing the legal requirements into actual code)
• Bug fixes related to privacy features
• Cookie management and tracking controls

Why This Matters#

The taxonomy created by this research offers practical value to the development community. By mapping which issues dominate conversations, practitioners can better prioritize their compliance efforts and tackle the problems that matter most. Universities and training programs can also use these findings to revise how they teach privacy law to future engineers.