  The EU General Data Protection Regulation (GDPR) is one of the most demanding
and comprehensive privacy regulations of all time. A year after it went into
effect, we study its impact on the landscape of privacy policies online. We
conduct the first longitudinal, in-depth, and at-scale assessment of privacy
policies before and after the GDPR. We gauge the complete consumption cycle of
these policies, from the first user impressions until the compliance
assessment. We create a diverse corpus of two sets of 6,278 unique
English-language privacy policies from inside and outside the EU, covering
their pre-GDPR and the post-GDPR versions. The results of our tests and
analyses suggest that the GDPR has been a catalyst for a major overhaul of the
privacy policies inside and outside the EU. This overhaul of the policies,
manifesting in extensive textual changes, especially for the EU-based websites,
comes at mixed benefits to the users. While the privacy policies have become
considerably longer, our user study with 470 participants on Amazon MTurk
indicates a significant improvement in the visual representation of privacy
policies from the users' perspective for the EU websites. We further develop a
new workflow for the automated assessment of requirements in privacy policies.
Using this workflow, we show that privacy policies cover more data practices
and are more consistent with seven compliance requirements post the GDPR. We
also assess how transparent the organizations are with their privacy practices
by performing specificity analysis. In this analysis, we find evidence for
positive changes triggered by the GDPR, with the specificity level improving on
average. Still, we find the landscape of privacy policies to be in a
transitional phase; many policies still do not meet several key GDPR
requirements or their improved coverage comes with reduced specificity.
