Document

I am a Ph.D. candidate in Computer Science at the University of Iowa and being advised by Prof. Rishab Nithyanand. I also had the pleasure of working under the mentorship of Prof. Supreeth Shastri previously. My research focuses on online privacy, with an emphasis on large-scale privacy measurement, identifying systemic privacy risks, and developing tools to evaluate and improve compliance with data protection regulations. I leverage machine learning, LLM-based agents, and large-scale data analysis to investigate privacy practices across online platforms and identify gaps between regulatory requirements and real-world system implementations.

Research Projects

On the Suitability of LLM-Driven Agents for Dark Pattern Audits
We design and evaluate an LLM-driven browser agent for auditing dark patterns in multi-step CCPA data rights workflows, enabling autonomous interaction, structured evidence collection, and taxonomy based classification. Through controlled prompt ablations and large scale deployment, we conduct structured failure analysis across the ReAct loop (observation, reasoning, and action), identifying key limitations of LLM agents during dark pattern audits.
Turning Trust to Transactions: Tracking Affiliate Marketing and FTC Compliance in YouTube’s Influencer
We develop a scalable measurement pipeline that combines web measurement and NLP to detect affiliate marketing and disclosure compliance across 2 million YouTube videos. Our study reveals widespread use of affiliate links alongside persistently low FTC-compliant disclosures, and shows that platform-level interventions are most strongly associated with improved transparency in the influencer economy.
Information about Data
We investigate a critical but overlooked assumption in privacy regulation, namely that firms understand their own data practices, by modeling corporate knowledge and empirically studying internal data governance across organizations. Through a mixed-methods study combining interviews and surveys, we identify organizational barriers such as information silos and propose disclosure-based mechanisms to improve internal awareness and regulatory effectiveness.
Faults and Pitfalls in Implementing the Right to be Forgotten
We present a two-phase framework for implementing RTBF that integrates legal reasoning with enforcement-driven system design, and evaluate it through a case study on Elasticsearch. Our analysis of real-world enforcement cases reveals recurring failure modes and system-level anti-patterns, highlighting key tradeoffs in achieving compliant and efficient data deletion.
GDPRxiv: Establishing the State of the Art in GDPR Enforcement
We build GDPRxiv, a large-scale automated system that collects and curates enforcement decisions, legal precedents, and regulatory guidance to systematically characterize how GDPR is enforced in practice. By aggregating 8,000+ official documents across jurisdictions, our work enables data-driven analysis of enforcement trends and reveals common compliance failures in real-world systems.

Publications

On the Suitability of LLM-Driven Agents for Dark Pattern Audits [PDF] [Code]
Chen Sun, Yash Vekaria, Rishab Nithyanand
Privacy Enhancing Technologies Symposium (PETS), 2026

Turning Trust to Transactions: Tracking Affiliate Marketing and FTC Compliance in YouTube’s Influencer [PDF] [Code]
Chen Sun, Yash Vekaria, Zubair Shafiq, Rishab Nithyanand
International AAAI Conference on Web and Social Media (ICWSM), 2026

Information about Data [PDF]
Mihailis Diamantis, Chen Sun , Rishab Nithyanand
Yale journal of law technology (YJOLT), 2026

Faults and Pitfalls in Implementing the Right to be Forgotten [PDF]
Chen Sun, Nikolas Guggenberger, Supreeth Shastri
Communications of the ACM (CACM), 2026

GDPRxiv: Establishing the State of the Art in GDPR Enforcement [PDF] [Website] [Code]
Chen Sun, Evan Jacobs, Daniel Lehmann, Andrew Crouse, and Supreeth Shastri
Privacy Enhancing Technologies Symposium (PETS), 2023

Profile

Research Projects

Publications