Chen Sun

Profile

Graduate Student
Department of Computer Science
The University of Iowa
317 MacLean Hall, Iowa City, IA 52242
chen-sun@uiowa.edu

github

I am a Ph.D. candidate in Computer Science at the University of Iowa and being advised by Prof. Rishab Nithyanand. I also had the pleasure of working under the mentorship of Prof. Supreeth Shastri previously. My research centers on online privacy, with a particular emphasis on privacy measurement, identifying privacy vulnerabilities, and creating tools that simplify and improve compliance with data protection regulations.

Research Projects

• On the Suitability of LLM-Driven Agents for Dark Pattern Audits
  We design and evaluate an LLM-driven browser agent for auditing dark patterns in multi-step CCPA data rights workflows, enabling autonomous interaction, structured evidence collection, and taxonomy based classification. Through controlled prompt ablations and large scale deployment, we conduct structured failure analysis across the ReAct loop (observation, reasoning, and action), identifying key limitations of LLM agents during dark pattern audits.
• Turning Trust to Transactions: Tracking Affiliate Marketing and FTC Compliance in YouTube’s Influencer
  We develop a scalable measurement pipeline that combines web measurement and NLP to detect affiliate marketing and disclosure compliance across 2 million YouTube videos. Our study reveals widespread use of affiliate links alongside persistently low FTC-compliant disclosures, and shows that platform-level interventions are most strongly associated with improved transparency in the influencer economy.
• Information about Data
  We investigate a critical but overlooked assumption in privacy regulation, namely that firms understand their own data practices, by modeling corporate knowledge and empirically studying internal data governance across organizations. Through a mixed-methods study combining interviews and surveys, we identify organizational barriers such as information silos and propose disclosure-based mechanisms to improve internal awareness and regulatory effectiveness.
• Faults and Pitfalls in Implementing the Right to be Forgotten
  We present a two-phase framework for implementing RTBF that integrates legal reasoning with enforcement-driven system design, and evaluate it through a case study on Elasticsearch. Our analysis of real-world enforcement cases reveals recurring failure modes and system-level anti-patterns, highlighting key tradeoffs in achieving compliant and efficient data deletion.
• GDPRxiv: Establishing the State of the Art in GDPR Enforcement
  We build GDPRxiv, a large-scale automated system that collects and curates enforcement decisions, legal precedents, and regulatory guidance to systematically characterize how GDPR is enforced in practice. By aggregating 8,000+ official documents across jurisdictions, our work enables data-driven analysis of enforcement trends and reveals common compliance failures in real-world systems.

Publications

• On the Suitability of LLM-Driven Agents for Dark Pattern Audits [PDF] [Code]
  Chen Sun, Yash Vekaria, Rishab Nithyanand
  Privacy Enhancing Technologies Symposium (PETS), 2026

• Turning Trust to Transactions: Tracking Affiliate Marketing and FTC Compliance in YouTube’s Influencer [PDF] [Code]
  Chen Sun, Yash Vekaria, Zubair Shafiq, Rishab Nithyanand
  International AAAI Conference on Web and Social Media (ICWSM), 2026

• Information about Data [PDF]
  Mihailis Diamantis, Chen Sun , Rishab Nithyanand
  Yale journal of law technology (YJOLT), 2026

• Faults and Pitfalls in Implementing the Right to be Forgotten [PDF]
  Chen Sun, Nikolas Guggenberger, Supreeth Shastri
  Communications of the ACM (CACM), 2026

• GDPRxiv: Establishing the State of the Art in GDPR Enforcement [PDF] [Website] [Code]
  Chen Sun, Evan Jacobs, Daniel Lehmann, Andrew Crouse, and Supreeth Shastri
  Privacy Enhancing Technologies Symposium (PETS), 2023