A privacy policy describes the information that an application may collect, but it cannot show what the application sends during a particular session. We built PrivacyComplianceVerifier to compare evidence from HTTP Archive (HAR) traffic with statements found in the application's privacy policy. The framework keeps repeated headers, cookies and query parameters instead of silently overwriting them. It also examines request and response bodies in formats such as JSON, multipart data, Base64, compressed text, raw Protocol Buffers and gRPC frames. Sensitive values are redacted before the evidence inventory is written. The comparison uses only the information types that can be supported by the captured traffic and the reviewed policy. URL exposure and authentication artifacts are reported separately as technical risks. We evaluated the framework using captures from 30 applications. In total, it processed 34,170 requests and detected 84,692 sensitive-data occurrences, representing 5,354 unique artifacts. Thirteen applications had at least one comparable type that was missing from the completed policy representation. Ten had all comparable observed types represented, while seven could not be fully assessed because their policy evidence was incomplete. These results show that network traffic can support a clear policy comparison, but they also reflect the limits of the tested workflow, encryption, policy wording and domain ownership.

Vimlesh Mourya, Maya Nair, "Automated Privacy Policy Compliance Verification Using Dynamic Network Traffic Analysis" International Journal of Scientific Research and Engineering Development, V9(5): Page(1548-1555) September - October 2026. ISSN: 2581-7175. www.ijsred.com. Published by Scientific and Academic Research Publishing.