hero image
Aleecia M. McDonald - Carnegie Mellon University. Pittsburgh, PA, US

Aleecia M. McDonald

Assistant Professor | Carnegie Mellon University


AleeciaMcDonald focuses on the public policy issues of Internet privacy, user expectations for privacy tools and behavioral economics.


Aleecia M. McDonald, Ph.D. is an Assistant Professor of the Practice, based at the CMU Silicon Valley campus. She focuses on the public policy issues of Internet privacy, including user expectations for privacy tools, behavioral economics and mental models of privacy, and the efficacy of industry self regulation. She co-chaired the WC3’s Tracking Protection Working Group, which was an effort to establish international standards for a Do Not Track mechanism that users can enable to request enhanced privacy online.

Aleecia’s decade of experience working in software startups adds a practical focus to her academic work, and she was a Senior Privacy Researcher for Mozilla prior to working as Director of Privacy at Stanford. Her findings have been featured in media outlets such as the Washington Post, Ars Technica, and NPR. She has presented findings in testimony to the California Assembly, and contributed to testimony before the United States Senate and the Federal Trade Commission.

Areas of Expertise (5)

Internet Law and Regulation

Behavioral Economics


Privacy Tools

Public Policy issues of Internet Privacy

Media Appearances (2)

Judge advances claims over privacy of decades-old yearbook photos

Courthouse News Service  


For Aleecia M. McDonald, assistant professor of the practice that focuses on internet privacy issues at Carnegie Mellon University, she says that the context on when the pictures were first taken adds a new wrinkle into the equation.

view more

California Passes Sweeping Law to Protect Online Privacy

The New York Times  online


But Aleecia M. McDonald, an incoming assistant professor at Carnegie Mellon University who specializes in privacy policy, said California’s privacy measure was one of the most comprehensive in the United States, since most existing laws — and there are not many — do little to limit what companies can do with consumer information.

view more






Aleecia M. McDonald: Innovating in the Wild with INI Practicum Online Privacy: Industry Self-Regulation in Practice 2023 International Data Privacy Day


Industry Expertise (4)

Information Technology and Services

Computer Software

Computer Networking

Public Policy

Education (4)

Carnegie Mellon University: Ph.D., Engineering & Public Policy

Carnegie Mellon University: M.S., Engineering & Public Policy

Carnegie Mellon University: M.S., Public Policy and Management

Carnegie Mellon University: B.A., Professional Writing

Affiliations (4)

  • Cylab : Member
  • Stanford's Center for Internet & Society : Non-resident Fellow
  • Privacy Rights Clearinghouse : Board of Directors
  • EPIC : Advisory Board

Articles (1)

Fighting the Fog: Evaluating the Clarity of Privacy Disclosures in the Age of CCPA

Computers and Society

2021 Vagueness and ambiguity in privacy policies threaten the ability of consumers to make informed choices about how businesses collect, use, and share their personal information. The California Consumer Privacy Act (CCPA) of 2018 was intended to provide Californian consumers with more control by mandating that businesses (1) clearly disclose their data practices and (2) provide choices for consumers to opt out of specific data practices. In this work, we explore to what extent CCPA's disclosure requirements, as implemented in actual privacy policies, can help consumers to answer questions about the data practices of businesses. First, we analyzed 95 privacy policies from popular websites; our findings showed that there is considerable variance in how businesses interpret CCPA's definitions. Then, our user survey of 364 Californian consumers showed that this variance affects the ability of users to understand the data practices of businesses. Our results suggest that CCPA's mandates for privacy disclosures, as currently implemented, have not yet yielded the level of clarity they were designed to deliver, due to both vagueness and ambiguity in CCPA itself as well as potential non-compliance by businesses in their privacy policies.

view more