Sophia Mittelbach, Florian Seida, Dominik Herrmann · Full Paper, ARES 2026, August 24–27, 2026, Linköping (Sweden) · Preprint to follow

Developed within the Bavarian research network ForDaySec.

Summary

The Privacy Range transfers the principle of security training environments such as the OWASP Juice Shop to data protection: a realistic, fictitious online shop with 13 deliberately planted GDPR problems – from pre-enabled cookie toggles to forms that send input to third parties before submission. In a qualitative lab study (N = 10), IT students who had just completed an intensive GDPR course taught by a practicing data protection lawyer searched for these problems while thinking aloud. The finding: the barrier was not missing conceptual knowledge but its procedural application – participants lacked investigative routines, tool fluency, and the impulse to verify interface claims against actual system behavior.

Key findings

Participants valued the environment less as a way to deliver knowledge than as a diagnostic instrument: “It really holds up a mirror to show you everything that’s still missing.” The consequence for education: legally focused GDPR instruction is necessary but insufficient on its own – “more training” of the same kind is the wrong answer. What is needed is training of procedural competence: structuring audits, verifying system behavior, and mapping observations to legal requirements.

How to cite

Camera-ready version, DOI, and preprint to follow; for now:

@misc{mittelbach2026privacyrange,
  title  = {Beyond Theory: Identifying Barriers to Applied GDPR Compliance
            in a Privacy Range},
  author = {Mittelbach, Sophia and Seida, Florian and Herrmann, Dominik},
  year   = {2026},
  note   = {Accepted at ARES 2026; preprint forthcoming}
}

Source code of the Privacy Range, problem descriptions with design rationales, interview guides, hints, and the full recognition rubric are openly available: doi.org/10.5281/zenodo.20285016. The environment itself runs at private-piranha.pics.