Privacy measurement instruments (e.g., CFIP, IUIPC, PAQ) predate GDPR by over a decade and measure privacy concerns, distinct from preferences for regulatory protections (e.g., data portability, erasure, automated decision-making rights). This leaves practitioners without tools to assess whether users value the GDPR mechanisms implemented in compliant policies. We developed a GDPR-grounded privacy preference measurement item bank by extracting 669 statements from all 99 GDPR articles, validated by: (1) two-round expert review achieving full consensus on accuracy, (2) semantic clustering into 10 parent themes and 87 subthemes, and (3) consensus review with 50 privacy experts (5 per theme) using a larger or equal than 4/5 vote retention threshold. The final 527-item bank comprises 9 parent themes and 73 subthemes (18 to 112 items per parent theme, 1 to 29 per subtheme), enabling targeted measurement across granularities while covering GDPR at mean pairwise expert agreement of approx. 85%. This work introduces a complementary measurement dimension aligning user preferences with regulatory mechanisms.

翻译：隐私测量工具（如CFIP、IUIPC、PAQ）早于GDPR十余年，主要测量隐私关注度，而非用户对监管保护（如数据可移植性、删除权、自动化决策权）的偏好差异。这导致从业者缺乏评估用户是否重视合规政策中实施的GDPR机制的工具。我们通过提取全部99条GDPR条款中的669项陈述，开发了基于GDPR的隐私偏好测量项目库，并经过以下验证：（1）两轮专家评审，在准确性上达成完全共识；（2）语义聚类形成10个父主题和87个子主题；（3）与50位隐私专家（每主题5位）进行共识评审，采用大于等于4/5的投票保留阈值。最终形成的527项项目库包含9个父主题和73个子主题（每父主题18至112项，每子主题1至29项），在覆盖GDPR的同时（专家平均成对一致性约85%），支持跨粒度定向测量。本研究引入了一个与监管机制对齐用户偏好的补充性测量维度。