Privacy threat modeling

Lens adapted to this topic: Why threat modeling is useful and how to apply it

The mainstream view treats privacy threat modeling as a practical privacy-engineering and risk-management discipline. Analysts define what or whom to protect, examine data flows and system contexts, identify privacy-specific harms, and select mitigations. Frameworks make analysis more systematic and can bring privacy considerations into design, while assessments should be adapted to the application and supplemented by legal, organizational, and policy review.

• Threat modeling helps teams identify privacy problems before they become embedded in an application and focuses attention on harms to people rather than only attacks on systems.
• LINDDUN offers a systematic framework for eliciting and mitigating privacy threats in software architectures, with a lighter toolkit for threat identification.
• LINDDUN organizes analysis around Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness, and Non-compliance.
• Threat modeling supports prioritization: because complete protection is impossible, people and organizations should focus on relevant assets, adversaries, likelihood, and practical trade-offs.
• Broader models such as PANOPTIC aim to provide a shared privacy-threat language that includes actions and inactions, benign and malicious intent, and the system itself as a possible threat agent.

Lens adapted to this topic: Critiques of privacy threat modeling and its assumptions

The dissenting view does not reject examining privacy risks, but questions whether current threat-modeling and assessment practices can reliably capture them. Privacy harms are context-dependent, difficult to observe, and often distributed across ecosystems and affected people. Vague methods, analyst discretion, unknown threats, weak incentives, and limited auditing may turn a formally completed assessment into performative compliance or false reassurance.

• Privacy threat modeling remains difficult because existing work often describes threat categories without adequately explaining how analysts should discover threats in complex real-world settings.
• A four-layer approach—feature, ecosystem, business context, and environment—is proposed because single-system analysis may not capture the complexity of privacy risks.
• Interdependent privacy risks can affect other users and non-users through platforms, permissions, APIs, and data sharing; conventional models may underestimate these harms.
• Privacy risk assessments contain substantial discretion, and weak organizational incentives or regulatory auditing can allow adversarial organizations to perform compliance without meaningfully reducing harm.
• Critics and community participants note that threats may be secret or unknown and that accurate risk assessment requires difficult knowledge of technology, law, and personal circumstances.