Privacy in Chatbot Conversation-Driven Development: A Comprehensive Review and Requirements Proposal
Geovana Ramos Sousa Silva, Edna Dias Canedo · ACM Transactions on Software Engineering and Methodology · 2025
Ensuring data privacy is a major challenge for software developers, especially in chatbots, where balancing privacy protection with response quality is key, given the need for conversation-driven development and data protection regulations. This research identifies privacy requirements and techniques for chatbot development through a literature review, privacy policy analysis, and a practitioner survey. The methodology includes a Systematic Literature Review (SLR), an adapted Gray Literature Review (GLR), privacy requirement formulation, and validation via a survey. Based on the SLR and GLR, eight privacy requirements are proposed, covering personal information protection, user authentication, access control, secure communication, database safety, user rights empowerment, decentralized storage, and reliable infrastructure. Survey results highlight foundational measures like secure communication and scalable infrastructures as priorities, while advanced measures such as decentralized storage or privacy rights implementation scored lower due to complexity and cost. Practitioners also stressed clarity and verifiability, citing gaps in definitions, examples, and validation criteria as challenges to adoption.