Detecting Contractual Risk in ODRL Policies Using DPV

12 pages•Published: October 28, 2026

Elena Molino-Peña, Jos De Roo, Beatriz Esteves, José María García and Antonio Ruiz-Cortés

Abstract

Terms of Service (ToS) in Software as a Service (SaaS) ecosystems define the responsibilities of providers and customers. However, the monitoring and enforcement of these contracts is usually under the control of providers, creating risks of power asymmetry and limited transparency. Moreover, many clauses cannot be easily verified, operationalised or computationally interpreted in unequivocal manner, making it difficult for customers to determine whether an obligation has been fulfilled, a right can be effectively exercised, or a prohibition has been violated, leading to a lack of awareness of the risks associated with accepting such terms. In this paper, a semantic approach is presented to model and infer contractual risks derived from potentially unfair terms in ToS. The Open Digital Rights Language (ODRL) is used to represent contractual terms, while the Data Privacy Vocabulary (DPV) is used to describe the risks to which customers may be exposed when subscribing to SaaS services. We introduce a ToS risk specification to classify risk sources and mitigation measures associated with unfair terms. In addition, we describe a set of N3 rules to infer risks from ODRL policies and link them to DPV risk instances. The approach is implemented in a prototype and illustrated using abusive and non-abusive test cases.

Keyphrases: contractual risk detection, dpv, odrl, terms of service

In: Andrea Cimmino Arriaga, Beatriz Esteves, Nicoletta Fornara and Víctor Rodríguez Doncel (editors). Proceedings of 2nd Workshop ODRL and Beyond: Practical Applications and challenges for poLicy-base access and usage control, OPAL 2026, vol 113, pages 60-71.

Links:	https://easychair.org/publications/paper/Cx5h
	https://doi.org/10.29007/hqjd

BibTeX entry

@inproceedings{OPAL2026:Detecting_Contractual_Risk_ODRL,
  author    = {Elena Molino-Peña and Jos De Roo and Beatriz Esteves and José María García and Antonio Ruiz-Cortés},
  title     = {Detecting Contractual Risk in ODRL Policies Using DPV},
  booktitle = {Proceedings of 2nd Workshop ODRL and Beyond: Practical Applications and challenges for poLicy-base access and usage control, OPAL 2026},
  editor    = {Andrea Cimmino Arriaga and Beatriz Esteves and Nicoletta Fornara and Víctor Rodríguez Doncel},
  series    = {EPiC Series in Computing},
  volume    = {113},
  publisher = {EasyChair},
  bibsource = {EasyChair, https://easychair.org},
  issn      = {2398-7340},
  url       = {/publications/paper/Cx5h},
  doi       = {10.29007/hqjd},
  pages     = {60-71},
  year      = {2026}}

Download PDF Open PDF in browser