DETAILED ACTION
This final rejection is responsive to communication filed March 27, 2026. Claims 1, 9, 10, 12, 16-18, 20, and 21 are currently amended. Claims 13-15 are canceled. Claims 1-12 and 16-23 are pending in this application.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-5, 11, 12, 16-18, and 20-22 are rejected under 35 U.S.C. 103 as being unpatentable over Groth et al. (US 2021/0192651 A1) (‘Groth’) in view of McCarty et al. (US 20200382554 A1) (‘McCarty’), and further in view of Rajpara (US 10,776,399 B1).
With respect to claim 1, Groth teaches a method, comprising:
ingesting, by a computing device, internal security policies of an organization (personalized privacy charter (PPC) and/or corporate privacy charter (CPC); (paragraphs 83, 93, 157, 170-171, 216) and external terms and conditions of a cookie agreement of a web-based activity (privacy data policies and agreements (including data protection and privacy policies, terms of use, and cookie policies) of digital service provider)(paragraphs 95-96, 143-144, 202) during enrollment of the web-based activity, the web-based activity being a website, a web application or a web-based system in which a user in the organization seeks to access to (Corporate privacy charter is used to calculate privacy score for all online services to which the user subscribes (enrolls) (i.e. data processing agreement from digital service provider). Also, PA system scans privacy agreements to check compliance with charter (security policy) when she browses and signals when DSP doesn’t respect privacy charter.))(paragraphs 203 and 224);
identifying, by the computing device, topics of the internal security policies of the organization (i.e. categories) and the external terms and conditions of the cookie agreement (paragraphs 25-26, 108, 125-126, 157-158, 161) ;
parsing, by the computing device, dependencies within the internal security policies of the organization and the external terms and conditions of the cookie agreement (paragraph 92, 95-96, 123, 144, 202);
creating, by the computing device, clusters of the internal security policies (categories) and clusters of the external terms and conditions of the cookie agreement based on the identifying and parsing (paragraphs 24, 31, 37, 121, 125, 137, 159, 161);
matching, by the computing device, the clusters of the internal cookie acceptance policies and the clusters of the external terms and conditions of the cookie agreement (Groth teaches comparing internal polices with external policies, which include categories. He further teaches a process of understanding privacy policies of digital service providers in order to fine-grain assess their compliance/non-compliance with the user's (enterprise employee or customer) personal privacy charter that includes clustering data.) (paragraphs 50, 85, 88, 99, and 143);
determining whether there is an alignment within the matched clusters, the alignment indicating that external terms and conditions of the cookie agreement comply with rules of the internal cookie acceptance policies (Groth, paragraphs 50, 85, 88, 92, 99, 143-144, and 172);
determining, by the computing device, non-compliance of terms of matched clusters of the internal security policies with terms of the clusters of the external terms and conditions of the cookie agreement using natural language processing (paragraphs 99, 197, 224, and 235-236); and
blocking, by the computing device, the web-based activity based on the non-compliance of the terms (paragraphs 34, 85, 219 and 224).
Although Groth teaches internal security policies and it is obvious these may include cookie policies, Groth does not explicitly teach internal cookie acceptance policies.
McCarty teaches internal cookie acceptance polices (i.e. enterprise specific cookie policies) (paragraphs 61, 64 and 81) that are compared to external terms and conditions of a cookie agreement of a web-based activity (i.e. cookie data of an application) to determine compliance (paragraphs 52, 63-64, and 80).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified the internal security policies of Groth to include internal cookie acceptance policies as taught by McCarty because incorporating a cookie policy into a security/privacy policy would yield predictable results. Further, the modification would enable an enterprise to establish (and enforce) an internal enterprise cookie standard for applications, which can be very helpful in enabling the enterprise to meet its privacy and security objectives and assures compliance with applicable governmental regulations, and minimizes technical issues. It would further enable tooling to track the use and compliance of cookies within enterprise environments, regardless of their size and IT diversity. (McCarty, paragraphs 80-82).
Further regarding claim 1, Groth in view of McCarty does not explicitly teach correlating, by the computing device, respective terms of the matched clusters to determine whether there is an alignment of the terms within the matched clusters.
Rajpara teaches matching clusters (sections) of documents (i.e. policies) and correlating, by the computing device, respective terms of the matched clusters (i.e. sections) to determine whether there is an alignment of the terms within the matched clusters (col. 6 lines 26-38 and col. 7 lines 11-14).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified Groth to determine an alignment of terms in matched clusters as taught by Rajpara to enable documents/policies to be compared based on a degree of similarity or similarity percentage (Rajpara, col. 6 lines 17-37), thereby providing even more granularity in comparing text for similarity or compliance with other text.
With respect to claim 2, Groth in view of McCarty and Rajpara teaches comprising extracting, by the computing device, features of the internal cookie acceptance policies of the organization and the external terms and conditions of the cookie agreement, and further comprises an analysis of text of the extracted features using a natural language processing (NLP) algorithm to break down the text into individual words or tokens (Groth, paragraphs 99, 108, 123, 159, 202; McCarty, paragraphs 61, 64 and 81).
With respect to claim 3, Groth in view of McCarty and Rajpara teaches wherein the NLP algorithm comprises tokenization which splits the text into tokens that are fed into a language model (Groth, paragraphs 24, 115, 117).
With respect to claim 4, Groth in view of McCarty and Rajpara teaches wherein the extracting comprises utilizing an entity extraction algorithm which extracts terms from the internal cookie acceptance policies of the organization and the external terms and conditions of the cookie agreement that are of importance (Groth, paragraphs 123, 138, 159, 172).
With respect to claim 5, Groth in view of McCarty and Rajpara teaches wherein the parsing of the dependencies comprises analyzing grammatical relationships between words and phrases in the internal cookie acceptance policies of the organization and the external terms and conditions of the cookie agreement (Groth, paragraphs 117 and 126).
With respect to claim 11, Groth in view of McCarty and Rajpara teaches wherein the computing device includes software provided as a service in a cloud environment (Groth, paragraph 90).
With respect to claim 12, Groth teaches a computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to:
ingest internal security policies of an organization (personalized privacy charter (PPC) and/or corporate privacy charter (CPC)) (paragraphs 83, 93, 157, 170-171, 216) and external terms and conditions of a cookie agreement of a web-based activity, the web-based activity being a website, a web application or a web-based system in which a user in the organization seeks access to (privacy data policies and agreements of digital service provider including cookie policies)(paragraphs 95-96, 143-144, 202) during enrollment of the web-based activity (Corporate privacy charter is used to calculate privacy score for all online services to which the user subscribes (enrolls) (i.e. data processing agreement from digital service provider). Also, PA system scans privacy agreements to check compliance with charter (security policy) when she browses and signals when DSP doesn’t respect privacy charter.))(paragraphs 203 and 224);
cluster terms within the internal security policies based on similarities and which identify rules to form a first set of clusters (paragraphs 24, 31, 37, 121, 159, 161);
cluster terms within the external terms and conditions of the cookie agreement based on similarities and which identify rules to form a second set of clusters (paragraphs 24, 121, 125-126, 137, 159, 161);
match the first set of clusters with the second set of clusters (paragraphs 50, 85, 88, 99, and 143);
determining whether there is an alignment within the matched clusters, the alignment indicating that external terms and conditions of the cookie agreement comply with rules of the internal cookie acceptance policies (Groth, paragraphs 50, 85, 88, 92, 99, 143-144, and 172); and
provide an action based on whether the first and the second set of clusters match and whether there is the alignment within the matched clusters (paragraphs 50, 85, 143-144, and 172),
wherein the matched clusters are formed by matching the first set of clusters and the second set of clusters, and wherein the action comprises allowing access to the web-based activity, responsive to a determination that no match exists (paragraphs 50, 85, 88, 99, 143-144, and 172)).
Although Groth teaches internal security policies and it is obvious these may include cookie policies, Groth does not explicitly teach internal cookie acceptance policies.
McCarty teaches internal cookie acceptance polices (i.e. enterprise specific cookie policies) (paragraphs 61, 64 and 81) that are compared to external terms and conditions of a cookie agreement of a web-based activity (i.e. cookie data of an application) to determine compliance (paragraphs 52, 63-64, and 80).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified the internal security policies of Groth to include internal cookie acceptance policies as taught by McCarty because incorporating a cookie policy into a security/privacy policy would yield predictable results. Further, the modification would enable an enterprise to establish (and enforce) an internal enterprise cookie standard for applications, which can be very helpful in enabling the enterprise to meet its privacy and security objectives and assures compliance with applicable governmental regulations, and minimizes technical issues. It would further enable tooling to track the use and compliance of cookies within enterprise environments, regardless of their size and IT diversity (McCarty, paragraphs 80-82).
Further regarding claim 12, Groth in view of McCarty does not explicitly teach correlating respective terms of the matched clusters to determine whether there is an alignment of the terms within the matched clusters.
Rajpara teaches matching clusters (sections) of documents (i.e. policies) and correlating respective terms of the matched clusters (i.e. sections) to determine whether there is an alignment of the terms within the matched clusters (col. 6 lines 26-38 and col. 7 lines 11-14).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified Groth to determine an alignment of terms in matched clusters as taught by Rajpara to enable documents/policies to be compared based on a degree of similarity or similarity percentage (Rajpara, col. 6 lines 17-37), thereby providing even more granularity in comparing text for similarity or compliance with other text.
With respect to claim 16, Groth in view of McCarty and Rajpara teaches further comprising placing the web- based activity on a blacklist when there is a match but no alignment (Groth, paragraphs 92 and 235; Rajpara, col. 6 lines 26-38 and col. 7 lines 11-14).
With respect to claim 17, Groth in view of McCarty and Rajpara teaches further comprising providing a notification to a user that there is a match but no alignment (Groth, paragraphs 34, 170 and 218; Rajpara, col. 6 lines 26-38 and col. 7 lines 11-14).
With respect to claim 18, Groth in view of McCarty and Rajpara teaches further comprising allowing access to the web-based activity when there is a match and the alignment (Groth, paragraphs 50, 85, 88, 92, 99, 143-144, and 172; Rajpara, col. 6 lines 26-38 and col. 7 lines 11-14).
With respect to claim 20, Groth teaches a system comprising:
a processor (paragraph 87), a computer readable memory (paragraph 87), one or more computer readable storage media (paragraph 87), and program instructions collectively stored on the one or more computer readable storage media the program instructions executable to:
ingest internal security policies of an organization (personalized privacy charter (PPC) and/or corporate privacy charter (CPC)) (paragraphs 83, 93, 157, 170-171, 216) and external terms and conditions of a cookie agreement (privacy data policies and agreements of digital service provider including cookie policies)(paragraphs 95-96, 143-144, 202) during enrollment of the web-based activity, the web-based activity being a website, a web application or a web-based system in which a user in the organization seeks access to (Corporate privacy charter is used to calculate privacy score for all online services to which the user subscribes (enrolls) (i.e. data processing agreement from digital service provider). Also, PA system scans privacy agreements to check compliance with charter (security policy) when she browses and signals when DSP doesn’t respect privacy charter.))(paragraphs 203 and 224);
cluster terms within the internal security policies based on similarities and which identify rules to form a first set of clusters (paragraphs 24, 31, 37, 121, 159, 161);
cluster terms within the external terms and conditions of the cookie agreement based on similarities and which identify rules to form a second set of clusters (paragraphs 24, 121, 125-126, 137, 159, 161);
match the first set of clusters with the second set of clusters (paragraphs 50, 85, 88, 99, and 143);
determining whether there is an alignment within the matched clusters, the alignment indicating that external terms and conditions of the cookie agreement comply with rules of the internal cookie acceptance policies (Groth, paragraphs 50, 85, 88, 92, 99, 143-144, and 172);
provide an action based on whether the first and the second sets of clusters match and whether there is the alignment within the matched clusters (paragraphs 50, 85, 143-144, and 172),
wherein the action comprises allowing access to the web-based activity (paragraphs 50, 85, 88, 99, 143-144, and 172) responsive to a determination that no match exists between the first set of clusters and the second set of clusters (paragraphs 34, 85, 219, 224, and 235).
Although Groth teaches internal security policies and it is obvious these may include cookie policies, Groth does not explicitly teach internal cookie acceptance policies.
McCarty teaches internal cookie acceptance polices (i.e. enterprise specific cookie policies) (paragraphs 61, 64 and 81) that are compared to external terms and conditions of a cookie agreement of a web-based activity (i.e. cookie data of an application) to determine compliance (paragraphs 52, 63-64, and 80).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified the internal security policies of Groth to include internal cookie acceptance policies as taught by McCarty because incorporating a cookie policy into a security/privacy policy would yield predictable results. Further, the modification would enable an enterprise to establish (and enforce) an internal enterprise cookie standard for applications, which can be very helpful in enabling the enterprise to meet its privacy and security objectives and assures compliance with applicable governmental regulations, and minimizes technical issues. It would further enable tooling to track the use and compliance of cookies within enterprise environments, regardless of their size and IT diversity (McCarty, paragraphs 80-82).
Further regarding claim 20, Groth in view of McCarty does not explicitly teach correlating respective terms of the matched clusters to determine whether there is an alignment of the terms within the matched clusters.
Rajpara teaches matching clusters (sections) of documents (i.e. policies) and correlating respective terms of the matched clusters (i.e. sections) to determine whether there is an alignment of the terms within the matched clusters (col. 6 lines 26-38 and col. 7 lines 11-14).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified Groth to determine an alignment of terms in matched clusters as taught by Rajpara to enable documents/policies to be compared based on a degree of similarity or similarity percentage (Rajpara, col. 6 lines 17-37), thereby providing even more granularity in comparing text for similarity or compliance with other text.
With respect to claim 21, Groth in view of McCarty and Rajpara teaches further comprising analyzing text of the ingested internal cookie acceptance policies of the organization and external cookie clauses of the external terms and conditions of the cookie agreement of the web-based activity (privacy policies and agreements include cookie policies) (Groth, paragraph 96; McCarty, paragraphs 61, 63-64 and 81) using a natural language processing (NLP) algorithm to break down the text into individual words or tokens (i.e. generating a set of tokens corresponding to individual constituent text snippets of each policy in such policies with a natural language engine) (Groth, paragraphs 24, 99, 115, 123, 202, and 324) and preventing acceptance of the cookies associated with the external terms and conditions of the cookie agreement that do not comply with the internal cookie acceptance policies of the organization and thereby ensuring compliance during enrollment of the web-based activity (Groth, paragraphs 34, 36, 218-219, 235, and 239-240).
With respect to claim 22, Groth in view of McCarty and Rajpara teaches further comprising finding any prohibited actions that occur by accepting a policy of the web-based activity and prohibiting the prohibited actions (Groth, paragraph 219).
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Groth in view of McCarty and Rajpara, as applied to claim 5 above, and further in view of Lauber (US 2025/0077564 A1).
With respect to claim 6, Groth in view of McCarty and Rajpara teaches classifying sentence (paragraphs 98 and 115) and latent semantic indexing (Groth, paragraph 126).
Groth in view of McCarty and Rajpara does not teach wherein the parsing of the dependencies comprises linking words together within a sentence that are related to one another.
Lauber teaches wherein the parsing of the dependencies comprises linking words together within a sentence that are related to one another (paragraph 52).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified the dependency parsing of Groth to link words together within a sentence as taught by Lauber to enable improved natural language processing of data in Groth. Further, the modification would entail swapping the dependency parser of Groth with that of Lauber to achieve natural language processing and analysis of grammatical relationship between words.
Claims 7-10 are rejected under 35 U.S.C. 103 as being unpatentable over Groth in view of McCarty and Rajpara, as applied to claim 5 above, and further in view of Kats et al. (US 11941156 B1).
With respect to claim 7, Groth in view of McCarty and Rajpara teaches latent semantic indexing (Groth, paragraph 126).
Groth in view of McCarty and Rajpara does not teach providing semantic role labeling to identify semantic roles of words and phrases in text of the internal cookie acceptance policies of the organization and the external terms and conditions of the cookie agreement.
Kats teaches providing semantic role labeling to identify semantic roles of words and phrases in text of the internal cookie acceptance policies of the organization and the external terms and conditions of the cookie agreement (col. 7 lines 55-60; col. 8 lines 14-23).
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the invention to have modified the analyzing of grammatical relationships of Groth to perform semantic role labeling as taught by Kats to enable improved natural language processing of data in Groth by find the meaning of sentences. Further, the modification would entail incorporating the semantic role labeling of Kats into natural language processing of Groth to achieve natural language processing and analysis of grammatical relationship between words.
With respect to claim 8, Groth in view of McCarty, Rajpara and Kats teaches the method of claim 7, wherein the clustering comprises creating clusters similar rules related to the words and phrases in the text of the internal cookie acceptance policies of the organization (McCarty, paragraphs 61, 63-64 and 81) and the external terms and conditions of the cookie agreement (Groth, paragraphs 24, 31, 37, 121, 125, 137, 159, 161).
With respect to claim 9, Groth in view of McCarty, Rajpara and Kats teaches the method of claim 8, further comprising determining, by the computing device, that at least one cluster from the internal cookie acceptance policies of the organization (McCarty, paragraphs 61, 63-64 and 81) and at least one cluster of the external terms and conditions of the cookie agreement match and in the matched clusters there is the alignment (Groth, paragraphs 50, 85, 88, and 143; Rajpara, col. 6 lines 26-38 and col. 7 lines 11-14).
With respect to claim 10, Groth in view of McCarty, Rajpara and Kats teaches the method of claim 9, further comprising taking an action when there is no alignment within the matched clusters (Rajpara, col. 6 lines 26-38 and col. 7 lines 11-14), which is indicative of a violation of the internal cookie acceptance policies of the organization (Groth, paragraphs 50, 85, 143-144, and 172; McCarty, paragraphs 61, 63-64 and 81).
Claim 19 is rejected under 35 U.S.C. 103 as being unpatentable over Groth in view of McCarty and Rajpara, as applied to claim 12 above, and further in view of Pavlopoulou et al. (US 11,868,380 B1) (‘Pavlopoulou’).
With respect to claim 19, Groth in view of McCarty and Rajpara teaches, further comprising, prior to the clustering:
identifying topics of the cookie acceptance policy and the external terms and conditions of the cookie agreement (Groth, paragraphs 26, 108, 125-126, 157-158, 161; McCarty, paragraphs 61, 63, and 81);
parsing dependencies within the internal cookie acceptance policies of the organization and the external terms and conditions of the cookie agreement(Groth, paragraphs 92, 95, 123, 144, 202; McCarty, paragraphs 61, 63, and 81); and
creating clusters of the internal cookie acceptance policy and clusters of the external terms and conditions of the cookie agreement based on the identifying and parsing (Groth, paragraphs 24, 31, 37, 121, 125, 137, 159, 161; McCarty, paragraphs 61, 63, and 81).
Groth in view of McCarty and Rajpara does not explicitly teach identifying topics using a non-negative matrix factorization (NMF) model.
Pavlopoulou teaches identifying topics using a non-negative matrix factorization (NMF) model (col. 11 lines 5-7 and lines 19-20).
It would have been obvious to a person having ordinary skill in the art prior to the filing date of the invention to have modified Groth to identify topics using a NMF model as taught by Pavlopoulou because NMF produces semantically-coherent or “cleaner” topics, meaning topics more easily interpretable by humans, and with its computational efficiency, it is easier and quicker to scale up to large-scale datasets; NMF topic model formulation further improves the quality of topics (Pavlopoulou, abstract, column 11 lines 5-20).
Claim 23 is rejected under 35 U.S.C. 103 as being unpatentable over Groth in view of McCarty and Rajpara, as applied to claim 1 above, and further in view of Agarwala et al. (US 2023/0153390 A1) (‘Agarwala’).
With respect to claim 23, Groth in view of McCarty and Rajpara teaches clusters.
Groth in view of McCarty and Rajpara does not explicitly teach wherein the clusters are created using a model based on Balance Iterative Reducing and Clustering using Hierarchies (BIRCH) algorithm.
Agarwala teaches wherein the clusters are created using a model based on Balance Iterative Reducing and Clustering using Hierarchies (BIRCH) algorithm (paragraphs 15 and 46).
It would have been obvious to a person having ordinary skill in the art prior to the filing date of the invention to have modified the clustering of Groth to be based on a BIRCH algorithm as taught by Agarwala because BIRCH is very efficient for large data and it also improves the accuracy of detecting proximity between data while keeping the computational expenses to minimum. As such, this reduces the time and processing power (Agarwala, abstract, paragraphs 46 and 48).
Response to Arguments
Applicant’s arguments with respect to claims 1-12 and 16-23 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ALICIA M WILLOUGHBY whose telephone number is (571)272-5599. The examiner can normally be reached 9-5:30, EST, M-F.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ajay Bhatia can be reached at 571-272-3906. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ALICIA M WILLOUGHBY/Primary Examiner, Art Unit 2156 June 12, 2026
Prosecution Insights