What Users Ask, Policies Miss: Unveiling the Gap Between Community-Expressed Privacy Concerns and LLM Provider Policies

Large Language Models(LLMs) process millions of conversations containing sensitive information daily, yet whether their privacy policies adequately address users' publicly expressed concerns remains unexplored. This paper presents the first large-scale, user-centered audit of privacy policy adequacy in LLM services. We systematically extract privacy concerns from Reddit communities of five major LLM providers and assess whether their latest privacy policies address these concerns. Our semi-automated pipeline analyzes 1,531 threads to extract 4,994 authentic privacy concerns, which we organize into a 20-topic taxonomy spanning four thematic groups. We then identify 3,137 policy gap instances and classify them into six categories: four policy coverage gaps (detail vague, AI feature unaddressed, vulnerable group neglected, and jurisdiction unclear) and two user perception gaps (explicit distrust and awareness deficit). Our analysis reveals that coverage gaps and perception gaps contribute nearly equally (50.2% vs. 49.8%), with AI-specific feature gaps (36.6%) and user awareness deficits (40.7%) together comprising the vast majority (77.3%) of all identified gaps. Notably, we also surface user-reported evidence suggesting potential discrepancies between stated policies and observed system behavior, highlighting the need for verifiable privacy guarantees. These findings demonstrate that improving LLM privacy requires dual-pronged interventions addressing both inadequate policy disclosures and user comprehension barriers, offering actionable insights for relevant stakeholders.