9 ms·

Privacy Policies Are an Incomprehensible Disaster

233 points by tysone 7y ago

ziddoap 7y ago
"For comparison, here are the scores for some classic texts. Only Immanuel Kant’s famously difficult “Critique of Pure Reason” registers a more challenging readability score than Facebook’s privacy policy. (To calculate their reading time, I measured the first chapter of each text.) " I'm feeling an interesting mix of laughter and sadness. How can you not laugh at the ridiculousness of a privacy policy being less legible than "Criqiue of Pure Reason"? How can you not feel a tinge of sadness at the state of the world when this is not only acceptable, but expected? Yet, it doesn't surprise me that privacy policies are generally hot garbage. And that's sad too.
- testplzignore 7y ago
  The real measuring stick of readability should be The Silmarillion :) There are plenty of ways privacy policies are bad, but I think the reading scores NYT is using from Lexile are a bogus criticism. From a reading length and vocabulary perspective, I don't see anything in the Facebook privacy policy that I wouldn't expect a high school student to be able to comprehend. My main criticism of privacy policies is that, after reading them, you realize that there is practically no upper bound on how your data can actually be used. You give the company a key to your house, and it is up to them to decide if they want to trash the place.
  - fmajid 7y ago
    I read the Silmarillion when I was 11. It's hardly challenging reading like dense and opaque German philosophy texts tend to be (I am looking at you, Wittgenstein).
    - danaris 7y ago
      Agreed. The Silmarillion's language isn't simple, but it is lyrical, and is intended to evoke great epics in its style. I think the most uncharitable thing you can say about it is that it reads somewhat like the King James Bible.
      - fmajid 7y ago
        Right, and unlike those philosophy texts, there is actually a payoff for the reader.
  - ziddoap 7y ago
    >I don't see anything in the Facebook privacy policy that I wouldn't expect a high school student to be able to comprehend. I think, vocabulary wise, yes. High school students should be able to read each word. The problem is context and impact. Can the reader not only read the words, but understand them in the context of the entire document as well as in the context of their usage? For example: >"[...]we collect information from and about the computers, phones, connected TVs and other web-connected devices you use that integrate with our Products, and we combine this information across different devices that you use." The words are easy to read. The meaning, however, is not. Most people don't take the time to learn how severe of an impact aggregating data has. It seems harmless to share two pieces of non-PII, until you learn that two pieces of non-PII may become PII when aggregated. The test by Lexile claims to measure complexity, not just the legibility. However, I haven't looked into the test that much and don't have an opinion on its accuracy. That said, I don't think the average person can _understand_ the documents, even if they can read the words - which is the same conclusion reached in the parent article: >"Even policies that are shorter and easier to read can be impenetrable, given the amount of background knowledge required to understand how things like cookies and IP addresses play a role in data collection."
gnicholas 7y ago
> The BBC has an unusually readable privacy policy. It’s written in short, declarative sentences, using plain language. This is good to know. Startups often adapt language for their own privacy policies from those of big companies (on the assumption that such policies are good/vetted). Hopefully founders who read this article will turn to the BBC's policy when figuring out how to fashion their own.
- ceejayoz 7y ago
  I was pretty impressed with Basecamp's. https://basecamp.com/about/policies/privacy https://basecamp.com/about/policies/privacy
solomatov 7y ago
It's not only about privacy policies. Terms of service and other contracts which people use are equally incomprehensible and full of legalese.
- solomatov 7y ago
  A good example of how far the situation came is described here: https://abovethelaw.com/2010/06/do-lawyers-actaully-read-boilerplate-contracts-judge-richard-posner-doesnt-do-you/ https://abovethelaw.com/2010/06/do-lawyers-actaully-read-boi... >Judge Posner at ACS panel: For my home equity loan, I got 100s of pages of documentation; I didn’t read, I just signed. #ACS10 #Posner #LOL
  - howard941 7y ago
    Isn't that a more efficient use of time? The terms aren't negotiable other than walking away.
    - solomatov 7y ago
      I am not so sure about it. The contract might contain something substantially adverse to you and still be enforceable. For example, in some EULAs I saw a paragraphs completely forbidding you to compete with any products of the company.
ebrewste 7y ago
Pretty well written piece for a an intro to this issue. Same issue with cookie acknowledgements. Some important quotes: “These are documents created by lawyers, for lawyers. They were never created as a consumer tool,” Dr. King said. "The BBC has an unusually readable privacy policy. It’s written in short, declarative sentences, using plain language. " The BBC example shows that it is possible to write a readable policy, if a company cares to.
- marcinzm 7y ago
  It's to many for-profit companies benefit that consumers not understand or read their privacy policies.
- mtgx 7y ago
  I think there should be a law that puts the burden of proof that the user understood the privacy policy on the company. This way the company would have an incentive to make it as easy to understand as possible and to ensure every user understands what they're doing -- otherwise, if any user sues them over a privacy breach, the company has a high-risk of losing that lawsuit if the judge/jury determines it wasn't easy for the user to comprehend the privacy policy, as per the mentioned law. GDPR sorts of does this, but I think it's only half-way there. It's always about incentives. Companies have all the incentives in the world to make the privacy policies as complicated and obfuscated as possible, while also putting in there that basically the user gives up all rights and data the moment they see the company's website, so that they remove any responsibility they might have otherwise.
  - icebraining 7y ago
    I think the GDPR is quite good, just not actually being applied. In fact, I'd say most or all of these are plainly invalid, since they don't present the request for consent "in a manner which is clearly distinguishable from the other matters", and they don't allow consenting separately for each purpose.
  - skybrian 7y ago
    I don't think most users want to spend any time understanding privacy policies. If you made people take a quiz showing the understand what they're getting into (like when getting a driver's license), user signups would go down dramatically. Plus this would probably be considered free labor and/or discrimination, like some people complain about captchas.
rosterface 7y ago
The New York Times is as bad at privacy as anyone. Here is their policy: https://help.nytimes.com/hc/en-us/articles/115014892108-Privacy-policy https://help.nytimes.com/hc/en-us/articles/115014892108-Priv... They make extremely illegitimate claims about "needing" to collect your personal information to provide their "services". Which is absolutely untrue since they're a newspaper you could read completely anonymously with zero degradation to experience (except where they've deliberately hobbled that option).
- toby- 7y ago
  Do you suppose the author of this opinion piece wrote the New York Times' privacy policy? Edit: some fair counterpoints to me, below. But publishing an opinion piece does not necessarily imply endorsement, and nor does it diminish the author's point(s) one iota.
  - SilasX 7y ago
    It's not relevant. I think accusations of hypocrisy usually map to an insightful argument: "Hey, there's a reason people do that thing you object to, and it's usually a good reason, as demonstrated by the fact that, given all the options, you find yourself resorting to it. So, maybe instead of shaming people, you should be helping to isolate the reason and find a way to obviate it instead of just throwing stones."
    - nickv 7y ago
      To be fair, the New York Times' privacy policy actually is represented as one of those dots in the image (and it's not in a particularly good spot ... it's pretty close to the top): https://imgur.com/a/wTHkk4O https://imgur.com/a/wTHkk4O
  - arkades 7y ago
    I keep hearing this. Every time the NYT writes an article on X, while being a hypocrite on X, "Do you think the guy who wrote this was also in charge of X at the NYT?" It's a valid counterpoint. The guy who wrote about X is not, usually, in charge of X. Agreed. The criticism, however, is not about the author - it's about the organization that endorses both the action X, and the criticism of X. The NYT is an opinionated organization, not a public wall open to whoever wants to throw things at it. They have an editorial stance. When they write criticisms of X, they are implicitly - as an organization - criticizing X. When they do X themselves, they are - as an organization - implicitly endorsing X. When they wish to distance themselves from a criticism in an article, they explicitly point out - hey, this is an Op-Ed from such-and-such author, and doesn't represent the views of the NYT. When it's not an Op-Ed, and/or when it's not disavowed, they are saying: this article represents the views of the NYT. The writer is not a hypocrite. The organization, however, is. There's nothing illogical or invalid about holding the organization accountable for doing bad things, and for pointing out that the organization is trying to earn goodwill from the public by being "against X" while perpetrating the act themselves.
Dajsvaro 7y ago
Twilio does an excellent job with their Terms of Service and Privacy Policies. For example, their Terms of Service has a "plain english" version in a right hand column, along with the legalese in the right: https://www.twilio.com/legal/tos https://www.twilio.com/legal/tos
- cdubzzz 7y ago
  But it is still maddeningly long. Even with the plain English version, who would ever read and digest that before signing up for Twilio (other than a lawyer)?
  - morpheuskafka 7y ago
    I'd hope who is about to build their business around the service and sign a contract in the name of their business to use it could take some time to read it... if not they shouldn't be signing their company up for it.
    - cdubzzz 7y ago
      Sure, that is the ideal. I'm more curious about the reality... Check out this page -- https://www.twilio.com/try-twilio https://www.twilio.com/try-twilio At the bottom it says, "By clicking the button, you agree to our legal policies." Ignoring the ambiguity of that statement, it seems that someone can't even sign up for a free trial without agreeing to the full set of terms. Does that mean a business needs to make a complete legal review of the policies before an employee can sign up to _test_ the service and decide if they want to use it? How often does that actually happen?
      - morpheuskafka 7y ago
        If it's not going to be used in production, which a free trial presumably wouldn't be, then you probably don't need a full review of the terms although it would be a good idea to take care of it.
- seandougall 7y ago
13415 7y ago
Luckily, these "contracts" are void in most European countries.
johnny313 7y ago
This really raises the question of what it means to "consent" to something. If you don't actually understand what you are consenting too, is it legally binding?
- kevin_b_er 7y ago
  A meeting of the minds is no longer really a requirement in American contract law. You do not have to understand what you're being legally bound to. You don't even have to understand if your human rights are being signed away either.
  - rhino369 7y ago
    The idea is that you have a meeting of the minds that the document you are signing contains the terms. If you could later argue that you didn't understand it and therefore shouldn't be bound, it would make contracts impossible to uphold. Though I do think there should be some sort of loosening of the requirements for a contract to be found unconscionable or deceptive.
- nabnob 7y ago
  Not a lawyer, but I seem to remember reading somewhere that a lot of these user agreements aren't legally binding specifically because no one reads them and most people don't understand what they're agreeing to anyway.
lacker 7y ago
Meanwhile, the New York Times privacy policy is also enormously long and unreadable. It even links to the Google privacy policies, saying that by reading the NYT you also have to be aware of the Google privacy policies, because the NYT uses both Google Ads and Google Analytics. https://help.nytimes.com/hc/en-us/articles/115014892108-Privacy-policy https://help.nytimes.com/hc/en-us/articles/115014892108-Priv...
- Alex3917 7y ago
  > It even links to the Google privacy policies, saying that by reading the NYT you also have to be aware of the Google privacy policies, because the NYT uses both Google Ads and Google Analytics. In order to build apps on Google APIs, your end users are required to agree to Google's API terms. In this case I'm not sure they were required to do this, but it's pretty normal to have your users agree to third-party terms as part of your terms.
davidw 7y ago
I've never used the service, but these guys have tried to standardize and automate the generation of privacy policies: https://www.iubenda.com/en/ https://www.iubenda.com/en/
- hadrien01 7y ago
  You need an account just to generate text?
  - davidw 7y ago
    I just recalled it existed and posted it - you can go argue with the people at the company about how their site works. I would imagine that it's kind of vulnerable to people just ripping the text off if they're not careful.
selectout 7y ago
Did an analysis on Alexa's top 1000 sites and their privacy policies a few years back. A brief infographic of the high level of this https://mashable.com/2011/01/27/the-real-reason-no-one-reads-privacy-policies-infographic/ https://mashable.com/2011/01/27/the-real-reason-no-one-reads...
reaperducer 7y ago
Working in healthcare, we have a privacy department that is adjunct to the legal department. It did an audit of all of my web sites last year and I was surprised to find out that they recommended that the privacy policies be removed from some of them. The reason was simple: The sites in question didn't do any tracking. So if you're not gathering information, there's no need to warn.
- groovybits 7y ago
  I disagree with this sentiment. If you do not track any user activity on your site, then perhaps there is not need to have a pop-up warning in your face. But the fact that you willingly do NOT track user activity IS your privacy policy. The policy does not go away. As a user visiting a site, I would much rather have the policy accessible, even if it says that the website does not have any tracking enabled. Edit: And I'm surprised that a legal advisor would recommend to remove the policy entirely. Isn't it generally better to be explicit and forthcoming, rather than say nothing at all?
  - LinuxBender 7y ago
    I agree with this. If you really don't collect data, then state it as such. That should certainly bolster confidence by the end users of the system.
morpheuskafka 7y ago
I don't think it's really fair to compare a privacy policy to A Critique of Pure Reason. One is hard to read because it references laws and has a lot of boilerplate stuff that you can skip over, the other involves abstract philosophical questions that are difficult to consider in terms of the subject matter itself.
diveanon 7y ago
"I agree" is the biggest lie of the information age.
0xffff2 7y ago
>The vast majority of these privacy policies exceed the college reading level. And according to the most recent literacy survey conducted by the National Center for Education Statistics, over half of Americans may struggle to comprehend dense, lengthy texts. That means a significant chunk of the data collection economy is based on consenting to complicated documents that many Americans can’t understand. How is this different to law itself? If we're going to argue that it's problematic for something as (relatively) inconsequential as privacy policies to be unintelligible, shouldn't we start with something more basic?
- icebraining 7y ago
  That the legibility of the law could and should be improved is a fair point. That said, humanity isn't incapable of concurrency - there's no reason to have to wait for the law before tackling privacy policies, which while a lesser issue, are also easier to change.
- ryandrake 7y ago
  I’d argue that the vast majority of Americans would struggle to comprehend a basic cell phone contract, auto loan, or mortgage, which we routinely sign. The problem is that people have to pretend to understand/agree with something in order to receive a service. You should not have to agree to a deliberately incomprehensible document as a condition of receiving a service you pay for.
samdixon 7y ago
I have recently been wondering if, instead of a company having a privacy policy, they could instead use a privacy license. This way you could easily discern their stance on privacy from the name of the license. Not sure if anything like this exists or if it would be worth looking into.
- tomcatfish 7y ago
  This actually sounds like an interesting deal, as it would make figuring out what a company does with your data easier to understand, but I'm fearful of 2 main things: 1. It's still a battle to explain to non-technically minded people whether an image is Creative Commons or free use or to get them to understand that there are different kinds of CC. 2. It will mean there is less to read through, but many companies will still fit blocks together (ie. General Use+Advertising Third Party+Server Backup in Other Country) or resort to using a license that is more general than they need, but definitely includes the things they want to do. It's a _really_ cool idea though, and I'm curious whether anyone has ever tried anything like it before.
bediger4000 7y ago
All or nearly all privacy policies are incomprehensible. The main exceptions appear to be European, or non-profit's. Does this uniform incomprehensibility come from an identifiable root cause, or is it just emergent because of a variety of factors, not all of which afflict every company?
- lmkg 7y ago
  Key quote from the article: > These are documents created by lawyers, for lawyers. They were never created as a consumer tool They are generally treated as the responsibility of the legal team, so they are written as legal documents. Companies treat them as a way to pro-actively defend against lawsuits (much like the Terms of Service), and not as a way to inform or educate users. The reason why many readable privacy policies come from Europe is because GDPR makes it literally a legal requirement that they are written "using clear and plain language." Source: GDPR Article 12 https://gdpr-info.eu/art-12-gdpr/ https://gdpr-info.eu/art-12-gdpr/
the_snooze 7y ago
There's an ongoing study whose early results found that even if people read and understood privacy policies (for mobile apps), those policies are incomplete, wrong, or self-contradictory a decent chunk of the time: https://www.ieee-security.org/TC/SPW2019/ConPro/papers/okoyomon-conpro19.pdf https://www.ieee-security.org/TC/SPW2019/ConPro/papers/okoyo... It's hard to see privacy policies being written in good faith. In my opinion, they're little more than declarations of "I'm going to do all these sketchy things with your data, and it's your responsibility to protect yourself from me."
dougk16 7y ago
I spent a ton of time on making my site's privacy policy easy to read, while also discussing philosophy and some technical aspects, meant to be read by anyone who can understand simple English. https://aytwit.com/about#privacy https://aytwit.com/about#privacy Feedback welcome! It's time to come up with solutions! So post yours below as well!
droithomme 7y ago
My preferred privacy policy is as follows: "Privacy Policy: We will not share your private information with anyone."
- lmkg 7y ago
  Not GDPR-compliant, nor would I personally consider it anywhere near complete. What information do you have about me? Can I see a copy of it? Why do you have it? What are you using it for? How long are you keeping it? How are you keeping it secure? (As far as I can tell, GDPR does not actually require you to answer how, only that you do it.) As an alternative, my preferred privacy policy: "We do not collect your personal information."
  - akersten 7y ago
    Hey, yours isn't complete either! :) Just by visiting your site, you are collecting my personal information (after all, GDPR says IP address is PII). So what are you doing with it, and how long are you keeping it?
    - lmkg 7y ago
      GDPR does not say that IP address is PII. Among other objections, GDPR does not mention IP address, nor does it mention PII. The current guidance on IP addresses is ambiguous, but my understanding is that an IP address on its own does not count as personal data. It can become personal data when it's used to create a profile. So if you only have the full IP fleetingly to serve web pages, and all logging wipes the last octet, there's no point where the data that you process counts as personal data.
      - droithomme 7y ago
        GDPR doesn't get that specific, but the judges in the courts do. In Breyer v. Bundesrepublik Deutschland, E.C.J., No. C-582/14, 10/19/16, it was ruled that internet protocol addresses relating to visitors' use of websites constitutes "protected data" according to European Union laws.
deleted 7y ago
[deleted]
lixtra 7y ago
Creative Commons like modular privacy policies could be a solution: https://www.achtungtechnik.de/english/2018/GDPR-statement-like-CC.html https://www.achtungtechnik.de/english/2018/GDPR-statement-li...
itsaidpens 7y ago
Lawyers are awful.
ticmasta 7y ago
I did a similar, deeper review of less policies for my course work in Privacy Protection and Freedom of Information with some of the same conclusions around length & required reading level. It's worse than this though; Orgs like Facebook have dozens of documents that deal with what data they collect and how they will use it. Even identifying what comprises their "privacy policy" is a huge task. Another massive issue: unilateral, largely uncommunicated changes. Stack Exchange used to have a very handy regular (read: legalese) policy and a parallel "plain language" version that I can't find anymore. They still have a relatively decent policy but that's only because the average quality is so low. for context I was using Canada's The Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's PIPA which is a scope similar to GDPR in many ways. PIPEDA is an interesting document; it's based on a set of expectations or statements that are decidedly "non legal" in nature which makes it very different from most laws
svachalek 7y ago
I don't see why they can't just follow the example of open source licenses. GPL is powerful and complicated, but when you see something is GPL you know what you're getting into because you've seen it before. There are a handful of well-known policies that have varying levels of generosity, and anyone can always make up a new one -- but if they do it's a bit of a red flag and people will dig in to find out what it's about. The problem with current policies is only partly that they're complicated, it also has a lot to do with them being snowflakes too.
zelon88 7y ago
I'm pretty proud of this one..... https://www.honestrepair.net/index.php/privacy-policy/ https://www.honestrepair.net/index.php/privacy-policy/
- mLuby 7y ago
  That is shockingly comprehensible and concise; you are right to be proud! (BTW "it’s" should be "its" in the second sentence.)
michaelaiello 7y ago
Built http://www.privacyparrot.com http://www.privacyparrot.com which uses ML to simplify privacy policies back in 2011 and it continues to grow in usage. Thank you HN community for the feedback back then https://news.ycombinator.com/item?id=3222334 https://news.ycombinator.com/item?id=3222334
eitland 7y ago
For me it was very interesting to see what GDPR did did to Googles privacy policy: it seems to have forced them to simplify and shorten it.
heisenbit 7y ago
My understanding of the GDPR in Europe is that these policies inform consumers but do not bind them. There is a widespread practice to let consumers sign them everywhere but this piece of paper does not change much the requirements for the company under the law.
7402 7y ago
Whether or not they are incomprehensible, I worry more that most of them seem to boil down to: "We can do whatever we want with any data we have about you. Your only alternative is to not use our services and not use any other business or organization that uses our services." Any privacy policy that has the usual clause saying, "We can change this policy at any time by posting an update to our website," is saying essentially the above. I suppose it would help if they were forced simply to put their policy in those terms - then more people might push back against it.
mirimir 7y ago
This is not exactly news, but having a NYT statement is cool. They're obviously legalistic bullshit. So whatever privacy and rights I need, I create myself. And so I can entirely ignore ToS and privacy policies.
Animats 7y ago
It's not that hard to read most EULAs and privacy policies, because they're usually plagarized from someone else's documents, and contain much the same clauses. ...Overreaching indemnification clause, bleah...disputes must be resolved in courts of Northern California, OK (Outer Nowhere, not so OK, offshore tax haven island, very bad) ... arbitration required under AAA consumer rules, not too bad (National Arbitration Forum was very bad) ... no class actions, all too common ... "sole discretion" termination, run away in a B2B context ... vagueness in what can be done with your data, all too common, and often where privacy rights go away ... mention of "affilates" having access, not good ... limitation of liability, common for ordinary websites but inappropriate for anybody you keep money with .... After you read about ten of these things, a pattern emerges.
jiveturkey 7y ago
Graphs done right! I can't imagine how this article could be better. I wish they would make their privacy analysis tools available to the public. So you could plug in the URL of your favorite policy and see how it ranks.

233 points by tysone 7y ago

"For comparison, here are the scores for some classic texts. Only Immanuel Kant’s famously difficult “Critique of Pure Reason” registers a more challenging readability score than Facebook’s privacy policy. (To calculate their reading time, I measured the first chapter of each text.) " I'm feeling an interesting mix of laughter and sadness. How can you not laugh at the ridiculousness of a privacy policy being less legible than "Criqiue of Pure Reason"? How can you not feel a tinge of sadness at the state of the world when this is not only acceptable, but expected? Yet, it doesn't surprise me that privacy policies are generally hot garbage. And that's sad too.

testplzignore 7y ago
The real measuring stick of readability should be The Silmarillion :) There are plenty of ways privacy policies are bad, but I think the reading scores NYT is using from Lexile are a bogus criticism. From a reading length and vocabulary perspective, I don't see anything in the Facebook privacy policy that I wouldn't expect a high school student to be able to comprehend. My main criticism of privacy policies is that, after reading them, you realize that there is practically no upper bound on how your data can actually be used. You give the company a key to your house, and it is up to them to decide if they want to trash the place.
- fmajid 7y ago
  I read the Silmarillion when I was 11. It's hardly challenging reading like dense and opaque German philosophy texts tend to be (I am looking at you, Wittgenstein).
  - danaris 7y ago
    Agreed. The Silmarillion's language isn't simple, but it is lyrical, and is intended to evoke great epics in its style. I think the most uncharitable thing you can say about it is that it reads somewhat like the King James Bible.
    - fmajid 7y ago
      Right, and unlike those philosophy texts, there is actually a payoff for the reader.
- ziddoap 7y ago
  >I don't see anything in the Facebook privacy policy that I wouldn't expect a high school student to be able to comprehend. I think, vocabulary wise, yes. High school students should be able to read each word. The problem is context and impact. Can the reader not only read the words, but understand them in the context of the entire document as well as in the context of their usage? For example: >"[...]we collect information from and about the computers, phones, connected TVs and other web-connected devices you use that integrate with our Products, and we combine this information across different devices that you use." The words are easy to read. The meaning, however, is not. Most people don't take the time to learn how severe of an impact aggregating data has. It seems harmless to share two pieces of non-PII, until you learn that two pieces of non-PII may become PII when aggregated. The test by Lexile claims to measure complexity, not just the legibility. However, I haven't looked into the test that much and don't have an opinion on its accuracy. That said, I don't think the average person can _understand_ the documents, even if they can read the words - which is the same conclusion reached in the parent article: >"Even policies that are shorter and easier to read can be impenetrable, given the amount of background knowledge required to understand how things like cookies and IP addresses play a role in data collection."

gnicholas 7y ago

> The BBC has an unusually readable privacy policy. It’s written in short, declarative sentences, using plain language. This is good to know. Startups often adapt language for their own privacy policies from those of big companies (on the assumption that such policies are good/vetted). Hopefully founders who read this article will turn to the BBC's policy when figuring out how to fashion their own.

ceejayoz 7y ago
I was pretty impressed with Basecamp's. https://basecamp.com/about/policies/privacy https://basecamp.com/about/policies/privacy

solomatov 7y ago

It's not only about privacy policies. Terms of service and other contracts which people use are equally incomprehensible and full of legalese.

solomatov 7y ago
A good example of how far the situation came is described here: https://abovethelaw.com/2010/06/do-lawyers-actaully-read-boilerplate-contracts-judge-richard-posner-doesnt-do-you/ https://abovethelaw.com/2010/06/do-lawyers-actaully-read-boi... >Judge Posner at ACS panel: For my home equity loan, I got 100s of pages of documentation; I didn’t read, I just signed. #ACS10 #Posner #LOL
- howard941 7y ago
  Isn't that a more efficient use of time? The terms aren't negotiable other than walking away.
  - solomatov 7y ago
    I am not so sure about it. The contract might contain something substantially adverse to you and still be enforceable. For example, in some EULAs I saw a paragraphs completely forbidding you to compete with any products of the company.

ebrewste 7y ago

Pretty well written piece for a an intro to this issue. Same issue with cookie acknowledgements. Some important quotes: “These are documents created by lawyers, for lawyers. They were never created as a consumer tool,” Dr. King said. "The BBC has an unusually readable privacy policy. It’s written in short, declarative sentences, using plain language. " The BBC example shows that it is possible to write a readable policy, if a company cares to.

marcinzm 7y ago
It's to many for-profit companies benefit that consumers not understand or read their privacy policies.
mtgx 7y ago
I think there should be a law that puts the burden of proof that the user understood the privacy policy on the company. This way the company would have an incentive to make it as easy to understand as possible and to ensure every user understands what they're doing -- otherwise, if any user sues them over a privacy breach, the company has a high-risk of losing that lawsuit if the judge/jury determines it wasn't easy for the user to comprehend the privacy policy, as per the mentioned law. GDPR sorts of does this, but I think it's only half-way there. It's always about incentives. Companies have all the incentives in the world to make the privacy policies as complicated and obfuscated as possible, while also putting in there that basically the user gives up all rights and data the moment they see the company's website, so that they remove any responsibility they might have otherwise.
- icebraining 7y ago
  I think the GDPR is quite good, just not actually being applied. In fact, I'd say most or all of these are plainly invalid, since they don't present the request for consent "in a manner which is clearly distinguishable from the other matters", and they don't allow consenting separately for each purpose.
- skybrian 7y ago
  I don't think most users want to spend any time understanding privacy policies. If you made people take a quiz showing the understand what they're getting into (like when getting a driver's license), user signups would go down dramatically. Plus this would probably be considered free labor and/or discrimination, like some people complain about captchas.

rosterface 7y ago

The New York Times is as bad at privacy as anyone. Here is their policy: https://help.nytimes.com/hc/en-us/articles/115014892108-Privacy-policy https://help.nytimes.com/hc/en-us/articles/115014892108-Priv... They make extremely illegitimate claims about "needing" to collect your personal information to provide their "services". Which is absolutely untrue since they're a newspaper you could read completely anonymously with zero degradation to experience (except where they've deliberately hobbled that option).

toby- 7y ago
Do you suppose the author of this opinion piece wrote the New York Times' privacy policy? Edit: some fair counterpoints to me, below. But publishing an opinion piece does not necessarily imply endorsement, and nor does it diminish the author's point(s) one iota.
- SilasX 7y ago
  It's not relevant. I think accusations of hypocrisy usually map to an insightful argument: "Hey, there's a reason people do that thing you object to, and it's usually a good reason, as demonstrated by the fact that, given all the options, you find yourself resorting to it. So, maybe instead of shaming people, you should be helping to isolate the reason and find a way to obviate it instead of just throwing stones."
  - nickv 7y ago
    To be fair, the New York Times' privacy policy actually is represented as one of those dots in the image (and it's not in a particularly good spot ... it's pretty close to the top): https://imgur.com/a/wTHkk4O https://imgur.com/a/wTHkk4O
- arkades 7y ago
  I keep hearing this. Every time the NYT writes an article on X, while being a hypocrite on X, "Do you think the guy who wrote this was also in charge of X at the NYT?" It's a valid counterpoint. The guy who wrote about X is not, usually, in charge of X. Agreed. The criticism, however, is not about the author - it's about the organization that endorses both the action X, and the criticism of X. The NYT is an opinionated organization, not a public wall open to whoever wants to throw things at it. They have an editorial stance. When they write criticisms of X, they are implicitly - as an organization - criticizing X. When they do X themselves, they are - as an organization - implicitly endorsing X. When they wish to distance themselves from a criticism in an article, they explicitly point out - hey, this is an Op-Ed from such-and-such author, and doesn't represent the views of the NYT. When it's not an Op-Ed, and/or when it's not disavowed, they are saying: this article represents the views of the NYT. The writer is not a hypocrite. The organization, however, is. There's nothing illogical or invalid about holding the organization accountable for doing bad things, and for pointing out that the organization is trying to earn goodwill from the public by being "against X" while perpetrating the act themselves.

Dajsvaro 7y ago

Twilio does an excellent job with their Terms of Service and Privacy Policies. For example, their Terms of Service has a "plain english" version in a right hand column, along with the legalese in the right: https://www.twilio.com/legal/tos https://www.twilio.com/legal/tos

cdubzzz 7y ago
But it is still maddeningly long. Even with the plain English version, who would ever read and digest that before signing up for Twilio (other than a lawyer)?
- morpheuskafka 7y ago
  I'd hope who is about to build their business around the service and sign a contract in the name of their business to use it could take some time to read it... if not they shouldn't be signing their company up for it.
  - cdubzzz 7y ago
    Sure, that is the ideal. I'm more curious about the reality... Check out this page -- https://www.twilio.com/try-twilio https://www.twilio.com/try-twilio At the bottom it says, "By clicking the button, you agree to our legal policies." Ignoring the ambiguity of that statement, it seems that someone can't even sign up for a free trial without agreeing to the full set of terms. Does that mean a business needs to make a complete legal review of the policies before an employee can sign up to _test_ the service and decide if they want to use it? How often does that actually happen?
    - morpheuskafka 7y ago
      If it's not going to be used in production, which a free trial presumably wouldn't be, then you probably don't need a full review of the terms although it would be a good idea to take care of it.
seandougall 7y ago

13415 7y ago

Luckily, these "contracts" are void in most European countries.

johnny313 7y ago

This really raises the question of what it means to "consent" to something. If you don't actually understand what you are consenting too, is it legally binding?

kevin_b_er 7y ago
A meeting of the minds is no longer really a requirement in American contract law. You do not have to understand what you're being legally bound to. You don't even have to understand if your human rights are being signed away either.
- rhino369 7y ago
  The idea is that you have a meeting of the minds that the document you are signing contains the terms. If you could later argue that you didn't understand it and therefore shouldn't be bound, it would make contracts impossible to uphold. Though I do think there should be some sort of loosening of the requirements for a contract to be found unconscionable or deceptive.
nabnob 7y ago
Not a lawyer, but I seem to remember reading somewhere that a lot of these user agreements aren't legally binding specifically because no one reads them and most people don't understand what they're agreeing to anyway.

lacker 7y ago

Meanwhile, the New York Times privacy policy is also enormously long and unreadable. It even links to the Google privacy policies, saying that by reading the NYT you also have to be aware of the Google privacy policies, because the NYT uses both Google Ads and Google Analytics. https://help.nytimes.com/hc/en-us/articles/115014892108-Privacy-policy https://help.nytimes.com/hc/en-us/articles/115014892108-Priv...

Alex3917 7y ago
> It even links to the Google privacy policies, saying that by reading the NYT you also have to be aware of the Google privacy policies, because the NYT uses both Google Ads and Google Analytics. In order to build apps on Google APIs, your end users are required to agree to Google's API terms. In this case I'm not sure they were required to do this, but it's pretty normal to have your users agree to third-party terms as part of your terms.

davidw 7y ago

I've never used the service, but these guys have tried to standardize and automate the generation of privacy policies: https://www.iubenda.com/en/ https://www.iubenda.com/en/

hadrien01 7y ago
You need an account just to generate text?
- davidw 7y ago
  I just recalled it existed and posted it - you can go argue with the people at the company about how their site works. I would imagine that it's kind of vulnerable to people just ripping the text off if they're not careful.

selectout 7y ago

Did an analysis on Alexa's top 1000 sites and their privacy policies a few years back. A brief infographic of the high level of this https://mashable.com/2011/01/27/the-real-reason-no-one-reads-privacy-policies-infographic/ https://mashable.com/2011/01/27/the-real-reason-no-one-reads...

reaperducer 7y ago

Working in healthcare, we have a privacy department that is adjunct to the legal department. It did an audit of all of my web sites last year and I was surprised to find out that they recommended that the privacy policies be removed from some of them. The reason was simple: The sites in question didn't do any tracking. So if you're not gathering information, there's no need to warn.

groovybits 7y ago
I disagree with this sentiment. If you do not track any user activity on your site, then perhaps there is not need to have a pop-up warning in your face. But the fact that you willingly do NOT track user activity IS your privacy policy. The policy does not go away. As a user visiting a site, I would much rather have the policy accessible, even if it says that the website does not have any tracking enabled. Edit: And I'm surprised that a legal advisor would recommend to remove the policy entirely. Isn't it generally better to be explicit and forthcoming, rather than say nothing at all?
- LinuxBender 7y ago
  I agree with this. If you really don't collect data, then state it as such. That should certainly bolster confidence by the end users of the system.

morpheuskafka 7y ago

I don't think it's really fair to compare a privacy policy to A Critique of Pure Reason. One is hard to read because it references laws and has a lot of boilerplate stuff that you can skip over, the other involves abstract philosophical questions that are difficult to consider in terms of the subject matter itself.

diveanon 7y ago

"I agree" is the biggest lie of the information age.

0xffff2 7y ago

>The vast majority of these privacy policies exceed the college reading level. And according to the most recent literacy survey conducted by the National Center for Education Statistics, over half of Americans may struggle to comprehend dense, lengthy texts. That means a significant chunk of the data collection economy is based on consenting to complicated documents that many Americans can’t understand. How is this different to law itself? If we're going to argue that it's problematic for something as (relatively) inconsequential as privacy policies to be unintelligible, shouldn't we start with something more basic?

icebraining 7y ago
That the legibility of the law could and should be improved is a fair point. That said, humanity isn't incapable of concurrency - there's no reason to have to wait for the law before tackling privacy policies, which while a lesser issue, are also easier to change.
ryandrake 7y ago
I’d argue that the vast majority of Americans would struggle to comprehend a basic cell phone contract, auto loan, or mortgage, which we routinely sign. The problem is that people have to pretend to understand/agree with something in order to receive a service. You should not have to agree to a deliberately incomprehensible document as a condition of receiving a service you pay for.

samdixon 7y ago

I have recently been wondering if, instead of a company having a privacy policy, they could instead use a privacy license. This way you could easily discern their stance on privacy from the name of the license. Not sure if anything like this exists or if it would be worth looking into.

tomcatfish 7y ago
This actually sounds like an interesting deal, as it would make figuring out what a company does with your data easier to understand, but I'm fearful of 2 main things: 1. It's still a battle to explain to non-technically minded people whether an image is Creative Commons or free use or to get them to understand that there are different kinds of CC. 2. It will mean there is less to read through, but many companies will still fit blocks together (ie. General Use+Advertising Third Party+Server Backup in Other Country) or resort to using a license that is more general than they need, but definitely includes the things they want to do. It's a _really_ cool idea though, and I'm curious whether anyone has ever tried anything like it before.

bediger4000 7y ago

All or nearly all privacy policies are incomprehensible. The main exceptions appear to be European, or non-profit's. Does this uniform incomprehensibility come from an identifiable root cause, or is it just emergent because of a variety of factors, not all of which afflict every company?

lmkg 7y ago
Key quote from the article: > These are documents created by lawyers, for lawyers. They were never created as a consumer tool They are generally treated as the responsibility of the legal team, so they are written as legal documents. Companies treat them as a way to pro-actively defend against lawsuits (much like the Terms of Service), and not as a way to inform or educate users. The reason why many readable privacy policies come from Europe is because GDPR makes it literally a legal requirement that they are written "using clear and plain language." Source: GDPR Article 12 https://gdpr-info.eu/art-12-gdpr/ https://gdpr-info.eu/art-12-gdpr/

the_snooze 7y ago

There's an ongoing study whose early results found that even if people read and understood privacy policies (for mobile apps), those policies are incomplete, wrong, or self-contradictory a decent chunk of the time: https://www.ieee-security.org/TC/SPW2019/ConPro/papers/okoyomon-conpro19.pdf https://www.ieee-security.org/TC/SPW2019/ConPro/papers/okoyo... It's hard to see privacy policies being written in good faith. In my opinion, they're little more than declarations of "I'm going to do all these sketchy things with your data, and it's your responsibility to protect yourself from me."

dougk16 7y ago

I spent a ton of time on making my site's privacy policy easy to read, while also discussing philosophy and some technical aspects, meant to be read by anyone who can understand simple English. https://aytwit.com/about#privacy https://aytwit.com/about#privacy Feedback welcome! It's time to come up with solutions! So post yours below as well!

droithomme 7y ago

My preferred privacy policy is as follows: "Privacy Policy: We will not share your private information with anyone."

lmkg 7y ago
Not GDPR-compliant, nor would I personally consider it anywhere near complete. What information do you have about me? Can I see a copy of it? Why do you have it? What are you using it for? How long are you keeping it? How are you keeping it secure? (As far as I can tell, GDPR does not actually require you to answer how, only that you do it.) As an alternative, my preferred privacy policy: "We do not collect your personal information."
- akersten 7y ago
  Hey, yours isn't complete either! :) Just by visiting your site, you are collecting my personal information (after all, GDPR says IP address is PII). So what are you doing with it, and how long are you keeping it?
  - lmkg 7y ago
    GDPR does not say that IP address is PII. Among other objections, GDPR does not mention IP address, nor does it mention PII. The current guidance on IP addresses is ambiguous, but my understanding is that an IP address on its own does not count as personal data. It can become personal data when it's used to create a profile. So if you only have the full IP fleetingly to serve web pages, and all logging wipes the last octet, there's no point where the data that you process counts as personal data.
    - droithomme 7y ago
      GDPR doesn't get that specific, but the judges in the courts do. In Breyer v. Bundesrepublik Deutschland, E.C.J., No. C-582/14, 10/19/16, it was ruled that internet protocol addresses relating to visitors' use of websites constitutes "protected data" according to European Union laws.

deleted 7y ago

[deleted]

lixtra 7y ago

Creative Commons like modular privacy policies could be a solution: https://www.achtungtechnik.de/english/2018/GDPR-statement-like-CC.html https://www.achtungtechnik.de/english/2018/GDPR-statement-li...

itsaidpens 7y ago

Lawyers are awful.

ticmasta 7y ago

I did a similar, deeper review of less policies for my course work in Privacy Protection and Freedom of Information with some of the same conclusions around length & required reading level. It's worse than this though; Orgs like Facebook have dozens of documents that deal with what data they collect and how they will use it. Even identifying what comprises their "privacy policy" is a huge task. Another massive issue: unilateral, largely uncommunicated changes. Stack Exchange used to have a very handy regular (read: legalese) policy and a parallel "plain language" version that I can't find anymore. They still have a relatively decent policy but that's only because the average quality is so low. for context I was using Canada's The Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's PIPA which is a scope similar to GDPR in many ways. PIPEDA is an interesting document; it's based on a set of expectations or statements that are decidedly "non legal" in nature which makes it very different from most laws

svachalek 7y ago

I don't see why they can't just follow the example of open source licenses. GPL is powerful and complicated, but when you see something is GPL you know what you're getting into because you've seen it before. There are a handful of well-known policies that have varying levels of generosity, and anyone can always make up a new one -- but if they do it's a bit of a red flag and people will dig in to find out what it's about. The problem with current policies is only partly that they're complicated, it also has a lot to do with them being snowflakes too.

zelon88 7y ago

I'm pretty proud of this one..... https://www.honestrepair.net/index.php/privacy-policy/ https://www.honestrepair.net/index.php/privacy-policy/

mLuby 7y ago
That is shockingly comprehensible and concise; you are right to be proud! (BTW "it’s" should be "its" in the second sentence.)

michaelaiello 7y ago

Built http://www.privacyparrot.com http://www.privacyparrot.com which uses ML to simplify privacy policies back in 2011 and it continues to grow in usage. Thank you HN community for the feedback back then https://news.ycombinator.com/item?id=3222334 https://news.ycombinator.com/item?id=3222334

eitland 7y ago

For me it was very interesting to see what GDPR did did to Googles privacy policy: it seems to have forced them to simplify and shorten it.

heisenbit 7y ago

My understanding of the GDPR in Europe is that these policies inform consumers but do not bind them. There is a widespread practice to let consumers sign them everywhere but this piece of paper does not change much the requirements for the company under the law.

7402 7y ago

Whether or not they are incomprehensible, I worry more that most of them seem to boil down to: "We can do whatever we want with any data we have about you. Your only alternative is to not use our services and not use any other business or organization that uses our services." Any privacy policy that has the usual clause saying, "We can change this policy at any time by posting an update to our website," is saying essentially the above. I suppose it would help if they were forced simply to put their policy in those terms - then more people might push back against it.

mirimir 7y ago

This is not exactly news, but having a NYT statement is cool. They're obviously legalistic bullshit. So whatever privacy and rights I need, I create myself. And so I can entirely ignore ToS and privacy policies.

Animats 7y ago

It's not that hard to read most EULAs and privacy policies, because they're usually plagarized from someone else's documents, and contain much the same clauses. ...Overreaching indemnification clause, bleah...disputes must be resolved in courts of Northern California, OK (Outer Nowhere, not so OK, offshore tax haven island, very bad) ... arbitration required under AAA consumer rules, not too bad (National Arbitration Forum was very bad) ... no class actions, all too common ... "sole discretion" termination, run away in a B2B context ... vagueness in what can be done with your data, all too common, and often where privacy rights go away ... mention of "affilates" having access, not good ... limitation of liability, common for ordinary websites but inappropriate for anybody you keep money with .... After you read about ten of these things, a pattern emerges.

jiveturkey 7y ago

Graphs done right! I can't imagine how this article could be better. I wish they would make their privacy analysis tools available to the public. So you could plug in the URL of your favorite policy and see how it ranks.