17 ms·
Nobody reads privacy policies, senator wants lawmakers to stop pretending we do
- colanderman 6y agoThis is good, but "nobody reads the privacy policies" is the wrong reason. "Due to market pressures, consumers have little meaningful choice of service providers without onerous policies, and invasion of consumer privacy on a nationwide scale is a net social negative" is a better reason.
- whatshisface 6y agoIf people read privacy policies, then why don't we start clones of every major online service, but with good privacy policies?
- notatoad 6y agobecause most people don't actually care what's in the privacy policy. "X but with better privacy" is not a selling feature outside of a very small group of people.
- kleiba 6y agoHow do you know that?
- ihumanable 6y agoName one company that has dominated a market by creating a similar product but with better privacy. Plenty have tried. Protonmail is Gmail with better privacy, Gmail dominates the market. Telegram / Signal is messaging with better privacy, Slack dominates the market. Zoom dominated the video conferencing market with poor privacy, although they seem to maybe be trying to make it better. Ultimately, "better privacy" does not seem to be a differentiator the market cares about. I would welcome some counter examples though, where a competitor was launched with the differentiator being better privacy and won the market segment.
- nerdponx 6y agoYou all downvoted because you saw a stupid comment. I upvoted because I saw a hilarious economics joke.
- WealthVsSurvive 6y agoBoth are good. But, even better is an enforced US GDPR.
- marcus_holmes 6y agono idea why you're getting downvoted. This is the answer. Since most online businesses already have to comply with the Euro GDPR it should be simple.
- glitchc 6y agoFurthermore, a user typically does not have access to the privacy policy until after they have purchased a product. If they disagree with a policy, they have limited recourse towards obtaining a refund. Products that do offer a refund have policies that take almost 30 days to get one. In this fully connected world, it's almost criminal that a purchase is processed in seconds whereas a refund takes 30 days. It's time that WAS criminal. It's a contract right? Well, all contracts are required to comply with a cooling off period (by law), ranging anywhere from 3 days to two weeks depending on type of contract and jurisdiction. It's time for the legal system to enforce these laws for software contracts. If I don't like an app within 3 days after purchase, I should have access to a prominently visible button to return it. If I click on it, the app should promptly issue a refund to my credit card (there's no reason why this can't be immediate) and delete the app from my device. Such a button should be mandated by law regardless of platform or application. But of course, the lawyers and lawmakers work for the rich, not the middle-class or poor.
- throwaway_USD 6y ago>...is the wrong reason.... is a better reason. I will suggest another reason, already built into contract law, these agreements/contracts are unconscionable. Generally where a contract would otherwise be enforceable, having met all the legal elements of a legally enforceable contract, the Court does not enforce the contract finding is would be unconscionable. There are all sorts of reasons a court would find it unconscionable to enforce an otherwise legally binding agreement/contract, so these cases really get into the nitty gritty facts. However, a typical example of an unconscionable contract is where one party is an experienced dealer in a type of business, while the other party is an average consumer. I know this basically sounds like every agreement between a business and consumer, but in practice its not (again you would have to begin reading tons of case law to get an idea). However, consider every single social media platform that builds into their agreements they have the right to modify the terms with or without actual notice to the users of said modification...that is about as unconscionable as it gets. Back in the decentralized autonomous organization (DAO) days, where proponents always claimed "the code is the law" and if the code allowed investor money to be stolen, that wasn't a hack or breach of contract, rather it was a contractual right the investor agreed to (even in light of plain English marketing contrary to the actual code, even though the marketing materials disclaimed: "the code is the law")...I always explained, and was often down voted into oblivion, a court would never enforce such a agreement/smart contract as it would be unconscionable.
- nshepperd 6y agoIMO they're not even contracts. The idea that there is a 'meeting of the minds' when I click through an installation dialog or website privacy policy, without even reading it, while screaming at my computer "I do not agree!" is ridiculous.
- throwaway_USD 6y ago>The idea that there is a 'meeting of the minds' when I click through an installation dialog or website privacy policy This is a fantastic point with respect to these online agreements because of analytics. Just as you say, someone clicks through these installation/website signup screens, click agree, etc... It is very easy to prove an agreement would take a minimum of x minutes to read through, yet these tech companies would have knowledge the user spent 1-2 seconds on the contract page/dialog box before clicking agree, therefore, they had knowledge the user did not and could not have read the same before agreeing.
- oezi 6y agoPrivacy and other ToCs cannot efficiently be optimized by markets because markets can only optimize efficiently for primary and a limited number of secondary attributes. Think how hard it is for consumers to beyond GHz to pick a processor. EULA, service terms etc are the last thing that is optimized for. My suggestion: we should only allow privacy policies to contain standardized sections which are based on industry standards such as ISO, IETF, DIN terms. This would ensure that terms can be better compared and remove the possibility for companies to cheat consumers by hiding predatory terms.
- satyrnein 6y agoI think privacy and ToCs could be optimized if there were an (probably regulatory) incentive. Imagine users had to take a quiz on the privacy policy before they were legally allowed to sign up, to prove informed consent. I imagine they would get optimized pretty quickly!
- lmkg 6y agoI view Privacy Policies as a type of a labeling law, like the ingredients lists on all of your food. Even though only a small fraction of people actually read it, it's still doing its job and its important that it's there. Some people care about the ingredients in their food, for a variety of reasons. Maybe they're vegan, or Kosher, or allergic to bananas, or are wary of processed sugar. Those people have the ability to make informed decisions, because they are informed. Similarly, privacy-conscious consumers can choose to avoid services based on their particular values when they are informed. Another important use case is advocacy and/or journalism. If data-sharing arrangements must be public, then a motivated researcher is able to connect the dots, like finding how many sites send data to Facebook/Google, how many of them are health or bank or porn sites, what non-public-brand companies are actually collecting lots of data. Then it's possible for the gestalt "public" to be informed even if each individual isn't doing the reading themselves. [edit] People are rightly pointing out several of the differences between ingredients lists and privacy policies, especially readability. I agree with this, and view it as a focus for regulation. Ingredients lists are useful in part because they're highly regulated in both contents and format. Privacy policies could be made more useful if they were to take some cues.
- austincheney 6y agoI view privacy policies as worthless. They don’t exist to protect the consumer‘s privacy. They only exist to shield the service provider from liabilities. In that case privacy policies serve no valid consumer facing function why bother the consumer with them in the first place? I, as a consumer, would prefer to not bother with this stupidity knowing I have virtually no privacy online and cannot sue the service provider for privacy violations except in cases of provable negligence. Since that applies to consumers whether or not they agree with it don’t waste the effort with the privacy notice. Save it for my lawyer. If, as consumers, we actually wanted privacy we would pressure our law makers to write privacy law like HIPAA or the Federal Privacy Act of 1974.
- devin 6y agoI agree. Why do we even call it a "privacy policy"? It's more of a waiver.
- advisedwang 6y agohttps://outline.com/EEgJNA https://outline.com/EEgJNA
- awinter-py 6y agoI read privacy / TOS from time to time (and write up notable findings), and believe that most users click without reading -- including most of my lawyer friends whom I've asked I think most policies don't say exactly what they do with the data, even post-GDPR -- like they're not docs of the app's RBAC system They all just say 'your privacy is important to us and we won't share your data with anyone (other than our business partners and for reasons of business)' I think any service you pay for should be obligated by law to reveal what data they have about you, where they got it, and how it factors into a decision (weights / PCA if not precise algorithm).
- chooseaname 6y agoEven if you do read them, what good does it do you when practically the only ISP in your area is Comcast?
- brightball 6y agoEnterprise customers do as part of their vendor management process, but general public users certainly do not.
- yodelshady 6y agoI'm struggling to think of a way in which a business, operating in good faith, would benefit from its customers not knowing what they signed up for. In fact I think it's tautological that they wouldn't. Good regulation won't guarantee that a privacy-friendly business will succeed, but at least they could differentiate themselves as such, because the claims they make would mean something.
- Nextgrid 6y ago> operating in good faith Nowadays this is a very big "if".
- newman8r 6y agoHN users do (well, sometimes), and that's why I love the users here. Any time I share a startup, I get at least a little bit of feedback about my TOS/privacy policy.
- nyxtom 6y agoThere are some privacy policies out there that are well organized and even summarize a lot of the legal jargon into bite sized chunks. 500px is a good example for instance. https://web.500px.com/privacy https://web.500px.com/privacy
- robertlagrant 6y agoWhy these things aren't completely standardised (i.e. pick from options 1-5 for your privacy policy) is beyond me.
- tehjoker 6y agoI feel like much of the debate about this topic focuses on how corporations hide what they are doing to us, and reforms would focus on making the language easy to understand like a nutrition label. However, if that reform passes, all that will happen is that all major corporations will in lockstep offer nearly the same terms and force us to take them. The problem isn't their sneakiness, it's their power. You can't even begin to conceive of a possible solution to this that won't be undone within a few years without asserting popular control over the decisions of a corporation.
- jt2190 6y agoI’ll add a plug for the Privacy Essentials browser add on: Chrome: https://chrome.google.com/webstore/detail/duckduckgo-privacy-essent/bkdgflcldnnnapblkhphbgpggdiikppg https://chrome.google.com/webstore/detail/duckduckgo-privacy... Safari: https://apps.apple.com/us/app/duckduckgo-privacy-essentials/id1482920575?mt=12 https://apps.apple.com/us/app/duckduckgo-privacy-essentials/... Firefox: https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-fo...
- notatoad 6y agothe privacy grading is a cool idea and i'd love to have that displayed in my address bar for every site i visit, but bundling it with a "tracker blocker" means that the extension needs full access to all my data on every webpage i visit. i think my privacy is better protected by having one fewer extension installed with such broad permissions.
- asdff 6y agoA good tracker should only be running locally. Ublock origin is just local rules and filters, nothing is being logged or sent anywhere. I'm not sure about this one, however.
- jt2190 6y agoThe add on is bringing in data from Terms of Service, Didn’t Read https://tosdr.org/ https://tosdr.org/, so you can always refer to that if you don’t like add ons.
- notatoad 6y agooh, and they have their own add on that doesn't require any access to the page contents. that's exactly what i wanted, thanks!
- meristem 6y agoClickwrapping is an actual UI pattern at this point, and click-and-go an expected behaviour.
- bttrfl 6y agoI'd love to see particular policies as a list of exceptions from THE standard policy rather than a solid text.
- rjmunro 6y agoI think there should be an absolute limit on the length. 1kb seems about right. Any more than that and the whole document is too long to possibly read. Severability clauses (like "If a provision of this Agreement is or becomes illegal, invalid or unenforceable in any jurisdiction, other provisions should still hold") should be explicitly banned. If something isn't legal, companies shouldn't be asking for it.
- eximius 6y agoThat's a thousand letters. I'm not against the concept but that's implausibly small.
- nybble41 6y agoA thousand letters should be plenty for almost every contract the average consumer is likely to encounter if they stick to well-known and standardized terms instead of writing every contract from scratch in impenetrable legalese. I wouldn't set a hard limit of 1KB, but it's not a bad goal to strive for. People can reasonably be expected to learn the nuances of a small set of common contracts; we could include this as part of the standard school curriculum. They cannot be expected to read and fully understand separate one-off contracts full of legal jargon for every company they happen to deal with. As such, deviation from the standards should be expensive. I would consider it perfectly reasonable to require companies to submit any custom contract terms to the courts in advance if they want them to be enforced against arbitrary members of the public, and to reject any non-standard terms which would not be readily comprehensible to at least 80-90% of the target audience.
- Wowfunhappy 6y agoIf one party to a contract cannot reasonably expect (!) that the contract was read by the other party, the contract should be invalid. Period, end of story. This applies not just to Privacy Policies, but to just about every Terms of Service. You're telling me that when Apple updates the App Store's terms of use, they in good faith expect their customers to spend half their workday rereading the contract before clicking I Agree and downloading that new app? It's completely nonsensical! Only high-level business software should be able to force its users to sign a contract, because that is the only circumstance in which it will be read.
- nickff 6y agoOne problem with your argument (from a political perspective) is that it undermines the entire system of mandatory disclosures (for drug warnings, investor relations, real estate, etc.). Accepting this argument means that all the (many) disclosure-based lawsuits and regulatory actions taken against companies are blatantly unjust, as they are based on the idea that consumers can and should read lengthy, confusing documents. I should add that despite what people here are saying, the complexity of the wording is usually driven by legal requirements, not a desire to confuse people.
- suifbwish 6y agoI think he is saying that terms of service and user end policy agreements in their current state are completely unacceptable. We need to simplify these policies and contracts if we expect people to be legally accountable for understanding their contents.
- nickff 6y agoThe problem is that the only reason they are complicated is because the courts require complexity. Each one of those complicated legal terms exists because of some lawsuit somewhere. Blaming it on the company, or saying that it's obfuscation simply misses the point. If we want to get rid of these complicated 'agreements', we need to change the way our legal system operates.
- robotburrito 6y agoBack when I was a contractor I often wondered if it would be OK to bill a few hours a day reading the 20 page legal documents required to hit OK on lol.
- vegetablepotpie 6y agoWhen my apartment installed a Luxor One locker for packages, I tried to read the privacy policy on the kiosk. The interface timed out on me while I was reading it. The designers did not consider that customers would read the fine print for their service.
- naugtur 6y agoDo for privacy policies and ToS what we did for software licenses. So that I read the lawyer explain ApachePrivacy1.0 and can reuse that knowledge going forward. And it seems like startups would benefit from that a lot. They tend to copy-paste the lawyery bits anyway. I'm scrolling the comments looking for this and having trouble believing nobody thought of it. Is it obviously impossible or something?
- novok 6y agoA set of standard contracts where you can read explainers about them can go a long way without needing really hard to change societal reforms like this. I hope one day creative commons makes a privacy policy wizard that most people understand.
- neonate 6y agohttps://archive.vn/oGOcW https://archive.vn/oGOcW
- mark_l_watson 6y agoInstead of calling these Privacy Policies, I wish there was some honesty in the industry and call them Surveillance Policies. Off topic, but I have been on a war path, talking to family and friends about the surveillance economy, and how the tech giants collecting personal info is to their benefit not ours. Most people have been receptive to at least using FireFox and containers.
- surfsvammel 6y agoI’ve heard somewhere that Warren Buffett never signs a contract that’s more than a page or two. If the authors where interested in having their users read and understand their agreements, policies, and such. Then why not create a very simple, readable, one. Then present the content of it, and have the user accept the terms, in part, spread out over time. Such that the user only have to read a sentence, or paragraph, or so. If they did it like that, I would probably read the ToS of the apps that I use.
- saagarjha 6y agoEven a page or two of the most straightforward language would tie up Warren Buffet's time enough to be worth tens of thousands of dollars. So I'm sure he's picky of whatever he chooses to read anyhow.
- Animats 6y agoMaybe there should be standard privacy policies. Medicare did something like this. Insurance companies are limited to 10 standard supplement plans. Each covers exactly the same thing, regardless of insurer. So there are direct comparison charts, and policies are mostly sold on price. Insurance companies hated that. It's worked out well. We should have standard privacy policies, graded A through F. Companies get to pick freely, and users get to see which one they picked before signing up.
- echlebek 6y agoIt's completely pointless to read privacy policies or really any EULA because they can change at any time. Sometimes they change monthly. It doesn't matter if they are easy to read or not, and it doesn't matter if they are simple or complex, when the other side can just change the rules out of nowhere. That's not an agreement, in the way that most people understand agreements intuitively.