7 ms·

I view Privacy Policies as a type of a labeling law, like the ingredients lists on all of your food. Even though only a small fraction of people actually read i

by lmkg 6y ago

I view Privacy Policies as a type of a labeling law, like the ingredients lists on all of your food. Even though only a small fraction of people actually read it, it's still doing its job and its important that it's there. Some people care about the ingredients in their food, for a variety of reasons. Maybe they're vegan, or Kosher, or allergic to bananas, or are wary of processed sugar. Those people have the ability to make informed decisions, because they are informed. Similarly, privacy-conscious consumers can choose to avoid services based on their particular values when they are informed. Another important use case is advocacy and/or journalism. If data-sharing arrangements must be public, then a motivated researcher is able to connect the dots, like finding how many sites send data to Facebook/Google, how many of them are health or bank or porn sites, what non-public-brand companies are actually collecting lots of data. Then it's possible for the gestalt "public" to be informed even if each individual isn't doing the reading themselves. [edit] People are rightly pointing out several of the differences between ingredients lists and privacy policies, especially readability. I agree with this, and view it as a focus for regulation. Ingredients lists are useful in part because they're highly regulated in both contents and format. Privacy policies could be made more useful if they were to take some cues.

austincheney 6y ago
I view privacy policies as worthless. They don’t exist to protect the consumer‘s privacy. They only exist to shield the service provider from liabilities. In that case privacy policies serve no valid consumer facing function why bother the consumer with them in the first place? I, as a consumer, would prefer to not bother with this stupidity knowing I have virtually no privacy online and cannot sue the service provider for privacy violations except in cases of provable negligence. Since that applies to consumers whether or not they agree with it don’t waste the effort with the privacy notice. Save it for my lawyer. If, as consumers, we actually wanted privacy we would pressure our law makers to write privacy law like HIPAA or the Federal Privacy Act of 1974.
- devin 6y ago
  I agree. Why do we even call it a "privacy policy"? It's more of a waiver.
  - Avicebron 6y ago
    Because people don't like the idea of "waiving their rights"
    - rurp 6y ago
      Well sure, but if naming something more accurately causes people to reject it because it sounds really bad, I don't think the issue is with the naming.
      - Avicebron 6y ago
        I fully agree and wasn't trying to justify the enforcement of long obtuse contracts that support the degradation of privacy.
  - tekknik 6y ago
    because it’s their policy on user privacy? the name makes perfect sense.
- asdfasgasdgasdg 6y ago
  > They only exist to shield the service provider from liabilities. In that case privacy policies serve no valid consumer facing function why bother the consumer with them in the first place? Because the consumers bother the companies with lawsuits if they aren't "forced" "to read" the privacy policy. The only way you can get away from the requirement to display these policies prominently is if you make it generally illegal to sue over anything disclosed in the privacy policy, even if it's not prominently displayed. Or, as you say, make the kinds of things people like to sue for actually illegal, so there will be nothing to disclose.
  - austincheney 6y ago
    It sounds like you are arguing for tort reform. They can sue anyways regardless of whether they read the policy and regardless of whether the suit is groundless. All it takes to create a law suit is to issue a motion to the court. Whether or not the suit is frivolous is for the court to decide in response to an opposing motion.
    - asdfasgasdgasdg 6y ago
      I wouldn't say I'm arguing for it. I don't have any real problem with the status quo as it pertains to privacy policies. I'm just saying IF you have a problem with privacy policies, it needs to be very inexpensive to defend lawsuits on privacy grounds which are currently defensible only due to privacy policies.
- tekknik 6y ago
  There is a great many of us who don’t use certain sites for privacy reasons. What happened here where Facebook was required to provide a service? Could you not avoid your entirely valid concern altogether by just not using the service? Why do these types of posts end up going the entitled route? You as a consumer have options for these luxury services, don’t use them and they’ll change.
strictnein 6y ago
A label on food is easily looked at and any important information can be found within seconds. The vast majority of Privacy Policies do the exact opposite. The function as a method to obscure the important details.
- tosers4 6y ago
  This. As a consumer it's extremely hard to find out what you need in a Privacy Policy, as it is simply too big of a document generally. For companies its different as they should have someone payed to read that. So what is needed is a standard way of conveying what data is being collected. And what is kept in-company, and what is shared/sold. Just like the ingredients in a package, a simple Table.
- codysc 6y ago
  This makes a lot of sense. Providing some kind of categorized/easily digestible format for the policy to fit into. When I was writing mine I tried to be very clear, but my startup is specifically focused on privacy, so I didn't really have much to disclose.
  - smichel17 6y ago
    The GitHub terms of service[1] have a pretty good format. However, the summaries are often too vague -- they describe the type of content instead of summarizing its contents, so it's still possible to hide unsavory details. For example, section R2, on assignability, is grossly imbalanced. I co-authored the Snowdrift.coop terms of service[2], which we adapted from GitHub -- we could not afford legal review and figured GitHub has enough lawyers to make sure the CYA language included was thorough enough to cover us pre-launch (we will get legal review before processing payments for outside projects). There was some legalese we'd prefer to remove but didn't feel comfortable without legal counsel, but the summaries are non-binding so we rewrote many of them to be more descriptive. Curious what you think! On the privacy policy[3] side, we agreed with you -- if our policy was long or complicated enough that a summary was necessary, we were doing something wrong. So we just described all the ways we collect personal data, in "If you X, we will Y" format. For example, > If you create a Snowdrift.coop account, we store your email address and use cookies to keep you logged in. I wish more sites had policies like this, so that "long and unreadable policy" would become more of a red flag. [1]: https://help.github.com/en/github/site-policy/github-terms-of-service https://help.github.com/en/github/site-policy/github-terms-o... [2]: https://snowdrift.coop/terms https://snowdrift.coop/terms [3]: https://snowdrift.coop/privacy https://snowdrift.coop/privacy
Gravityloss 6y ago
The ingredients list in food is in a common format and short. Compare that to the massive amount of legalese in these various policies and agreements.
freeflight 6y ago
I think that comparison is very misleading because ingredient lists of food are not written by lawyers, they use very simple language, and they don't make you give up all kinds of rights. They are also not even remotely as extensive as privacy policies are. Case in point: Back in 2012 one already needed 76 workdays to read all the privacy policies accepted on the Internet in one year [0]. Since then that number has very likely gone extensively up as people use even more online-services on average, particularly on mobile devices, and a lot of these services now also have extensive codes of conduct in addition to the privacy policies and bloated ToS/EULAs. So while reading the ingredients of everything you eat is a very realistic and plausible thing to do, something people with allergies do on a near-daily basis, trying the same with privacy policies is just not realistic. Particularly when one wants to read them in an informed way to actually understand what you are agreeing to [1], for that you would need a lawyer to read them with you to make sense of the convoluted legal-speak they are usually written in. A fact that is pretty common knowledge to such a degree that companies have even written $10k rewards into their ToS for people actually reading them. [2] That's why most privacy policies do not really exist to inform the users as food labeling does, their main purpose is for the company to cover their ass legally while doing all kinds of shady things with users' data. [0] https://techland.time.com/2012/03/06/youd-need-76-work-days-to-read-all-your-privacy-policies-each-year/ https://techland.time.com/2012/03/06/youd-need-76-work-days-... [1] https://www.cracked.com/article_19683_6-terrifying-user-agreements-youve-probably-accepted.html https://www.cracked.com/article_19683_6-terrifying-user-agre... [2] https://www.npr.org/2019/03/08/701417140/when-not-reading-the-fine-print-can-cost-your-soul https://www.npr.org/2019/03/08/701417140/when-not-reading-th...
- marcus_holmes 6y ago
  To be fair, ingredients labelling is covered by an extremely strict set of regulations, and companies do play games with it as much as they're able (my favourite is "aqua" when they mean "water"). Which may be the way to go: introduce a strict set of regulations covering how to present your privacy policy
  - taejo 6y ago
    Writing "aqua" instead of "water" is not playing with the regulations, it is a regulation. In the US cosmetics have to be labelled using the International Nomenclature of Cosmetic Ingredients (INCI) and the INCI name for water is "aqua".
glitchc 6y ago
This analogy fundamentally falls flat for a simple reason: Labelling is not legally binding. A privacy policy is a contract. It contains valud actions, outcomes, liabilities and remedies, all the components of a contract. Kindly stop minimizing their importance.
- satyrnein 6y ago
  Nutritional info is legally required, and you cannot legally misrepresent it, doesn't that make it legally binding?
  - glitchc 6y ago
    Nutritional information is information. It is legislated and regulated, but not a contract. The manufacturer has to comply with regulations, but that is not considered a legally binding contract, and failure to comply does not constitute breach of contract. To be clear, just because there's a legal penalty attached for failure to comply does not constitute a contract between the manufacturer and the government. Similarly, the individual is not bound to any contract to the manufacturer by purchasing a can of beans. They are, on the other hand, when purchasing software. It's a crucial difference.
  - Supermancho 6y ago
    It's not quite the same to describe something that already exists, as opposed to describing actions that have or have not happened yet (nor will they for the duration of a policy lifespan). Auditing ingredients is _relatively_ trivial to trying to audit the amorphous "privacy" restrictions.
  - TheCoelacanth 6y ago
    Legally binding for the people writing it, not for the people reading it.
- shkkmo 6y ago
  Privacy Policies exist almost exclusively to protect companies from consumers. Labeling is legally binding but also highly regulated so that labeling protects consumers. The liabilities and remedies are standardized via law. If privacy policies existed to protect consumers from companies you would probably see more people willing to acknowledge their importance.
satyrnein 6y ago
"Privacy Czar's warning: this product sells your data to third parties."
vansteen 6y ago
Everywhere in the world, nutrition labels appear to try to summarize in a simple way if a food product is "good" or "bad". Examples: - The European nutriscore : https://en.wikipedia.org/wiki/Nutri-score https://en.wikipedia.org/wiki/Nutri-score - The Chilean black labels : https://en.wikipedia.org/wiki/Food_labelling_and_advertising_law_(Chile) https://en.wikipedia.org/wiki/Food_labelling_and_advertising... There's also lots of new apps like Yuka which try to warn you about bad ingredients. You scan the bar code on a food product then you get some summarized details and warnings. Maybe there's something to do to make these privacy policies more comprehensible.
thaumasiotes 6y ago
> Even though only a small fraction of people actually read it, it's still doing its job and its important that it's there. This philosophy tends to conflict with the fact that privacy policies say "we reserve the right to change the policy unilaterally at any time".
spideymans 6y ago
See, now you've got me thinking that there should be some sort of "labelling law" for privacy policies, at least for companies of a certain size. A standard, easy to read summary of the privacy policies of any given software or service. "Yes this app provides your data to third parties", "no, it does not record your location history", etc...
kyleblarson 6y ago
If it were required to add some sort of a non-lawyer readable summary ala the 'Nutrition Facts' labels in the US that would be a big step.
Reedx 6y ago
If terms of use and privacy policies were as readable as nutrition labels, that would be a huge win. Anyone know if there are any existing examples along those lines?
hinkley 6y ago
There are also a very wide set of laws about things you can't put into food even if you label it, and classes of ingredients that must be called out specifically, like certain food colorings, allergens, and compounds that various high profile genetic abnormalities are affected by (phenolketoneuria for one). I wonder if there's a Q&A format one could do for legal agreements that still meets muster, or could be legislated as such?
usrusr 6y ago
But food labeling is pretty well standardized, you can't just make up your own terms and add ten pages of convoluted circumscriptions and then say that's ok because a professional trained in just the right sub-field of biochemistry could deduce what's in there. If privacy policies were like food labeling nobody would object.
mtgx 6y ago
and in the us food labeling sucks too. I see a trend here.

by lmkg 6y ago

austincheney 6y ago

I view privacy policies as worthless. They don’t exist to protect the consumer‘s privacy. They only exist to shield the service provider from liabilities. In that case privacy policies serve no valid consumer facing function why bother the consumer with them in the first place? I, as a consumer, would prefer to not bother with this stupidity knowing I have virtually no privacy online and cannot sue the service provider for privacy violations except in cases of provable negligence. Since that applies to consumers whether or not they agree with it don’t waste the effort with the privacy notice. Save it for my lawyer. If, as consumers, we actually wanted privacy we would pressure our law makers to write privacy law like HIPAA or the Federal Privacy Act of 1974.

devin 6y ago
I agree. Why do we even call it a "privacy policy"? It's more of a waiver.
- Avicebron 6y ago
  Because people don't like the idea of "waiving their rights"
  - rurp 6y ago
    Well sure, but if naming something more accurately causes people to reject it because it sounds really bad, I don't think the issue is with the naming.
    - Avicebron 6y ago
      I fully agree and wasn't trying to justify the enforcement of long obtuse contracts that support the degradation of privacy.
- tekknik 6y ago
  because it’s their policy on user privacy? the name makes perfect sense.
asdfasgasdgasdg 6y ago
> They only exist to shield the service provider from liabilities. In that case privacy policies serve no valid consumer facing function why bother the consumer with them in the first place? Because the consumers bother the companies with lawsuits if they aren't "forced" "to read" the privacy policy. The only way you can get away from the requirement to display these policies prominently is if you make it generally illegal to sue over anything disclosed in the privacy policy, even if it's not prominently displayed. Or, as you say, make the kinds of things people like to sue for actually illegal, so there will be nothing to disclose.
- austincheney 6y ago
  It sounds like you are arguing for tort reform. They can sue anyways regardless of whether they read the policy and regardless of whether the suit is groundless. All it takes to create a law suit is to issue a motion to the court. Whether or not the suit is frivolous is for the court to decide in response to an opposing motion.
  - asdfasgasdgasdg 6y ago
    I wouldn't say I'm arguing for it. I don't have any real problem with the status quo as it pertains to privacy policies. I'm just saying IF you have a problem with privacy policies, it needs to be very inexpensive to defend lawsuits on privacy grounds which are currently defensible only due to privacy policies.
tekknik 6y ago
There is a great many of us who don’t use certain sites for privacy reasons. What happened here where Facebook was required to provide a service? Could you not avoid your entirely valid concern altogether by just not using the service? Why do these types of posts end up going the entitled route? You as a consumer have options for these luxury services, don’t use them and they’ll change.

strictnein 6y ago

A label on food is easily looked at and any important information can be found within seconds. The vast majority of Privacy Policies do the exact opposite. The function as a method to obscure the important details.

tosers4 6y ago
This. As a consumer it's extremely hard to find out what you need in a Privacy Policy, as it is simply too big of a document generally. For companies its different as they should have someone payed to read that. So what is needed is a standard way of conveying what data is being collected. And what is kept in-company, and what is shared/sold. Just like the ingredients in a package, a simple Table.
codysc 6y ago
This makes a lot of sense. Providing some kind of categorized/easily digestible format for the policy to fit into. When I was writing mine I tried to be very clear, but my startup is specifically focused on privacy, so I didn't really have much to disclose.
- smichel17 6y ago
  The GitHub terms of service[1] have a pretty good format. However, the summaries are often too vague -- they describe the type of content instead of summarizing its contents, so it's still possible to hide unsavory details. For example, section R2, on assignability, is grossly imbalanced. I co-authored the Snowdrift.coop terms of service[2], which we adapted from GitHub -- we could not afford legal review and figured GitHub has enough lawyers to make sure the CYA language included was thorough enough to cover us pre-launch (we will get legal review before processing payments for outside projects). There was some legalese we'd prefer to remove but didn't feel comfortable without legal counsel, but the summaries are non-binding so we rewrote many of them to be more descriptive. Curious what you think! On the privacy policy[3] side, we agreed with you -- if our policy was long or complicated enough that a summary was necessary, we were doing something wrong. So we just described all the ways we collect personal data, in "If you X, we will Y" format. For example, > If you create a Snowdrift.coop account, we store your email address and use cookies to keep you logged in. I wish more sites had policies like this, so that "long and unreadable policy" would become more of a red flag. [1]: https://help.github.com/en/github/site-policy/github-terms-of-service https://help.github.com/en/github/site-policy/github-terms-o... [2]: https://snowdrift.coop/terms https://snowdrift.coop/terms [3]: https://snowdrift.coop/privacy https://snowdrift.coop/privacy

Gravityloss 6y ago

The ingredients list in food is in a common format and short. Compare that to the massive amount of legalese in these various policies and agreements.

freeflight 6y ago

I think that comparison is very misleading because ingredient lists of food are not written by lawyers, they use very simple language, and they don't make you give up all kinds of rights. They are also not even remotely as extensive as privacy policies are. Case in point: Back in 2012 one already needed 76 workdays to read all the privacy policies accepted on the Internet in one year [0]. Since then that number has very likely gone extensively up as people use even more online-services on average, particularly on mobile devices, and a lot of these services now also have extensive codes of conduct in addition to the privacy policies and bloated ToS/EULAs. So while reading the ingredients of everything you eat is a very realistic and plausible thing to do, something people with allergies do on a near-daily basis, trying the same with privacy policies is just not realistic. Particularly when one wants to read them in an informed way to actually understand what you are agreeing to [1], for that you would need a lawyer to read them with you to make sense of the convoluted legal-speak they are usually written in. A fact that is pretty common knowledge to such a degree that companies have even written $10k rewards into their ToS for people actually reading them. [2] That's why most privacy policies do not really exist to inform the users as food labeling does, their main purpose is for the company to cover their ass legally while doing all kinds of shady things with users' data. [0] https://techland.time.com/2012/03/06/youd-need-76-work-days-to-read-all-your-privacy-policies-each-year/ https://techland.time.com/2012/03/06/youd-need-76-work-days-... [1] https://www.cracked.com/article_19683_6-terrifying-user-agreements-youve-probably-accepted.html https://www.cracked.com/article_19683_6-terrifying-user-agre... [2] https://www.npr.org/2019/03/08/701417140/when-not-reading-the-fine-print-can-cost-your-soul https://www.npr.org/2019/03/08/701417140/when-not-reading-th...

marcus_holmes 6y ago
To be fair, ingredients labelling is covered by an extremely strict set of regulations, and companies do play games with it as much as they're able (my favourite is "aqua" when they mean "water"). Which may be the way to go: introduce a strict set of regulations covering how to present your privacy policy
- taejo 6y ago
  Writing "aqua" instead of "water" is not playing with the regulations, it is a regulation. In the US cosmetics have to be labelled using the International Nomenclature of Cosmetic Ingredients (INCI) and the INCI name for water is "aqua".

glitchc 6y ago

This analogy fundamentally falls flat for a simple reason: Labelling is not legally binding. A privacy policy is a contract. It contains valud actions, outcomes, liabilities and remedies, all the components of a contract. Kindly stop minimizing their importance.

satyrnein 6y ago
Nutritional info is legally required, and you cannot legally misrepresent it, doesn't that make it legally binding?
- glitchc 6y ago
  Nutritional information is information. It is legislated and regulated, but not a contract. The manufacturer has to comply with regulations, but that is not considered a legally binding contract, and failure to comply does not constitute breach of contract. To be clear, just because there's a legal penalty attached for failure to comply does not constitute a contract between the manufacturer and the government. Similarly, the individual is not bound to any contract to the manufacturer by purchasing a can of beans. They are, on the other hand, when purchasing software. It's a crucial difference.
- Supermancho 6y ago
  It's not quite the same to describe something that already exists, as opposed to describing actions that have or have not happened yet (nor will they for the duration of a policy lifespan). Auditing ingredients is _relatively_ trivial to trying to audit the amorphous "privacy" restrictions.
- TheCoelacanth 6y ago
  Legally binding for the people writing it, not for the people reading it.
shkkmo 6y ago
Privacy Policies exist almost exclusively to protect companies from consumers. Labeling is legally binding but also highly regulated so that labeling protects consumers. The liabilities and remedies are standardized via law. If privacy policies existed to protect consumers from companies you would probably see more people willing to acknowledge their importance.

satyrnein 6y ago

"Privacy Czar's warning: this product sells your data to third parties."

vansteen 6y ago

Everywhere in the world, nutrition labels appear to try to summarize in a simple way if a food product is "good" or "bad". Examples: - The European nutriscore : https://en.wikipedia.org/wiki/Nutri-score https://en.wikipedia.org/wiki/Nutri-score - The Chilean black labels : https://en.wikipedia.org/wiki/Food_labelling_and_advertising_law_(Chile) https://en.wikipedia.org/wiki/Food_labelling_and_advertising... There's also lots of new apps like Yuka which try to warn you about bad ingredients. You scan the bar code on a food product then you get some summarized details and warnings. Maybe there's something to do to make these privacy policies more comprehensible.

thaumasiotes 6y ago

> Even though only a small fraction of people actually read it, it's still doing its job and its important that it's there. This philosophy tends to conflict with the fact that privacy policies say "we reserve the right to change the policy unilaterally at any time".

spideymans 6y ago

See, now you've got me thinking that there should be some sort of "labelling law" for privacy policies, at least for companies of a certain size. A standard, easy to read summary of the privacy policies of any given software or service. "Yes this app provides your data to third parties", "no, it does not record your location history", etc...

kyleblarson 6y ago

If it were required to add some sort of a non-lawyer readable summary ala the 'Nutrition Facts' labels in the US that would be a big step.

Reedx 6y ago

If terms of use and privacy policies were as readable as nutrition labels, that would be a huge win. Anyone know if there are any existing examples along those lines?

hinkley 6y ago

There are also a very wide set of laws about things you can't put into food even if you label it, and classes of ingredients that must be called out specifically, like certain food colorings, allergens, and compounds that various high profile genetic abnormalities are affected by (phenolketoneuria for one). I wonder if there's a Q&A format one could do for legal agreements that still meets muster, or could be legislated as such?

usrusr 6y ago

But food labeling is pretty well standardized, you can't just make up your own terms and add ten pages of convoluted circumscriptions and then say that's ok because a professional trained in just the right sub-field of biochemistry could deduce what's in there. If privacy policies were like food labeling nobody would object.

mtgx 6y ago

and in the us food labeling sucks too. I see a trend here.