5 ms·

Why Privacy Policies Suck

24 points by Facens 15y ago

dcaylor 15y ago
As long as we have a sue-happy society, companies will use privacy policies to limit liability. That means they will continue to be documents with more text than most of us are likely to read. Icons and diagrams won't work without the text behind them. However, I do agree that just because a document has legal significance does not mean it needs to be full of legalese. We tried to keep our privacy policy as short and light as possible and write it in plain language. http://nodeping.com/PrivacyPolicy http://nodeping.com/PrivacyPolicy
- Facens 15y ago
  There's probably still need of a legalese document behind, but we are working on cutting that part too :P Even with the need of having a strictly law-compliant page, having a first page which is simple and readable at a glance is always a good idea. Consider that we are seriously working on bringing that model to the mass (read end of the article :) )
  - deleted 15y ago
    [deleted]
- iaskwhy 15y ago
  I really like yours but is there any reason why you don't add more elements to the page (icons, images, different text sizes)?
  - dcaylor 15y ago
    Thanks! That's a very good question, and the honest answer is because we're geeks and design is much harder work for us than building functionality. I guess that's another argument in favor of something like iubenda.com is doing.
    - Facens 15y ago
      Also notice that we are working with a top-notch designer ^^ http://dribbble.com/jonnotie/projects/15616-iubenda http://dribbble.com/jonnotie/projects/15616-iubenda
- brlewis 15y ago
  Some people say the U.S. has a sue-happy society. Others say that we don't; that the whole sue-happy idea is an invention of large companies that want tort reform. Yesterday I observed that companies still sell products in that hard-to-open plastic packaging that has injured a lot of people. That this packaging is still common indicates to me that we do not in fact live in a sue-happy society.
fractalcat 15y ago
Yes. Just yes. I recently wrote a privacy policy for my new startup; I think it complies with all but two of those guidelines (lightbox and standardised). Any feedback would be appreciated: https://theescortcompanion.com/privacy/ https://theescortcompanion.com/privacy/
- fractalcat 15y ago
  I hope you're not thinking of charging for privacy policies though. I have an deep aversion to paying for something I can write in twenty minutes.
  - Facens 15y ago
    Most people don't know what to put on a privacy policy, and we built a service with lawyers behind, assuring compliance and top quality service. Since yours is of course a good point, consider that our product will be very cheap, and I'd seriously pay a cheap price instad of spending those 20 minutes. Also consider that your privacy policy currently lacks the parties involved, and it's not "completely compliant". Our goal is to save your time on this side, for a reasonable price and giving something very polished in change :) What do you think?
    - fractalcat 15y ago
      Point taken - I can't see myself using such a service personally, but my startup's not at a stage where my twenty minutes is worth that much. :) You're right about the parties involved - I also forgot to mention our location/jurisdiction. Thanks for the feedback!
wisty 15y ago
The article is assuming that the ToS and privacy statement is meant to be informative. It's not. If you give people a good overview of what you are doing with their data, a significant portion will get pissed off. If you bore them with legalese, 99.9% of them will just sign, rather than wade through the terms. It's broken, but it's broken by design.
- matth 15y ago
  The broken by design thing is something that's always bothered me. I posted a draft of our company's Privacy Policy to github a while back as an experiment. https://github.com/wetalky/privacy-policy/blob/master/POLICY.md https://github.com/wetalky/privacy-policy/blob/master/POLICY... We're trying to be completely open with updates to this document, and we welcome outside commits. We intend to do the same with our ToS. I'm not sure anyone has tried this before, so I'm really excited to see where this experiment goes.
  - Facens 15y ago
    Did you get any commit so far?
- Facens 15y ago
  Look a the Facebook's example shown in the post. Facebook could have replaced that popup with a text broth, but it didn't, and this payed. The main privacy policy of Facebook is another example. They redesigned it with the help of TRUSTe, when they realized all that people want is to keep control of what they share (and my opinion is cleared in the article). Furthermore, TRUSTe bases its business on the assumption that well written privacy policies increase conversions, because when people have to provide their credit card (an example), they get scared by a broth-like privacy policy. Also think about Creative Commons: many people use it and many people rely on it when needing to know how to share content. The world is a better place with Creative Commons, and I think it will be a better place with simpler Privacy Policies and TOS :)
  - shabble 15y ago
thwarted 15y ago
Does the machine readable P3P format have any use still?
- Facens 15y ago
  I think that it's too complex to work on a scale. Maybe our service will embed it in the future, maybe we'll rethink a new standard (since p3p is a bit outdated) :)
  - thwarted 15y ago
    Privacy policies have not changed that much. I agree that P3P does not provide a scale of privacy, but that seems by design, since privacy, and the things described in privacy policies, don't map to a linear scale.
dcosson 15y ago
Looked at facebook just now, and sure enough there in the footer (if you're fast enough to click on it before the infinite scroll kicks in) they have this http://www.facebook.com/full_data_use_policy http://www.facebook.com/full_data_use_policy, which reaffirms my suspicion that using only what the author suggests probably isn't quite as safe legally. That said, I definitely agree that putting a simpler layer on top of it so non-lawyers can get the gist of your policy quickly is a great idea - now item 1,000,001 on my startup's to-do list!
- Facens 15y ago
  The best part is that we are making it automatic, just check our main website, our goal is to help website owners to get rid of the hassle of writing a privacy policy :)
flyswatter 15y ago
Would like to see some notion of how long data is retained. Period of time, til account deletion, forever, etc. I agree with 'broken by design' in many cases, but first step is at least having a non-broken design.
snarktacular 15y ago
I'd be happier to use Iubenda if its beta-access system didn't make me feel so violated, by requiring me to literally share it on every social media I can in multiple ways.
- Facens 15y ago
  You are not required to do it. Only if you want early access :)
evertonfuller 15y ago
Simple. Just don't have one. Nobody reads them anyway.
- Facens 15y ago
  So far, nobody tried. I think that Creative Commons can teach a lesson :)

24 points by Facens 15y ago

As long as we have a sue-happy society, companies will use privacy policies to limit liability. That means they will continue to be documents with more text than most of us are likely to read. Icons and diagrams won't work without the text behind them. However, I do agree that just because a document has legal significance does not mean it needs to be full of legalese. We tried to keep our privacy policy as short and light as possible and write it in plain language. http://nodeping.com/PrivacyPolicy http://nodeping.com/PrivacyPolicy

Facens 15y ago
There's probably still need of a legalese document behind, but we are working on cutting that part too :P Even with the need of having a strictly law-compliant page, having a first page which is simple and readable at a glance is always a good idea. Consider that we are seriously working on bringing that model to the mass (read end of the article :) )
- deleted 15y ago
  [deleted]
iaskwhy 15y ago
I really like yours but is there any reason why you don't add more elements to the page (icons, images, different text sizes)?
- dcaylor 15y ago
  Thanks! That's a very good question, and the honest answer is because we're geeks and design is much harder work for us than building functionality. I guess that's another argument in favor of something like iubenda.com is doing.
  - Facens 15y ago
    Also notice that we are working with a top-notch designer ^^ http://dribbble.com/jonnotie/projects/15616-iubenda http://dribbble.com/jonnotie/projects/15616-iubenda
brlewis 15y ago
Some people say the U.S. has a sue-happy society. Others say that we don't; that the whole sue-happy idea is an invention of large companies that want tort reform. Yesterday I observed that companies still sell products in that hard-to-open plastic packaging that has injured a lot of people. That this packaging is still common indicates to me that we do not in fact live in a sue-happy society.

fractalcat 15y ago

Yes. Just yes. I recently wrote a privacy policy for my new startup; I think it complies with all but two of those guidelines (lightbox and standardised). Any feedback would be appreciated: https://theescortcompanion.com/privacy/ https://theescortcompanion.com/privacy/

fractalcat 15y ago
I hope you're not thinking of charging for privacy policies though. I have an deep aversion to paying for something I can write in twenty minutes.
- Facens 15y ago
  Most people don't know what to put on a privacy policy, and we built a service with lawyers behind, assuring compliance and top quality service. Since yours is of course a good point, consider that our product will be very cheap, and I'd seriously pay a cheap price instad of spending those 20 minutes. Also consider that your privacy policy currently lacks the parties involved, and it's not "completely compliant". Our goal is to save your time on this side, for a reasonable price and giving something very polished in change :) What do you think?
  - fractalcat 15y ago
    Point taken - I can't see myself using such a service personally, but my startup's not at a stage where my twenty minutes is worth that much. :) You're right about the parties involved - I also forgot to mention our location/jurisdiction. Thanks for the feedback!

wisty 15y ago

The article is assuming that the ToS and privacy statement is meant to be informative. It's not. If you give people a good overview of what you are doing with their data, a significant portion will get pissed off. If you bore them with legalese, 99.9% of them will just sign, rather than wade through the terms. It's broken, but it's broken by design.

matth 15y ago
The broken by design thing is something that's always bothered me. I posted a draft of our company's Privacy Policy to github a while back as an experiment. https://github.com/wetalky/privacy-policy/blob/master/POLICY.md https://github.com/wetalky/privacy-policy/blob/master/POLICY... We're trying to be completely open with updates to this document, and we welcome outside commits. We intend to do the same with our ToS. I'm not sure anyone has tried this before, so I'm really excited to see where this experiment goes.
- Facens 15y ago
  Did you get any commit so far?
Facens 15y ago
Look a the Facebook's example shown in the post. Facebook could have replaced that popup with a text broth, but it didn't, and this payed. The main privacy policy of Facebook is another example. They redesigned it with the help of TRUSTe, when they realized all that people want is to keep control of what they share (and my opinion is cleared in the article). Furthermore, TRUSTe bases its business on the assumption that well written privacy policies increase conversions, because when people have to provide their credit card (an example), they get scared by a broth-like privacy policy. Also think about Creative Commons: many people use it and many people rely on it when needing to know how to share content. The world is a better place with Creative Commons, and I think it will be a better place with simpler Privacy Policies and TOS :)
- shabble 15y ago

thwarted 15y ago

Does the machine readable P3P format have any use still?

Facens 15y ago
I think that it's too complex to work on a scale. Maybe our service will embed it in the future, maybe we'll rethink a new standard (since p3p is a bit outdated) :)
- thwarted 15y ago
  Privacy policies have not changed that much. I agree that P3P does not provide a scale of privacy, but that seems by design, since privacy, and the things described in privacy policies, don't map to a linear scale.

dcosson 15y ago

Looked at facebook just now, and sure enough there in the footer (if you're fast enough to click on it before the infinite scroll kicks in) they have this http://www.facebook.com/full_data_use_policy http://www.facebook.com/full_data_use_policy, which reaffirms my suspicion that using only what the author suggests probably isn't quite as safe legally. That said, I definitely agree that putting a simpler layer on top of it so non-lawyers can get the gist of your policy quickly is a great idea - now item 1,000,001 on my startup's to-do list!

Facens 15y ago
The best part is that we are making it automatic, just check our main website, our goal is to help website owners to get rid of the hassle of writing a privacy policy :)

flyswatter 15y ago

Would like to see some notion of how long data is retained. Period of time, til account deletion, forever, etc. I agree with 'broken by design' in many cases, but first step is at least having a non-broken design.

snarktacular 15y ago

I'd be happier to use Iubenda if its beta-access system didn't make me feel so violated, by requiring me to literally share it on every social media I can in multiple ways.

Facens 15y ago
You are not required to do it. Only if you want early access :)

evertonfuller 15y ago

Simple. Just don't have one. Nobody reads them anyway.

Facens 15y ago
So far, nobody tried. I think that Creative Commons can teach a lesson :)