5 ms·
The Bulletproof Glass Effect: Unintended Consequences of Privacy Notices
- nkristoffersen 4y agoI was so disappointed when USA was going after TikTok instead of codifying proper data protection for all citizens. Having gone through several GDPR implementation process in Europe, it’s what the citizens of USA need, but not what American companies or government agencies want. So from my perspective, American citizens will never fully be protected. Sadly.
- chatterhead 4y agoMost things in this world are the opposite of what the say... The C.A.R.E.S. Act had nothing to do with caring. "Lifetime warranty" has a very specific meaning. "Organic" isn't what you think it means. Love. (Feel free to add your own interpretation on this one ;) )
- cassonmars 4y agoThere's a tremendous situational irony with the massive cookie notice at the bottom of the screen when this loads.
- abruzzi 4y ago"we value your privacy" ... so here is how we are going to track you.
- matheusmoreira 4y agoWe value your privacy a lot. We make money off of it after all.
- ansgri 4y agoAt least they have “decline all” that works.
- MereInterest 4y agoSomething that wasn't mentioned in the abstract is whether the privacy policies were sufficient to actually protect somebody's privacy. It touches on there being no explicitly detrimental practices in the studies, but doesn't state whether they actually protect privacy, or merely codify existing business practices. To use their metaphor of bulletproof glass, suppose a company pointed a sheet of cardboard as a safety measure. Strictly speaking, a bullet will be moving slower after going through the cardboard, so it is t detrimental on its own. However, if a company lists it as a safety measure without listing anything else, I'd be more worried. Where before there was uncertainty about whether their practices were sufficient, after there was certainty that they are insufficient. In the same way, any privacy policy that includes "We only share your data with our trusted business partners." decreases my overall trust. Because that is already an admission of data changing hands, being used for further aggregation. Saying that you'll only share data about me when provided money in a business relationship is strictly better that sharing it publicly at all times, but isn't sufficient to give me any comfort.
- somat 4y agoI like your analogy, but is it not more like having a sign telling you how the bullet-proof glass works without any evidence of actual bullet-proof glass. And on the analogy of the bullet-proof glass. The bullet-proof glass is never there to protect you the customer. it is only there to protect the company.
- MereInterest 4y agoExactly. A so-called "privacy policy" may instead be a "you-have-no-privacy policy". That both are described in the same terminology is part of the problem.
- teeray 4y agoPrivacy Policies are as useless as cookie banners. Companies feed you page after page of confusing legalese so you give up and click “I accept.” There should be a simplified plain-language form created by the FTC with checkboxes—-check off any statements that are true about your company’s privacy practices. Then they could be easily understood and compared.
- Quarrel 4y agoThe actual paper courtesy of HBS: https://www.hbs.edu/ris/Publication%20Files/The%20Bulletproof%20Glass%20Effect%20-%20JMR%20Preprint_a3f8b3cf-120a-477f-976f-d25f9bf03229.pdf https://www.hbs.edu/ris/Publication%20Files/The%20Bulletproo...
- JadeNB 4y agoI'm not sure why it's presented that way, but, while the page itself prompts me to "Get Access", I can just click the PDF overlay on the journal page to get the PDF: https://journals.sagepub.com/doi/pdf/10.1177/00222437211069093 https://journals.sagepub.com/doi/pdf/10.1177/002224372110690... .
- JadeNB 4y agoYou can probably guess at the meaning, but here's an excerpt from the abstract defining "the bulletproof-glass effect" and its relevance: > A privacy notice, by placing legally enforceable limits on a firm's data practices, communicating safeguards, and signaling transparency, might be expected to promote confidence that personal data will not be misused. Indeed, most managers expected a privacy notice to make customers feel more secure (Study 1). Yet, consistent with the analogy that bulletproof glass can increase feelings of vulnerability despite the protection offered, formal privacy notices undermined consumer trust and decreased purchase interest even when they emphasized objective protection (Studies 2, 3, and 5) or omitted any mention of potentially concerning data practices (Study 6).
- thayne 4y agoFor a privacy policy to actually give me confidence in it protecting my privacy it would need to: 1. Be short enough that I can read it quickly (at most a couple minutes) 2. Be easily understandable 3. Actually have meaningful protections for my privacy Most privacy policies are none of those.
- ChrisMarshallNY 4y agoHow does this work for you? https://littlegreenviper.com/welcome-to-little-green-viper/privacy/ https://littlegreenviper.com/welcome-to-little-green-viper/p...
- phdelightful 4y agoNot the parent, but I like it! First sentence is unnecessary. It would be better if it disallowed taking data for a legit reason and then using it for another less scrupulous reason. Point 5 may mitigate this concern substantially however.
- ChrisMarshallNY 4y agoThanks for the feedback. Yeah, I think I agree.
- thayne 4y agoYes! that is such a breath of fresh air compared to the usual privacy policy.
- epicureanideal 4y agoStartup idea: a policy policy provider with a set of standard terms, or pro version for more money where it evaluates and grades and verifies the absence of anything crazy or unexpected in a custom privacy policy.
- h0l0cube 4y agoThe free ToSDR browser extension might be what you’re looking for: https://tosdr.org/ https://tosdr.org/
- nobodyandproud 4y agoBlame businesses. I see long winded policies as cover-your-ass for the business. The language and format isn’t any different from EULAs and lends zero confidence because I have no way of verifying misbehavior, short of doing things like one-off email accounts. Not dissimilar to business whistle-blower “protection” and HR’s mandatory “ethics” and other legal courses.