Something that wasn't mentioned in the abstract is whether the privacy policies were sufficient to actually protect somebody's privacy. It touches on there bei

Something that wasn't mentioned in the abstract is whether the privacy policies were sufficient to actually protect somebody's privacy. It touches on there being no explicitly detrimental practices in the studies, but doesn't state whether they actually protect privacy, or merely codify existing business practices. To use their metaphor of bulletproof glass, suppose a company pointed a sheet of cardboard as a safety measure. Strictly speaking, a bullet will be moving slower after going through the cardboard, so it is t detrimental on its own. However, if a company lists it as a safety measure without listing anything else, I'd be more worried. Where before there was uncertainty about whether their practices were sufficient, after there was certainty that they are insufficient. In the same way, any privacy policy that includes "We only share your data with our trusted business partners." decreases my overall trust. Because that is already an admission of data changing hands, being used for further aggregation. Saying that you'll only share data about me when provided money in a business relationship is strictly better that sharing it publicly at all times, but isn't sufficient to give me any comfort.