4 ms·

If only there were an agreed upon best practice for communicating a sites handling of user data... a... "Privacy Policy", of sorts... Humm......

JohnFen 4y ago
Privacy Policy pages aren't really a solution to this, in my opinion. I don't think they reasonably count towards satisfying "informed consent". First, because they don't actually inform you of much. Second, because they're tricky to understand if you're not a lawyer. Most of them mean "you have no privacy", but worded in a way that leads you to think you do. Third, because it's a bit ridiculous to expect everyone to read them. You'd spend more of your time reading those damned things than the page you want to read -- and you'd have to read them on every visit because they can change at any time without notice. Better is if sites would just give basic, truthful warnings at the moments where you are making a privacy-impacting decision.
- phendrenad2 4y ago
  There is no solution to what you want really, which is informed users. Users don't always care to be informed, and shoving a consent dialog in their faces has been a grand experiment that proves this. I suppose we could require users to take a test to prove that they read the privacy policy. That would be interesting.
  - JohnFen 4y ago
    I'm not on board with shoving consent dialogs in people's faces. But a nice little warning line next to relevant controls seem like it would be a good idea. > I suppose we could require users to take a test to prove that they read the privacy policy That wouldn't really address the main issue with them, which is that they're written in a deceptive manner. I can tell you right now what 90% of them mean: "you have none". But that's not how they read. How they read is things like "we may share your data with trusted partners in order order to deliver you a great experience".
    - phendrenad2 4y ago
      So they should say "you have none"? What should they say? Would you be satisfied by such a change?
      - JohnFen 4y ago
        They should be written clearly, without obfuscation. If you have none, then that's exactly what they should say. but none of the ones I've read qualify as "informed consent" because even if they're clearly understandable, they don't fully inform you. They always mention sharing data with partners, for instance, but never say who those partners are, what data is being shared with them, and what those partners are doing with that data. Unless you know that, informed consent is impossible.
        phendrenad2 4y ago
        Every privacy policy I've read seemed very sensible to me. Remember that privacy policies are legal documents and they quickly become cluttered with "legal-isms" and verbosity. Sometimes companies will move heaven and earth to make their privacy policy readable at a 3rd-grade level. And you know what? That costs them money and they pass those costs on to consumers, who overwhelmingly don't care about what's actually in the agreement (because they have a fairly good understanding of what kinds of things it says anyway). Complaining about them seems to miss the bigger picture.

JohnFen 4y ago

Privacy Policy pages aren't really a solution to this, in my opinion. I don't think they reasonably count towards satisfying "informed consent". First, because they don't actually inform you of much. Second, because they're tricky to understand if you're not a lawyer. Most of them mean "you have no privacy", but worded in a way that leads you to think you do. Third, because it's a bit ridiculous to expect everyone to read them. You'd spend more of your time reading those damned things than the page you want to read -- and you'd have to read them on every visit because they can change at any time without notice. Better is if sites would just give basic, truthful warnings at the moments where you are making a privacy-impacting decision.

phendrenad2 4y ago
There is no solution to what you want really, which is informed users. Users don't always care to be informed, and shoving a consent dialog in their faces has been a grand experiment that proves this. I suppose we could require users to take a test to prove that they read the privacy policy. That would be interesting.
- JohnFen 4y ago
  I'm not on board with shoving consent dialogs in people's faces. But a nice little warning line next to relevant controls seem like it would be a good idea. > I suppose we could require users to take a test to prove that they read the privacy policy That wouldn't really address the main issue with them, which is that they're written in a deceptive manner. I can tell you right now what 90% of them mean: "you have none". But that's not how they read. How they read is things like "we may share your data with trusted partners in order order to deliver you a great experience".
  - phendrenad2 4y ago
    So they should say "you have none"? What should they say? Would you be satisfied by such a change?
    - JohnFen 4y ago
      They should be written clearly, without obfuscation. If you have none, then that's exactly what they should say. but none of the ones I've read qualify as "informed consent" because even if they're clearly understandable, they don't fully inform you. They always mention sharing data with partners, for instance, but never say who those partners are, what data is being shared with them, and what those partners are doing with that data. Unless you know that, informed consent is impossible.
      - phendrenad2 4y ago
        Every privacy policy I've read seemed very sensible to me. Remember that privacy policies are legal documents and they quickly become cluttered with "legal-isms" and verbosity. Sometimes companies will move heaven and earth to make their privacy policy readable at a 3rd-grade level. And you know what? That costs them money and they pass those costs on to consumers, who overwhelmingly don't care about what's actually in the agreement (because they have a fairly good understanding of what kinds of things it says anyway). Complaining about them seems to miss the bigger picture.