A website’s privacy policy breaks down aspects such as what types of data it collects from users, why the company needs that information, and how long the organization keeps the content. Most privacy policies are extensive documents. Here’s a guide to understanding what they mean before agreeing to use a site or service.
What Does a Privacy Policy Typically Contain?
The exact contents of a privacy policy vary depending on geographic areas and jurisdictions. However, this is a short rundown of the typical details covered:
- Who owns the site or app.
- How it gathers data.
- What information the site collects.
- The legal or business case basis for taking the data.
- Any applicable details about cross-border information transfers.
- Information about third-party data sharing.
- The privacy policy’s effective date.
- How the company notifies customers of policy updates.
- Users’ data rights, such as asking a company to delete information.
Companies Often Have Privacy Policy Shortcomings
It’s naive to expect well-known companies to check all the data privacy boxes, and a look at recent news headlines emphasizes that reality. A regulator fined TikTok nearly $900,000 for failing to translate its privacy policy into Dutch for that market.
In another instance, Muse Group, which owns open-source audio editor Audacity, updated and apologized about its privacy policy after receiving public backlash. The company also provided a table of its key features, their purposes, and whether users could disable functionality for data-safeguarding reasons.
These examples highlight why it’s crucial to read privacy policies thoroughly rather than blindly agreeing to them. Companies don’t always have users’ best interests in mind and typically think of profits first and foremost. And they often get away with it because people generally don’t check these policies thoroughly—most users think they’re simply too long!
As you come across eyebrow-raising details in a privacy policy, ask yourself whether they might put your data at risk or if an organization oversteps reasonable boundaries with its information handling.
A Company’s Overall Commitment to Privacy Speaks Volumes
Evaluating a site’s privacy values can also mean you get a greater understanding of how it treats the topic as a whole. For example, does the only mention of privacy occur in a tiny footer link, or does the company have an entire section dedicated to it?
It’s also a good sign if companies use straightforward language to help customers understand privacy policies. Web browser provider DuckDuckGo does not collect or store users’ personal information. The brand also uses “Privacy, simplified” as a tagline and lives up to that ideal with an understandable policy breakdown.
These examples show how companies can go above and beyond to be upfront and transparent with privacy. Other businesses have similar approaches, and those actions can help you gauge whether to trust a company with your data.
Read Privacy Policies With Intentionality
The best practice is to thoroughly digest a privacy policy before agreeing to it. However, that’s often a daunting prospect to people without a legal background.
Shane McNamee, Avast’s chief privacy officer, points out, “A good privacy policy should be layered. It shouldn’t be one wall of undifferentiated text. If there are no navigational aids, that’s a red flag.”
One of his recommendations is to focus on the parts of a privacy policy that you deem most important, whether that’s data collection, storage timeframes, or something else.
You can also use your browser’s search functionality to find phrases of interest, i.e. Windows users can locate a particular phrase like “information we collect” by typing that into the search bar that appears after hitting Ctrl + F.
Set aside plenty of time to go through the privacy policy and understand the potential ramifications of a company’s processes. Tools also exist to screen guidelines for possible issues. Although those resources don’t replace reading a document, you could treat them like a second pair of eyes.
For example, Polisis is a free tool that uses artificial intelligence (AI) to help users search through a database of thousands of privacy policies, then learn their positive and aspects that might be concerning. You can read a summary of a company’s practices, plus explore particular topics, such as data collection, third-party sharing, and retention.
Guard is another tool built with AI. It gives top sites like Reddit and YouTube letter grades for their privacy practices, plus tells users about the biggest associated privacy concerns and whether the service has ever suffered data protection scandals.
Be Wary of Unclear Details or Timeframes
Clubhouse, an audio-based social media platform, came under scrutiny for its privacy policy. People took issue with several elements of the document, mostly due to a lack of clarity.
For example, the company did not specify how long it keeps data, including audio recordings.
Plus, Clubhouse collects phone contacts “to help users connect with people they know.” However, that raises questions about whether the company gathers data from individuals who do not use its services and what the organization might do with that information later.
The company also lacked details about how long it keeps data after someone ceases using Clubhouse. It merely said the information is retained for “a reasonable period of time.” However, there could be significantly different ideas about what’s reasonable from a company vs. user point of view.
Non-specific timeframes give companies more freedom to handle data in ways that could create issues later.
Information Builds Awareness
You’ll come across many privacy policies filled with confusing legal jargon. Even in those cases, examine the content for specifics you understand and watch for vague information.
By doing those things, plus learning the basics of any applicable data privacy laws in your state or country, you’ll make excellent progress in becoming a more informed internet user.