Nobody reads privacy policies, senator wants lawmakers to stop pretending we do

I should add that despite what people here are saying, the complexity of the wording is usually driven by legal requirements, not a desire to confuse people.

I wouldn't blame any particular company for not departing from this equilibrium we're in. But it makes a "meeting of the minds" so absurd it's a mockery of the ancient meaning of a contract.

Edit: I may be thinking only of terms of service; I don't remember how routine that term might be in privacy policies.

The median US adult reads at a grade 5 level. That's a problem in and of itself. However when I paste Apple's privacy policy at https://www.apple.com/legal/privacy/en-ww/ into https://readabilityformulas.com/freetests/six-readability-fo... it comes out with a Flesch-Kincaid Grade Level of 14.4. There are a variety of readability measures at that site, and for this document they varied between grade 12 and college graduate.

It is therefore demonstrably impossible for the average American to read that policy. EVEN IF THEY WANTED TO.

Now another poster claims that this is because of what is legally required. That is nonsense. It is because nobody cares about making it readable. Let me demonstrate. Here is a sample paragraph from the document with a reading level of grade 13.4:

You may be asked to provide your personal information anytime you are in contact with Apple or an Apple affiliated company. Apple and its affiliates may share this personal information with each other and use it consistent with this Privacy Policy. They may also combine it with other information to provide and improve our products, services, content, and advertising. You are not required to provide the personal information that we have requested, but, if you chose not to do so, in many cases we will not be able to provide you with our products or services or respond to any queries you may have.

Here is a rewritten version that is significantly shorter, more readable (grade 7.3), and actually says more:

When you contact Apple or its affiliated companies, we may ask you questions about yourself. Examples that we commonly ask for include your name, age, address, and credit card number. You do not have to answer us. But if you don't, we may not be able to answer your questions or provide you with our services.

Your answers can be shared between Apple and its affiliates as long as we follow this Privacy Policy. We can also combine your answers with other data that we have. We do this to provide and improve our products, services, content, and advertising.

I could easily improve the readability more, but my point is made. The hardest part of the exercise was making the rewritten version long enough to get a readability score.

I think it would be very reasonable to pass a law saying that any consumer contract with a Flesch-Kincaid Grade Level of over grade 8 should not be enforceable. The reasoning being that there cannot have been a meeting of minds when few consumers are even able to understand the language which the contract is written in. And if there were such a law, I guarantee that lawyers would quickly learn how to put their thoughts in plain writing instead of legalese.

These are meant to be rhetorical questions but I am curious how people would answer.

The problem is, we have an extremely litigious society, and lawyers are asked to think through and address all of the risks. The lower the dollar amount, the lower the liability that a company can reasonably take for the transaction.

Do you want to have an account? Great, but we need to be clear about who is responsible for use of the account and its credentials. We also need to clarify when it can be suspended or terminated. Do you want to submit content? Cool, but we should confirm that what you submit is your own responsibility, and we need to add some language about ownership and licensing to avoid copyright and other IP issues. We should also confirm that certain types of activities are not OK (e.g., pornography, harassment). Do you want to provide feedback? Awesome, but you cannot sue if it is used. Do you want to use APIs? Sweet, but there are things you can and cannot do so you don't break or abuse our system. Are you paying for things? We need to be clear how that works. And through it all, we need to have key provisions about warranties and limitations of liability so the business is not on the hook for millions when the account is worth $10.

And all this is for a simple service. There are countless ways to add complexity to a service.

I still agree with a ton of points here about the dangers of one-sided agreements, limited options for services, complex legalese, etc. But I will say that this is a trickier issue than people seem to give it credit. It may be nonsensical to say that a consumer read and understood a contract, but it is also nonsensical to say that companies should risk bankruptcy for free or cheap services (unless we are OK with free or cheap services no longer existing).

Perhaps a better way would be to legislate what privacy policies can contain, so that they are more like Creative Commons licenses.

I, as a consumer, would prefer to not bother with this stupidity knowing I have virtually no privacy online and cannot sue the service provider for privacy violations except in cases of provable negligence. Since that applies to consumers whether or not they agree with it don’t waste the effort with the privacy notice. Save it for my lawyer.

If, as consumers, we actually wanted privacy we would pressure our law makers to write privacy law like HIPAA or the Federal Privacy Act of 1974.

The vast majority of Privacy Policies do the exact opposite. The function as a method to obscure the important details.

Compare that to the massive amount of legalese in these various policies and agreements.

They are also not even remotely as extensive as privacy policies are. Case in point: Back in 2012 one already needed 76 workdays to read all the privacy policies accepted on the Internet in one year [0].

Since then that number has very likely gone extensively up as people use even more online-services on average, particularly on mobile devices, and a lot of these services now also have extensive codes of conduct in addition to the privacy policies and bloated ToS/EULAs.

So while reading the ingredients of everything you eat is a very realistic and plausible thing to do, something people with allergies do on a near-daily basis, trying the same with privacy policies is just not realistic. Particularly when one wants to read them in an informed way to actually understand what you are agreeing to [1], for that you would need a lawyer to read them with you to make sense of the convoluted legal-speak they are usually written in.

A fact that is pretty common knowledge to such a degree that companies have even written $10k rewards into their ToS for people actually reading them. [2]

That's why most privacy policies do not really exist to inform the users as food labeling does, their main purpose is for the company to cover their ass legally while doing all kinds of shady things with users' data.

[0] https://techland.time.com/2012/03/06/youd-need-76-work-days-...

[1] https://www.cracked.com/article_19683_6-terrifying-user-agre...

[2] https://www.npr.org/2019/03/08/701417140/when-not-reading-th...

A privacy policy is a contract. It contains valud actions, outcomes, liabilities and remedies, all the components of a contract. Kindly stop minimizing their importance.

There's also lots of new apps like Yuka which try to warn you about bad ingredients. You scan the bar code on a food product then you get some summarized details and warnings.

Maybe there's something to do to make these privacy policies more comprehensible.

This philosophy tends to conflict with the fact that privacy policies say "we reserve the right to change the policy unilaterally at any time".

Anyone know if there are any existing examples along those lines?

I wonder if there's a Q&A format one could do for legal agreements that still meets muster, or could be legislated as such?

In this fully connected world, it's almost criminal that a purchase is processed in seconds whereas a refund takes 30 days. It's time that WAS criminal. It's a contract right? Well, all contracts are required to comply with a cooling off period (by law), ranging anywhere from 3 days to two weeks depending on type of contract and jurisdiction. It's time for the legal system to enforce these laws for software contracts.

If I don't like an app within 3 days after purchase, I should have access to a prominently visible button to return it. If I click on it, the app should promptly issue a refund to my credit card (there's no reason why this can't be immediate) and delete the app from my device. Such a button should be mandated by law regardless of platform or application. But of course, the lawyers and lawmakers work for the rich, not the middle-class or poor.

I will suggest another reason, already built into contract law, these agreements/contracts are unconscionable.

Generally where a contract would otherwise be enforceable, having met all the legal elements of a legally enforceable contract, the Court does not enforce the contract finding is would be unconscionable.

There are all sorts of reasons a court would find it unconscionable to enforce an otherwise legally binding agreement/contract, so these cases really get into the nitty gritty facts. However, a typical example of an unconscionable contract is where one party is an experienced dealer in a type of business, while the other party is an average consumer. I know this basically sounds like every agreement between a business and consumer, but in practice its not (again you would have to begin reading tons of case law to get an idea). However, consider every single social media platform that builds into their agreements they have the right to modify the terms with or without actual notice to the users of said modification...that is about as unconscionable as it gets.

Back in the decentralized autonomous organization (DAO) days, where proponents always claimed "the code is the law" and if the code allowed investor money to be stolen, that wasn't a hack or breach of contract, rather it was a contractual right the investor agreed to (even in light of plain English marketing contrary to the actual code, even though the marketing materials disclaimed: "the code is the law")...I always explained, and was often down voted into oblivion, a court would never enforce such a agreement/smart contract as it would be unconscionable.

My suggestion: we should only allow privacy policies to contain standardized sections which are based on industry standards such as ISO, IETF, DIN terms. This would ensure that terms can be better compared and remove the possibility for companies to cheat consumers by hiding predatory terms.

Nowadays this is a very big "if".