Why they are hard to read, and why to try anyway
Privacy policies are long, partly because laws expect organizations to disclose many things, and partly because they are written to protect the company. Few people read them in full, and you do not need to. A policy is still the one place where a company states, in writing, what it says it does with your information. Reading the right parts for a few minutes can tell you whether a service is worth the trade.
Treat a policy as a statement of what the company says and what it may do, not a guarantee of how it behaves. Even so, it is a useful starting point, and a vague or missing one tells you something too.
Start with the structure
Use the browser’s find function (usually Ctrl+F or Cmd+F) and look for key words rather than reading top to bottom. Many policies also have a short summary or a table of contents near the top. Check the date: a policy that has not been updated for years may no longer describe what the service does.
The sections that matter most
What information is collected
Look for lists of the types of data: information you provide, information collected automatically (device, location, usage) and information from other sources. Compare the list with what the service needs to work. A flashlight app that collects contacts and location is a red flag, which ties in to the way you judge app permissions.
Why it is used
A good policy ties each kind of data to a purpose, such as providing the service, security or analytics. Be cautious about broad wording like “to improve our offerings” paired with “and for other purposes.” Pay particular attention to whether data is used for advertising or to build profiles.
Who it is shared with
This is often the most important section. Look for:
- service providers acting on the company’s behalf (payment, hosting, support)
- advertising and analytics partners
- affiliates or “group companies”
- sale or “sharing” of personal information
- disclosure to authorities when legally required
- transfers if the company is sold or merged
A policy saying data is “sold” or shared for advertising is not necessarily improper, but you should know and decide whether to opt out where that is offered.
How long it is kept
Some policies give a retention period; many say “as long as necessary.” Look for what happens after you close an account. Deletion may be partial, and backups can persist for a while.
Your choices and rights
Look for words such as “your rights,” “opt out,” “access,” “delete” and “choices.” Good policies explain how to see your data, correct it, delete it and limit marketing, and give an email address or form. Which rights you actually have depends on where you live, as the overview of data privacy laws explains.
Security
Expect general statements such as “reasonable safeguards.” Specific mentions of encryption or access controls are mildly reassuring, but no policy can promise that data breaches will not happen.
Children
If the service may be used by children, check the age restrictions and how the service says it handles minors’ data.
Cookies and tracking
Many sites have a separate cookie notice. It should explain which cookies are essential, which are for analytics or advertising, and how to change your choices.
Contact and changes
There should be a way to reach the company about privacy questions, and a statement about how it informs you of changes. Be wary when a policy says changes apply automatically just by continued use, especially for a service where you hold a lot of data.
Warning signs
- Very vague wording that leaves almost everything permitted
- No contact details, or no mention of how to exercise rights
- Collection of data that seems unrelated to the service
- Broad rights to use or license your content
- No policy at all, or a copy that looks pasted from elsewhere with another company’s name left in
A five-minute routine
- Find the date and the list of data collected.
- Search for “share,” “sell” and “partners.”
- Search for “retain,” “delete” and “opt out.”
- Look for a contact address.
- Decide: is what they take proportionate to what you get?
If the answers worry you, you can use a limited version of the service, provide only required fields, decline optional tracking, or choose an alternative. When you are reading on behalf of a company, for example before adopting a new tool, treat the policy as one input to your assessment of third-party risk, and consider asking a qualified professional about contracts. For personal use, the aim is simply to make the decision knowingly rather than clicking “agree” by reflex.