In my perfect world, the EFF would publish several, modeled after the 'creative commons' licenses; each policy would grant different levels or different kinds of privacy, and the meaning of the policy would be fairly well understood by all parties just by stating the name of the policy.

edit: I don't mean /legally mandating/ these privacy policies... I'm suggesting something like the system in place for managing copyright (or,uh, left) - the idea would be that if there are standard policies, you won't have to read each policy all the way through for every service.

Something totally independent of both business and government run as a non-profit that reviews the various privacy policies, notices changes (by spidering them periodically) and alerts users to those changes and their consequences?

You could also issue a 'badge' or a widget that you could include on your privacy policy page that gets served up from the reviewing institution.

Even ignoring the cost in lawyer time to draw up and review the policies, knowing that a policy is 'reviewed by X' tells the user less than "ISP Y uses standard policy Z"

Also, just like there are different creative commons licenses that grant different rights, it's reasonable to have different privacy policies that grant different rights... and if you need a particular right, it's much easier to go "Oh, isp X uses policy Y which gives me what I want" than to go reading the custom policy that each ISP drew up.

In that case it makes perfect sense. I thought about all privacy policies and because there are so many different products out there it would be very hard to have a limited set of policies. But for the ISP subset that could definitely be done.