I view privacy policies as worthless. They don’t exist to protect the consumer‘s privacy. They only exist to shield the service provider from liabilities. In that case privacy policies serve no valid consumer facing function why bother the consumer with them in the first place?

I, as a consumer, would prefer to not bother with this stupidity knowing I have virtually no privacy online and cannot sue the service provider for privacy violations except in cases of provable negligence. Since that applies to consumers whether or not they agree with it don’t waste the effort with the privacy notice. Save it for my lawyer.

If, as consumers, we actually wanted privacy we would pressure our law makers to write privacy law like HIPAA or the Federal Privacy Act of 1974.

I agree. Why do we even call it a "privacy policy"? It's more of a waiver.

Because people don't like the idea of "waiving their rights"

Well sure, but if naming something more accurately causes people to reject it because it sounds really bad, I don't think the issue is with the naming.

I fully agree and wasn't trying to justify the enforcement of long obtuse contracts that support the degradation of privacy.

because it’s their policy on user privacy? the name makes perfect sense.

> They only exist to shield the service provider from liabilities. In that case privacy policies serve no valid consumer facing function why bother the consumer with them in the first place?

Because the consumers bother the companies with lawsuits if they aren't "forced" "to read" the privacy policy. The only way you can get away from the requirement to display these policies prominently is if you make it generally illegal to sue over anything disclosed in the privacy policy, even if it's not prominently displayed. Or, as you say, make the kinds of things people like to sue for actually illegal, so there will be nothing to disclose.

It sounds like you are arguing for tort reform. They can sue anyways regardless of whether they read the policy and regardless of whether the suit is groundless. All it takes to create a law suit is to issue a motion to the court. Whether or not the suit is frivolous is for the court to decide in response to an opposing motion.

I wouldn't say I'm arguing for it. I don't have any real problem with the status quo as it pertains to privacy policies. I'm just saying IF you have a problem with privacy policies, it needs to be very inexpensive to defend lawsuits on privacy grounds which are currently defensible only due to privacy policies.

There is a great many of us who don’t use certain sites for privacy reasons. What happened here where Facebook was required to provide a service? Could you not avoid your entirely valid concern altogether by just not using the service? Why do these types of posts end up going the entitled route? You as a consumer have options for these luxury services, don’t use them and they’ll change.

A label on food is easily looked at and any important information can be found within seconds.

The vast majority of Privacy Policies do the exact opposite. The function as a method to obscure the important details.

This makes a lot of sense. Providing some kind of categorized/easily digestible format for the policy to fit into. When I was writing mine I tried to be very clear, but my startup is specifically focused on privacy, so I didn't really have much to disclose.

The GitHub terms of service[1] have a pretty good format. However, the summaries are often too vague -- they describe the type of content instead of summarizing its contents, so it's still possible to hide unsavory details. For example, section R2, on assignability, is grossly imbalanced.

I co-authored the Snowdrift.coop terms of service[2], which we adapted from GitHub -- we could not afford legal review and figured GitHub has enough lawyers to make sure the CYA language included was thorough enough to cover us pre-launch (we will get legal review before processing payments for outside projects). There was some legalese we'd prefer to remove but didn't feel comfortable without legal counsel, but the summaries are non-binding so we rewrote many of them to be more descriptive. Curious what you think!

On the privacy policy[3] side, we agreed with you -- if our policy was long or complicated enough that a summary was necessary, we were doing something wrong. So we just described all the ways we collect personal data, in "If you X, we will Y" format. For example,

> If you create a Snowdrift.coop account, we store your email address and use cookies to keep you logged in.

I wish more sites had policies like this, so that "long and unreadable policy" would become more of a red flag.

[1]: https://help.github.com/en/github/site-policy/github-terms-o...

[2]: https://snowdrift.coop/terms

[3]: https://snowdrift.coop/privacy

Re: Terms

I read through a good amount and I think they make sense. The short version helps, but that always worries me from a legal standpoint. If we summarize something in a legally ambiguous way have we undermined the original intent?

There are some inconsistencies with how you present the data that I think would help to smooth out. On your summary table. You start with the description being more of a goal for that section, than sporadically start switching to the "short version" of what your terms are.

For me I was hoping that it would be the short-version so I essentially get a comprehensive cliff-notes kind of view.

Also some minor issues with bolding some headers 4. Project Termination 4. Survival

As well as inconsistently formatting the short version. (I prefer the all bold version to help clearly show where the short part ends)

Privacy policies are much easier for me to wrap my head around. What you store, How you store it, and what you do with it.

This clause was a good idea that I will "borrow":

If our corporate structure or status changes (e.g., if we restructure, are acquired, or go bankrupt), we will notify all users so that you may choose to anonymize or delete your private data before we pass on any data to a successor or affiliate.

My version is here https://www.pritact.com/privacy-policy.html which I think follows along a lot with yours in spirit, but just has less ground to cover because of the nature of my platform.

> If we summarize something in a legally ambiguous way have we undermined the original intent?

I share some of your concern. A written contract (including ToS) is supposed to capture an agreement between two parties, so if they later disagree on what was agreed, there's an unambiguous record. If one party isn't clear on the terms as written (say, because they only read the legally-ambiguous summary), then it's hard to say there was an agreement.

Unfortunately, these goals are often at odds: many websites/services feel the need to include lots of boilerplate to shield themselves from liability, and in the pursuit of precision, legalese is often jargony and inscrutable. In my opinion, we'd be better off if people didn't disclaim so much liability and were willing to take a chance on clearer but less established language. But there are societal reasons for those things that I can't really fix as an individual.

So, ideally, terms should be both legally precise and short/layperson-readable; in practice that's often not possible, which means any readable summary is necessarily ambiguous (otherwise, we'd just replace the terms with it). Given that existing ToS are often not layperson-readable, I think they're already failing to establish agreement, so I think that summaries, while clearly a non-ideal compromise, are a net positive.

> You start with the description being more of a goal for that section, than sporadically start switching to the "short version" of what your terms are.

I agree it could use more consistency and I agree the "shortest version" is better (many "goals for the section" barely have more meaningful words than the section title alone). It is how it is because summarizing is hard and our time is not unlimited. Definitely open to future revision.

For what it's worth, there is a "short version" at the top of each individual section; the table at the top is a further summary (hence "shortest" above). Given more bandwidth, I'd make each of the table sections expandable to show the "short version" as well.

> Also some minor issues with bolding some headers 4. Project Termination 4. Survival

Thanks. I suspect this has to do with the conversion from markdown (as they were written) to hamlet (for display). Opened an issue to track it. https://gitlab.com/snowdrift/snowdrift/-/issues/186

> As well as inconsistently formatting the short version. (I prefer the all bold version to help clearly show where the short part ends)

This was intentional; the bolded summaries are for two sections (warranty and liability) which, IIRC, are legally required to be emphasized. Usually that's done by putting the sections themselves in all caps (ugh), with the side effect of making them unreadable. GitHub's terms, on which ours are based, have a bold "Please read this section carefully; you should understand what to expect." in that section after the summary; we opted to just bold the whole thing. Maybe that's confusing, though, and we should just follow their lead.

> https://www.pritact.com/privacy-policy.html

I agree, it looks nice. :) Especially, I like putting the form of data collected as the first words of each sentence under "what we store". Having our "If you…" part first makes it read better but harder to skim. I'll propose changing that next time we modify the policy.

Aside, I looked at the home page and while I understood what your service does, it wasn't clear to me how it was delivered (app? website? dedicated hardware (joking)?). I don't think I would have figured it out if I hadn't seen a reference to app.pritact.com in the privacy policy.

I really like Tarnap's terms: http://www.tarsnap.com/legal.html

Concise, understandable, and explanations for almost all items are available.

Thank you for the link; I really like the [why?] footnote style. Also, keeping the terms so short mean summaries really aren't needed :)

Credit card companies were forced to do this, and it has improved the industry for consumers having some bullet points of the key facts up front. Industries have to be forced to act on consumers behalves, as they stand to benefit from fleecing them.

This.

As a consumer it's extremely hard to find out what you need in a Privacy Policy, as it is simply too big of a document generally.

For companies its different as they should have someone payed to read that.

So what is needed is a standard way of conveying what data is being collected. And what is kept in-company, and what is shared/sold. Just like the ingredients in a package, a simple Table.

Also, food manufacturers don't reserve the right to change my food's nutritional value at any time after I buy it.

Privacy Policies are written in juridical terms and are hardly/not-easily understood by an average person or user. That is the main issue with Privacy Policies, in my opinion.

> A label on food is easily looked at and any important information can be found within seconds.

I don't really agree. if I look at the label on a box of poptarts, I can see the number of calories in a serving and the ratio of carbs, fat, and protein. from this I can conclude that it is a relatively unhealthy food, but I have no idea how to interpret the breakdown of exactly what types of fat they contain. are polyunsaturated fats bad? what about monounsaturated? the nutrition facts are right there on the box, but I don't really know what they mean without doing a bunch of research.

the actual ingredients list is worse. there are at least ten ingredients in poptarts that I just don't recognize. I can clearly tell that they are not an "all natural" food, but not much else. if I had a food allergy or wanted to avoid a specific additive for whatever reason, it would certainly be useful, but otherwise not so much.

Imagine a “Privacy facts” label at facebook.com/privacy.

The format of the page is mandated by the government, including the font and margins. It is easily scraped and must be by law. This label is required in place of a privacy policy.

Facebook.com will:

Store data about you forever in a profile.

Share data about you with 3rd parties.

Show you advertisements based on a profile.

Show you content based on a profile.

Share profile about you information with law enforcement.

Facebook.com’s top five markets by revenue are:

Advertising

News Redistribution

Device Development

This may still be opaque and ignored by most people. Standardizing the language and format in a way that laypeople can read delivers actual value to consumers.

Would be cool if it was required that such a label needs to be placed prominently on any signup page.

As a vegetarian, I find ingredient lists pretty reliable and useful, and consult them regularly. There are a lot of non-obvious things you have to look out for if you're vegan, but even there it's usable and useful.

With a few things people like to avoid, it's tricky -- MSG notably can be under a bunch of different names -- but most common allergies are clearly highlighted, or at least not hidden.

If you don''t have specific things you need to avoid, then of course a list of the specific things in it is not useful, but why/how would it be? It has a purpose and it serves that purpose.

"Is this healthy?" isn't an answerable question. There's no one specific answer true for multiple people--it's analogous to "Will this website respect my privacy?" On the other hand, "Is this vegetarian" and "Will this website share my data with third parties" are. (Or are closer to being so.)

I want to know if there's meat in an item of food, and the label tells me that in a fairly easy-to-read format.

I want to know if my data will be shared to third-parties by a website, and the privacy policy maybe provides it to me, but in a very inaccessible manner.

There's as many characters on the side of a box as 3 tweets.

Privacy policies are many, many more than 3 tweets.

I think that comparison is very misleading because ingredient lists of food are not written by lawyers, they use very simple language, and they don't make you give up all kinds of rights.

They are also not even remotely as extensive as privacy policies are. Case in point: Back in 2012 one already needed 76 workdays to read all the privacy policies accepted on the Internet in one year [0].

Since then that number has very likely gone extensively up as people use even more online-services on average, particularly on mobile devices, and a lot of these services now also have extensive codes of conduct in addition to the privacy policies and bloated ToS/EULAs.

So while reading the ingredients of everything you eat is a very realistic and plausible thing to do, something people with allergies do on a near-daily basis, trying the same with privacy policies is just not realistic. Particularly when one wants to read them in an informed way to actually understand what you are agreeing to [1], for that you would need a lawyer to read them with you to make sense of the convoluted legal-speak they are usually written in.

A fact that is pretty common knowledge to such a degree that companies have even written $10k rewards into their ToS for people actually reading them. [2]

That's why most privacy policies do not really exist to inform the users as food labeling does, their main purpose is for the company to cover their ass legally while doing all kinds of shady things with users' data.

[0] https://techland.time.com/2012/03/06/youd-need-76-work-days-...

[1] https://www.cracked.com/article_19683_6-terrifying-user-agre...

[2] https://www.npr.org/2019/03/08/701417140/when-not-reading-th...

To be fair, ingredients labelling is covered by an extremely strict set of regulations, and companies do play games with it as much as they're able (my favourite is "aqua" when they mean "water").

Which may be the way to go: introduce a strict set of regulations covering how to present your privacy policy

Writing "aqua" instead of "water" is not playing with the regulations, it is a regulation. In the US cosmetics have to be labelled using the International Nomenclature of Cosmetic Ingredients (INCI) and the INCI name for water is "aqua".

ah, thanks for that. I did not know that :)

there's a load of problems with food labeling requirements... for example, sometimes they use multiple kinds of sugars to make them appear lower on the ingredients list...

But yeah, privacy policies should be required to include the important bits in a small table, maybe a bit smaller than the Nutrition Facts table on foods.

Doesn't the label have to list the total amount of carbs though? Even if they list the sugars separately the carbs are what you care about anyway.

> Even though only a small fraction of people actually read it, it's still doing its job and its important that it's there.

This philosophy tends to conflict with the fact that privacy policies say "we reserve the right to change the policy unilaterally at any time".

Everywhere in the world, nutrition labels appear to try to summarize in a simple way if a food product is "good" or "bad". Examples: - The European nutriscore : https://en.wikipedia.org/wiki/Nutri-score - The Chilean black labels : https://en.wikipedia.org/wiki/Food_labelling_and_advertising...

There's also lots of new apps like Yuka which try to warn you about bad ingredients. You scan the bar code on a food product then you get some summarized details and warnings.

Maybe there's something to do to make these privacy policies more comprehensible.

This analogy fundamentally falls flat for a simple reason: Labelling is not legally binding.

A privacy policy is a contract. It contains valud actions, outcomes, liabilities and remedies, all the components of a contract. Kindly stop minimizing their importance.

Privacy Policies exist almost exclusively to protect companies from consumers.

Labeling is legally binding but also highly regulated so that labeling protects consumers. The liabilities and remedies are standardized via law.

If privacy policies existed to protect consumers from companies you would probably see more people willing to acknowledge their importance.

Nutritional info is legally required, and you cannot legally misrepresent it, doesn't that make it legally binding?

Nutritional information is information. It is legislated and regulated, but not a contract. The manufacturer has to comply with regulations, but that is not considered a legally binding contract, and failure to comply does not constitute breach of contract. To be clear, just because there's a legal penalty attached for failure to comply does not constitute a contract between the manufacturer and the government.

Similarly, the individual is not bound to any contract to the manufacturer by purchasing a can of beans. They are, on the other hand, when purchasing software. It's a crucial difference.

It's not quite the same to describe something that already exists, as opposed to describing actions that have or have not happened yet (nor will they for the duration of a policy lifespan). Auditing ingredients is _relatively_ trivial to trying to audit the amorphous "privacy" restrictions.

Legally binding for the people writing it, not for the people reading it.

In spirit-of-the-law terms (maybe letter of the law too), I'd argue that privacy policy is not a contract. A contract requires a meeting of minds. It's well-known that privacy policies are rarely read and to most people, incomprehensible or unreadable for simple lack of time in the day. That they are binding contracts is a fiction that the legal system just hasn't seen its way through yet.

There are also a very wide set of laws about things you can't put into food even if you label it, and classes of ingredients that must be called out specifically, like certain food colorings, allergens, and compounds that various high profile genetic abnormalities are affected by (phenolketoneuria for one).

I wonder if there's a Q&A format one could do for legal agreements that still meets muster, or could be legislated as such?

See, now you've got me thinking that there should be some sort of "labelling law" for privacy policies, at least for companies of a certain size. A standard, easy to read summary of the privacy policies of any given software or service. "Yes this app provides your data to third parties", "no, it does not record your location history", etc...

The ingredients list in food is in a common format and short.

Compare that to the massive amount of legalese in these various policies and agreements.

But food labeling is pretty well standardized, you can't just make up your own terms and add ten pages of convoluted circumscriptions and then say that's ok because a professional trained in just the right sub-field of biochemistry could deduce what's in there. If privacy policies were like food labeling nobody would object.

If terms of use and privacy policies were as readable as nutrition labels, that would be a huge win.

Anyone know if there are any existing examples along those lines?

If it were required to add some sort of a non-lawyer readable summary ala the 'Nutrition Facts' labels in the US that would be a big step.

"Privacy Czar's warning: this product sells your data to third parties."