Other points that you are mentioning have more to do with user's willingness to take privacy seriously. Most don't take it seriously because a) it's tedious and time-consuming b) they probably don't understand it c) it is easier to trust the company like everyone else and get onto using the app and 4) ... as long as it does not include criminal, financial, health or their telephone records, everything is pretty much a go go for a user.

Users don't care about their privacy unless it has elements of the 4 categories stated above. Users hate hassle and they have pretty much resigned from the fight for privacy mainly because they have found that the benefit of sharing things with others outweighs the willingness to be clear of a trouble that rarely every shows up in their conscience anyway .... think about it ... when was the last time a major security breach occurred that compromised so many millions and devastated so many thousands that it has left a blip or a bad mark on users conscience.

We maybe very techi ... but average users are far more occupied with other concerns. So blind trust plays a strong role for them.

I'm not saying Path is right for what they did, but neither do I think it's the same as publishing everything where identity thieves can get at it. Such black & white thinking is of little use in creating policy.

You should have read them. All those people who got stung by Adjustable Rate Mortgages? Didn't read the terms either.

Now imagine that an app has terms that are a bit like Adjustable Rate Mortgages.

This really is a false comparison. Accessing an address book for the app's use only and accessing the address book for public publishing are so far apart it's ridiculous. Security policies don't mean anything. If data is stored digitally there will always be a way to compromise its security no matter how much encryption, SSL, etc. you use. Security, especially on the web is a total misnomer. All you can really do is make it inconvenient to access.

Trusting a company isn't about their data privacy and security policies. It's about their brand to a large degree. Their track record and other peoples' experiences with the app. I'm in the camp that understands these policies and what they mean but thats not the reason I trust the company behind an app. I trust Google with my docs because they have a good track record. Facebook I trust as a necessary evil. Scratch that, I don't trust Facebook but I use it anyway because I'm banking on the odds. I think that's what it boils down to for most average folks. If the odds are that they'll have no trouble then that's a risk they're willing to take. If there's a breach of security and a bunch of people have their data exposed (but I'm not affected) well that makes me think twice not because of the breach itself but because of all the pile-on press coverage.

I'm one who firmly believes that people don't make their own minds up about this stuff. The average person's view of this whole app uploading address books thing is based purely in whichever side of the manufactured debate is the loudest and seemingly most expert-y. After watching how people use the web, their computers, and their smartphones for some time now I've become really cynical when it comes to this stuff. People don't seem to care until someone writes a blog post that tells them they should care.

But that's the point, isn't it? They shouldn't have to care! People shouldn't have to be security experts to use a phone. The phone should protect them by default and make them have to jump through hoops to waive that protection, rather than the other way around.