Peter Fleischer has a good summary piece on the (miserable) state of online privacy policies today. As he writes:
Today, privacy policies are being written to try to do two contradictory things. Like most things in life, if you try to do two contradictory things at the same time, you end up doing neither well. Here’s the contradiction: should a privacy policy be a short, simple, readable notice that the average end-user could understand? Or should it be a long, detailed, legalistic disclosure document written for regulators? Since average users and expert regulators have different expectations about what should be disclosed, the privacy policies in use today largely disappoint both groups.
(…)
The time has come for a global reflection on what, exactly, a privacy policy should look like. Today, there is no consensus. I don’t just mean consensus amongst regulators and lawyers. My suggestion would be to start by doing some serious user-research, and actually ask Johnny and Jean and Johann.
I entirely, fully, wholeheartedly agree: most policies today are absolute garbage. I actually read a lot of them – and research on social media policies will be online and available soon! – and they are more often than not an elaborate act of obfuscation than something that explains, specifically and precisely, what a service does or is doing with the data that is collected.
The thing is, these policies don’t need to be as bad as they are. It really is possible to bridge ‘accessible’ and ‘legalese’ but doing so takes time, care, and effort.
And fewer lawyers.
As a good example of how this can be done check out how Tunnelbear has written their privacy policy: it’s reasonably accessible and lacks a lot of the ‘weasel phrases’ you’ll find in most privacy policies. Even better, read the company’s Terms of Service document; I cannot express how much ‘win’ is captured in their simultaneously legal and layperson disclosure of how and why their service functions as it does.
Excited Pixels 