A Comparative Study of Online Privacy Policies and Formats

Abstract

Abstract. Online privacy policies are difficult to understand. Most privacy policies require a college reading level and an ability to decode legalistic, confusing, or jargon-laden phrases. Privacy researchers and industry groups have devised several standardized privacy policy formats to address these issues and help people compare policies. We evaluated three formats in this paper: layered policies, which present a short form with standardized components in addition to a full policy; the Privacy Finder privacy report, which standardizes the text descriptions of privacy practices in a brief bulleted format; and conventional non-standardized human-readable policies. We contrasted six companies' policies, deliberately selected to span the range from unusually readable to challenging. Based on the results of our online study of 749 Internet users, we found participants were not able to reliably understand company's privacy practices with any of the formats. Compared to natural language, participants were faster with standardized formats but at the expense of accuracy for layered policies. Privacy finder formats supported accuracy more than natural language for harder questions. Improved readability scores did not translate to improved performance. All formats and policies were similarly disliked. We discuss our findings as well as public policy implications.

Understanding Privacy Policies: Content, Self-Regulation, and Markets

“…48 It has been estimated that the average individual would need 201 hours a year to read all the privacy policies of the sites she visited. 49 It is thus not surprising that people don't read them. 50 Early evidence suggests that companies have also failed to adopt FIPs.…”

“…The 261 sample firms' policies are drawn from seven online markets where consumers often share personal or sensitive information: adult (17 firms), cloud computing (28), dating (40), gaming (20), news and reviews (18), social networks (89), and special interest message boards (49). These are markets where information sharing is relatively more salient than in others where information sharing is a secondary aspect of """"""""""""""""""""""""""""""""""""""""""""""""""""""""…”

Designing Evidence‐based Disclosures: A Case Study of Financial Privacy Notices

“…Furthermore, consumers spend only about one‐fifth of the estimated required reading time when they do read notices (Grossklags and Good 2007; Kay and Terry 2009). Shorter summaries of information or layered notices get mixed results (Good et al 2005; McDonald et al 2009; Proctor, Ali, and Vu 2008). Standardization may help consumers transfer learning and make comparisons (McDonald et al 2009); research on a standardized privacy “label” showed improvements in consumers finding and understanding information and easily comparing policies (Kelley et al 2009a, 2009b).…”

“…Shorter summaries of information or layered notices get mixed results (Good et al 2005; McDonald et al 2009; Proctor, Ali, and Vu 2008). Standardization may help consumers transfer learning and make comparisons (McDonald et al 2009); research on a standardized privacy “label” showed improvements in consumers finding and understanding information and easily comparing policies (Kelley et al 2009a, 2009b). Finally, risk perception and factors such as consumers' perceived self‐efficacy, age, perceived threat, overall concern about privacy and general overall readability of the notice are related to the probability that consumers will read online privacy notices (McDonald et al 2009; Milne, Culnan, and Greene 2006; Milne, Labrecque, and Cromer 2009; Milne, Rohm, and Bahl 2004).…”

Poli-see

“…However, fifteen years of critiques have provided compelling evidence that current privacy policies fail to adequately implement informed consent. People do not read privacy policies [2,14,23], the number of policies and frequency of updates make it infeasible to keep up to date [4,17], and policies are difficult to understand [18,22,25]. To address these problems, alternate representations of privacy policies have been designed [15,19,27,29].…”