Why these documents are hard to read
Privacy policies are written to satisfy legal requirements as much as to inform. They are often long, repetitive and full of terms with specific legal meaning. Few people read them in full, and that is understandable. The good news is that you rarely need to. A targeted skim of a few sections tells you most of what matters.
A policy is also only a statement of what a company says it does. It is not an audit of what it actually does, and policies can change. It is still the best single place to learn what a service says it collects and why.
Where to look first
Most policies follow a similar structure, though headings differ. Look for these parts.
What data is collected. A good policy separates information you give directly (name, email, payment details) from information collected automatically (device data, IP address, usage, location) and from information obtained elsewhere (other companies, public sources). If the policy lists categories you would not expect for the service, such as precise location for a torch app, that is worth noting.
How it is used. Look for reasons connected to running the service, such as delivering orders or preventing fraud, versus reasons like advertising, profiling and “improving products.” The latter can cover a lot of ground.
Who it is shared with. Check whether data goes to service providers who only act on the company’s behalf, or to partners and advertisers who use it for their own purposes. Also look for wording about a sale of the business, where data transfers to a new owner.
How long it is kept. Specific periods are better than “as long as necessary.” Vague retention often means data stays for a long time.
Your choices and rights. This section should explain how to see, correct, download or delete your data, how to opt out of marketing or sharing, and who to contact. Depending on where you live, you may have legal rights that the policy must mention. Check that there is a working contact route, not just a statement of principle.
Security. Statements here are usually general. It is reassuring to see mention of encryption and access controls, but this section rarely proves anything. The article on data breaches explains why even careful companies can be hit.
Changes to the policy. Look at how you will be told about updates. Notice by email is better than “check this page periodically.”
Phrases and what they usually mean
Wording varies, but these terms come up often.
- “Affiliates” or “group companies.” Other businesses under the same ownership. Data may be shared among them.
- “Third parties” or “partners.” Outside companies. Find out whether they are service providers or advertisers.
- “Service providers” or “processors.” Companies that handle data for the business under instructions, such as a cloud hosting firm or payment processor.
- “Legitimate interests.” In some legal systems, a basis a company claims for using data without asking for consent, provided it balances its interests against your rights. You may be able to object.
- “Consent.” You have agreed, ideally by a clear choice. Consent should normally be possible to withdraw.
- “Aggregated” or “de-identified” data. Information with direct identifiers removed or merged into groups. This does not always mean it can never be linked back to a person, particularly with detailed records.
- “Personalisation.” Often a polite word for using your activity to shape content or adverts. See targeted advertising for how that works in practice.
- “Cookies and similar technologies.” Tracking tools in the browser or app, described in the article on tracking cookies.
- “We may share to comply with legal obligations.” Standard language for responding to lawful requests from authorities.
- “Selling” or “sharing” data. The definition varies by law and by company. Some firms avoid the word “sell” while still passing data to advertisers, so read the surrounding sentences.
Signs of a weak or worrying policy
- Very broad purposes, such as “any business purpose.”
- No mention of retention or deletion.
- No contact details or way to make a request.
- Permission to change terms at any time without notice.
- Sharing with unnamed “partners” with no explanation.
- Collection that seems unrelated to the service.
- A policy that is missing altogether, or hard to find.
None of these on its own proves bad intent, but several together suggest you should share less.
A quick routine
When signing up for something new, or revisiting a service you already use:
- Search the page (Ctrl+F or the equivalent on your device) for words like “sell”, “share”, “retain”, “delete” and “advertising”.
- Read those paragraphs only.
- Open the account’s privacy settings, which often matter more than the policy text because they are where you can act.
- Decide whether to provide only the required information, and skip optional fields.
Some apps summarise their data practices on a store listing page. These summaries are helpful, but they are supplied by developers, so they are not independently checked. The permissions an app asks for are also telling, and the guide to app permissions explains how to review them.
Beyond the policy
A policy tells you what a company says about its data. To judge risk, also consider the company’s track record, whether it offers real controls, and whether the service is worth the information it asks for. If a policy leaves you uneasy and the service is optional, using a different one, or none, is a legitimate choice.