- What's the deal (mellow music)
with privacy policies?
We've all received a bunch of them lately
because of the new GDPR privacy regulation in Europe,
but what am I supposed to do with all this info?
How do I even begin to process this thing?
Privacy policies are legal documents
that are designed to shield companies from lawsuits.
And because of this most of us
probably don't even read these privacy policies.
If we're being totally honest,
we're also probably going to use these services
regardless of what their privacy policies say anyway.
But you should try to care about your data
because it's not only important to know
who you're giving it to,
in light of the Facebook Cambridge Analytica scandal
and major data breaches like Equifax,
but also because you might find some interesting tools
in these policies that'll give you more control
over your information.
- Privacy policies do have some value.
- That's Joseph Jerome. (energetic spacey music)
He is going to help us learn about privacy policies,
as is Nate Cardozo, the Senior Staff Attorney
at the Electronic Frontier Foundation.
So, before we get into their hot privacy policy tips,
let's first establish who actually has a privacy policy.
It's basically every company.
- You know, when you're signing up
for a loyalty card in your grocery store,
that's a huge data collection point.
- Your grocery store might not seem like the pinnacle
of technological achievement, but if they're collecting
your information, they have to let you know
some parameters around how they use it.
Understanding what's written, though, isn't easy.
- Humans write them with the notion
to not make them clear and readable,
but to make them legally bulletproof.
- Joseph suggests looking for the word control
to find what data settings you can change.
He also looks for bullet points that sum up a policy.
- If a company can't even give you
some high level highlights of what's going on,
that suggests that they probably
aren't as mature in their privacy thinking.
- You can also easily check the date
the privacy policy was published or last updated.
You'll wanna see something relatively recent
to show the company takes privacy seriously.
Finally and crucially, Joseph says we'll wanna figure out
what information is collected about us.
He's skeptical of companies
that collect location information,
even if it's technically stored in the aggregate,
meaning that location data
isn't directly tied to your account.
Basically, he just treats location information
as sensitive and doesn't readily share it.
Nate searches for the phrase such as in the policy,
which is actually a bad thing.
- If a privacy policy uses the term such as,
that means they're collecting all sorts of stuff
and they're not gonna tell you what they're collecting.
- Just out of curiosity,
let's look at some (curious music)
of these privacy policies and try out these tips.
Alright, so let's, of course, (shuffling)
start with Instagram's privacy policy.
One word that Joseph mentioned is the word not.
The reason you wanna search for not
is because companies typically won't put that in,
because that means they cannot do something
and that really limits them.
This is interesting.
It says we will not rent or sell your information
to third parties outside Instagram.
But then it lists a bunch of exceptions,
including giving this information
to third party advertising partners, which is not good,
and that's probably what you're most interested in.
How about trying such as.
There is a such as, there is a such as.
There's five such ases here.
So here we have a such as that means
we also share certain information such as cookie data.
So that means they could be sharing cookie data,
but it also leaves it very open.
It could be other stuff, too.
Nate would not be happy.
Now, what's interesting about Instagram
is they actually have a separate policy
called the Data Policy, and we're gonna check that out.
I am interested in the controls
that Instagram offers, like Joseph mentioned,
so I'm searching control. (tapping)
And immediately, you can see learn more
about how you can control who can see the things you share.
So it brought me to this page on Facebook because Instagram
is owned by Facebook, and I can actually go
to my privacy settings and change them.
And I can actually edit who can see my future posts.
Right now it's public, which is not good.
We can actually make it to friends.
So now only friends will see my future posts.
Go back to this data policy.
This is interesting.
It says facial recognition.
So if I click that, it takes me
straight to this facial recognition settings page,
and it says do you want Facebook to be able
to recognize you in photos and videos?
I'm uncomfortable with that, so I would say no.
A lot of people probably don't know that these pages exist,
so it's actually a nice feature
that Instagram slash Facebook calls your attention to these
if you know what to search for in the data policy.
Again, is any of this (shuffling)
going to make me not use Instagram?
Probably not, because I like Instagram!
But it's good info to have.
Plus, maybe vocal users
can make a difference in company policies.
Alright.
Is there nothing else we can do?
What if I really, really hate this policy?
Keep in mind, you could always say no
to giving a retail store your e-mail or phone number.
You could even ask why they need it.
You could also set up a burner e-mail account
that you only use for spam mail.
That at least segments your online identity a little bit.
Nate also says we can request our data from companies,
because after GDPR was enacted,
they have to give you your data if you request it.
They'll often still give it to you
even if you don't live in Europe.
So now we're privacy policy professionals, sort of.
But honestly, even still, privacy policies are a mess,
and no one wants to spend forever reading them,
except for maybe Joseph and Nate.
Now, this is where things get interesting.
Joseph believes AI will help us eventually
parse through these policies and make sense of them.
- I really hope we can get to what I think
are standardized machine-readable privacy policies.
Long-term, we really need these policies
to be machine readable so they can be digested at scale.
- Nate and the EFF, however, aren't proponents
of these AI-assisted readings.
Nate believes that AI would actually be terrible
and could easily gamed.
Certain phrases like such as and not
would trick the system, which does make sense
given that we're just looking for those phrases too.
Instead, he thinks that privacy policy itself
needs to be solved with more information
on data and how it's used.
"Maybe then," he says, "AI would work."
For now, we're going to just have to use
our brains a little bit and try to understand
what these privacy policies are telling us.
- When advocates, (digital zipping)
or researchers, or even the general public,
reads something in a privacy policy
that is alarming to them, that has a way
of trickling upward to companies.
And a lot of the stories that we read about
that are like what is this company doing,
that usually is first revealed through some sort
of public statement they've made,
oftentimes in their privacy policy.