Apple’s solution is a strong move in the right direction and sends a powerful message, but is it enough? Ostensibly, it relies on users to get informed about how apps track them and, if they wish to, regulate or turn off the tracking. It’s a system that, historically speaking, has not produced excellent results. In the words of Soviet satirists Ilf and Petrov, “The cause of helping the drowning is in the drowning’s own hands.”
Today’s online consumer is drowning in the deluge of privacy policies, cookie pop-ups, and various web and app tracking permissions. New regulations pile more privacy disclosures, and businesses are happy to oblige. They pass the information burden to the end-user, whose only rational move is to accept blindly because reading through the heaps of information does not make sense rationally, economically, or subjectively. We have only one option to save that overburdened consumer: Killing the legal privacy notice.
A notice that goes unnoticed
Studies show that online consumers often struggle with standard-form notices. Most online users expect that if a company has published a document titled “privacy notice” or “privacy policy” on its website, it will not collect, analyze, or share their personal information with third parties. At the same time, most consumers have serious concerns about being tracked and targeted for intrusive advertising.
It’s a privacy double whammy. Online businesses and major platforms gear privacy notices and other relevant data disclosures toward obtaining consent, not educating and explaining. To get on the platform, users have to accept the privacy notice. By taking it, they allow tracking and intrusive ads. If they read the privacy notice before taking it, it costs them valuable time and can be challenging and frustrating.
If Facebook’s privacy policy is as hard to comprehend as German philosopher Immanuel Kant’s “Critique of Pure Reason,” we have a problem. Ultimately, the option to decline is merely a formality; not accepting the privacy policy means not getting access to the platform. So, what use is the privacy notice in its current form? For companies, on the one hand, it legitimizes their data-processing practices.
It’s usually a document created by lawyers, for lawyers, without thinking one second about the interests of the actual users. Safe in knowing nobody reads such disclosures, some businesses deliberately fail to make the text understandable and pack it with silly or refreshingly honest content.
One company even claimed its users’ immortal souls and right to eternal life. For consumers, on the other hand, the obligatory checkmark next to the privacy notice can be a nuisance — or it can lull them into a false sense of data security on the unlikely occasion that a privacy notice is so blatantly disagreeable that it pushes users away from one platform. An alternative, this is often not a real solution, either.
Monetizing data has become the dominant business model online, and personal data ultimately flows toward the same Big Tech giants. Even if you’re not directly on their platforms, many of the media you are on work with Big Tech through plugins, buttons, cookies, and the like. Resistance seems futile.
A regulatory framework from another time
If companies deliberately produce opaque privacy notices nobody reads, maybe lawmakers and regulators could intervene and help improve users’ data privacy. Historically, this has not been the case. In pre-digital times, lawmakers were responsible for many pre-contractual disclosure mandates that resulted in the heaps of paperwork that accompanied leasing an apartment, buying a car, opening a bank account, or taking out a mortgage.
Regarding the digital realm, legislation has been reactive, not proactive, and it lags considerably behind technological development. It took the EU about two decades of Google and one decade of Facebook to develop the General Data Protection Regulation, a comprehensive piece of legislation that still does not rein in rampant data collection practices. This is a symptom of a more significant problem: politicians and legislators do not understand the Internet. How do you regulate something if you don’t know how it works?
Many lawmakers on both sides of the Atlantic often do not understand how tech companies operate and how they make their money with user data — or pretend not to understand for various reasons. Instead of tackling the issue themselves, legislators ask companies to inform the users in whatever “clear and comprehensible” language they see fit. It’s part laissez-faire, part “I don’t care.”
Thanks to this attitude, we are fighting 21st-century challenges — such as online data privacy, profiling, and digital identity theft — with the legal logic of Ancient Rome: consent. Not to knock Roman law, but Marcus Aurelius never fully read the iTunes Privacy Policy.
Therefore, online businesses and powerful platforms gear privacy notices and other relevant data disclosures toward obtaining consent, not educating and explaining. It keeps the data flowing, making for great PR when the opportunity for a token privacy gesture appears. Still, a growing number of users are waking up to the setup. It is time for a change.
A call to companies to do the right thing
We have seen that it’s difficult for users to understand all the “legalese,” and they have nowhere to go even if they did. We have also noted lawmakers’ inadequate knowledge and motivation to regulate tech properly. It is up to digital businesses to act now that growing numbers of online users express their discontent and frustration. If data privacy is one of our time’s most significant challenges, it requires concerted action. Like countries worldwide pledged to lower carbon emissions, enterprises must band together and commit to protecting their users’ privacy.
So, here’s a plea to tech companies large and small: Kill your legal privacy notices! Don’t write texts that almost no user understands to protect yourselves against potential legal claims so that you can continue collecting private user data. Instead, use privacy notices that are addressed to your users and that everybody can understand.
And don’t stop there — don’t only talk the talk but walk the walk: Develop products that do not rely on collecting and processing personal data. Please return to the internet’s open-source protocol roots, and deliver value to your community, not Big Tech and its advertisers. It is possible, it is profitable, and it is rewarding.
