20 Hours a Month Reading Privacy Policies

Barence sends word of research out of Carnegie Mellon University calling for changes in the way Web sites present privacy policies. The researchers, one of whom is an EFF board member, calculated how long it would take the average user to read through the privacy policies of the sites visited in a year. The answer: 200 hours, at a hypothetical cost to the US economy of $365 billion, more than half the financial bailout package. Every year. The researchers propose that, if the industry can't make privacy policies easier to read or skim, then federal intervention may be needed. This resulted in the predictable cry of outrage from online executives. Here's the study (PDF).

Comments

Solution: Standardized policies

[crow]

If there were a few standardized policies that most sites used, then users wouldn't need to read them. Like with software licenses, you don't bother to read the GPL for each time you install software that uses that license.

Re:Solution: Standardized policies

[sakdoctor]

Wasn't that the idea behind P3P

Re:Solution: Standardized policies

[truthsearch]

Creative Commons puts out a variety of licenses that have a simple (human readable) version and a complete (legal) version. A logo or link on a site makes it immediately clear which license is being used. The exact same formula would probably work quite well for privacy policies.

Re:Solution: Standardized policies

[electrictroy]

It's not the FCC job to regulate anything other than over-the-air radio waves (public property).
Software, not being radio, is private and NONE of the government's long-nosed business.

The solution I use is to not bother reading the policies, because I know the companies don't adhere to them. They just sell your info to whoever that want, and do whatever they please (similar to how Bush is eavesdropping on overseas Americans even though he promised he wouldn't). There's no point wasting my time reading a policy that is not enforced.

Re:Solution: Standardized policies

[Stewie241]

True, but you learn about your rights by reading the license. And, by knowing what the license is, you don't have to worry about the question of whether or not you got it legitimately or not.

Re:Solution: Standardized policies

[DriedClexler]

It's not the FCC job to regulate anything other than over-the-air radio waves (public property).
Software, not being radio, is private and NONE of the government's long-nosed business.

Good job. He said FCC (Federal Communications Commission) when he should have said FTC (Federal Trade Commission) and instead of reminding the rest of us what the relevant government agency would be, you took the opportunity to grandstand about his mistake. That really helps the discussion, doesn't it?

Anyway, I have a hard time seeing how this would be overstepping the government's bounds. It's just setting up a template people are free to use, or not, or use with modifications. Government-endorsed behavior (where it pays people to do something), is not the same thing as government-recognized behavior (where it sets a template to ease communication).

The worst that would happen is that it biases people into not trusting those who refuse to simplify their TOS into one of the common templates. Good. People should have distrusted long license agreements in the first place. It's the general tolerance of that kind of BS that has pushed people into accepting as commonplace the atrocious practice of agreeing to something you haven't read ... something that in any other context is evidence of coercion.

Or maybe...

[Aladrin]

Or maybe people shouldn't submit their data to every website they visit. If they care about their privacy, they had better well read the privacy policy.

Companies aren't going to dumb-down their policies and open themselves to lawsuits. They are precise and lengthy for a reason.

In the end it doesn't even matter, though. They all include a clause that lets them change the policy any time they like.

No big deal.

[Mister Whirly]

200 hours? big deal.
Average amount of hours wasted reading Slashdot at work in a year : 5,000,000

Re:No big deal.

[aurb]

It's a good thing we don't read the articles. The number could be much much bigger...

Re:No big deal.

[alexhs]

By my own calculations using your helpful data, it means a slashdotter in average wastes each work hour 2500 times...

Using relativity formulae, I guess we would come close to the speed of light...

Re:No big deal.

[MadCow42]

Actually, the average for Slashdot editors appears to be slightly lower than the general populace... it's the only explanation I can see. :)

MadCow.

Standardization

[FireStormZ]

Some group need to write a half dozen or so policies covering a range of options and publish them under a license which *does not* allow them to be used under the same name if any changes are made.

Who really reads the GPL anymore after you have went through it a few time? the MPL? BSD? If you get somewhere under a dozen options out there you can save *everybody* time..

Re:fp

[ozphx]

Short, sweet and to the point. Fine use of rhetoricals and emphasis on the punchline. This well balanced piece is let down by its brevity and typos, I can't help but feel that Coward rushed this work.

Worth your time. Three and a half stars.

What about television

[iteyoidar]

I would imagine every American loses like, a bujillion hours a month watching TV. That probably costs a lot too.

I'm your browser and I'm here to help.

[SleptThroughClass]

Even better, a tag could tell your browser which standard policy is being used. Tell your browser which policies you want to be accepted, and what action to take for sites with other policies.

This is a very BIG deal!

[tuxgeek]

So, if our time, 200 hrs, is worth $350 billion
And we spend 5,000,000 hrs / year reading slashdot
That means our wasted hours reading slashdot is worth $8,750,000,000,000,000.00

Good God man! If we slashdotters collude on this we can buy the whole planet and kick everyone else off it, or at least charge them rent.

-----

Never underestimate the power of stupid people in large groups

Re:This is a very BIG deal!

[digitig]

So, if our time, 200 hrs, is worth $350 billion

Where do I apply for this $1.75 billion an hour job, reading privacy agreements?

Re:They need another study

[corsec67]

Not even congress reads the laws.

Logicless Leap

[Hercules Peanut]

The researchers propose that, if the industry can't make privacy policies easier to read or skim, then federal intervention may be needed.

Why? Why should I need the federal government to get involved? At what point did I lose the power to choose to simply not use the service. If I don't have time to read the policy, then I can simply say no. It is only at the point that I no longer have a choice and that my rights are threatened that I need the federal government to step in and protect my rights.

How did we become a society of people who believe that the only ones who can solve our problems are the government, worse, the federal government? Have we no self reliance anymore?

Re:fp

[Anonymous Coward]

Fair assessment. Great turnaround time.

Would troll again AAAAAAAAAAAAA++++++++++++++++

Privacy policies aren't legally enforcable anyway

[Aram Fingal]

Back in the Clinton administration, the FTC tried to set a precedent for enforcement of privacy policies with the case of Toysmart.com. Toysmart.com went bankrupt and a judge ruled that they could sell their customer database in violation of their own privacy policy to settle debt. The Clinton administration tried to reverse the decision on appeal but the case went on after Clinton left office and Bush came in.

The Bush administration tried to broker a compromise allowing Toysmart.com to sell their database as long as it was to a company in the same industry. One of the shareholders in Toysmart.com didn't want to be responsible for that decision so he bought the database himself and destroyed it. No precedent was set and the Bush administration hasn't tried to prosecute anyone for violation of privacy policy since.