15 Top Privacy Policies, Analyzed

Written by Steven Walling / July 23, 2009 2:00 PM / 7 Comments

We all know no one reads privacy policies. What do the top websites really include in them? In its mission to get anonymous public data, The Common Data Project a New York City-based non-profit, is on a mission to eliminate the barriers that privacy policies pose.

In a new report, they analyzed ten of the most popular Web properties on the Internet, and several more emerging ones. Here's how what they put in their policies affects your privacy, and how other enterprises can imitate their best practices.

Regardless of any similarities or differences within policies, one thing is absolutely clear: tons of data is being collected about you, though some of it may already be incidental enough to be private (such as the popularity of search terms).

Privacy is certainly not an issue limited to the Web, but it facilitates the nearly limitless ability to gather data by the boatload. The question at this point isn't if companies will acquire your data. It's what they'll do with it.

Policies Analyzed

The 15 privacy policies studied encompasses both some of the biggest online portals and retailers, non-profits, and scrappy startups. The full list includes: Google, Yahoo!, Wikipedia, Microsoft, AOL, Amazon, eBay, Facebook, Craigslist, Photobucket, NYT, WebMD, Ask, Cuil, and Ixquick.

Common Themes

Out of the analysis, Common Data Project asked seven pointed questions about what companies will or won't do. Here are some of the red flags found in existing privacy policies.

Private Data Not Covered By Policy
Yes, that's right. In some policies, there is data collected through sites and services but not covered within the legal terms of any binding privacy policy. An example of this is the way third party advertisers will handle your data. In other words, any data collected by outside advertisers on a particular site isn't protected.

Vague Definitions
Many top websites do a poor job of defining just what is and is not personal information. Even data crucial to legal matters, such as IP addresses, may not be included under their particular description.

Data Retention
Some of the biggest changes to privacy policies in the last year or so have been in how data is retained. Yahoo! and Google do not promise to delete your data at any time, even if you delete an account, but will anonymize it after several months.

It may not be much of a surprise from a business perspective, since giving up even anonymous data would be a huge loss to companies built around manipulating and presenting information. But crystal clear understandings of just how your data will be made anonymous is key.

Consumer Choice
One of the most promising areas that is still developing is options for users in data collection and privacy. As one example, Google now allows you to specify what kind of interests are associated with you, and thus what ads you're presented with. This both improves their business and increases your control over what is identified with you while using Google products.

Reasonable Expectations

The Common Data Project asserts in their conclusion that users should never be expected to actually read privacy policies. Considering that no one does at this point, it's not exactly a mind-blowing observation.

But for businesses, this presents the challenge of anticipating what people will accept from privacy policies. If no one pays attention to these policies, how can we expect them to comply with norms for how private information is handled?

1 TrackBacks

TrackBack URL for this entry: http://www.readwriteweb.com/cgi-bin/mt/mt-tb.cgi/12256

Percocet withdrawal symptoms. from Adrenaline levels after percocet.

Comments

Subscribe to comments for this post OR Subscribe to comments for all ReadWriteEnterprise posts

I have been working on privacy polices lately and it's funny (law of attraction) that I see this post in my Google Reader.

You know how they have those "hidden on the Intenet" games? I think the smart thing would be to start with the PP's and the TOS's. NEVER READ..

I plan on putting some cool SHITE in mine. People that click on it will be in for a surprise....

Posted by: Jim | July 23, 2009 8:31 PM

Steven, it's tough blogging on this topic, isn't it? If you additionally consider IP rights (which are more generally dealt with in the Terms of Use) to User generated content, it seems clear that Users are giving away their rights piecemeal to a number of companies.

As companies obtain perpetual, non-exclusive royalty-free licenses to User IP, there is less incentive for other companies to obtain the same IP. As this occurs, we'll see "free" offerings diminish, as companies attend to other markets that haven't been "tapped."

Posted by: Kenneth Stein | July 23, 2009 10:39 PM

Here's another comparison of privacy policies, in this case the top 10 ad networks, who of course collect quite a bit of behavioral information across different websites:

http://www.privacychoice.net/site/TopTenAdNetworks

Posted by: Jim | July 24, 2009 9:27 AM

Within and information based economy data is a proxy for currency. It has monetary value. The key point to realize is that the value of your data, attention, opinions (your currency) exceeds the value of the web services you consume (or else an advertising funded service would financially collapse). The problem is you (as an individual) cannot calculate that value. In addition you have no mechanism to realize that value in the marketplace. This is why an advertising funded search engine like Google has such a healthy business - they have huge margins because of their relatively low operational costs and their raw material costs are effectively $0.

Let’s take a closer look at a popular search engine. You give this search engine company digital inventory "keywords" (+ other data) which they in turn sell to the market of advertisers. You barter your keywords for their search services which searches a small portion of the total internet (say 20%). In economic terms you freely exchange the opportunity cost of selling your own data in exchange for their search service. But what is the value of your keywords? What is the value of the information you are giving away? What is the value of your attention? This is hard to be precise about but let’s take a try at it for USA consumers. If you divide the search engine’s annual revenue in USA by their US based visitor population you get a figure of approximately $250/person/year. (Last time I did the analyses- probably less now due to the economic downturn)

Is putting your privacy at risk and getting search services that only cover 1/5 of the internet worth $250/year? Is this a fair price for search services in a competitive environment with many other search companies in the marketplace?

The truth is that bartering content or services for your attention and information (advertising funded business) is an outmoded business model based on a one way network. This model entices consumers with the prospect of receiving “free” service. The audience is also conditioned by 90 years of analog based business models of newspaper, TV,RADIO, Direct mail that technically were unable to enable them to realize the value of their attention, information and opinions. The internet is a new interactive network being monetized with an old inefficient analog business model. However, it is inefficient for the consumer – it is great business for some large companies.

My colleagues and I started www.KindClicks.com to enable all people to make their information their business. Our mission is to give the internet back to the people by helping them aggregate their collective purchase power and realize as individuals the value of their online presence without exposing themselves to privacy risk. We want to define a more equitable exchange of value for consumers and bring greater efficiency to all commercial communications. If you want to realize the value of your privacy as an individual - or reduce marketing inefficiency as a business we would greatly appreciate your show your support by registering for our service.

Posted by: Frank | July 24, 2009 10:08 AM

2254190

Posted by: shamsher | July 25, 2009 2:31 AM

Hello,

One aspect should not be forgotten : whereas I agree with something I read on this page, meaning that people should not be supposed to read any privacy policy at all, some firms tend to include clauses as "you are supposed to have read and accepted our privacy policies, but never forget they can change at any moment, including while you are reading them, and the only way you have to know they changed is to download them again".

If that is not explicitly laughing at the reader ...

Posted by: John | July 25, 2009 6:59 AM