Reading a privacy policy
Why it matters A privacy policy is where a company writes down what it actually does with your data. They are long on purpose, but a few phrases carry most of the meaning. Knowing them lets you read a policy in five minutes instead of an hour.
Reading it like a recipe
You do not read a recipe book cover to cover; you find the recipe, check the ingredients and skip the stories. Do the same with a privacy policy. Look for four sections, whatever they are called:
- What we collect (data types)
- How we use it (purposes)
- Who we share it with (recipients)
- How long we keep it, and your choices
Try it Open any privacy policy, press Ctrl+F (on a Mac, Cmd+F) and search for the words in the table below one by one: partners, share, legitimate, improve, retain. Read only the sentences around each hit.
The phrases that matter
| The policy says | What it can allow in practice |
|---|---|
| "We share data with our partners" | "Partners" can mean a handful of companies or hundreds of ad firms. Look for a list or a link to one. If there is no list, assume it is wide. |
| "Based on our legitimate interest" | The company has decided it can do this without asking you first. On banners, these purposes are often in a separate tab with switches already on. You usually can object, but you must find the switch. |
| "To improve our services" | Very broad. It can cover almost any analysis of what you do, including training systems on your activity. Look for a more specific sentence nearby. |
| "We do not sell your data" | A good sign, but check the sharing section. Data can be shared, or used for ads, without being "sold". |
| "Aggregated" or "de-identified" data | Combined or with names removed. Safer, but detailed records can sometimes be linked back to people, as the fingerprinting module showed. |
| "We may..." | "May" means they allow themselves to; it does not tell you whether they do. |
| "For as long as necessary" | No fixed limit. A good policy gives a time, such as "deleted 30 days after you close your account". |
One phrase, "legitimate interest", comes from data protection rules. This course does not cover law; here we only describe what it means for you in practice.
Signs of a policy you can trust
- Named recipients, or a clear list of categories.
- Specific purposes with specific data.
- Fixed retention times.
- Clear steps to see, download or delete your data.
- Written for people, with short sections and examples.
A common misconception
"Having a privacy policy means a site protects my privacy." A policy describes what happens; it does not promise that what happens is good. A short, honest policy that says "we share with 400 partners" is still sharing with 400 partners.
Recap
- Skim for four things: what is collected, why, who receives it, and for how long.
- "Partners" without a list, "legitimate interest", and "improve our services" are the widest phrases.
- "We do not sell" does not mean "we do not share".
- A policy describes the practice; it does not make it private.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.