Apple’s solution is a strong move in the right direction and sends a powerful message, but is it enough? Ostensibly, it relies on users to get informed about how apps track them and, if they wish to, regulate or turn off the tracking. In the words of Soviet satirists Ilf and Petrov, “The cause of helping the drowning is in the drowning’s own hands.” It’s a system that, historically speaking, has not produced excellent results.
Today’s online consumer is drowning indeed — in the deluge of privacy policies, cookie pop-ups, and various web and app tracking permissions. New regulations just pile more privacy disclosures on, and businesses are mostly happy to oblige. They pass the information burden to the end-user, whose only rational move is to accept blindly because reading through the heaps of information does not make sense rationally, economically, or subjectively. To save that overburdened consumer, we have only one option: Killing the standard privacy notice.
A notice that goes unnoticed
Online businesses and major platforms gear their privacy notices and other relevant data disclosures toward obtaining consent, not toward educating and explaining. It’s a privacy double whammy. To get on the platform, users have to accept the privacy notice. By taking it, they allow tracking and intrusive ads. If they actually read the privacy notice before taking, that costs them valuable time and can be challenging and frustrating.
It’s usually a document created by lawyers, for lawyers without thinking one second about the interests of the actual users. Safe in the knowledge that nobody reads such disclosures, some businesses deliberately fail to make the text understandable and pack it with all kinds of silly or refreshingly honest content.
One company even claimed its users’ immortal souls and their right to eternal life. For consumers, on the other hand, the obligatory checkmark next to the privacy notice can be a nuisance — or it can lull them into a false sense of data security, on the unlikely occasion that a privacy notice is so blatantly disagreeable that it pushes users away from one platform. Toward an alternative, this is often not a real solution, either.
Monetizing data has become the dominant business model online, and personal data ultimately flows toward the same Big Tech giants. Even if you’re not directly on their platforms, many of the media you are on work with Big Tech through plugins, buttons, cookies, and the like. Resistance seems futile.
A regulatory framework from another time
If companies deliberately produce opaque privacy notices that nobody reads, maybe lawmakers and regulators could intervene and help improve users’ data privacy? Historically, this has not been the case. In pre-digital times, lawmakers were responsible for many pre-contractual disclosure mandates that resulted in the heaps of paperwork that accompanied leasing an apartment, buying a car, opening a bank account, or taking out a mortgage.
When it comes to the digital realm, legislation has been reactive, not proactive, and it lags behind technological development considerably. It took the EU about two decades of Google and one decade of Facebook to develop the General Data Protection Regulation, a comprehensive piece of legislation that still does not rein in rampant data collection practices. This is just a symptom of a more significant problem: politicians and legislators do not understand the internet. How do you regulate something if you don’t know how it works?
Many lawmakers on both sides of the Atlantic often do not understand how tech companies operate and how they make their money with user data — or pretend not to understand for various reasons. Instead of tackling the issue themselves, legislators ask companies to inform the users directly, in whatever “clear and comprehensible” language they see fit. It’s part laissez-faire, part “I don’t care.”
Therefore, online businesses and powerful platforms gear their privacy notices and other relevant data disclosures toward obtaining consent, not toward educating and explaining. It keeps the data flowing, making for great PR when the opportunity for a token privacy gesture appears. Still, a growing number of users are waking up to the setup. It is time for a change.
A call to companies to do the right thing
We have seen that it’s difficult for users to understand all the “legalese,” and they have nowhere to go even if they did. We have also noted lawmakers’ inadequate knowledge and motivation to regulate tech properly. It is up to digital businesses to act now that growing numbers of online users are expressing their discontent and frustration. If data privacy is one of our time’s most significant challenges, it requires concerted action. Just like countries worldwide pledged to lower their carbon emissions, enterprises must also band together and commit to protecting their users’ privacy.
So, here’s a plea to tech companies large and small: Kill your legal privacy notices! Don’t write texts that almost no user understands to protect yourselves against potential legal claims so that you can continue collecting private user data. Instead, use privacy notices that are addressed to your users and that everybody can understand.
And don’t stop there — don’t only talk the talk but walk the walk: Develop products that do not rely on collecting and processing personal data. Return to the internet’s open-source protocol roots, and deliver value to your community, not to Big Tech and their advertisers. It is possible, it is profitable, and it is rewarding.