To Read All Those Web Privacy Policies, Just Take A Month Off Work

Apr 19, 2012

Internet surfers have long worried that they have insufficient control over their online privacy — despite the privacy policies many people agree to when they visit websites or use online services.

There are data to support the surfers' feelings: Online privacy policies are so cumbersome and onerous that it would take the average person about 250 working hours every year — about 30 full working days — to actually read the privacy policies of the websites they visit in a year, according to an analysis by researchers Aleecia M. McDonald and Lorrie Faith Cranor.

The Federal Trade Commission has recently announced it is exploring whether to give consumers greater control over their online privacy. Online privacy is currently not regulated in the United States. Authorities have encouraged companies to disclose information to users, based on the idea that users will then read the policies and make enlightened decisions about which companies to trust with their information.

But the proliferation of long, onerous and often difficult-to-follow privacy policies has led to a situation where most people consent to privacy policies without reading or understanding them, Cranor says.

"If people were to actually stop and read all of them for every website that they visited, they could spend on the order of 200 to 250 hours a year — about a month of time at work each year that you could spend reading privacy policies," she says. "It's insane."

Privacy policies are so onerous that Cranor's graduate students moan in protest when she asks them to read three policies for class.

Cranor said most Americans do not understand the full extent to which their personal information is being captured and mined.

"When you go into a shopping mall, there's nobody following you around," she says. "Imagine that as you go around your shopping mall, you have someone who is not only looking and commenting — but actually recording everything that you look at, every time you hesitate, every time you remark about something. And then, after you leave the shopping mall, and you go to your dentist's office, you go to the doctor's, you go to pick your kids up from school, they continue to follow you around, and everything is being recorded. I think that is what you have on the Internet."

If people actually were to read the policies placed before them, Cranor says, the total cost — in time alone — would be around $781 billion a year.

Copyright 2018 NPR. To see more, visit http://www.npr.org/.

STEVE INSKEEP, HOST:

Let's talk about online privacy, or the lack of it. Facebook, Google, and many other Internet Services ask you to accept privacy policies, and the other day I had an experience which suggested to me what that might feel like if it happened in my life away from my devices.

(SOUNDBITE OF KNOCKING)

INSKEEP: Hey, Shankar.

I had asked NPR science correspondent Shankar Vedantam into my office. I just wanted to chat. He's an interesting guy, but I was surprised when he showed up at the door with a 35-page stack of paper.

SHANKAR VEDANTAM, BYLINE: I just have this quick privacy policy I'd like you to read over and sign.

INSKEEP: This is like a stack of paper here.

VEDANTAM: Yeah. Yeah. Here's a pen. All you have to do is just sign on the last sheet.

INSKEEP: Okay. Just because you're telling me, I'm gonna sign this, because really, time is short.

VEDANTAM: Thank you so much.

INSKEEP: So I signed it the same way that I click I accept on those endless online privacy policies, and then afterwards Shankar began standing around my office making observations.

VEDANTAM: This is Steve Inskeep, white male, six foot two, latitude 38.901951, desk extremely cluttered, checking some of the emails that have been printed out and laid on the desk next to him.

INSKEEP: Excuse me - excuse me, Shankar, you're kind of invading my space here.

VEDANTAM: We actually talked about that during the privacy policy, Steve, so we're actually all good about that. Nothing to worry about, totally...

INSKEEP: Talked about that during the privacy policy? I don't remember...

VEDANTAM: Yes, this is actually something that we discussed during the privacy policy. His left leg is crossed over his right leg. His screen saver has a picture of what looks like a little girl.

INSKEEP: Yeah, that's my daughter. Thank you very much.

VEDANTAM: Oh, great. OK. That's his daughter.

INSKEEP: OK. Privacy policy or not, out, get out. A little play-acting there. Now Shankar Vedantam is back again. And Shankar, that was a lot more unpleasant than just clicking I accept on an online privacy policy.

VEDANTAM: Well, Steve, what I was trying to illustrate really is that we have very different takes on invasions of our privacy. When there's an actual human being who walks into our space, our homes or our offices, and when that invasion of privacy is being done technologically, that we're much more aware of it when there's a human being compared to when it's being done by technology. And, you know, the analogy I have is when you're driving on the street and you see a cop behind you, it's much easier to pay attention to the cop than it is to pay attention to a traffic camera. And that's because evolutionarily our brains are designed to pay attention to other human beings. Our brains are not designed to pay attention to webcams and cookies and traffic cameras and GPS trackers and Java scripts and all the other ways in which we're being monitored electronically.

INSKEEP: Even though the companies do tell us - I mean, the privacy policy is there. We have to click on something. We know someone's paying attention.

VEDANTAM: That's exactly right. But of course, as you recall, Steve, you just signed this 35-page document that I've placed before you.

INSKEEP: Ah, yes.

VEDANTAM: If you can take a look at page 33 of the policy that I just handed to you, can you read out the last paragraph that's on page 33 of this policy, please?

INSKEEP: If I can find page 33. Last paragraph. I, Steve Inskeep, prevent Shankar Vedantam to track everything I do at NPR. By signing this policy, I explicitly welcome all intrusions into my personal privacy. I signed that.

VEDANTAM: You totally signed it, Steve. Why did you sign it?

INSKEEP: Because you said to, basically. It was too long a read and it's a policy.

VEDANTAM: That's exactly right. So I spoke with this researcher who studies online privacy at Carnegie Mellon University. Her name is Lorrie Cranor. And she had something really interesting to say about the number of online privacy policies that are put before the average person in any given year.

LORRIE CRANOR: If people were to actually stop and read all of them for every website that they visited, they could spend on the order 200, 250 hours a year. It's about a month of time at work each year that you could spend reading privacy policies.

INSKEEP: So my life just got shorter if I'm trying to guard my - and in the end I've got to click I accept anyway or I can't access the site.

VEDANTAM: Yeah, you know, actually, when you think about it, it's really a thing of beauty, Steve, which is if you give people things that are really long and difficult to read, most of them won't bother reading it. And of the people who do bother reading it, because the monitoring is silent and happening via technology, they quickly forget how intrusive it is.

INSKEEP: Is there any doubt that companies go out of their way to make these policies incomprehensible?

VEDANTAM: I have no comment on that, Steve.

INSKEEP: Shankar, drop by any time, without the privacy policy.

VEDANTAM: Sure thing, Steve.

INSKEEP: NPR's science correspondent Shankar Vedantam, who regularly joins us to talk about social science research. And you can track him on Twitter @HiddenBrain. And while you're at it, you can follow this program @MorningEdition and @NPRInskeep. Transcript provided by NPR, Copyright NPR.