Joseph Turow Wants to Retire the Phrase ‘Privacy Policy’

By TAP Staff Blogger

Posted on August 29, 2018


Privacy Policy: “People assume it means their information will be kept private. Nothing could be further from the truth.” – Joseph Turow, Professor of Communication at the University of Pennsylvania's Annenberg School for Communication.


In an opinion piece he wrote for The New York Times, University of Pennsylvania communications professor Joseph Turow shares his research over the past 15 years about how people think about their privacy in the online and offline worlds.


In conducting six national surveys, Professor Turow and his colleagues have included a statement such as, “When a website has a privacy policy, it means the site will not share my information with other websites or companies without my permission.” Their findings consistently showed that “When people see the phrase “privacy policy,” most assume their information is kept private.”


In “Let’s Retire the Phrase ‘Privacy Policy’,” Professor Turow stresses that “privacy policy” is “a misleading label. In reality, these policies explain how companies will use your information — because they are using it.”


Below are a few excerpts from “Let’s Retire the Phrase ‘Privacy Policy’.”


The FTC Prompted Disclosure about How Companies Use Customer Data

To be clear, it is lawful — and common — for websites to trade most types of information about us without asking. The reason “privacy policy” is a ubiquitous phrase is that since 1998, the Federal Trade Commission has strongly suggested that all websites (and, later, all apps) include a disclosure about what they do with visitor data and what choices visitors have regarding those uses. What lies behind these links is a cavalcade of disclosures of how businesses across the internet track us, target us and trade our information.


Example: Target’s Privacy Policy

Consider Target’s privacy policy, which is perfectly legal and not at all unusual. Target collects data about you across its website and app, in addition to knowing what you buy. It uses the information for its own marketing purposes. It also allows “third-party companies” to collect “certain information when you visit our websites or use our mobile applications.” In other words, it can share the data it collects with just about anyone.


But Target is not just profiling you based on how you shop with Target. It may also collect what you say on any blogs, chat rooms and social networks you use, and it may obtain “demographic and other information” about you from “third parties.”


You have to assume that Target can purchase any known information about you held by any other company. Not even your body is off limits — cameras in some stores “may use biometrics, including facial recognition,” for theft prevention and security.


How ‘Privacy Policy’ Mis-Directs Understanding of Privacy Law

In addition to the “privacy policy” label defusing public anger against commercial surveillance, it may also distract people from the need for effective privacy laws. Two of our surveys asked people whether they agreed or disagreed that “existing laws and organizational practices provide a reasonable level of protection for consumer privacy today.”


We found that among people who understood the “privacy policy” label’s correct meaning, a majority thought privacy laws needed to be stronger. By contrast, among those who misunderstood what “privacy policy” means, a majority saw no need for organizational and legislative changes in the service of privacy.


Possible Solution

One solution would be for the F.T.C., which is mandated to police deceptive corporate practices, to rule that only sites and apps that don’t share people’s information without their permission can use that phrase. Otherwise, they should use a more accurate label, such as “how we use your information.”


Companies don’t want people to realize how extensively they use our information and are likely to object to this new, clearer phrasing. Yet it is a struggle worth pursuing in the interest of creating transparency around the name of a document that has been mistitled and misunderstood since its inception.


Read the full article: “Let’s Retire the Phrase ‘Privacy Policy’.”


Joseph Turow is the Robert Lewis Shayon Professor of Communication at the University of Pennsylvania's Annenberg School for Communication. He is also the Associate Dean for Graduate Studies. His research focuses on digital cultural industries, especially at the intersection of the Internet, marketing, and society, as well as studies on database marketing, media and privacy, digital out-of-home media, the process of innovation in the mass media, and the relationship between media and the medical system.