Inside 1to1:Privacy

Academics, Advocates Call for Privacy "Nutrition" Labels

July 13, 2012

By Sean Lyons

The way Carnegie Mellon University's Lorrie Cranor counts it, if the average American read the privacy policies of every unique website they visited, they would spend more than 200 hours a year struggling through single-spaced details written by lawyers on how those sites use information they gather on users.

And they still wouldn't understand most any of it.

"We need a way to talk to each other and communicate with each other when it comes to privacy online," said Cranor, an associate professor of computer science, engineering and public policy at Carnegie Mellon University. "Right now, it's as if everybody has their own web and consumers are losing out."

Cranor and her team of researchers at Carnegie Mellon's Cylab are part of an ongoing movement by academics, consumer advocates and regulators to get companies to make their online privacy policies more accessible so that consumers can read and understand what a company does with their personal information.

Many call it a movement to create a sort of "nutritional label" for privacy on the Internet.
"The nutritional label is something that people use regularly to compare products," Cranor said. "It wasn't something that everybody was comfortable with in the beginning, but now it's really part of our everyday experience as consumers."

There are numerous prototypes that companies and advocates are experimenting with, from simplified text versions of their policies to games users can work through, such as Zynga's Privacyville.

Cranor and her team have developed a simple chart with rows and columns--think of it as a color-coded Excel spreadsheet--that they say their studies show effectively helps users read and understand a company's privacy policy.

"We put it out there in hopes that it will inspire others to come up with new ideas," Cranor said.

Others have tried to simplify them further, proposing a series of icons to illustrate policies.

"I think that's probably where things are heading," said Dave Deasy, vice president of marketing for TRUSTe, which uses a combination of icons and simplified text for its policy. The policy gets more detailed the more you click through it. "The reality is that consumers are crying out for a more accessible process."

But boiling down what some studies show are policies that weigh in at an average of 2,400 words--about twice the length of the Declaration of Independence--is not an easy task. How companies use and share the information they might collect on users varies widely.

"Data isn't always yes or no," said Julie Martin, a lawyer specializing in intellectual property and the former lead counsel for privacy at Mozilla. "What if you visit a website, do they collect your e-mail? It might depend if you sign up for a newsletter. In that case, yes, but not just by visiting. It might be tough to illustrate all those differences."
Another difficulty in making privacy policies more accessible is that there exists for many companies no real incentive to change how they present their policies.
Joe Andrieu, the founder of Switchbook, a company that allows users to keep track of the data they use and share on the web, said some companies might prefer their users are kept in the dark about their privacy policies while others know that most users will just click "accept" and move on.

"What they don't understand is they are retarding economic activity," Andrieu said. "The economy of the Internet would run more smoothly and more people would be engaging in more types of services because you reduce the fear of potential exposure."

Deasy said that companies are beginning to get the message. Online consumer privacy became an issue in 1997 with the introduction of cookies being left in browsers, Deasy said. A survey conducted by his company a year later found that only about 14 percent of companies online had privacy policies.  

Today, roughly 97 percent of websites have policies. And with the explosion of growth in behavioral marketing and advertising, cloud-based computing and mobile devices, privacy is becoming a central focus for consumers.

"The awareness by consumers has gone way up, and they are ultimately what will drive companies to make their policies more accessible," Deasy said. "Our view is that consumers hold themselves most accountable, and they will demand the information they need, in a way they need it, to make the right choices."

Sean Lyons is a former newspaper journalist whose reporting has won numerous national awards, including the Livingston Award, the largest all-media general reporting prize in the country. He is the lead interviewer for a book and PBS special due out in 2013 examining the legacy of the Kennedy administration.

Read more by Sean Lyons: 
Privacy Concerns Spark Innovations Among Companies, Startups