 What's the deal with privacy policies? We've all received a bunch of them lately because of the new GDPR privacy regulation in Europe, but what am I supposed to do with all this info? How do I even begin to process this thing? Privacy policies are legal documents that are designed to shield companies from lawsuits. And because of this, most of us probably don't even read these privacy policies. If we're being totally honest, we're also probably going to use these services regardless of what their privacy policies say anyway. But you should try to care about your data because it's not only important to know who you're giving it to in light of the Facebook Cambridge Analytica scandal and major data reaches like Equifax, but also because you might find some interesting tools in these policies that'll give you more control over your information. Privacy policies do have some value. That's Joseph Jerome. He's going to help us learn about privacy policies. As is Nate Cardozo, the senior staff attorney at the Electronic Frontier Foundation. So before we get into their hot privacy policy tips, let's first establish who actually has a privacy policy. It's basically every company. You know, when you're signing up for a loyalty card in your grocery store, that's a huge data collection point. Your grocery store might not seem like the pinnacle of technological achievement, but if they're collecting your information, they have to let you know some parameters around how they use it. Understanding what's written, though, isn't easy. Humans write them with the notion to not make them clear and readable, but to make them legally bulletproof. Joseph suggests looking for the word control to find what data settings you can change. He also looks for bullet points that sum up a policy. A company can't even give you some high-level highlights of what's going on that suggests that they probably aren't as mature in their privacy thinking. You can also easily check the date the privacy policy was published or last updated. You'll want to see something relatively recent to show the company takes privacy seriously. Finally, and crucially, Joseph says we'll want to figure out what information is collected about us. He's skeptical of companies that collect location information even if it's technically stored in the aggregate, meaning that location data isn't directly tied to your account. Basically, he just treats location information as sensitive and doesn't readily share it. Nate searches for the phrase such as in the policy, which is actually a bad thing. If a privacy policy uses the terms such as, that means they're collecting all sorts of stuff and they're not going to tell you what they're collecting. Just out of curiosity, let's look at some of these privacy policies and try out these tips. Alright, so let's of course start with Instagram's privacy policy. One word that Joseph mentioned is the word not. The reason you want to search for not is because companies typically won't put that in because that means they cannot do something and that really limits them. This is interesting. It says, we will not rent or sell your information to third parties outside Instagram. But then it lists a bunch of exceptions including giving this information to third party advertising partners, which is not good and that's probably what you're most interested in. How about trying such as? There's a such as, there's such as, there's five such ases here. So here we have a such as that means we also share certain information such as cookie data. So that means they could be sharing cookie data but it also leaves it very open. It could be other stuff too. Nate would not be happy. Now, what's interesting about Instagram is they actually have a separate policy called the data policy. We're going to check that out. I'm interested in the controls that Instagram offers like Joseph mentioned. So I'm searching control and immediately you can see learn more about how you can control who can see the things you share. So it brought me to this page on Facebook because Instagram is owned by Facebook. And I can actually go to my privacy settings and change them and I can actually edit who can see my future posts. Right now it's public, which is not good. We can actually make it to friends. So now only friends will see my future posts. Go back to this data policy. This is interesting. It says facial recognition. So if I click that it takes me straight to this facial recognition settings page and says, do you want Facebook to be able to recognize you in photos and videos? I'm uncomfortable with that. So I would say no. A lot of people probably don't know that these pages exist. So it's actually a nice feature that Instagram slash Facebook calls your attention to these if you know what to search for in the data policy. Again, is any of this going to make me not use Instagram? Probably not because I like Instagram, but it's good info to have. Plus maybe vocal users can make a difference in company policies. All right. Is there nothing else we can do? What if I really, really hate this policy? Keep in mind, you can always say no to giving a retail store your email or phone number. You can even ask why they need it. You could also set up a burner email account that you only use for spam mail. That at least segments your online identity a little bit. Nate also says we can request our data from companies because after GDPR was enacted, they have to give you your data if you request it. They'll often still give it to you even if you don't live in Europe. So now we're privacy policy professionals, sort of. But honestly, even still, privacy policies are a mess and no one wants to spend forever reading them, except for maybe Joseph and Nate. Now, this is where things get interesting. Joseph believes AI will help us eventually parse through these policies and make sense of them. I really hope we can get to what I think are standardized machine-readable privacy policies. Long term, we really need these policies to be machine-readable so they can be digested at scale. Nate and the EFF, however, aren't proponents of these AI-assisted readings. Nate believes that AI would actually be terrible and could easily be gamed. Certain phrases like such as and not would trick the system, which does make sense given that Wordge is looking for those phrases too. Instead, he thinks the privacy policy itself needs to be solved with more information on data and how it's used. Maybe then, he says, AI would work. For now, we're going to just have to use our brains a little bit and try to understand what these privacy policies are telling us. When advocates or researchers or even the general public read something in a privacy policy that is alarming to them, that has a way of trickling upward to companies. And a lot of the stories that we read about that are like, what is this company doing? That usually is first revealed through some sort of public statement they made, oftentimes in their privacy policy.
 What's the deal with privacy policies?
 We've all received a bunch of them lately because of the new GDPR privacy regulation in Europe,
 but what am I supposed to do with all this info?
 How do I even begin to process this thing?
 Privacy policies are legal documents that are designed to shield companies from lawsuits.
 And because of this, most of us probably don't even read these privacy policies.
 If we're being totally honest, we're also probably going to use these services
 regardless of what their privacy policies say anyway.
 But you should try to care about your data because it's not only important to know who you're giving it to
 in light of the Facebook Cambridge Analytica scandal and major data reaches like Equifax,
 but also because you might find some interesting tools in these policies
 that'll give you more control over your information.
 Privacy policies do have some value.
 That's Joseph Jerome. He's going to help us learn about privacy policies.
 As is Nate Cardozo, the senior staff attorney at the Electronic Frontier Foundation.
 So before we get into their hot privacy policy tips,
 let's first establish who actually has a privacy policy.
 It's basically every company.
 You know, when you're signing up for a loyalty card in your grocery store,
 that's a huge data collection point.
 Your grocery store might not seem like the pinnacle of technological achievement,
 but if they're collecting your information, they have to let you know some parameters around how they use it.
 Understanding what's written, though, isn't easy.
 Humans write them with the notion to not make them clear and readable,
 but to make them legally bulletproof.
 Joseph suggests looking for the word control to find what data settings you can change.
 He also looks for bullet points that sum up a policy.
 A company can't even give you some high-level highlights of what's going on
 that suggests that they probably aren't as mature in their privacy thinking.
 You can also easily check the date the privacy policy was published or last updated.
 You'll want to see something relatively recent to show the company takes privacy seriously.
 Finally, and crucially, Joseph says we'll want to figure out what information is collected about us.
 He's skeptical of companies that collect location information even if it's technically stored in the aggregate,
 meaning that location data isn't directly tied to your account.
 Basically, he just treats location information as sensitive and doesn't readily share it.
 Nate searches for the phrase such as in the policy, which is actually a bad thing.
 If a privacy policy uses the terms such as, that means they're collecting all sorts of stuff
 and they're not going to tell you what they're collecting.
 Just out of curiosity, let's look at some of these privacy policies and try out these tips.
 Alright, so let's of course start with Instagram's privacy policy.
 One word that Joseph mentioned is the word not.
 The reason you want to search for not is because companies typically won't put that in
 because that means they cannot do something and that really limits them.
 This is interesting. It says, we will not rent or sell your information to third parties outside Instagram.
 But then it lists a bunch of exceptions including giving this information to third party advertising partners,
 which is not good and that's probably what you're most interested in.
 How about trying such as?
 There's a such as, there's such as, there's five such ases here.
 So here we have a such as that means we also share certain information such as cookie data.
 So that means they could be sharing cookie data but it also leaves it very open.
 It could be other stuff too.
 Nate would not be happy.
 Now, what's interesting about Instagram is they actually have a separate policy called the data policy.
 We're going to check that out.
 I'm interested in the controls that Instagram offers like Joseph mentioned.
 So I'm searching control and immediately you can see learn more about how you can control who can see the things you share.
 So it brought me to this page on Facebook because Instagram is owned by Facebook.
 And I can actually go to my privacy settings and change them and I can actually edit who can see my future posts.
 Right now it's public, which is not good.
 We can actually make it to friends.
 So now only friends will see my future posts.
 Go back to this data policy.
 This is interesting. It says facial recognition.
 So if I click that it takes me straight to this facial recognition settings page and says,
 do you want Facebook to be able to recognize you in photos and videos?
 I'm uncomfortable with that. So I would say no.
 A lot of people probably don't know that these pages exist.
 So it's actually a nice feature that Instagram slash Facebook calls your attention to these if you know what to search for in the data policy.
 Again, is any of this going to make me not use Instagram?
 Probably not because I like Instagram, but it's good info to have.
 Plus maybe vocal users can make a difference in company policies.
 All right. Is there nothing else we can do?
 What if I really, really hate this policy?
 Keep in mind, you can always say no to giving a retail store your email or phone number.
 You can even ask why they need it.
 You could also set up a burner email account that you only use for spam mail.
 That at least segments your online identity a little bit.
 Nate also says we can request our data from companies because after GDPR was enacted,
 they have to give you your data if you request it.
 They'll often still give it to you even if you don't live in Europe.
 So now we're privacy policy professionals, sort of.
 But honestly, even still, privacy policies are a mess and no one wants to spend forever reading them,
 except for maybe Joseph and Nate.
 Now, this is where things get interesting.
 Joseph believes AI will help us eventually parse through these policies and make sense of them.
 I really hope we can get to what I think are standardized machine-readable privacy policies.
 Long term, we really need these policies to be machine-readable so they can be digested at scale.
 Nate and the EFF, however, aren't proponents of these AI-assisted readings.
 Nate believes that AI would actually be terrible and could easily be gamed.
 Certain phrases like such as and not would trick the system,
 which does make sense given that Wordge is looking for those phrases too.
 Instead, he thinks the privacy policy itself needs to be solved with more information on data and how it's used.
 Maybe then, he says, AI would work.
 For now, we're going to just have to use our brains a little bit
 and try to understand what these privacy policies are telling us.
 When advocates or researchers or even the general public read something in a privacy policy that is alarming to them,
 that has a way of trickling upward to companies.
 And a lot of the stories that we read about that are like, what is this company doing?
 That usually is first revealed through some sort of public statement they made, oftentimes in their privacy policy.