Privacy policies are useful governance documents, but users should be protected regardless of what a tech company's policies say or how long or clear they are
Woodrow Hartzog / Medium :
Context & Ripple Effects
Woodrow Hartzog's argument lands in the middle of a running fight over whether notice-and-consent can carry privacy governance at all. His claim that users deserve protection regardless of a policy's length or clarity directly targets the disclosure model, and the later Washington Post coverage makes the same move — arguing laws and technology should deliver real choices instead of expecting anyone to read overwhelming terms (laws and tech giving users real privacy choices).
The counterposition is already on record in this corpus: Techdirt argues current regulation is flawed because it treats privacy as something to protect rather than a trade-off for benefits (privacy as a trade-off rather than a thing to protect), and Stratechery warns that 'privacy fundamentalism' ignores the internet's inherent trade-offs. Hartzog's piece matters because it stakes out the duty-based side of that split — and Apple's Siri practices show why policy text alone is a weak guarantee.
First-order effects
- Companies like Apple, whose billboard privacy doctrine sits uneasily beside its failure to give Siri users clear data control (Siri users' lack of clear data control), can no longer treat a well-drafted policy as the compliance endpoint — the argument shifts scrutiny from what the document says to what the product does.
- Regulators and courts that use policy disclosure as the benchmark for fair practice face pressure to judge conduct independently of what the terms say.
Second-order effects
- Ad-funded platforms such as Facebook and Google, whose human-rights commitments are already hamstrung by growth-focused ad models, lose consent as a legitimacy shield — if protection doesn't depend on agreement, their data-collection economics absorb the risk directly.
- The trade-off camp (Techdirt, Stratechery) is forced to answer with an affirmative alternative, since 'users shouldn't have to read' and 'privacy is a trade-off' both reject the status quo policy regime from opposite directions.
Third-order effects
- If the pattern holds, privacy law migrates from notice-and-consent toward duties that attach to companies regardless of disclosure — with the unresolved question being whether those duties are fiduciary-style obligations or the benefit-trade-off framing the critics prefer.
- Policy documents get repositioned as governance artifacts for regulators and auditors rather than as the mechanism that legitimizes data use, changing what 'compliance' even means for platform operators.
The trend: Privacy governance is shifting from a disclosure-and-consent regime, where the policy document carries the legal weight, toward protections that bind companies regardless of what their terms say.