Rather than expecting users to read and consent to overwhelming privacy policies, laws and tech can help give them real privacy choices
Let's abolish reading privacy policies. Here's how we can use the law and technology to give us real privacy choices. Tweets: @oldenoughtosay , @geoffreyfowler , @geoffreyfowler , @washingtonpost , @moylato , @asmartbear , @rachaelmyrow , and @geoffreyfowler Tweets: Madeline Odent / @oldenoughtosay : shout out to Barclays who update their app policy, literally, I've counted, an average of once every four days https://twitter.com/... Geoffrey A. Fowler / @geoffreyfowler : New @washingtonpost: I tried to read all my app privacy policies. It was 1 million words! It's too hard to keep up with digital privacy, and it's not your fault. So let's abolish privacy policies. Here's some good ideas to give us real privacy choices: https://www.washingtonpost.com/ ... https://twitter.com/... Geoffrey A. Fowler / @geoffreyfowler : @washingtonpost How long would it take you to actually read the privacy policies for the apps on your phone? We made this little widget @washingtonpost to help you estimate. The point is: Privacy policies aren't protecting anyone except corporations and lawyers. https://www.washingtonpost.com/ ... https://twitter.com/... @washingtonpost : “We the users shouldn't be expected to read and consent to privacy policies. Instead, let's use the law and technology to give us real privacy choices,” writes tech columnist Geoffrey Fowler. https://www.washingtonpost.com/ ... Tom Moylan / @moylato : For the past decade or so, one idea has dominated efforts to fix privacy policies: Make them simpler. But understandability isn't our biggest privacy problem. Being overwhelmed is. https://www.washingtonpost.com/ ... Jason Cohen / @asmartbear : We've all complained that no one reads the EULA or privacy policy, but we all still click “I agree.” A lie on our part, therefore essentially a lie from vendors that “we have everyone's permission.” https://www.washingtonpost.com/ ... Rachael Myrow / @rachaelmyrow : When you're presented with an “agree” button, you can't negotiate terms. You might be giving permission to mine your tax return. Or sharing data that will be used to discriminate against you in job applications or buying a home. 👀 https://www.washingtonpost.com/ ... via @geoffreyfowler Geoffrey A. Fowler / @geoffreyfowler : Facebook just “simplified” its infamous privacy policy. But in the process, the full thing multiplied from 4,300 words — to more than 12,000. So long as we're relying on users to read these things, our privacy is in peril. A few ways to fix it —> https://www.washingtonpost.com/ ...
Context & Ripple Effects
Geoffrey A. Fowler's experiment — trying to actually read his apps' privacy policies and hitting roughly one million words, with Barclays among the worst offenders at updating its app policy every few days — is the latest entry in a long-running debate over whether notice-and-consent ever worked. Earlier coverage had already dismantled the alternatives: researchers concluded that putting a monetary value on consumer privacy produces such varying results that the approach itself is wrong, while Stratechery argued that privacy fundamentalism ignores the internet's inherent trade-offs.
What makes this column matter is that it stops diagnosing the failure and proposes a replacement mechanism — law plus technology delivering real choices instead of unread documents. That lands in the middle of an unresolved tension Benedict Evans flagged: many circulating privacy proposals would further entrench big platforms rather than help competition, so any redesign has to pick a side between usability and market structure.
First-order effects
- App publishers like Barclays, whose near-constant policy churn Fowler's reporting highlights, face pressure to replace legal-document updates with machine-readable settings that users can act on without reading anything.
- Lawmakers and regulators get a concrete design brief from a mainstream outlet: legislate default protections and standardized choice mechanisms rather than mandate disclosure.
Second-order effects
- Any move toward standardized, technical privacy choices shifts compliance costs toward whoever builds the tooling — a dynamic that, per Evans's earlier argument, risks favoring large platforms unless regulators design around it.
- The central-custodian model floated under GDPR — a government or a firm like Apple holding personal data on users' behalf — becomes a more plausible endpoint once individual reading-and-consenting is abandoned as unworkable.
Third-order effects
- If the pattern holds, privacy regulation migrates from a disclosure regime to an architecture regime — defaults and enforced choices written into products — ending the fiction that consent-to-terms constitutes informed agreement.
- The unresolved conflict between privacy rules and competition policy becomes the central design constraint for whatever replaces privacy policies, since every proposed mechanism redistributes power between platforms and smaller firms.
The trend: Privacy regulation is shifting from notice-and-consent paperwork toward legally mandated defaults and technical choice mechanisms, with the platform-concentration trade-off as its unresolved cost.