Rather than expecting users to read and consent to overwhelming privacy policies, laws and tech can help give them real privacy choices
This Washington Post article by Geoffrey Fowler about privacy policies caught my eye. Tweets: Ben Oberkfell / @benlikestocode : 2002: some jerk on the Something Awful Forums replies “too long; didn't read” to a post 2022: a bill in the Senate is named TL;DR https://twitter.com/... @senatorlujan : It's ridiculous all of the terms companies expect you to read on a Terms of Service Agreement-some taking weeks to read. My TLDR Act would change that by forcing online companies to make their terms more accessible and transparent. https://www.washingtonpost.com/ ... Madeline Odent / @oldenoughtosay : shout out to Barclays who update their app policy, literally, I've counted, an average of once every four days https://twitter.com/... Tom Moylan / @moylato : For the past decade or so, one idea has dominated efforts to fix privacy policies: Make them simpler. But understandability isn't our biggest privacy problem. Being overwhelmed is. https://www.washingtonpost.com/ ... Rachael Myrow / @rachaelmyrow : When you're presented with an “agree” button, you can't negotiate terms. You might be giving permission to mine your tax return. Or sharing data that will be used to discriminate against you in job applications or buying a home. 👀 https://www.washingtonpost.com/ ... via @geoffreyfowler Geoffrey A. Fowler / @geoffreyfowler : Facebook just “simplified” its infamous privacy policy. But in the process, the full thing multiplied from 4,300 words — to more than 12,000. So long as we're relying on users to read these things, our privacy is in peril. A few ways to fix it —> https://www.washingtonpost.com/ ... Jason Cohen / @asmartbear : We've all complained that no one reads the EULA or privacy policy, but we all still click “I agree.” A lie on our part, therefore essentially a lie from vendors that “we have everyone's permission.” https://www.washingtonpost.com/ ...
Context & Ripple Effects
The notice-and-consent model has been failing visibly for years: Facebook's 'simplified' privacy policy actually grew from roughly 4,300 to over 12,000 words, and Barclays reportedly refreshes its app policy about every four days — reading rates near zero are the rational response. Geoffrey Fowler's Washington Post column lands as the legislative branch responds: Sen. Ben Ray Luján's TLDR Act would force online companies to make their terms accessible and transparent, with the bill's name itself a nod to 'too long; didn't read.'
The column arrives into a long-running argument about what privacy regulation should even do. Critics have warned that privacy fundamentalism misreads the internet's inherent trade-offs, that [[a:945945|attempts to price consumer privacy have produced such varying results researchers now call the approach wrong]], and — most pointedly for the TLDR Act — that [[a:970155|many privacy proposals in circulation directly conflict with competition policy by entrenching big platforms]]. Fowler's framing shifts the question from whether users should consent to whether the consent mechanism itself can be made real.
First-order effects
- If the TLDR Act advances in the Senate, online companies face a new compliance surface: terms of service and privacy policies must be rewritten for accessibility, moving the work from legal boilerplate teams toward product and UX functions.
- Facebook and high-frequency updaters like Barclays are the immediate targets — their current disclosure practices (a 12,000-word 'simplification', near-daily policy changes) are exactly the behavior a transparency mandate is written against.
Second-order effects
- Disclosure mandates standardize the consent layer, which favors firms that can afford dedicated compliance and design resources — the entrenchment risk Benedict Evans flagged when arguing privacy proposals and competition goals are in direct conflict.
- If machine-readable or standardized terms become the norm, third-party tools that summarize and compare policies gain a viable data substrate, turning consent from a per-company document into an auditable, comparable artifact.
Third-order effects
- A working TLDR-style regime would mark the decline of notice-and-consent as the load-bearing privacy mechanism, pushing policy toward the structural alternatives already in the debate — such as the central custodian model under GDPR-style regulation the Wall Street Journal explored, where a government or a firm like Apple holds data on users' behalf.
- Whether disclosure mandates reduce data collection or merely repackage it remains the open question the corpus frames: the Atlantic's account of decades of data collection and resale suggests the underlying business model, not the readability of its terms, is what any real privacy choice would have to touch.
The trend: Privacy regulation is shifting from asking users to read endless terms toward legislating and designing the consent layer itself — with readability mandates as the entry point and custodian-style structural models as the deeper destination.