Absent a comprehensive federal privacy law, the majority of U.S. businesses operate under the assumption that fine print in a legally complex privacy policy is sufficient to act in good faith. Unfortunately, standard privacy policies do nothing to advise consumers of the harms they may experience when utilizing a website, application, or device. Without a basic understanding of why they should care about their personal information being sold and shared, consumers lack the requisite knowledge necessary to make an informed decision.<\/p>\n
This article argues that the potential for consumer harms, resulting from the use of a product or service, should be spelled out and disclosed. The FTC should promulgate a rule to require harms\u2019 disclosure in a standardized, easy-to-understand privacy policy that is consistent throughout the industry. By educating the general public up front, informed consumers can determine the true level of risk they are willing to take, instead of blindly following flashy advertising and exciting trends.<\/p>\n
II. Background<\/h5>\nA. Overview of Privacy Policies<\/h6>\n
Privacy policies are typically lengthy notices filled with technical terms and legal language[3]<\/a> that explain what an entity does with a consumer\u2019s personal information, how the information is shared with third parties, and whether the consumer has options regarding this sharing.[4]<\/a> Many privacy policies are difficult to understand and contain language designed to mislead consumers into believing the business protects their information.[5]<\/a> Moreover, privacy policies typically provide no warning to consumers of potential harms they may encounter when utilizing the product or service.<\/a>[6]<\/a><\/p>\n Many businesses rely on the fine print in a legally complex privacy policy to address consumer privacy issues.[7]<\/a> According to Jen King, the director of consumer privacy at the Center for Internet and Society, privacy policies are \u201cdocuments created by lawyers, for lawyers. They were never created as a consumer tool.\u201d[8]<\/a><\/p>\n In 2012, the average length of an online privacy policy was 2,415 words.[9]<\/a> It would take an average internet user seventy-six working days\u2014consisting of eight hours per day\u2014to read the privacy policies of every website they encountered within a year.[10]<\/a>\u00a0 Over the past decade, Americans\u2019 use of the internet has exploded; as a result businesses have greatly expanded their privacy policies.[11]<\/a> For example, Facebook\u2019s privacy policy takes a reported eighteen minutes to read.[12]<\/a> Thus, it is not reasonable to expect the average consumer has the time, nor the sophistication, to read and understand every lengthy and substantially different privacy policy they may encounter.<\/p>\n The FTC is in charge of preventing unfair or deceptive acts or practices that affect commerce in the privacy arena.[13]<\/a> Pursuant to Section 18 of the FTC Act and the Commission\u2019s rules of practice, the FTC has the authority to \u201cpromulgate, modify, and repeal trade regulation rules that define with specificity acts or practices that are unfair or deceptive in or affecting commerce within the meaning of Section 5(a)(1).\u201d[14]<\/a> The FTC Act identifies unfair or deceptive acts as those that cause or are likely to cause significant injury to consumers.[15]<\/a><\/p>\n The FTC currently sanctions businesses for unfair or deceptive practices while enforcing adherence to a business\u2019 privacy policy.[16]<\/a> As the FTC does not provide a standardized template for privacy policies, businesses are left to draft their own documents, without clear guidelines.<\/p>\n As technology has revolutionized American lives, individuals\u2019 personal information is entered into online platforms on a daily basis in order to schedule medical appointments, apply for college, or communicate with most businesses. Moreover, the average Smartphone user in the U.S. utilizes approximately forty-six apps per month.[17]<\/a> As a result, the risk of individual privacy harms continues to increase.[18]<\/a> Privacy harms encompass a large scale of scenarios ranging from discrimination to emotional impairment to economic loss.[19]<\/a><\/p>\n Privacy injuries associated with the unauthorized use of an individual\u2019s data may include reputational,[20]<\/a> discrimination,[21]<\/a> physical,[22]<\/a> autonomy,[23]<\/a> economic,[24]<\/a> emotional,[25]<\/a> and relationship harms.[26]<\/a> For example, the disclosure of personal health data may affect a consumer\u2019s ability to obtain employment, financial products, insurance, housing, or admission to a nursing home; it may cause social stigmatization based on race, sexual preferences, disease, addictions, mental health conditions, religion, or political positions; and it may subject the consumer to potentially dangerous situations due to blackmail, bullying, stalking, Ransomware, or the revelation of secret locations for domestic abuse victims.[27]<\/a> Disclosures of mental health conditions, along with certain diagnoses, such as sexually transmitted disease, alcohol, or drug use carry additional social stigmatizations.[28]<\/a><\/p>\n Courts have moved beyond rigid injury requirements to include more intimate personal autonomy harms, such as \u201ccoercion \u2013 the impairment on people\u2019s freedom to act or choose; (2) manipulation \u2013 the undue influence over people\u2019s behavior or decision-making; (3) failure to inform \u2013 the failure to provide people with sufficient information to make decisions; (4) thwarted expectations \u2013 doing activities that undermine people\u2019s choices; (5) lack of control \u2013 the inability to make meaningful choices about one\u2019s data or prevent the potential future misuse of it; [and] (6) chilling effects \u2013 inhibiting people from engaging in lawful activities.\u201d[29]<\/a><\/p>\n Further stigmatization can occur when online platforms make their way into the real lives of consumers. For example, Facebook has developed a relationship with law enforcement, searching for individuals whose online activities may infer suicidal tendencies.[30]<\/a> Facebook scans users\u2019 input\u2014including private messages\u2014for content that may apply to \u201csafety and health.\u201d[31]<\/a>\u00a0 Facebook then reports individuals to law enforcement that they consider as potentially suicidal.[32]<\/a> Thus, by sending allegedly private messages on Facebook, a user runs the risk of the police showing up at their door in real life.[33]<\/a><\/p>\n This can be particularly troubling for users as police documentation about a potentially suicidal visit\u2014including officers\u2019 body cam footage of people, cars, and homes\u2014becomes public record.[34]<\/a> The records may be shared with any interested parties\u2014including data brokers.[35]<\/a> This public documentation of a consumer\u2019s perceived mental instability can have devastating consequences that affect the rest of their lives.[36]<\/a> Potential harms may include discrimination in careers, housing, public doxing, reputational damage, relationship issues, or mental health stigmas. Imagine having to disclose to potential employers that you were deemed a suicide risk by local law enforcement.<\/p>\n Still, the majorities of consumers are not adequately informed of potential harms and have little to no knowledge of the life-long consequences that may result from utilizing these products and services.[37<\/a>]<\/a> <\/a><\/p>\n At the time of publication, there are still no comprehensive U.S. privacy laws at the federal level, let alone any statutes to require privacy policies disclose potential consumer harms. While it is standard practice in the U.S. for some industries to warn consumers of potential harms, the technological world is way behind. For example, in California, amusement parks, personal car manufacturers, and even holiday lights\u2019 manufacturers are required to disclose \u201csignificant exposures to chemicals that cause cancer, birth defects or other reproductive harm.\u201d[38]<\/a><\/p>\n Countries worldwide and several U.S. states have begun to pass privacy laws to minimize commercial surveillance and promote data security.[39]<\/a> \u201cPersistent and targeted surveillance collapses individual moments of interaction, spread out over time and mitigated through human forgetfulness, into one long story of an individual\u2019s life.\u201d[40]<\/a> This type of surveillance can lead to inferences about highly sensitive areas of a person\u2019s life, such as religion, sexual activities, and health.[41]<\/a> Therefore, U.S. consumers need to be warned of surveillance profiling and subsequent harms, before they agree to utilize a product or service.<\/p>\n \u201cStudies have shown that most people do not generally understand the market for consumer data that operates beyond their monitors and displays.\u201d[42]<\/a> A Pew Research Center study found that \u201c78% of US adults say they understand very little or nothing about what the government does with the data it collects, and 59% say the same about the data companies collect.\u201d[43]<\/a> Thus, if the majority of consumers admit they do not understand what is done with their personal data, a privacy policy filled with legal terms and jargon does nothing to serve as a warning.<\/p>\n Critics may argue that privacy harms often do not occur until some future time, if at all. Therefore, it is unnecessary to warn consumers about the potential risk of future harms. The current technological ecosystem is so complex and consists of so many entities; it is difficult\u2014if not impossible\u2014for the average consumer to pinpoint where their personal information was disclosed, when experiencing higher insurance rates, employment discrimination, or targeted advertising based on their most intimate secrets. Thus, it is critical to notify consumers of potential harms at the initial time of their data collection.<\/p>\n Absent a comprehensive federal privacy law, this article proposes the FTC should promulgate a rule to require consumer harms\u2019 disclosure in a standardized, easy-to-understand privacy policy that is consistent throughout the industry.<\/p>\n The Gramm-Leach-Bliley Act (\u201cGLBA\u201d) provides financial institutions with a standardized template listing specific categories of information that must be disclosed.[44]<\/a> This template is similar to the nutrition-label approach to privacy instituted by Apple and Google in their app stores.[45]<\/a> For example, Apple created the labels \u201cto help users learn at a glance what data will be collected by an app, whether that data is linked to them or used to track them, and the purposes for which that data may be used.\u201d[46]<\/a> The nutrition labels are a great tool to identify the information being collected; however, the labels fail to warn consumers of potential harms resulting from the collection.<\/p>\n By utilizing a template similar to the GLBA requirement, consumers can easily determine whether or not the business sells or shares their personal information with third-parties, who those third parties are, what potential harms can result from said sharing, and what choices the consumer has\u2014if any\u2014to opt out. Thus, consumers can quickly identify the key components to determine whether they want to do business with the entity. While the U.S. has a long way to go in protecting users\u2019 privacy, this disclosure of harms is one step that can educate and empower consumers to make informed decisions.<\/p>\n Action should be taken at the federal level to clearly notify consumers of potential privacy harms resulting from the sharing of their personal information. By providing sweeping protection in privacy policies for all U.S. residents, the FTC can help to balance the benefits of technology with the education necessary for consumers to take back control of their own private lives.<\/p>\n <\/p>\n <\/p>\n *J.D., Gonzaga University School of Law. Acknowledgments and gratitude to Professor Drew Simshaw for his [1]<\/a> Trade Regulation Rule on Commercial Surveillance and Data Security<\/em>, Fed. Trade Comm\u2019n,, Dec. 8, 2021, 1, 5 https:\/\/www.ftc.gov\/system\/files\/ftc_gov\/pdf\/commercial_surveillance_and_data_security_anpr.pdf. [hereinafter FTC Trade Regulation Rule].<\/p>\n [2]<\/a> See <\/em>Danielle Keats Citron & Daniel J. Solove, Privacy Harms<\/em>, Geo Wash. L. Fac. Publications & Other Works, 1, 19, 21-23, 25, 28\u00a0 https:\/\/scholarship.law.gwu.edu\/faculty_publications\/1534<\/a> (last visited Feb. 7, 2023).<\/p>\n [3]<\/a> See<\/em> Lori Andrews, A New Privacy Paradigm in the Age of Apps<\/em>, 53 Wake Forest L. Rev. 421, 435 (2018).<\/p>\n [4]<\/a> See <\/em>Andrews, supra <\/em>note 3, at 434-36.<\/p>\n [5]<\/a> See Deceived by Design<\/em>, Forbrukerradet 1, 22\u00a0 (June 27, 2018),<\/p>\n https:\/\/fil.forbrukerradet.no\/wp-content\/uploads\/2018\/06\/2018-06-27-deceived-by-design-final.pdf (discussing how Big Tech utilizes positive and negative wording to \u201cnudge users toward making certain choices\u201d); See also<\/em> Kevin Litman-Navarro, We Read 150 Privacy Policies. They Were an Incomprehensible Disaster,<\/em> N.Y. Times, June 12, 2019, https:\/\/www.nytimes.com\/\u200binteractive\/\u200b2019\/\u200b06\/\u200b12\/\u200bopinion\/\u200bfacebook-google-privacy-policies.html.<\/p>\n [6]<\/a> See <\/em>Forbrukerradet, supra<\/em> note 5.<\/p>\n [7]<\/a> See<\/em> Andrews, supra <\/em>note 3, at 435.<\/p>\n [8]<\/a> See<\/em> Litman-Navarro, supra <\/em>note 5.<\/p>\n [9]<\/a>Alexis C. Madrigal<\/a>, Reading the Privacy Policies You Encounter in a Year Would Take 76 Work Day<\/em>s, Atl. Monthly Grp., LLC (Mar. 1, 2012), https:\/\/www.theatlantic.com\/technology\/archive\/2012\/03\/reading-the-privacy-policies-you-encounter-in-a-year-would-take-76-work-days\/253851\/.<\/p>\n [10]<\/a> Id.<\/em><\/p>\n [11]<\/a> See<\/em> Litman-Navarro, supra<\/em> note 5.<\/p>\n [12]<\/a> See<\/em> Litman-Navarro, supra<\/em> note 5.<\/p>\n [13]<\/a> See<\/em> 15 U.S.C. \u00a7\u00a7 41-58, as amended [hereinafter 15 U.S.C.]; See also<\/em> Michael Goodyear, The Dark Side of Videoconferencing: The Privacy Tribulations of Zoom and the Fragmented State of U.S. Data Privacy Law<\/em>, 10 Hous. L. Rev. 76, 79 (2020).<\/p>\n [14]<\/a> See<\/em> FTC Trade Regulation Rule, supra<\/em> note 1, at 12.<\/p>\n [15]<\/a> See<\/em> 15 U.S.C., supra<\/em> note 13; See also<\/em> Scott Stiefel, The Chatbot Will See You Now;\u00a0 Protecting Mental Healthware Confidentiality in Software Applications<\/em>, 20 Colum. Sci. & Tech. L. Rev. 333, 386 (2019).<\/p>\n [16]<\/a> See<\/em> 15 U.S.C., supra<\/em> note 13; See<\/em> also<\/em> Nicole Angelica, Alexa\u2019s Artificial Intelligence Paves the Way for Big Tech\u2019s Entrance into the Health Care Industry \u2013 The Benefits to Efficiency and Support if the Patent-Centric System Outweigh the Impact on Privacy<\/em>, 21 N.C. J. L. & Tech. 59, 77-78 (2020)..<\/p>\n [17]<\/a> See<\/em> Stephanie Chan, U.S. Consumers Used an Average of 46 Apps Each Month in the First Half of 2021<\/em>, Sensor Tower, Inc., Aug. 2021, https:\/\/sensortower.com\/blog\/apps-used-per-us-smartphone.<\/p>\n [18]<\/a> See<\/em> FTC Trade Regulation Rule, supra<\/em> note 1, at 7 (stating how the FTC noted that \u201ccompanies\u2019 collection and use of data have significant consequences for consumers\u2019 wallets, safety, and mental health\u201d).<\/p>\n [19]<\/a> See<\/em> Lothar Determann, Healthy Data Protection<\/em>, 26 Mich. Tech. L. Rev. 229, 256 (2020).<\/p>\n [20]<\/a> See<\/em> Citron & Solove, supra<\/em> note 2, at 22 (describing how \u201creputational harms impair a person\u2019s ability to maintain \u2018personal esteem in the eyes of others and can taint a person\u2019s image.\u2019\u201d Reputational harms can result in social rejection, lost employment or business).<\/p>\n [21]<\/a> See<\/em> Citron & Solove, supra<\/em> note 2, at 28 (Discrimination harms particularly highlight the inequality and disadvantages for people from marginalized communities. Potential discrimination may occur in the form of employment, housing, insurance ratings, or online harassment).<\/p>\n [22]<\/a> See<\/em> Citron & Solove, supra<\/em> note 2, at 19 (describing physical harms as setbacks to physical health or physical violence when personal data is improperly shared).<\/p>\n [23]<\/a> See<\/em> Citron & Solove, supra<\/em> note 2, at 40 (describing autonomy harms as the \u201crestriction, coercion, or manipulation of people\u2019s choices\u201d).<\/p>\n [24]<\/a> See<\/em> Citron & Solove, supra<\/em> note 2, at 21 (Economic harms include financial loss or identity theft).<\/p>\n [25]<\/a> See<\/em> Citron & Solove, supra<\/em> note 2, at 23 (Emotional harms include emotional distress, categorized by anger, frustration, various degrees of anxiety, and annoyance).<\/p>\n [26]<\/a> See <\/em>Citron & Solove, supra<\/em> note 2, at 25 (describing how relationship harms can encompass personal, professional, and organizational relations).<\/p>\n [27]<\/a> See <\/em>Determann, supra<\/em> note 19, at 256; See <\/em>Andrews, supra<\/em> note 3, at 465\u201366.<\/p>\n [28]<\/a> See<\/em> Determann, supra<\/em> note 19, at 256-57 (When faced with a mental health diagnosis, patients may experience \u201cembarrassment, shame, and even social exclusion should information of this nature become public.\u201d This stigmatization often affects an individual\u2019s quality of life and can cause additional health conditions or a variety of psychosomatic symptoms).<\/p>\n [29]<\/a> See<\/em> Citron & Solove, supra<\/em> note 2, at 47.<\/p>\n [30]<\/a> See <\/em>Benjamin Goggin, Inside Facebook\u2019s Suicide Algorithm<\/em>; Insider, Inc., Jan. 6, 2019, https:\/\/www.businessinsider.com\/facebook-is-using-ai-to-try-to-predict-if-youre-suicidal-2018-12.<\/p>\n [31]<\/a> See id.<\/em><\/p>\n [32]<\/a> See id.<\/em><\/p>\n [33]<\/a> See id.<\/em><\/p>\n [34]<\/a> See<\/em> Jacqueline White, ISP body-cam footage shows Idaho suspect pulled over in Indiana, minutes after being stopped by Deputy<\/em>, Scripps Media, Inc., https:\/\/www.wrtv.com\/news\/working-for-you\/isp-body-cam-footage-shows-idaho-suspect-pulled-over-in-indiana-minutes-after-being-stopped-by-deputy (last updated Jan 3, 2023 04:18 PM).<\/p>\n [35]<\/a> See generally<\/em> Electronic Frontier Foundation, FOIA How To<\/em>,<\/p>\n https:\/\/www.eff.org\/issues\/transparency\/foia-how-to (last visited Feb. 6, 2023).<\/p>\n [36]<\/a> See <\/em>Goggin, supra<\/em> note 30.<\/p>\n [37]<\/a> See<\/em> Brooke Auxier, Lee Rainie, Monica Anderson, Andrew Perrin, Madhu Kumar, and Erica Turner, Americans and Privacy: Concerned, Confused, and Feeling Lack of Control Over Their Personal Information<\/em>, Pew Res. Ctr, 1, 10 (Nov. 15, 2019)<\/p>\n https:\/\/www.pewresearch.org\/internet\/2019\/11\/15\/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information\/ [hereinafter Pew Research Center] (describing how the majority of Americans do not understand what the government or private businesses do with their personal information); See<\/em> also<\/em> Citron & Solove, supra<\/em> note 2, at 18-40 (describing privacy harms a consumer may experience due to unauthorized use of their personal information).<\/p>\n [38]<\/a>See<\/em> OEHHA Cal. Off. Envtl Health Hazard Assessment About Proposition 65<\/em><\/p>\n https:\/\/oehha.ca.gov\/proposition-65\/about-proposition-65 (last visited Feb. 2, 2023) (\u201cProposition 65 requires businesses to provide warnings to Californians about significant exposures to chemicals that cause cancer, birth defects or other reproductive harm.\u00a0 These chemicals can be in the products that Californians purchase, in their homes or workplaces, or that are released into the environment. By requiring that this information be provided, Proposition 65 enables Californians to make informed decisions about their exposures to these chemicals\u201d).<\/p>\n [39]<\/a> See Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016<\/em>, Official J. Eur. Union L. 119, at 1 (2016) (The GDPR is a comprehensive privacy law designed to prohibit businesses from tracking and selling the personal information of consumers located in the EU, absent consent); See<\/em> also<\/em> Californians for Consumer Privacy, CPRA Executive Summary<\/em><\/p>\n https:\/\/www.caprivacy.org\/cpra-exec-summary\/ (last visited June 21, 2021)\u00a0 (describing California\u2019s privacy law); See also <\/em>Va. Code \u00a7\u00a7 59.1-571 to -581 (2021) (describing Virginia\u2019s privacy law); See also<\/em> Col. Gen. Assemb., Senate Bill 21-190<\/em>,<\/p>\n https:\/\/leg.colorado.gov\/sites\/default\/files\/documents\/2021A\/bills\/2021a_190_enr.pdf (last updated June 23, 2021) (describing Colorado\u2019s Privacy Law).<\/p>\n [40]<\/a> Margot E. Kaminsky, Privacy and the Right to Record<\/em>, 97 Boston U. L. Rev. 167, 215 (2015).<\/p>\n [41]<\/a> Id.<\/em><\/p>\n [42]<\/a> See<\/em> FTC Trade Regulation Rule, supra<\/em> note 1, at 5.<\/p>\n [43]<\/a> See<\/em> Pew Research Center, supra<\/em> note 37, at 10.<\/p>\n [44]<\/a> See<\/em> FTC Trade Regulation Rule, supra<\/em> note 1, at\u00a0 15 (describing how the GLBA regulates the privacy of consumer information collected by financial institutions).<\/p>\nB. Legal Foundation<\/h6>\n
III. Potential Harms from Data Sharing<\/h5>\n
IV. Privacy Policies Should Disclose Potential Harms<\/h5>\n
V. Solution<\/h5>\n
VI. Conclusion<\/h5>\n
\ninvaluable insights and continuing support.<\/p>\n
![\"\"](\"https:\/\/jolt.richmond.edu\/files\/2023\/02\/Screenshot-2023-02-20-at-8.33.25-AM.png\")
<\/p>\n