Let's Give Them Something to Talk About: Mobile Devices and the Privacy Policy Distraction

Introduction

"The Tale of the Vacant Lot" is a story about a young girl, driven by capitalist signifiers of success and self-worth, who buys every product she desires and imagines will improve her life. Unwilling to part with money or any of her other physical possessions, the girl agrees to a trade. The shopkeeper offers to take only "something that has no value to her." When the girl questions what that might be, the shopkeeper replies: "Should it matter?" The twist of course is that the shopkeeper slowly steals pieces of her life. We trade pieces of our lives (in a less metaphysical sense) for free browsing, free email, and a multitude of other online services, but many if not most of us have no idea exactly what it is that we are giving up and to what end. Privacy policies are designed to itemize that bill.

Such transparency has become utterly inapposite at this point. Less than one third of Americans feel they are in control of their personal information on their mobile devices; many apps routinely gather information from the personal address books of unwitting users and store such information on their servers, with one leading app executive calling it "industry best practice" The internet occasionally erupts in outrage over such practices, and yet, smartphone penetration continues to increase. More people than ever are conducting personal and professional transactions on data-gathering mobile applications ("apps"), willfully blind to the agreements they have made when downloading them.

The attitudes consumers have towards privacy policies make California Attorney General Kamala Harris's crusade all the more farcical. By June 2012, Harris had reached an agreement with Apple, Google, Facebook, Amazon, Microsoft, Hewlett Packard, and Research in Motion that they would require apps on their platforms to conspicuously post a privacy policy detailing the information they collect, how they use it, and with whom it is shared. Users would be able to review these policies before they download a given app, and platforms must offer a mechanism to report non-compliant apps. While in some sense this seems to indicate positive momentum with respect to users' privacy, in reality, the Agreement perpetuates an already defunct system based on the ethics of consent.

The Death of the Notice-and-Consent Model

Private transactions are governed by the law of contract. Vendors provide notice of their terms and consumers make a choice to accept those terms. Both must be meaningfully present in order to ensure a fair bargain. Until recently, this model seemed a given, but traditional notions of notice and consent break down in transactions involving personal information.

No One Notices

Most people do not read privacy policies. A YouGov study found that though 92% of active internet users utilize at least one Google service, only 12% of users actually read Google's privacy policy. One could point to any number of reasons for this apathy: Vendors have every incentive to be overly vague and data collection practices themselves are extremely complex; the opacity of data collection and usage frustrates transparency; even if violations became apparent, there is no enforcement mechanism in place to address them; and many vendors reserve the right to alter the terms without notifying the consumers. All of these complaints are valid ones, but none of them are actually to the problem. Clear and concise notice is simply not the issue. Assuming that all of these concerns are addressed and remedied, there is little reason to believe that consumers would change their habits. Informing individuals that Facebook is collecting biometric information or that Google is reading their mail, or even that every single keystroke on their iPhone is being recorded will certainly horrify them, but it will not stop most of them from living their digital lives in exactly the same addictive way.

Consent or Can't-Sent?

Margaret Jane Radin notes that free consent requires more than a mere passive acquiescence to do something; there must be a possibility for individuals to choose to do otherwise. Most, if not all, major digital vendors collect a significant amount of user data, and there is very little room to bargain for more data protection. If the average person wants to use an online service, the cost, a surrender of privacy, is non-negotiable. While no one is forced to use a computer or a smartphone to conduct transactions, most people prefer to live in a "highly digitized society," wherein one is free to consume and transact online constantly. Some of these services have doubtlessly made our lives better, but many of them have just made us gluttonous. The only meaningful consent we've made then is the choice to continuously over-discount the future risks of privacy loss.

Conclusion

The Harris Agreement is yet another regulatory effort that misses the point entirely. Harris assumes that the issue is one of notice, but overlooks the even more pronounced problem of consent. The only thing consumers care about when downloading an app is whether it is free. If it is and their friends are using it, just show them where to click. Present them with a mandatory privacy policy first and they will immediately scroll to the bottom. Just like they do with the optional privacy policies now. Those that do read it are the likely same people who already have constructive knowledge that they must be parting with something to play Angry Birds, but they also know that it is something they don't seem to miss in the present.

Though one might wonder why on earth the government would expend the regulatory energy attempting to improve a tool that most people entirely disregard, it is easy to see why these platforms are so accommodating. The agreement changes nothing of substance, and they are empowered as units of official public policy. Companies that trade on data collection will still be free to do whatever they choose with users' data and they will be able to hide behind the shield of legal compliance. The only ones that suffer here are the app developers, who will now be told how and what to program by the government. Harris may think she is helping those who cannot help themselves, but she is mistaken. We are a people who will not help themselves.