A few months back, we featured this quote from DU24 in our weekly newsletter: “I’m an expert in data privacy, and often I don’t know exactly what is being said in a privacy notice.”

It comes from Tami Dokken, The World Bank’s first chief data privacy officer. Prior to World Bank, Tami was head of global data privacy and protection at MoneyGram International. She is a licensed attorney with broad experience in privacy laws.

Which got us thinking. If Tami doesn’t know, does anyone? And because data is the cornerstone of AI, is this something we should really worry about, or is it broadly okay?

What even is a data privacy policy?

According to Pew Research Center, 81% of Americans are “largely concerned and confused about how their data is being used”. Of course that’s alarming, but Tami is correct: the problem starts a long way before usage. Because most people don’t know what they’re signing up for in the first place.

A stunning (in the literal sense of the word: I read it and sat open-mouthed, tiny birds flying around my head) report from the Annenberg School for Communication at University of Pennsylvania asked 2000 people 17 basic questions about online marketing practices and how companies can use their data.

77% answered nine or fewer questions correctly – “a failing grade in a typical classroom”. To pull just one result as an example: 63% of people don’t know it’s legal for an online store to charge people different prices depending on where they are located.

Lawmakers and policymakers have applied the medical principle of informed consent to the Internet. But as this report explicitly states: “Americans overwhelmingly lack the basic knowledge about Internet privacy necessary to grant consent.”

And does it matter anyway?

So, to answer my first question, statistically only one in 2000 of us knows exactly what’s being said in a privacy notice. But what about the second question? I mean, we’re still broadly okay, aren't we?

There are, unfortunately, an increasing number of examples of bad actors acting badly with your data. This article gathers seven of them, including (amongst others) Facebook, Twitter, Google, Uber, and Morgan Stanley. Their charge sheets a menu of mayhem: election interfering, location tracking, way-too-personally targeted advertising, and “God view” employee tracking. All proven. All jarringly permission free.

But, most importantly, all discovered and stopped.

Fox News is concerned that worse is to come. It says Meta’s AI training is different from companies such as Google and OpenAI. According to Fox, Meta will: “use every personal detail of your life that you posted publicly. This includes photos and videos in your feed and captions on your posts and Reels.”

Does even that matter? Well, if we’re being cynical (and we are), we might point out that Google and OpenAI made agreements with large publishers for their training data. Large publishers like Fox owner News Corp. So, financially, Meta’s approach might matter more to Fox than it does to the average Facebook or Instagram user.

Answer the damn question

Does it matter that, thanks to a privacy policy they didn’t read fully, someone who lives in a bougie neighborhood pays more for yogurt? Yes, I think it does.

It matters that we don’t know enough about Internet privacy to grant consent. It matters that reading the privacy policies you encounter in a year would take 76 days. It matters that companies know this and, instead of pushing for more transparency, push further into the murk. It matters that we don’t know which bits of our data are being used, where they’re being used, or when they are being used against us.

It matters that an expert in data privacy frequently “doesn’t know exactly” what is being said in a privacy notice, because someone designed the privacy policy that way.

And that really matters. Because if someone created it, we can change it.