Study Confirms Consumers Ignore Online Policies And Agree To Anything

Researchers have confirmed what privacy advocates and government regulators have suspected for a long time: Internet users often ignore online policies: privacy and terms of service. And those consumers who read policies, pay insufficient attention.

In a working paper titled, "The Biggest Lie On The Internet," researchers tested 543 college students (from a communications class) by having them sign up for NameDrop, a fictitious social networking site (SNS). 47 Percent of test participants were female, and the average age of all participants was 19. 62 percent identified as Caucasian, 15 percent as Asian, 6 percent as Black, 2 percent as Hispanic/Latin, and 3 percent as mixed race/ethnicity.

Authors of the working paper were Jonathann A. Obar, a Research Associate at the the Quello Center for Telecommunications Management and Law at Michigan State University, and Anne Oeldorf-Hirsch, at the University of Connecticut. The paper was submitted for peer review and to the U.S. Feral Communications Commission (FCC).

The study found that almost three of four test participants -- 74 percent -- skipped reading the privacy policy by clicking on a "Quick Join" button. Those that did read the privacy policy spent a little over a minute -- 73 seconds -- reading the 7,977-word policy. Test participants spent less time -- 51 seconds -- reading the 4,316-word TOS policy.

The researchers expected test participants to spend longer times reading the policies because persons with a 12-grade or college education read about 250 to 280 words per minute. So, the it should have taken 29 to 32 minutes to read the 7,977-word privacy policy. The range of actual reading times was 2.96 seconds to 37 minutes; with 80 percent of test participants spending less than one minute of reading time.

The paper did not mention if reading times varied by device (e.g., phone, tablet, laptop, desktop). The researchers identified three factors that predict policy reading times:

1. Information Overload: if the persons perceived the policies to be too long andtoo much work,
2. Nothing to Hide: persons view the policies as irrelevant because they do nothing wrong, and
3. Difficult to Understand: persons believe that they can't understand the language in the policies.

The researchers inserted problematic clauses into the policies which test participants should have spotted and inquired about:

"Implications were revealed as 98 percent missed NameDrop TOS 'gotcha clauses' about data sharing with the National Security Agency (NSA) and employers, and about providing a first-born child as payment for SNS access."

Only 15 percent (83 persons) expressed concerns about NameDrop's policies. Of the 83 persons who expressed concerns, 11 mentioned the NSA clause, and nine mentioned the child-assignment clause. The rest mentioned concerns about the length of the policies and the trustworthiness of the SNS.

The study also asked test participants how long they spent reading policies. The findings supported the "privacy paradox" found by other researchers:

"The paradox suggests that when asked, individuals appear to value privacy, but when behaviors are examined, individual actions suggest that privacy is not a high priority... When participants were asked to self-report their engagement with privacy and TOS policies, results suggested average reading times of approximately five minutes..."

So, test participants said they spent about 5 minutes reading policies while their actual times were about a minute or less, if they read the policies at all.

With most consumers skipping online policies, they have given companies the power to insert any clauses desired into these policies. This has implications for consumers' ability to control their online reputation, privacy, and resolve conflicts (e.g., binding arbitration instead of courts).

This also has implications for how governments enforce data protection for their citizens. Historically:

"... approaches to privacy and increasingly reputation protections by governments throughout the world often draw from a contentious model referred to as the 'notice and choice' privacy framework. Notice and choice evolved from the U.S. Federal Trade Commission's (FTC) Fair Information Practice Principles, developed in the 1970s to address growing information privacy concerns raised by digitization. In the early 1980s, the FIPPs were promoted by the OECD as part of an international set of privacy guidelines, contributing to the implementation of data protection laws and guidelines in the U.S., Canada, the EU, Australia, and elsewhere... The notice and choice privacy framework was designed to "put individuals in charge of the collection and use of their personal information" (Reidenberg et al, 2014: 3)..."

The researchers' focused upon the:

"... notice component, noted by the FTC as "the most fundamental principle" (FTC, 1998: 7) of personal information protection... As the FTC (1998) notes, choice and related principles attempting to offer data control "are only meaningful when a consumer has notice of an entity's policies, and his or her rights with respect thereto." Notice policies typically... appear on websites, applications, are sent in the mail, provided in-person, generally when an individual connects with the entity in question for the first time, and increasingly when policies change. Despite suggestions that notice policy in particular is deeply flawed, strategies for strengthening notice policy continue to be seen as central to address, for example, privacy concerns associated with corporate and government surveillance, and consumer protection concerns about Big Data..."

So, the biggest lie on the Internet is that consumers agree to policies, which they really can't because they haven't read them. Governments, privacy advocates, companies, and usability professionals need to find a better way, because the current approach clearly isn't working:

"The policy implications of these findings contribute to the community of critique suggesting that notice and choice policy is deeply flawed, if not an absolute failure. Transparency is a great place to start, as is notice and choice policy; however, all are terrible places to finish. They leave digital citizens with nothing more than an empty promise of protection, an impractical opportunity for data privacy self-management, and as Daniel Solove (2012) analogizes, too much homework. This doesn't even begin to address the challenges unique to children in the realm of digital reputation..."

Absolutely, since many sites allow children as young as 14 to sign up. Policy reading rates are probably worse among children ages 14 - 17.

Download the working paper: "The Biggest Lie on The Internet" (Adobe PDF). the paper is also available here. The study used students majoring in communications. I wonder if the results would have been different with business majors or law students. What do you think?

Comments

[Chanson de Roland]

The common law, which is the basis of our legal system, has an ancient remedy to protect the rights of a person, whose disabilities, such as ignorance, illiteracy, lack of bargaining power, possible coercion, etc., create a situation where his assent to an agreement doesn't expressly a free, meaningful, fairly negotiated, and/or knowledgeable consent. That remedy is the law of status. Status arose from the time when the Lord of the manor, who had his scribes, clerics, and other early predecessors to lawyers, negotiated written agreements with illiterate peasant, who allegedly expressed their assent to the binding agreement, which usually involved interests in realty, by placing their mark as their signature on the agreement.

This, of course, was an utter sham and amounted to little more than larceny by trick. In addition, the illiterate peasant was often aided in his decision to place his mark on the agreement by the presence of several of the Lord's men-at-arms being in attendance to witness the ceremony to encourage the peasant to assent to the agreement.

To remedy this injustice, the common law developed the law of status, where one's conditions, such as being a peasant, prohibited the Lord from entering into certain types of agreements with the peasantry and guaranteed to the peasantry certain rights in their land and/or tenancies, notwithstanding anything in any agreement to the contrary.

Today, as described in the article, supra, we have the similar disparities of power, knowledge, and/or circumstances that characterized the relationship between Lord and peasant in the Middle Ages, where today the consumer, even though usually literate to some degree, either can't understand the complex agreements that are offered to his for his assent and/or has no bargaining power because there are no alternatives in the market for needed service or good. And thus, we need the same remedy: We need a certain status for the consumer which guarantees that he has certain intellectual property and privacy rights in his personal information, notwithstanding anything to the contrary in any agreement between himself and entities that collect and trade in his personal information.

For the sham of notice and informed consent is just that, a sham, in this matter and in many other areas of consumer contracts. But staying with this matter, as a matter of status, most consumers should have nearly unalienable IP rights in their personal information and rights of privacy, which can only be alienated in certain limited and prescribed ways for a limited amount of time, let's say not more than five years.

Status is nothing new. While it has been much limited today by statue and case law, it still exist in, for example, rules that restricts certain types of investments to only qualified investors; in that status arrangements that protect the spouse’s, usually the woman’s, interest in marital property, when she has spent her life rearing the children woman, but whose husband find the charms of a younger woman more enticing; in an array of laws that protect children and those with cognitive impairment and other disabilities; in laws that prohibit enforcement of contracts against a party where the lack of competitive alternatives or some other disparity in bargaining power is manifestly unfair and the result shocks the conscious.

In our world today, were the disparities of knowledge, skill, and understanding place consumers in situations where their alleged assent to agreements is a sham, it is a time for a return to the law of status.