Last week, you likely received another email. Title: “Our Privacy Policy Has Been Updated.
You didn’t read it. Neither did I at first.
This is the thing though: I would write these notices as a paralegal. I have read what firms put in the fine print. And in a year as an attorney, I can assure you that not paying attention to these updates could cost you more than you expect.
Wonder what is really going on behind those dry corporate emails? I can tell you.
The Email Nobody Reads
Sarah, a graphic designer in Seattle, informed me that she receives an average of three privacy policy updates monthly. She clicks without reading Accept. Always has.
One of her apps modified its data-sharing regulations last year. The company began selling location data to advertisers. It was only when targeted ads to a fertility clinic showed up on her feed immediately after a visit with her doctor that Sarah found out.
She felt violated. Angry. Betrayed.
The worst part? She had agreed to it.
This is due to the fact that we have become what scientists refer to as consent-fatigued. We are bombarded with privacy notices to the point where we simply gloss over them. Companies know this. Some count on it.
What Changed in Privacy Policy (And Why Now)
The world is becoming stricter on privacy laws. The California Privacy Rights Act became effective in 2023. Virginia, Colorado, and Connecticut enacted their own regulations. The GDPR in Europe keeps developing.
Companies have to revise their policies to remain legal. However, what they do not hype here is:
They’re often expanding what they can do with your information.
When you see that update notice, the company might be:
- Sharing your data with more third parties
- Keeping your information longer
- Using your content to train AI models
- Tracking you across more devices
- Combining data from different sources to build detailed profiles
A recent study conducted by Carnegie Mellon discovered that the average privacy policy is 18 minutes long to read. Americans would require 76 working days a year to read all the privacy policies they come across.
Nobody has that time.
The Real Cost of Clicking “Accept”
This is what I found during my paralegal days: businesses plan these updates in a strategic manner.
They head them on Friday afternoons. They are full of heavy legalism. They enlarge the Accept All button and make it shine, and conceal granular controls under multiple clicks.
Why? Your data is valuable.
The profile of a single consumer would sell between $0.50 and more than 100 dollars, depending on the level of detail and type. Health care records fetch high prices. And so does financial information.
Think about what you’ve shared online:
- Health searches
- Banking apps
- Location history
- Shopping habits
- Political views
- Relationship status
- Photos of your kids
- Your daily routine
All of this creates a digital portrait. These portraits are bought, sold, and exchanged among companies. The privacy policy explains to you that they can do so. You just have to read it.
How to Actually Protect Yourself
You do not have to become a privacy expert. You just need a system.
The Five-Minute Rule
When you get an update notice, spend five minutes on these questions:
- What changed? Most notices have a “What’s New” section. Start there.
- Who gets my data? Look for phrases like “third-party partners,” “affiliates,” or “service providers.”
- Can I opt out? Check if you can limit data sharing without losing the service.
- How long do they keep it? Some companies delete data after 30 days. Others keep it forever.
- What are my rights? Can you request deletion? Download your data? See what they have?
Document everything. Make privacy screen shots. Save confirmation mails when you choose not to share the data.
I am doing so with each app I regularly use. It consumes roughly 30 minutes a month, in total. Last year, it assisted me in catching a rogue data exchange which I could dispute.
The Options You Didn’t Know You Had
The majority of privacy policies provide options. They simply do not make them explicit.
California residents have the right to require companies to reveal what data they have collected and have shared with whom. You can request deletion. You can opt out of sales.
Other states follow suit. The Consumer Data Protection Act of Virginia allows residents to access, correct, delete, and receive copies of their data.
But you have to act. These rights do not come into force automatically.
Here’s how:
Go to the privacy center of the company (typically found at the bottom of the site). Search Your Privacy Choices or Do Not Sell My Personal Information.
In the case of California residents, companies are required to include an explicit link to Do Not Sell or Share My Personal Information.
Use their official form to submit your request. Don’t email customer service. They’ll just redirect you.
The companies have 45 days to respond. Otherwise, you can make a complaint to your state attorney general.
When to Walk Away
Some policy changes should make you delete the app entirely.
Red flags include:
- Removing your ability to opt out
- Claiming ownership of your content
- Sharing data with unnamed “partners”
- Tracking you even when you’re not using the app
- No option to delete your account
Last year I stopped using a popular fitness app when it updated that they were allowed to share my health information with insurance companies. Not worth the risk.
Alternatives will almost always be available. Do some research. Ask friends what they use. Read recent reviews.
The AI Question Everyone’s Avoiding
This is the latest issue, AI training.
Business organizations are changing their policies so that they can use your posts, photos and messages to train artificial intelligence models. It is impossible to reverse your data to an AI. It is implanted in the system.
This language was recently added to Reddit, Twitter, and a variety of other platforms. Others provided opt-outs in settings. Others made it mandatory.
Prior to accepting the next update, use a search query within the policy that includes terms such as machine learning, artificial intelligence, or AI training. See what they’re planning.
What Companies Hope You Don’t Notice
I spent four years watching lawyers craft these policies. They use specific techniques:
The reassurance sandwich: Start with friendly language about respecting privacy. Bury the concerning stuff in the middle. End with promises about security.
The complexity shield: Use enough legal terms that regular people give up reading.
The urgency push: “Update required to continue using service” creates pressure to accept quickly.
The fatigue factor: Send multiple updates close together so people stop paying attention.
Knowing these tactics helps you resist them.
Your Action Plan (Right Now)
Select your three favorite apps. The ones who have your sensitive information. Banking, health, social media, email.
This week:
- Visit their privacy centers
- Read what data they collect
- Check your sharing settings
- Opt out where possible
- Set a calendar reminder to review again in six months
The next time you receive an update notice, do not disregard it. Neither should it be blindly accepted.
Question: What is changing, and am I accepting this trade-off?
Sometimes you will. A free service must have a way of earning money. Fair enough.
But do it as a matter of decision. No haste nor clatter on a Friday afternoon.
Also read: Notice to Cure Lease Violation: Complete Guide and Template
The Bottom Line
Privacy policies are not fun. They’re not designed to be.
But they’re contracts. The law regarding what your personal information should and should not do within the firms.
You would not sign a mortgage loan or a car loan without reading it. The same should be paid to your online existence.
The following update notification can be important. It may even enable them to trace you without your consent. It can post information that you have assumed as confidential. It can take away freedoms of which you were not aware.
A five-minute reading might spare you the fate of Sarah. Out of the personal information on the most personal moments. Out of data breaches with information you had never intended to share.
You control more than they want you to know. Use it.
Got a privacy policy update waiting in your inbox right now? Go check what actually changed. I’ll wait.
You can also get in touch with me on LinkedIn if you need any help with drafting!
Note: The laws regarding privacy differ according to the place and mutually evolve. This article is information in general, it is not specific legal advice in a particular situation. Personal legal advice: Personal legal advice should be obtained with a licensed attorney in your jurisdiction.
