The Privacy Policy Words That Quietly Lie to You
Privacy policies tend to open with words that sound familiar: metadata, encryption, aggregated information, local storage. Most of us skim right past them, assuming we know what they mean. Researchers at Wellesley College and Pomona College decided to test that assumption instead of taking it for granted, and what they found is worth stopping on.
The Words We Think We Understand
They pulled 57 technical terms from real privacy policies and asked nearly 800 people to explain each one. The results were not promising. The average score didn’t even reach 40%, and on many terms less than half of respondents got it right. About 28% believed “device fingerprinting” meant using your actual fingerprint to unlock a phone, which is absurd. Around one in three figured “local storage” meant your data physically sits somewhere close to you.
When Boring Words Build False Trust
The mistakes themselves were what stuck with me. I expected people to misread a term and panic over nothing, and that was not always the case. Sometimes the error ran the other way. “We collect metadata” sounds like a boring marker, so people relaxed. They didn’t realize metadata can reveal when you talked, with whom, and for how long. Wording can do more than scare people. It can build trust that hasn’t been earned.
Get Sufyan Muhammad’s stories in your inbox
Join Medium for free to get updates from this writer.
If I were building a tool around this, that’s the warning I would personally take from it. The lesson isn’t “make things sound frightening or scary.” It’s that plain, comforting language that can make people feel safe when they are really not.
Why Encryption Understanding Isn’t Fixed
The number that surprised me most was about end-to-end encryption. Only around 17% said standard encryption was safe, while more than 70% could explain what E2E actually does to protect people. Honestly, I did not expect that, especially after reading an older interview study on WhatsApp users, where almost everyone seemed confused about encryption.
The timing probably explains it, as this survey ran in 2021, well after a steady stream of news stories asking whether WhatsApp was really private. The people in the earlier study were likely hearing the concept for the first time. Understanding shifts as public conversation about a topic grows, so an explanation that flops today might land later, once enough people have heard it and passed it along.
What Surveys Can’t Tell Us And Makes Us Question?
One thing keeps revolving around my mind. The paper suggests different terminology shapes of how people feel and what they say they will put up with. But saying you’d accept something in a survey is different from tapping “I agree” in an app you actually want to use. In real life, most people just want to click through onboarding and get going. So I’d like to see field studies rather than surveys alone, such as tracking real opt-out rates after a clause is rewritten in plain language and comparing them against the technical version.
