In 2008, researchers Lorrie Faith Cranor and Aleecia McDonald at Carnegie Mellon University asked a simple question. How long would it take an average American internet user to read every privacy policy they met in a year? Their figure: 76 work days. Not calendar days, but working days, eight hours each. And that was at 2008 levels of online activity. The researchers were not suggesting people should read faster. Their conclusion was structural: privacy policies are written to create the legal appearance of informed consent while making it practically impossible to achieve in real life.
The paper, “The Cost of Reading Privacy Policies,” has not aged badly. The services have multiplied. The policies have not shortened. The clauses that produce the most consequential outcomes stay buried under thousands of words of boilerplate. Those are the clauses on who gets your data, how long it is kept, and whether it can be sold.
Understanding what those clauses look like, and where to find them, makes the problem workable. It does not take anything close to 76 days of reading.
The short answer: You do not need to read a whole privacy policy. Find five clauses instead: third-party sharing, retention periods, the consent mechanism, the update-notification method, and data sale. Vague phrasing (like “trusted partners” or “as long as necessary”) is usually where the real license hides. A browser Ctrl+F search finds all five in a few minutes. The rest of this guide shows what each clause means when you find it.
What does “we may share your data with trusted partners” mean?
This is the most consequential sentence in most privacy policies. It appears in some variant in nearly all of them. Every word is doing work.
“May” is the critical modifier. It makes the practice conditional — the company is reserving the right to share data without committing to doing so. There is no obligation to share; there is also no obligation not to. The sentence is a permission grant to the company, not a description of current practice.
“Trusted partners” is defined nowhere in the policy. In practice, it means any entity the company has a contractual relationship with. That covers advertising networks, analytics platforms, market research firms, and affiliate marketing companies. For large conglomerates, it also covers business units of the same parent company operating under different brand names.
Under GDPR, Article 13(1)(e) requires companies to disclose “the recipients or categories of recipients of the personal data.” This is a real obligation. EU-regulated companies must name specific third parties or specify categories. Examples: “advertising networks,” “analytics providers,” “social media platforms.” They must do so clearly enough that you can form a meaningful picture of where your data goes. Under most US law, there is no equivalent requirement for companies outside specific regulated sectors such as healthcare (HIPAA) or financial services (GLBA). A US company’s privacy policy is legally permitted to say “trusted partners” and mean exactly what that phrase says: anyone they have a business relationship with.
The practical test: pull up the US and EU versions of the same company’s privacy policy side by side. Meta, Google, Microsoft, and LinkedIn all publish region-specific policies. The EU version names categories of recipients. The US version frequently does not. That gap reflects what companies disclose when legally required to versus what they disclose voluntarily. The EU version, even if you are not in the EU, shows what they are obligated to tell someone.
“Legitimate interests” — GDPR’s flexibility clause
For anyone subject to GDPR, there is a second clause worth locating: the legal basis on which the company processes your personal data.
GDPR Article 6(1) sets out six lawful bases for processing. Consent is the one most people have heard of. “Legitimate interests” under Article 6(1)(f) is the one most frequently used to avoid asking for consent. The statutory text allows processing without consent when it is “necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.”
In principle this requires a documented Legitimate Interests Assessment — a genuine balancing of the company’s interests against your rights and freedoms. The ICO’s guidance on lawful bases accepts that direct marketing can qualify as a legitimate interest, while noting that intrusive profiling for advertising purposes generally cannot without consent.
In practice, “legitimate interests” appears as a catch-all. LinkedIn’s reliance on legitimate interests for targeted advertising was found by the Irish Data Protection Commission to be unlawful in a 2022 decision. The Irish DPC reached an equivalent conclusion about Meta’s approach to targeted advertising on Facebook and Instagram in January 2023, imposing €390 million in fines across two decisions. Meta had argued it could rely on contractual necessity — that personalised advertising was necessary to provide the service users signed up for. The EDPB rejected that, and the DPC’s decisions confirmed that the legal basis for personalised advertising in the EU is consent, not contract or legitimate interests.
Watch for a policy that says a company processes your data for “business purposes on the basis of legitimate interests” without specifying those purposes. It is reserving the right to do things it has not disclosed, under a legal basis it has not properly tested. Under GDPR you can object to legitimate-interests processing under Article 21(1). The burden then shifts to the company to demonstrate compelling grounds to override your objection.
Retention periods — or the absence of them
GDPR Article 5(1)(e) requires personal data to be kept “no longer than is necessary for the purposes for which the personal data are processed.” Most privacy policies technically satisfy this with a vague line. Something like: “We retain your personal data for as long as necessary to provide the service, or as required by applicable law.” No period is given. No differentiation between data types. No explanation of what “necessary” means in practice.
The California Privacy Rights Act (CPRA), effective January 2023, goes further than GDPR in one specific respect. It requires businesses to disclose the retention period for each category of personal data they collect. US companies with Californian customers who comply with CPRA publish retention schedules. These tell you explicitly that purchase history is kept for seven years, location data for twelve months, browsing behaviour indefinitely. If that same company’s global policy says “as long as necessary,” the CPRA schedule shows what that means.
Absence of a specific retention period is a signal. Data kept indefinitely can be breached, subpoenaed, sold in an acquisition, or used for purposes that did not exist when you created your account. Companies that delete data quickly tend to say so — it is a differentiator. Companies that keep it indefinitely say as little as possible.
Consent that isn’t really consent
Many privacy policies describe a consent mechanism in language that sounds more meaningful than the mechanism actually is. A policy might state: “You can control your marketing preferences by adjusting the settings in your account.” This sounds like genuine user control. Whether it is depends entirely on the default setting and the ease of changing it.
GDPR Recital 32 is clear: “Silence, pre-ticked boxes or inactivity should not constitute consent.” Suppose the marketing preferences box defaults to ticked and most users never visit account settings. The policy has technically disclosed an opt-out, but the practical effect is consent through inaction.
In January 2022, France’s CNIL fined Google €150 million and Meta €60 million over their cookie consent designs. Accepting was a single click, but declining required navigating nested preference panels. That asymmetry violated GDPR’s equal-ease requirement. The ICO’s 2023 enforcement notices to major UK websites made the same point under UK GDPR.
When reading a privacy policy, find where it describes the consent mechanism. Then ask two questions. What is the default state? And how many steps does it take to change it?
The unilateral update clause
Almost every privacy policy contains a provision in the following form: “We reserve the right to update this policy at any time. We will notify you of material changes by posting the updated policy on our website. Your continued use of the service constitutes your acceptance of the revised terms.”
This clause has been used to expand data-sharing practices after corporate acquisitions. The WhatsApp example is the most documented case. When Facebook acquired WhatsApp in 2014, WhatsApp’s privacy policy explicitly stated that user data would not be shared with Facebook. In August 2016, WhatsApp updated that policy. It began sharing certain user data, including phone numbers and usage patterns, with Facebook entities. The stated purposes included improving Facebook ads and products. Users who continued using WhatsApp had, under the policy’s own terms, accepted this expansion.
The EU took action. The European Commission investigated under competition law rather than data protection law. It fined Facebook €110 million in 2017 for providing misleading information during the acquisition process. Specifically, Facebook had claimed that linking accounts between the two platforms was technically unfeasible. Under GDPR, which came into force in 2018, data protection regulators also scrutinised the data-sharing arrangement. For EU users of WhatsApp, regulators ultimately restricted the sharing for accounts that existed before the 2016 policy update. For users outside the EU, no equivalent restriction applied.
The structural problem is this. The unilateral update clause, combined with a continued-use-equals-acceptance model, lets a company materially change how your data is processed without asking for fresh consent. Under GDPR, material changes to processing purposes or legal bases require communicating the change clearly and, where applicable, obtaining new consent. Under US law, the continued-use model is generally enforceable. When these update notices arrive — the modal that says “We’ve updated our privacy policy” — reading the summary of what changed is worth three minutes of your time.
Which five clauses should you check in a privacy policy?
Rather than reading a full policy, locate five specific sections. Most policies have a table of contents or anchor links; failing that, a browser Ctrl+F search takes under two minutes.
Third-party sharing. Find the section on sharing or disclosure. Does it name specific categories of recipients, or does it use phrases like “trusted partners,” “service providers,” and “business partners” without definition? Under GDPR-compliant policies, you will see categories like “advertising networks,” “analytics providers,” and “cloud infrastructure providers.” Under policies not constrained by GDPR, you will often see only vague phrases. The vaguer the language, the broader the licence.
Retention periods. Search for “retain” or “retention.” Watch for a sentence ending with “as long as necessary” or “as required by law.” With no specific time period, there is no defined deletion schedule. The CPRA requires Californian-facing businesses to publish specific periods. If the policy does not, check whether the company has a separate CPRA or “California Privacy” supplement. Many publish the specific schedule only there.
Consent mechanism. Find where the policy describes how your consent is given and how you can withdraw it. Phrases like “by using the service, you consent” are broad and not specific to any particular processing purpose — these are structural consent waivers, not genuine consent mechanisms. Look for whether withdrawal is described as equally easy as giving consent, and what the default state of any preference is.
Update notification. Find how the company says it will tell you about changes. “We will post notice on our website” means you will not be told directly. “We will notify you by email before material changes take effect” is meaningfully different. The notification method determines whether you have any realistic chance of knowing the terms have changed before you are bound by them.
Data sale. Under CCPA and CPRA, companies subject to California law must explicitly disclose whether they sell or share personal information as those laws define it. They must also provide a “Do Not Sell or Share My Personal Information” link or mechanism. If a company’s policy covers the US and includes a CCPA section, that section tells you whether your data is sold. Outside that regulatory context, many companies process data in ways that function economically as a sale. They share it with advertising partners who pay for access, without ever using the word “sell.”
Tools that do the reading for you
For services you use regularly without wanting to review full policies, several resources do useful pre-processing work.
Terms of Service; Didn’t Read (tosdr.org) has been rating and summarising privacy policies since 2012. Services receive a grade from A to E, with specific clauses flagged as consumer-friendly or hostile. The most widely used platforms — Google, Meta, Apple, Amazon, Spotify, Twitter/X, LinkedIn — are covered in detail. An E-rated service means the summary team found the terms particularly harmful to users.
PrivacySpy.io runs a similar analysis with a searchable database, useful for comparing services in the same category across clause categories including data sale and third-party sharing.
Both tools reflect policies as of their last review. For high-stakes decisions — a health app, a financial service, a workplace tool — they supplement but do not replace a direct check of the five clauses above.
The most direct reality check is a Subject Access Request (SAR). Under GDPR Article 15, you are entitled to receive a copy of all personal data a company holds about you, along with information about processing purposes and recipients. Comparing the response to what the policy claims is collected frequently reveals discrepancies — data kept longer than stated, undisclosed data categories, or third-party recipients the policy omits. Under CCPA, Californian residents have an equivalent right. Both must be answered within 30 days (GDPR) or 45 days (CCPA), at no charge. Template letters and escalation steps are in the practical guide to exercising your GDPR rights.
Why this matters beyond the abstract
Privacy policies are not the end point of data handling. They are the permission slip that determines what happens downstream. A company that reserved the right to share with undefined “trusted partners” can transfer your browsing history, purchase patterns, and location data to an advertising data broker. That broker aggregates it into a profile sold to insurers, employers, or political campaigns. None of this requires a breach. It is the policy working exactly as written.
Gravy Analytics was sanctioned by the FTC in December 2024 for collecting and selling sensitive location data from mobile apps without adequate consumer consent. That included visits to healthcare facilities and places of worship. Many of the source apps disclosed sharing location data with “analytics partners.” Technically accurate. The end use — health-related movement profiles sold to any paying customer — was not disclosed in any form a user could have anticipated.
The clauses described here are the ones that create the gap between what a policy technically says and what it actually enables. Finding them does not require reading 76 days’ worth of policies. It requires knowing where to look and what the phrasing means when you find it.
See what a scan finds → walks through an example report of the kinds of personal data brokers expose. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.