In the mobile era an app is standard equipment, and tapping ‘I have read and agree to the terms of service and privacy policy’ is the standard first move. Those documents run to tens of thousands of characters, the length of a paper, and surveys suggest close to 80% of users rarely or never read them. What is buried in the text? A reporter looked, ahead of 15 March.
Who reads 27,000 characters?
Five apps with more than 100 million downloads each — social, gaming, short video and shopping — were checked. Each writes its own terms, but the basics repeat.
The terms usually describe the product and the rules of use: how accounts are registered and closed, what happens if a password is lost. They set out user conduct, forbidding the fabrication or spreading of rumours and false information. They assert the company’s rights, including ownership of the intellectual property in content. They disclaim liability and give contact details.
On personal data, which has drawn most attention, the terms generally carry a separate chapter, sometimes with clauses on minors, and the privacy policy sets out how data is collected, managed, stored and protected.
Across the five apps the terms and policies ran past 130,000 characters, an average of about 27,000 per app — longer than an undergraduate dissertation and close to a master’s. Smaller apps are shorter, in the thousands.
How much of that gets read? A joint research group led by Yuan Kang, deputy director of the Wuhan University Institute for Network Governance, surveyed 1,036 people last year: 77.8% rarely or never read the privacy policy when installing an app, and 69.69% ignore notices that it has been updated.
‘The terms are dense with information that specialists find painful, let alone ordinary consumers,’ Yuan said. ‘That so few read them shows the documents are a formality that does not deliver the right to know they were meant to deliver.’
Five traps
Governance has improved these documents, but some apps still dig pits.
Trap 1: agree or leave
The Personal Information Protection Law says a processor may not refuse to provide a product or service because a user will not consent to processing, or withdraws consent, unless the processing is necessary to provide it. ‘An app showing products or video has no need to demand personal data beyond that, and refusing service when consent is withheld is not acceptable,’ said Zuo Xiaodong, deputy director of the China Information Security Research Institute. ‘Whether something is necessary should not be for the app to decide unilaterally, and the grey areas need closing.’
Trap 2: consent by default
In March a logistics-tracking app was reported by the national computer virus emergency response centre for failing to prompt users to read its privacy policy through a pop-up or other obvious means on first run, and for seeking consent by pre-ticking the box.
Trap 3: collect first, ask later
Several apps this year, among them a health service and a travel app, began collecting personal data before consent was given and were each reported. ‘Supervision has tightened, but unlawful collection is still hard to see,’ Yuan said.
Trap 4: consent once, consent forever
Some apps revise the privacy policy as they go, without the user being able to tell what changed. One beauty app’s terms state that the company may revise the agreement and its rules from time to time, publish the revision in the app and not notify users separately, and that using the service counts as accepting it.
Trap 5: passing data to third parties
One shopping app’s terms claim a permanent, worldwide, royalty-free right to use a user’s video, photos and text, and the right to license it to any third party without seeking consent at the time of use. Yuan’s reading is that the initial agreement already grants the sharing of user data with third parties, which amounts to asking users to give up any future say over where their data goes.
Could the terms be a checklist?
Zuo and others argue that some of these documents use obscurity to muddy the water, and call for a checklist that sets out what consumers need to know in plain terms, lowering the bar to reading them.
Chen Xuhui, who heads the internet information and user behaviour research centre at Tianjin University of Finance and Economics, and Yuan both want the material that affects users put up front, the way a listed company’s annual report carries a summary or a paper carries an abstract.
‘The terms also need to define what counts as necessary information and who counts as a third party, rather than saying vaguely that data may be disclosed to third parties,’ Yuan said. ‘Sensitive data should be anonymised before it is shared.’
App stores carry responsibility too. Chen argues that regulators can focus on the stores as the gatekeepers, by defining their liability for hosting non-compliant apps, so that the problem is dealt with at the point of listing.
And users need to be able to protect themselves. Zuo sees younger, better-informed users as the group most able to push these documents toward something usable, with lawyers and others joining in — a cycle in which every violation gets reported and every report gets investigated.
Republished for information. The original text has not been independently verified and does not necessarily reflect our views.
Want to talk through what you just read?
We work end to end, from product design to launch. Tell us about your scenario and we can start there.
Shenzhen XZS Technology Co., Ltd. · Tel 0755-82494862 · 13760424861