You can get the substance of almost any privacy policy in about five minutes by reading six sections and skipping the rest: what they collect, why they say they are allowed to, who else receives it, how long they keep it, what you can demand, and how the policy can be changed later. Those six hold the actual commitments. The remaining pages — definitions, the cookie taxonomy, the children's section, the jurisdiction clause, the postal address — are either identical boilerplate across every site or do not apply to you.
Policies are long because they are written to be defensible, not to be read, which is also why skimming front to back fails: the first screen is the least informative part of the document. The trick is to stop reading and start searching.
The method: search, don't read
Open the page and use your browser's find function (Ctrl-F, or Cmd-F on a Mac) for a handful of words. Each one lands you in one of the six sections:
- collect — what they take
- legitimate interests or basis — why they say they may
- share, sell, partners, third part — who else gets it
- retain or retention — how long they keep it
- request or delete — what you can make them do
- change or update — how the deal can shift under you
The second habit is to read the verbs. "We do not sell your personal information" is a commitment. "We may share your information with selected partners" is a permission the company is granting itself, written to cover what it might do in three years rather than what it does today. Any sentence built on may describes the ceiling of the behaviour, and the ceiling is what you are agreeing to.
1. What they collect
This section is nearly always two lists. The first is what you hand over knowingly, and you already know it because you filled it in.
The second is the interesting one, usually labelled "information collected automatically": IP address, device and browser, operating system, the pages you viewed and in what order, the referring site, your time zone, an approximate location derived from the IP address, and identifiers stored in cookies or embedded in images. Nobody consents to this list in any meaningful sense — it describes what the site already recorded while you were reading the policy.
Two things here are worth slowing down for. "We use pixels to understand how our communications are used" belongs in this list too, because a tracking pixel reports back when and where you opened an email, and blocking it is an easy separate fix. A mention of data obtained from other sources — brokers, enrichment providers, "publicly available sources" — means the profile is larger than what you gave them. And "inferences" or "preferences we derive" means the file holds conclusions about you that you never stated and cannot check.
2. Why they collect it
Under European-style data protection law a company has to name a lawful reason for each use, and in practice there are four: it is necessary to deliver what you asked for, a law requires it, you consented, or the company claims a legitimate interest.
The fourth is the one to read, because it is the company's own assessment that its interest outweighs your privacy, made without asking you. It is often entirely reasonable — fraud prevention and security logging usually sit here. But when analytics, profiling or marketing to existing customers is justified this way, the company is telling you it decided on your behalf. The useful detail is whether the same paragraph offers a way to object, and whether that way is a link or a postal address.
3. Who else gets it
If you only read one section, read this one: it is where two superficially identical policies actually differ, and it usually lists categories rather than companies.
Service providers (or "processors") are the hosting, payment, email-delivery and support tools the company runs on — unavoidable and fine in principle. What matters is whether analytics and advertising vendors have been quietly filed under the same heading.
Affiliates and group companies means other brands under the same owner, which with a large group is a far wider circle than the site you signed up to.
Advertising partners is where your email address stops being contact details and becomes an identifier. Addresses are usually passed hashed rather than in plain text, which sounds protective but is not anonymisation: the same address produces the same hash everywhere, which is exactly what makes it work for matching you across unrelated sites. Policies written for California law often say "we do not sell your personal information" and then, separately, that they "share information for cross-context behavioural advertising." Both can be true, because those are two defined terms — and the second describes ad targeting. Read them together.
Third parties for their own purposes is the phrase that should stop you. A provider acting on the company's instructions is one thing; a third party free to use your details for its own marketing is list rental, and it is the usual explanation for junk arriving at an address you only ever gave to one site. If that is already happening to you, the most common causes of a sudden rise in spam are worth working through in order.
Business transfer appears in nearly every policy: if the company is acquired or sold, your data goes with it. Standard, not sinister, but it has a real consequence — the promises you are reading today belong to whoever owns the database tomorrow.
4. How long they keep it
The honest version of this section gives periods per category: transaction records for a stated number of years because tax law requires it, support tickets for months, marketing lists until you opt out, server logs for weeks.
The common version says "we retain your information for as long as necessary to fulfil the purposes set out in this policy." That is not a retention period. It restates the rest of the document, and it is compatible with keeping everything indefinitely.
This is the clause that matters most when something goes wrong, because data a company no longer holds cannot leak. It is also the one people discover too late: what actually happens after your address appears in a breach depends largely on how much a long-dead account still had on file.
5. Your rights, and how much friction stands in front of them
The list of rights is dictated by law, so it reads almost identically everywhere: access a copy, correct errors, delete, object to certain processing, take your data elsewhere, withdraw consent. Reading it closely teaches you little.
The mechanism is the informative part. A one-click control in your account settings, a web form, a named email address, or an instruction to write to a data protection officer by post? Does deletion require identity documents? Is opting out of marketing handled separately from closing the account — which it often is, and which is why people who deleted an account still get mail?
Response times are set by law, not by the company: broadly one month under the GDPR and 45 days under California's rules, each extendable in defined circumstances. A policy that mentions no timeline is simply not telling you one.
6. How the policy can change
Almost every policy ends with "we may update this policy from time to time, and your continued use constitutes acceptance." You cannot negotiate it, but you can read two things off it.
First, whether the company commits to telling you about material changes, and how — an email, or a quietly edited page. Second, whether there is a "last updated" date at the top. A dated policy can be compared against what you agreed to; an undated one cannot.
What to do when the policy is bad
You are not going to negotiate with the document, and refusing every service with a broad sharing clause would rule out most of the internet. The lever you control is how much you put in before you agree, because a sharing clause can only reach the fields you filled. Guest checkout instead of an account, a blank phone number, and a separate address for sites that only want one as a turnstile all shrink the surface first. For those turnstile cases — a gated download, a one-off code, a forum you will read once — a disposable inbox leaves nothing behind to share.
That is the right frame for the exercise. A policy is a statement of intent and a legal commitment, not a technical guarantee. Reading it tells you what a company has given itself permission to do; what happens when it is breached is a different question, and the best defence against both is having handed over less.