No. 17
How to Read a Privacy Policy in Five Minutes (Without Losing Your Mind)
Privacy policies are long on purpose. Here's a five-minute method to find the parts that matter: what's collected, who it's shared with, whether it's sold, how long it's kept, and how to opt out. Includes the exact words to search for.
The Tea the short version
- You don't need to read the whole thing. You need to find five answers.
- Use Find on Page to search for sell, share, partners, retain, opt out, and location.
- Vague words like 'may,' 'such as' and 'including but not limited to' usually mean 'more than we're telling you.'
- If you can't find how to delete your data, that's an answer too.
In 2025, Washington's Attorney General asked residents about their privacy. Of the more than 700 who responded, 62% said opting out of targeted ads was difficult and 65% said requesting deletion was difficult (Ashurst Perkins Coie summary).
That's not because people are bad at technology. It's because privacy policies are written to protect companies, by lawyers, for lawyers.
But you can learn to read them like an analyst. Not every word. Just the ones that matter. Here's the five-minute method I teach in my classes.
The five questions
Every privacy policy, no matter how long, is answering five questions. Your job is to find the answers.
- What do they collect?
- Who do they share it with?
- Do they sell it?
- How long do they keep it?
- How do I opt out or delete it?
Open the policy. Press Ctrl+F (or Cmd+F on a Mac, or "Find on Page" in your phone's browser menu). Then search for the words below.
Minute 1: What they collect
Search: collect, automatically, location, device
Look for the list of what they gather. Pay special attention to anything collected "automatically", which is data gathered without you typing it in. That usually means device identifiers, IP address, browsing behavior, and often location.
What to notice: Is it "approximate" location or "precise" location? Precise location (GPS-level) can reveal where you live, work, worship and get medical care. Many states treat it as sensitive for a reason.
Minute 2: Who they share with
Search: share, third part, partners, affiliates, service providers
(Searching "third part" catches both "third party" and "third parties.")
There's a big difference between these:
- Service providers process data for the company, like cloud hosting or payment processing. Usually necessary, often restricted by contract.
- Affiliates are other companies under the same corporate umbrella. Your data may travel to brands you don't know are related.
- Partners and third parties is where it gets vague. Advertising partners, analytics companies, data brokers.
What to notice: Does it name actual companies, or just categories? Names are better.
Minute 3: Do they sell it?
Search: sell, sale, targeted advertising, cross-context
Here's a technical wrinkle worth knowing. Some companies say "we do not sell your personal information" but then describe "sharing for cross-context behavioral advertising" or "targeted advertising." In some state laws, those are treated differently from a "sale," even though data still flows to advertisers.
So don't stop at "we don't sell." Look for whether they share for advertising, too.
What to notice: A "Do Not Sell or Share My Personal Information" link. That's often a sign the company operates under state privacy laws and gives you an opt-out.
Minute 4: How long they keep it
Search: retain, retention, as long as, delete
Good policies give specific timelines: "We delete chat logs after 30 days." Weak policies say "as long as necessary for business purposes," which can mean forever.
What to notice: Data that's kept is data that can be breached. Short retention is a sign a company takes security seriously.
Minute 5: How to get out
Search: opt out, your rights, request, delete, access
Find the actual mechanism. Is it a web form? An email address? A setting in the app? Do you need to log in?
What to notice: If you genuinely can't find how to delete your data, that's an answer. It tells you how the company thinks about you.
The vague-word decoder
Privacy policies have their own dialect. Here's my translation guide:
| They write | It often means |
|---|---|
| "We may collect..." | We do, or we want the option to |
| "Information such as..." | This list isn't complete |
| "Including but not limited to..." | Definitely more than this |
| "To improve our services" | Could include training AI or building new products |
| "Trusted partners" | Partners. The word "trusted" is doing a lot of work |
| "Aggregated or de-identified data" | Data with names removed. Sometimes it can be re-identified |
That last one matters more than people realize. In September 2026, Italy's data protection authority fined a health analytics company €7 million after finding that a supposedly anonymous research database of about a million patients could still single out individuals, because a persistent patient code combined with detailed clinical and location data made re-identification possible (National Law Review). "Anonymous" is a claim, not a guarantee.
Health apps get a special check
If you're in Washington and the app touches anything health-related, like fitness, sleep, periods, mental health or medications, also search for "consumer health data." Under the My Health My Data Act, covered companies must post a separate consumer health data privacy policy and get separate consent to share. I explain that law in Washington's My Health My Data Act, Explained.
Practice on one app tonight
Pick the app you open most. Give it five minutes. Find the five answers. Then do one thing: turn off precise location, opt out of ad sharing, or set a reminder to request your data.
Small sips. That's how habits stick.
Pour me another: What's the sketchiest thing you've ever found in a privacy policy? Tell me through the contact form.
Sip slow, stay curious.D
Receipts 2 sources cited in this post
- Ashurst Perkins Coie summary ashurstperkinscoie.com
- National Law Review natlawreview.com
Your host
Dei’Marlon “D” Scisney
Founder & Principal Data Engineer, The Data Guys™
Data engineer, teacher and civic technologist. Vice-Chair of Seattle’s Community Technology Advisory Board. Raised by his grandmother in Evansville, Indiana; building community technology centers in Seattle’s Central District and back home in Evansville.
I am not a lawyer, and nothing here is legal advice. Facts were current when this was written, and every claim links to its source. Spot something that has changed? Tell me and I’ll update it.