Reading a privacy policy is a checklist task, not close reading. In ten minutes you can find five answers: who holds the data, what gets collected, who receives it, how long it is kept, and how to undo a signup. California's Department of Justice expects a compliant policy to describe six consumer rights, as of January 1, 2023.
This is how to read a privacy policy in ten minutes. The method works because policies follow legal templates. Regulators demand the same sections almost everywhere, so the reading order never changes. Bring the five questions. Ignore everything else on the first pass.
Find the policy before you read it
The document hides in plain sight, and California's attorney general describes the usual spots.
- Step 1. Open the service’s homepage and scroll to the very bottom. Expected: a row of small footer links, one named “Privacy” or “California Privacy Rights.”
- Step 2. In a mobile app, check the store download page and the app’s settings menu. Expected: a link to the same document there, per the attorney general’s guidance.
If neither place holds a link, treat that as a finding. A company that hides its practices has told you something.
Start with who is collecting
UK guidance from the Information Commissioner’s Office puts the first required item at the top: the name and contact details of the organisation. Its checklist marks that item as always required. Find the legal entity name and a contact address. Expected result: a company you can name in a complaint, which may differ from the brand on the box. Subsidiaries tend to surface in this paragraph.
Read the collect and share lists
California’s notice at collection rules require a business to list the categories of information it gathers and the purposes for each use, per the state Department of Justice. Scan for the words collect and share, then read the bullets around them. Expected result: a short map of what leaves the device. If the business sells data, the law expects a Do Not Sell or Share link, and the attorney general’s CCPA guidance says the notice must carry it.
Match each listed category against the service’s job. A delivery app that keeps location history while active passes the smell test. The same app reading a contact list does not, and the policy will say so if you look.
Find the exits before you need them
Rights sections are the fastest part. The CCPA, as amended by the CPRA with effect from January 1, 2023, expects a policy to describe the rights to know, to delete, to correct, to opt out of sale, to limit, and to be free from discrimination for using them. Confirm the policy states a contact method for requests and a response deadline. Expected result: a working email or web form you can bookmark today, not during a crisis. This connects to our earlier piece, How to spot a phishing email: the six checks that catch most fakes.
Retention matters as much as rights. UK GDPR guidance treats retention as a required disclosure, so search for the words retain or keep. Expected result: either a concrete period in months or years, or a phrase like as long as necessary. Vague is common. Rename it in your head: they keep it until they decide otherwise.
A request needs no lawyer. State the right by name, send it through the listed channel, and note the date you sent it. Expected result: a confirmation number or an acknowledgment email, which becomes the timeline if the company stalls. Keep both. The paper trail costs two minutes now and saves weeks later. For related coverage, see Beginner's guide to two-factor authentication: what it is and how to start today.
Conclusion: five answers in ten minutes
A policy read this way yields five answers: who holds the data, what gets collected, who receives it, how long it stays, and how to reverse a decision. Anything unanswered is a signal about the company, not about the reader. The legal template does most of the work. Ten minutes finds what regulators already force companies to disclose, and the silence speaks too.
