Kesan, Jay P., Carol M. Hayes, and Masooda Bashir. "Consumer Privacy Choices, Informed Consent, and Baseline Protections to Facilitate Market Transactions in the Cloud" (April 19, 2012). Illinois Program in Law, Behavior and Social Science Paper No. LBSS12-11; Illinois Public Law Research Paper No. 11-20.
From the abstract: "So many of our daily activities now take place 'in the cloud,' where we use our devices to tap into massive networks that span the globe. Virtually every time that we plug in to a new service, the service requires us to click the seemingly ubiquitous box indicating that the user has read and agrees to the provider’s Terms of Service and Privacy Policy. If a user does not click on this box, he is denied access to the service. It is generally accepted that no one reads these agreements. They click accept, because otherwise they could not use the service of their choice, and these terms are typically almost entirely disregarded as a factor when services are chosen. If a user is asked why he does not read these terms, he might offer reasons like the dense legalese, or the length of these agreements.
However, not reading these agreements can have negative effects. Some agreements contain binding arbitration provisions, limiting the agreeing party’s avenues for redress if the provider wrongs him. When a user is not informed about the terms of a privacy policy, she may be unknowingly consenting to the disclosure of her information to third parties with whom she would not want to share her information. These agreements can also affect the agreeing party’s legal rights. The Department of Justice has argued that violating a website’s Terms of Service amounts to a violation of the Computer Fraud and Abuse Act. Additionally, agreeing to overbroad privacy policy terms could reduce a party’s protections under the Stored Communications Act and the Fourth Amendment.
As part of this work, we analyzed and categorized the terms of TOS agreements and privacy policies of several major cloud services to aid in our assessment of the state of user privacy in the cloud. Our empirical analysis showed that providers take similar approaches to user privacy, and were consistently more detailed when describing the user’s obligations to the provider than when describing the provider’s obligations to the user. This asymmetry, combined with these terms’ nonnegotiable nature, led us to conclude that the current approach to user privacy in the cloud is in need of serious revision." Read more
