Privacy policies from some major streaming sites may require a university reading-level to fully understand, according to new research by VPNOverview.
Listing out all the ways in which an organisation gathers, stores and uses its customer’s personal information and data, privacy policies are what keeps consumers informed about their data protection rights.
However, signing on to the terms and conditions without fully reading them is a common cliche amongst consumers simply trying to use a service – lengthly statements with legal jargon create an added barrier to transparency.
Cybersecurity expert Christ Bluvshtein from VPNOverview has therefpre compared the most complicated and difficult to read privacy policies from top streaming services in order to clarify what data these companies are really after.
Chris Bluvshtein from VPNOverview said: “A privacy policy is one of the most important statements on a company’s website. Skipping over one could put your personally identifiable information at risk of being exposed and resold. This makes you more vulnerable to annoying, unwanted spam calls and having your identity stolen.”
Readability
Disney+ – 2.8
Disney+ was found to be the hardest policy to read with the lowest readibility score out of 100, requiring a university graduate reading level. Coming in at just 2.8, the legal jargon kept consumers in the dark despite only taking about 20 minutes to read.
More concerningly, the policy allows Disney to share data with third parties, and any data shared with these third parties are subject to that party’s privacy practices.
Essentially, Disney+ users are consenting to policies of companies they don’t even know, without knowing it, all for the sake of streaming Ratatouille and The Simpsons.
Netflix – 23.7
Netflix’s policy also required a university graduate reading level, and had one of the longest word counts at 4,977 words, taking about 38 minutes to read.
Data collected by the streaming services include devices used, location, and browsers. Netflix is unclear about why it collects this data, but it could be advantageous as it cracks down on shared accounts.
Spotify – 25.0
With a read time of about 45 minutes, Spotify’s policy also required a university graduate reading level.
Intriguingly, the music streaming service’s policy says it can log and store voice data and build up personal profiles for users. The policy claims to use voice data to “evaluate and develop new features, technologies and improvements to the Spotify service” and “to comply with a legal obligation we are subject to.”
Sky – 29.7
Despite being 1,710, its low readability put Sky’s privacy policy as the fourth most difficult to read, and it also requires a university graduate reading level.
Sky states that it will keep data including payment card and financial history for up to seven years, even after you cancel your subscription. Other types of data such as recorded calls to customer services are deleted after twelve months.
YouTube – 30.6
While still ranking a the fifth most difficult to read, YouTube’s privacy policy would only require a university student’s reading capacity to get through the 872 words.
Sharing policies with Google, YouTube collects and stores search terms, videos watched, and location data to personalise ads to its viewers.
ITV – 35.6
ITV’s privacy policy is only 300 words longer than that of Disney+ however it is much easier to read, only requiring a university student reading level.
The policy states that the user can object to the company processing their personal information and that they will “consider if your rights outweigh our interests and if they do, then we will either restrict our use of your information or delete it.”
Recommended
- Four Strategies for Digital Challenger Banks to Turn a Profit in 2023
- InnoScot Health Launches Webinar Series for Innovators
- Big Tech Layoffs | What You Need to Know
BBC iPlayer – 43.5
The BBC’s streaming service was only 555 words long, requiring only a university student reading level.
The policy is due to be updated, however, but the BBC will require new consent from users if they change the way they use their data.
Apple TV+ -43.4
While Apple TV’s privacy policy includes a ‘do not track’ option for users, it does stipulate that information regarding purchases and downloads for ” at least a 10-year retention period – in China the period is extended to 30 years.
Channel 4 – 56.2
While Channel 4’s privacy policy is the easiest to read, requiring the reading level of a school student, it is also the longest, taking over an hour to read through.
Channel 4 does collect data and provides them to third parties, but ensures these are ‘thoroughly checked.”
Data collected includes housing status, if uses are married or havve children, and household consumption habits.
“The majority of the policies we examined would be considered unreadable for many UK users, given that the majority required at least a university undergraduate reading level, ” Bulvshtein concluded. “This is particularly problematic when you consider that 1 in 7 adults in England alone, have a reading age expected of a 7-9 year old.”
Get all the latest news from DIGIT direct to your inbox
Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.
To subscribe, click here.





