With regular headlines about data breaches and tech scams, AI might not be the first tool you think about for taking more control of your privacy online. But I know many people tend to agree to privacy policies without so much as skimming them to understand how a website or app is using their data.
So, I had a theory: If the choice is between not reading the terms you’re agreeing to at all or taking a few minutes to get an AI-generated recap of the key points, this might be a scenario where AI can actually help protect your privacy a little better than you would otherwise.
To test out my theory, I asked four AI chatbots to summarize various privacy policies, including their own. The results were surprisingly useful, though there are a few tricks needed to get all the key information you need. After some trial and error, here are the steps I used to quickly make sense of tediously long privacy policies.
Sign up for Kiplinger’s Free E-Newsletters
Profit and prosper with the best of expert advice on investing, taxes, retirement, personal finance and more – straight to your e-mail.
Profit and prosper with the best of expert advice – straight to your e-mail.
1. Ask AI to summarize the privacy policy page
(Image credit: Gemini)
For this test, I used ChatGPT, Gemini, Copilot and Perplexity. In all cases, I was able to simply paste the URL of the privacy policy and say “summarize this” to get the AI to generate a recap.
The initial summary is fairly vague, but it provides enough to give you a quick overview of the policy. For example, Gemini’s summary of Google’s privacy policy was a very short, bullet-point recap of Google’s lengthy policy. So there’s definitely a lot missing, but it was enough to give me a sense of the kind of data Google is collecting about me, what it’s using it for, and what kind of third parties it might be sharing my data with.
Overall, the summaries were a good starting point to spot any possible red flags that I might be concerned about, so I know which sections of the policy I might want to read in full.
2. Ask follow up questions based on what you’re concerned about
(Image credit: Microsoft Copilot)
All the summaries I got were pretty short, which, to be fair, is the point of a summary. But to really understand what you’re agreeing to in a privacy policy, it helps to ask the AI a few follow-up questions on certain key points.
Here are questions I recommend asking:
- What data does the company collect about users? Look out for types of data that don’t seem necessary for the service. A delivery app needs your address, for example, but it probably doesn’t need access to your contact list.
- What data does the company collect from my device? This might include things like what device you’re using, your IP address or your physical location. Again, look for things that don’t seem necessary for the service.
- How does the company use the data it collects about users? If you see mentions of personalized, targeted, or interest-based advertising, the company is likely sharing your data with other companies. Even if you’re comfortable with how this company uses your data, those other companies might not be as safe or responsible as you’d like.
- Does the company sell or share user data with other parties? This is usually a red flag, but not always. If the policy lists the specific companies or agencies your data is shared with, that’s a good sign because you can check the privacy policies of those specific partners. If it lists vague categories like “advertisers” or “third parties,” you don’t have that same ability to verify the policies of every place that will have access to your data. Unfortunately, most privacy policies I checked are vague.
- What security measures are used to protect user data? If a company is gathering so much information, it’s important to know whether or not it’s taking the necessary steps to keep it safe from hackers and other criminals. If the privacy policy is vague on security, that’s a red flag.
- How long does the company store user data? Even with strict security measures, data breaches can still happen. Ideally, a company would regularly delete stored data so that there’s less information available for a hacker to steal in a breach. Some policies mention a time frame. Many don’t, but they might mention a way for you to manually delete your data or request to have your data deleted.
- Which tracking technologies does the company use? Cookies are a well-known type of tracking technology. But a site might also use other trackers, like web beacons and tracking pixels. The way to block or get rid of each one varies, so it helps to know which ones are being used.
- How can I opt out or limit the data the company collects about me? See more on this topic in Step 4.
The AI responses to these questions weren’t always helpful on their own. But they were usually enough to tell me whether or not the privacy policy mentions a particular topic at all.
Either way, I think it’s always worth verifying anything your preferred AI chatbot tells you by searching the full text of the privacy policy itself for the relevant section.
3. Find the relevant section in the original text to get the full picture
(Image credit: Perplexity)
Another useful feature of the AI summary is that it tells me the kind of language a particular policy uses, so I know what keywords to search for.
For example, Perplexity’s privacy policy says, “We do not ‘sell’ or ‘share’ (as those terms are defined under the CCPA) personal information.” So, doing a search in the original privacy policy for “sell” or “share” would take you to that specific section and nowhere else.
Meanwhile, the AI summary mentioned that Perplexity uses my data for marketing and advertising purposes. By using CTRL+F (or Command+F on iOS) to search the full text of the policy for “advertising,” I was taken to a section explaining how Perplexity “discloses” my information to advertisers and other third parties.
Assuming it is compliant with the California Consumer Protection Act (CCPA), it’s only disclosing de-identified information – data about me that can’t be traced back to me specifically. But that can still include information like my browsing activity, what devices I’m using and anything else it’s collecting about me as long as that information doesn’t tie that to, say, my name or address.
Since it uses the term “disclose” rather than “sell” or “share” in this section, I wouldn’t have spotted that nuance if I had just searched the policy for the usual keywords without first getting the summary from AI.
4. Find and make use of every option you have to limit data collection
(Image credit: ChatGPT)
Maybe the most important use of the AI summary is that you can quickly figure out what choices you have for protecting your privacy. In some cases, you might be able to opt out of having certain kinds of data collected or turn off certain cookies and other types of tracking technologies. In others, you might be able to request that data stored about you be deleted.
Of course, in an ideal world, you could simply choose to not use the particular website or app if you aren’t comfortable with the data it’s gathering or who it’s sharing that data with. In reality, some of the worst offenders when it comes to excessive data collection are major tech companies like Google and Meta, and it’s hard to navigate the internet without running into something owned by one of them.
Short of tossing every internet-enabled device you own and moving to the woods to live off-grid, you will inevitably have to agree to privacy policies that you aren’t entirely comfortable with if you want to use the internet.
If you don’t have the wilderness survival skills to go off-grid, your next best alternative is to check that privacy policy and look for any options you have to keep your data as private as possible.
AI can help here because, as mentioned earlier, the specific language used can vary from one policy to the next. In some, the language used is “opt out.” In others, those choices are referred to as “privacy settings” or “data settings” that you can adjust.
If the initial AI summary doesn’t mention anything about your options for controlling the data collected or shared about you, ask a follow-up question to get a sense of what language to search for in the full text.
Once you find the relevant section, immediately make use of any privacy settings or adjustments available to you. In some cases, this might be as easy as toggling certain features on and off in your account. In others, I noticed the company makes it a little cumbersome by requiring you to send an email to make the request.
What I learned from using AI to read privacy policies
One of the biggest lessons I learned from this experiment is that privacy is pretty much nonexistent online. Even when a website or app does allow you to limit data collection in some way, those limits are only a fraction of the enormous amount of information that companies are gathering about you.
But by using AI to quickly summarize and skim through privacy policies, you at least have an opportunity to check what you’re agreeing to before you do. For nonessential services like, say, a new game your friend wants you to download, you can simply choose not to download it if your AI review pulls up too many red flags.
For services you need, like a web browser or email server, you can quickly compare the policies of a few different services to find the one that offers you the most privacy. In cases where you don’t have many alternatives — like some Google services — you can, at the very least, find and make use of every privacy setting that service does offer.