Privacy Fatigue
Let’s face it: most people don’t care about their data or online privacy. Every day, millions of people happily use Instagram, TikTok, or sign up for the latest shiny app without giving a second thought to how their personal data might be used - or misused - by these companies. Questions like, “What legal basis do they have to collect this data?” or, “How long will my information be stored?” rarely cross their minds. And why would they? To the average person, it’s abstract, tedious, and, frankly, irrelevant to their day-to-day lives.
And they’re not wrong. They shouldn’t have to care. Because even if they did muster the energy to read through privacy policies, dig into terms of service, or scrutinize cookie consent pop-ups, what could they realistically do about it? What can you actually do with the data you download under the GDPR’s Right to Access? Imagine trying to take on a behemoth like Meta or ByteDance because you spotted a vague clause in their privacy policy. Even if you had the legal expertise to find a flaw, the power dynamics are so skewed that it feels pointless to resist. Not everyone’s name is Max Schrems.
This new kind of SEO when companies are optimizing their consent and cookie screens to skew the conversion rates toward “Yes” by a couple of percent is exactly why nobody reads these screens or documents - just like nobody actually read the iTunes Terms and Conditions, famously lampooned in South Park S15E1. Legal jargon, walls of text, and endless “agree” buttons have turned into white noise for users. It’s not apathy; it’s fatigue. The sheer volume of decisions we’re expected to make about our privacy is overwhelming, and the sense of powerlessness that accompanies it makes most people disengage entirely.
It’s all a privacy theater, as correctly notes Carey Lening:
The world of data protection has largely fallen into this symbolic representation trap. This is made manifest in all the ways that organizations drown us in information to demonstrate compliance, and signal that they care about our privacy. Whether it’s the endless sea of privacy policies and notices that nobody reads, the non-negotiable e-book length data processing addendums, the cookie notice popups that never remember your preferences, the ‘risk assessments’ that don’t meaningfully evaluate risk, or the security white papers which might as well be marshmallow fluff. It’s all so many words, with so little substance.
That’s the real tragedy. By making privacy policies so inaccessible and disempowering, companies have created a system where the people whose data is most at risk feel least equipped to protect it. It’s a cycle of indifference, fueled by complexity - and it’s by design.
I’m not saying that the GDPR is bad or that we don’t need measures to protect data privacy. What I’m pointing out is that continuous fines and constant regulation don’t seem to stop Big Tech from misusing data or complying in bad faith. Instead, they primarily make life harder for smaller companies and worsen the entire internet with consent banners.
And, at the end of the day, can we really blame people for tuning out? Until privacy becomes less about endless forms, legalese, and checkbox fatigue, and more about empowering individuals with meaningful control, it’s no wonder most people just shrug and move on. After all, their photos, likes, and personal details already seem like small sacrifices for a convenient digital life.
To quote Carey again:
We must prioritize the development and adoption of actions – nurturing the growth and expansion of privacy-enhancing technologies, setting meaningful, practical & actionable design standards, and holding entities accountable for their actual data (ab)uses. This will build trust, change behaviors, and protect privacy and data – the actual things we care about. By emphasizing the practical and tangible aspects of data protection as opposed to their representations, we can finally move away from the superficial, compliance hell that we’ve found ourselves in, towards a future where privacy is not just a buzzword, but a reality.