Forbes Technology Council | How To Tell If A Company’s Privacy Promises Don’t Add Up
By Expert Panel®, for Forbes Technology Council
Companies routinely assure customers that their personal information is safe, but privacy policies and reassuring statements don’t always tell the whole story. As businesses collect, share and use data in increasingly complex ways, both individual consumers and business clients need to know whether privacy commitments are backed by responsible practices.
For businesses evaluating potential partners and consumers deciding which companies to trust with their information, recognizing potential red flags can help prevent problems before they arise. Below, members of Forbes Technology Council share warning signs that may indicate a company isn’t handling consumer data as carefully or responsibly as it claims.
At the heart of privacy risk lie two familiar threats: data that escapes unnoticed and data that is shared beyond its intended use. When an organization lacks disciplined governance and effective access controls, it is not a true steward of privacy, and there’s no structure to ensure consumer data is managed responsibly. – Shefali Mookencherry, University of Illinois Chicago
Be wary of reassuring language paired with vague architecture. It’s a warning sign when a company can’t explain where your data actually lives, who touches it or how it’s deleted. That’s not privacy. That’s a policy wearing a costume. – Merlin Bise, Inbenta
Ignore the privacy policy. Watch the permissions. A flashlight app that wants your contacts or a coupon site that tracks your every move is telling you everything its lawyers won’t. Companies that truly respect your data collect only what the product needs and can explain every field. Companies that collect everything aren’t building trust. They’re building inventory. And inventory eventually gets sold, shared or breached. Believe what they take, never what they say. – Dr. Aditya Vikram Kashyap, Morgan Stanley
A big warning sign is when a company’s actions don’t match its privacy promises. If it’s collecting more data than it clearly needs, retaining it indefinitely or making it difficult for consumers to access or delete their data, that’s worth questioning. – Stephen Clark, Vanguard Group Inc.
It’s a warning sign when a company can’t show you how to delete your data. Privacy policies are easy to write. Data deletion is hard to build. If a company can’t clearly explain how a customer can see, export or permanently delete their data, it is a warning sign that the company is probably covering for weak practices underneath. In the age of AI, data piles up very quickly and quietly in training sets, logs and backups. Responsible companies decide up front what they collect, why they collect it, and when they get rid of it. – Rajesh Iyengar, Lincode Labs Inc.
A warning sign is a mismatch between reassuring language and the fine print: A company calls itself only a processor, yet its services or sub-processors, such as SMS carriers, can access, retain or reuse personally identifiable information. Check every data flow, especially whether “service improvement” includes sharing data to train LLMs. If consent isn’t clear, pause. – Rafael Flores, Treasure AI
A simple litmus test would be to start on the company’s home page and count the number of clicks you had to make in order to get to the company’s reassuring privacy language. If it was more than two, you may want to consider how closely that company wants its privacy practices examined. – Kim Bozzella, Protiviti
One warning sign is privacy language that sounds reassuring but says little about how consumer data is collected, used, shared or stored. A company that cannot trace an application rejection or account flag back to the relevant data cannot explain its own decisions, and it will often miss when those decisions are wrong. – Ravi Nemalikanti, Abrigo
. . .
To see the full article featuring Abrigo, visit Forbes, “How To Tell If A Company’s Privacy Promises Don’t Add Up.”
