I just posted my new article draft with Professor Woodrow Hartzog (BU Law School) on SSRN (free download): Privacy as Contract?
Here’s the abstract:
Nearly everything people buy, every service they use, every account they create, and even every website they visit involves the collection, use, and transfer of personal data—a matter that is ostensibly governed by privacy notices (also called “privacy policies”). Privacy notices are the foundation of privacy regulation; most privacy laws rely on the existence of privacy notices as a central pillar. Various statutory rights and obligations are tied or limited by what is specified in privacy notices, including the scope and nature of the collection, use, and transfer of personal data.
On the surface, privacy notices seem like contracts. They feel promissory in nature and are central to the grand bargain between consumers and companies at the heart of surveillance capitalism. When companies break the promises they make in privacy notices, contract law (through regular contract or promissory estoppel) appears to be a tool that could empower consumers to seek redress. But this has rarely been the case. Privacy notices still exist in a weird twilight between a mere description of policy and a binding agreement. They are even strangely still separate documents from companies’ terms of use agreements. Despite nearly forty years after privacy notices emerged to become the dominant mechanism to address privacy issues, the question of how contract law applies to privacy notices has been only thinly addressed by courts.
In this Article, we argue that contract law is unsuitable for governing consumer privacy. The law of consumer contracts is too oblivious to power disparities, too focused on the individual at the expense of groups and society, and too infected with bogus conceptions of consent to serve as a viable foundation to govern privacy in consumer transactions. Applying contract law more robustly and consistently to privacy notices will not better protect consumers—in fact, it will worsen protection and exacerbate the significant power imbalance between companies and consumers.
Even with reforms, applying contract law to privacy notices will not lead to a desirable balance of power between companies and consumers. Current contract law lacks the right tools to address privacy issues; it is rooted far too deeply in an individual control model similar to the one that has failed spectacularly in privacy law.
Instead of being developed to colonize privacy, contract law should be subject to an internal revolution in how it handles transactions in the Digital Age. With the internet and digital technologies, contract doctrine has lost its way and functions mainly to enable companies to wield power unilaterally against consumers. The fundamental goals, scope, and structure of consumer contract law must be rethought to better address problems with consent, fairness, and power.
