## 6 Results and Discussion
To quantify the agreement between the two approaches, we measured the correlation between the ranking resulting from sorting policies according to Guard's ratings, and the ranking obtained by sorting the same policies by our global score. Correlation was measured by means of the Spearman's rank correlation coefficient, which assesses how well the relationship between the two scoring criteria can be described using a monotonic function (linear or not). In this way, we avoid depending on the scale of each scoring criteria and we can focus on the relative rankings they define. We obtained a of 0.839, which indicates a strong direct association between the two scores, even though they may consider different criteria. Our approach also provides per-goal scores that help to explain the global score. In particular, these fine-grained scores can make the user aware of the types of risks associated with the use of the service. Focusing on these scores, it can be seen that all service providers fulfill the _transparency_ goal. This is expected because the ultimate purpose of a privacy policy is to explain how personal data are managed, regardless how respectful this is with the individual's privacy. In fact, we found a number of sentences that made clear statements (which are good for transparency) on how careless the company is with the customer's data. For instance, Instagram states that it _\"cannot ensure the security of any information you transmit to Instagram or guarantee that information on the Service may not be accessed, disclosed, altered, or destroyed\"_. Being transparent on bad practices indicates that some companies expect customers not to read (or not being able to understand) their policies [3,4]. Regarding the goals that are more closely related to privacy, we can see that the scores associated with _confidentiality_, _unlinkability_ and _data minimization_ are much more variable across services, but strongly correlated among them for a given service: the average pairwise Pearson correlation among these three goals is 0.811 (with _confidentiality_ and _unlinkability_ exhibiting the strongest correlation of 0.9). The fact that fulfilling these  
Figure 1: Per-goal and global scores (higher is better) of privacy policies of several services and companies, sorted from best to worst by their global score. goals hampers the monetization of customers' data creates a conflict of interest that most companies face by prioritizing their own benefit. In fact, only Mozilla and Telegram, which operate under non-profit principles, obtained positive scores for all these goals. This can be illustrated by comparing how Mozilla and Netflix manage data releases to third parties. Whereas the former state that _\"we sometimes release information to make our products better and foster an open web, but when we do so, we will remove your personal information and try to disclose it in a way that minimizes the risk of you being re-identified\"_, Netflix just informs that _\"we disclose your information for certain purposes and to third parties\"_. _Intervenability_ obtains middle-of-the-road results. Lacking on _intervenability_ goes one step beyond against customers' privacy because it also negates users the possibility of controlling how their data are collected and managed. So, it is not surprising that the services with the worst global score are also the worst regarding _intervenability_: the Pearson correlation between _intervenability_ score and the global score is a strong 0.847.