Entity Accessibility and length Contractual issues Self-regulatory scheme - Security claims 3440 Via app page (eg. Appendix B, Image 3) Agree to contract through use of service. Agree to privacy policy through use of service Informs you how you can opt out. TRUSTe ‘Supercell takes reasonable measures to protect your information from unauthorised access or against loss, misuse or alteration by third parties.’ No data breach notification policy Glu 1898 words Via app store page (eg. Appendix B, Image 3) Agree to contract through use of service. to privacy policy through contract No statement on this found. ‘Glu takes reasonable measures to help protect information about you from loss, theft, misuse and unauthorised access, disclosure, alteration or destruction. Kabam 7779 Via app page (eg. Appendix B, Image 3) Agree to contract through use of service. Agree to privacy policy by using service TRUSTe EU-US Safe Harbor framework takes commercially reasonable security measures to protect against unauthorised access to, or unauthorised alteration, disclosure or destruction of, sensitive data that you share and we collect and store.’ Uses SSL to protect sensitive personal information. 3442 Via app page, (eg. Appendix B, Image 3) Agree to contract through use of service. No statement on this found. ‘We use a variety of security technologies and procedures for the purpose of preventing loss, misuse, unauthorised access or disclosure of information.’ Uses SSL to protect sensitive personal information
Mobile app publishers – Collection of personal information Entity What information is collected? Treatment of third party issues Data retention Overseas transfers User supplied data (surveys, competitions etc.) Device data Use information Cookie tracking data Social sign-in (name, email, age etc.); social media posts and messages 3rd collection for behavioural advertising no responsibility for third party collection of personal information. User must read third party privacy policy (no links provided). No clear end of data retention period Yes. User ‘consents’ to overseas transfer. Glu User supplied data (surveys, competitions etc.) Device data Use information Cookie tracking data Social media sign-in (name, email, age etc.); social media posts and messages 3rd party collection for behavioural advertising No responsibility for third party use of personal information. No statement on this No statement on this found. Kabam User supplied data (surveys, competitions etc.) Device data Use information Cookie tracking data Social sign-in (name, email, age etc.); social media posts and messages 3rd party collection for behavioural advertising Friend referrals Third party use of personal information is subject to third party’s privacy policy (no links provided). No clear end of data retention period – data may persist account is deleted (it may exist in social media and with third parties) Data will be stored on servers in the US.
User supplied data (surveys, competitions etc.) Device data Use information Cookie tracking data Social media sign-in (name, email, age etc.); social media posts and messages 3rd party collection for behavioural advertising ‘…we will use reasonable efforts to ensure that such third parties only use your Personal Information: 1. In compliance with this privacy policy, 2. Subject to any other instructions we give them…’ No end of data retention period. ‘We operate and may continue to operate servers in a number of jurisdictions around the world, so the server on which your Personal information is used may not be in your jurisdiction.’ Web browsers – Presentation of privacy information Service provider Accessibility and length Contractual issues scheme - other Security claims Firefox (Mozilla policy) 995 words Via link on download page No attempt to bind users to privacy policy. Browser use subject to Mozilla public licence No statement on this found. ‘We implement physical, business and technical security measures. Despite our efforts, if we learn of a security breach, we’ll notify you so that you can take appropriate action.’ Safari (Apple policy) 3157 words Via link on download page Agreement by clicking ‘agree’. Licence agreement with user incorporates privacy policy. TRUSTe Separate security guidelines.
Opera 3002 words Via link on download page Terms of service states that the user agrees to terms of service and privacy policy by using the service. Privacy policy makes no statement that the user is bound Onus on user to check privacy policy for updates No statement on this ‘Opera Software strictly protects the security of personal information within the confines of Opera’s products and services and honours the users’ choices for its intended use. We have safeguards in place to protect users’ data from loss, misuse, unauthorised access, alteration, or destruction. We protect user data from disclosure, with exceptions only in matters where designate by law or court order.’ Internet explorer 7396 words Via link on download page. Note – much of the statement is dedicated to how to change settings. Users agree to terms of use by using services. Not clear that user ‘accepts’ privacy policy through use. Occasionally update privacy statement – no notification, user must policy. No statement on this found. ‘Microsoft is committed to protecting the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorised access, use or disclosure. For example, we store the personal information you provide on PC systems with limited access, which are located in controlled facilities’. Web browsers – Collection of personal information Service provider What information is collected? Treatment of third party issues Data retention Overseas transfers
with federal regulations to protect personal information about you.’ ChaCha 2428 words Use of site user to terms of use and privacy policy No information provided. ‘To improve data security and restrict access to your personal and business information, ChaCha has put in place certain physical, electronic, and managerial procedures to safeguard the information ChaCha collects via the Site.’ 2139 words No terms of use. Privacy policy is not a contract. No statement on this found. Site does not collect personally identifiable information. Search engines – Collection of personal information Service provider What information is collected? Treatment of third party issues Data retention Overseas transfers
Google Information provided by users Device information Use information Search queries Info from other Google services to provide users with ‘tailored content’. ‘Share’ identifiable information publicly and with partners. DoubleClick cookie information is not combined with other information. Third parties who serve behavioural ads are not covered by Google’s privacy policy. No statement on this No statement on this found. Device information Registration data provided by users with regard to competitions etc. For 3rd party advertising Pages that users request. No statement on this found. No statement on this found. No statement on this ChaCha ‘ChaCha may request and/or collect personal information from you that may include: first and last name, address, phone number, email address, location or other information.’ Automatically records all search queries or questions. Use data. 3rd party advertisers, serving ads based on tracking data. No statement on this found. ‘If you ever wish to access your personal information, or to have your personal information deleted, updated, changed or modified, you may contact ChaCha…” ChaCha processes and stores information in the USA. DuckDuckGo Searches are saved but not in a personally identifiable way. No cookies are used by default. Third parties do not receive personal information. No personal information is collected. No personal information is collected.
Social media – Presentation of privacy information Service provider Accessibility/ presentation issues/ length Contractual issues scheme/ Security claims Facebook 2,700 words Via link on Facebook home page Agree to contract through use of service Agree to privacy policy through contract Facebook may vary contract and privacy policy – users bound by changes by continued use. TRUSTe US-EU and US-Swiss Safe Harbor ‘We work hard to protect your account using teams of engineers, automated systems, and advanced technology such as encryption and machine learning. We also offer easy-to-use security tools that add an extra layer of security to your account’. Instagram 2,791 words Via link on Instagram home page to contract through use of service to privacy policy through use of service Instagram may vary contract and privacy policy – users bound by changes by continued use. No statement on this No specified security measures. Instagram uses ‘commercially reasonable safeguards’ to keep information secure. Twitter 3,189 words Via link on Twitter home page to contract through use of service Agree to the terms of privacy policy through contract, which is agreed to through use of service Twitter may vary contract and privacy policy. Users bound by changes by continued use. US-EU and US-Swiss Safe Harbor No specified security measures.
Twitter User supplied data (including content metadata) Device data Use information Cookie tracking data (in accordance with ‘Twitter’s use of cookies and similar technologies’ page) 3rd party collection of personal data for behavioural advertising Information provided to service providers shared subject to obligations ‘consistent with’ the privacy policy and ‘any other appropriate confidentiality and security measures’. Log data deleted or de-identified after a maximum of 18 months. Yes. Users ‘consent’ to transfer to the US, Ireland, and ‘other countries’ Snapchat User supplied data (including message content) Device data Use information Cookie tracking data Device content metadata (with consent) Contacts information 3rd collection of personal data for behavioural advertising Information provided to service providers: no obligations specified. No responsibility for third party collection or use of information. Generally, no guarantee that messages will be deleted within a specific timeframe Messages deleted automatically from servers once viewed by recipient (this claim has been challenged - see note 73) Yes. Users ‘consent’ to transfer to, and processing in, the US and ‘other countries’