1

In reference to the recent change of the Stack Exchange privacy policy:

Most people reading this are probably aware, but the Stack Exchange Privacy Policy has changed, which is a little frustrating. I may or may not join a site based on their policies. It does seem practical to change it one every year or two, but they just changed it in march, and now they changed it again. They say it is a couple small changes, but the text actually reads completely different, and I am a developer not a lawyer, I have to use 3rd party resources to really understand the policy every-time they change it. Considering they hold a ton of work I have authored, is there in law in place that prevents them from changing the policy multiple times in a certain time period?


Here is the link to the recent policy change: https://meta.stackexchange.com/questions/370216/updates-to-privacy-policy-september-2021?cb=1


Improve this question
4
  • 4
    The terms you agree to by using the network state: "Stack Overflow reserves the right, at its discretion, to modify these Public Network Terms at any time by posting revised Public Network Terms on the public Network and by providing notice via e-mail, where possible, or on the public Network. You shall be responsible for reviewing and becoming familiar with any such modifications." Whether that's enforceable, I don't know. (The privacy policy is included in the TOS)
    – ColleenV
    Commented Sep 28, 2021 at 17:40
  • @ColleenV well that's the thing right, I agreed to the TOS, but then they change it, which is essentially changing the terms I agreed to. I guess it is just a policy, not a rule I am being bound to, but it does discuss how information that relates to me is handled. Really I am trying to just understand my rights, be it that I have any, they are a private corporation, and just how protected the information is that I give to websites like Stack Overflow (or SE) wich might be considered a trusted site by many.
    – JΛYDΞV
    Commented Sep 29, 2021 at 13:33
  • Also, they don't contact me about the change, I found it scrolling through a Q&A forum, it seems unreasonable to legally consider me as responsible for understanding, and updating myself with it.
    – JΛYDΞV
    Commented Sep 29, 2021 at 13:35
  • If you don't like a company's policies, you shouldn't agree to be bound by them. I read all of that legalese every time and weigh how much I want what the company is offering against how much I dislike their policies. It's a pain in the ass, but that's really the only thing you can do short of trying to go to court or getting a new law passed.
    – ColleenV
    Commented Sep 29, 2021 at 13:42

1 Answer 1

Reset to default
4

The privacy policy now includes the statement:

We may amend or update this policy from time to time and will notify you of any material changes to this policy. Previous versions of this privacy policy are available upon request.

Previous versions of the policy included the same or similar language.

When an agreement includes such language, it can be modified unilaterally and remains binding in many cases. However, a privacy policy is not generally an agreement or a contract, it is a statement by a service provider of its current practices and intentions. To the best of my knowledge there is no law or regulation limiting how often such a policy may be updated.

There are several laws which make having a privacy policy mandatory for certain web sites and service providers. None of them apply to all sites in the US. These include:

  • the GDPR
  • the CCPA (California Consumer Protection Act)
  • the Children's Online Privacy Protection Act (COPPA)
  • The Cable Communications Policy Act of 1984
  • The Consumer Credit Reporting Control Act
  • the Gramm-Leach-Bliley Act (applies to Institutions engaged in the financial sector)
  • the Health Insurance Portability and Accountability Act (HIPAA)

Most of these laws require that a privacy policy be "current" or "up-to-date" at all times.

The page "how often should our IT policies be reviewed and updated?" includes the advice that:

In general, we recommend reviewing all your IT policies at least annually. It can be your new ‘New Years’ tradition.

The page "Update Notices for Privacy Policy Changes" reads:

Your Privacy Policy is a critical part of protecting your business and your customers. It's an up-to-date notice of your data practices, including everything from collection to storage to security. The key word in that sentence is up-to-date.

Whenever you make a meaningful change to the way you handle customer data, you need to update your Privacy Policy to reflect the change.

In short it is common to update such policies with some frequency. Various laws may mandate such updates whenever privacy practices change. No law that I have found limits the frequency of such updates.

Improve this answer
3
  • That was an amazing answer David. You've enlightened me.
    – JΛYDΞV
    Commented Sep 29, 2021 at 4:12
  • So because, I am in California, special rules apply to me? Or apply to the websites that operate "physically" within California?
    – JΛYDΞV
    Commented Sep 29, 2021 at 4:15
  • @JΛY-ÐΞV The CCPA applies to any service providers located in CA, and to any when doing business with consumers located in CA, wherever the provider may be. Some provisions only apply if the provider is large enough. Most provisions cannot be enforced directly, but only through the CA Attorney General's office.
    – David Siegel
    Commented Sep 29, 2021 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .