At 6:47 on a Tuesday morning, my phone lit up a dark bedroom with the weather, a news alert, and three emails. By 9:15 I had also silenced an alarm, checked a transit app, tapped to pay for coffee, scrolled a news site over that coffee, and glanced at the sleep score on a fitness ring. Nothing unusual — the most forgettable morning available. The desk's experiment was to do the part nobody does: before writing a word, we would read every privacy policy attached to those seven interactions, start to finish, the way the law's fiction says we already have.
Here is the finding, and it is more interesting than “policies are long.” They are not really written to be read at all. They are written to be agreed to. Once you read a few in a row, you stop seeing documents and start seeing a single document wearing different logos — a permission slip addressed to the company, drafted by the company, and signed, in effect, by your continued existence near a phone.
Seven policies before lunch
The reading itself was an exercise in controlled drowning. None of the policies was outrageous. That is precisely what made them exhausting. Each one described data collection in categories broad enough to be nearly contentless: “identifiers,” “usage data,” “information we receive from third parties,” collected for purposes like “improving our services,” “personalization,” “business operations,” and the quietly bottomless “any other purpose with your consent” — consent being the thing you are supposedly exercising by reading the sentence.
The grammar does a lot of work. Data is “shared with trusted partners.” Information “may be combined.” Decisions are arrived at, somehow, in the passive voice, by no one in particular. The fitness ring's policy described health-adjacent data with the serene abstraction of a customs form. The coffee app's policy spent more words on what it might do than on what it does, which is the genre's signature move: the policy is not a description of the present but a reservation of the future. It doesn't tell you what happens to your data. It tells you what the company would like to be allowed to do, forever, without asking again.
By the fourth policy a pattern hardened into a rule: specificity appears exactly where the law requires it — cookie tables, state-by-state rights disclosures, retention schedules for particular categories — and evaporates everywhere else. The documents are precise about your rights and vague about their behavior. You learn that you may request deletion of your data. You do not learn, in any operational sense, who has it.
The arithmetic of agreeing
None of this would matter much if reading were cheap. It is not, and the canonical figure for its cost comes from a 2008 study by Aleecia McDonald and Lorrie Cranor at Carnegie Mellon, “The Cost of Reading Privacy Policies,” published in I/S: A Journal of Law and Policy for the Information Society. They measured median policy length among the most popular websites at 2,514 words, timed actual readers, and calculated that reading every policy a person encounters in a year — word for word, just once each — would take the average American internet user about 201 hours annually. Valued as time, that's roughly $3,534 per person per year; scaled nationally, around $781 billion. Twenty-five working days a year, spent on homework nobody assigned and everybody assumes.
And the 2008 web was a pamphlet compared with today's. In 2024, Australia's Consumer Policy Research Centre found the average policy it sampled had grown to 13,323 words — a 56-minute read — and estimated that reading every policy encountered in a single day would take 14 hours. Microsoft's ran to over 90,000 words, a novella of consent. When The New York Times read some 150 policies for its Privacy Project, it found Facebook's alone took about 18 minutes, and quoted Stanford's Jen King describing the documents as “created by lawyers, for lawyers.” The trajectory is not toward clarity. It is toward coverage.
McDonald and Cranor noticed something else that has aged well. Their estimate assumes each policy is read once a year. If you actually did what the notice-and-choice model imagines — compared policies before choosing a service, the way you'd compare prices — the cost climbs past the value of the entire online advertising market the arrangement exists to support. Informed consent, taken literally, is not just burdensome. It's economically incoherent. The system only functions because almost nobody performs it.
The point of the unreadable
Which leads to the conclusion we resisted for a while, because it sounds conspiratorial and isn't: the length is not a failure of communication. It is the design. A policy that took ninety seconds to read would also take ninety seconds to reject, compare, or quote back angrily to a regulator. A policy that takes forty minutes accomplishes something different — it converts a legal question (what may this company do?) into a practical one (what will you, a person with a train to catch, tolerate?). The answer, reliably, is anything. Not because people don't care about privacy, but because caring costs 201 hours a year and apathy costs nothing visible.
This is the quiet trick of the notice-and-choice regime. Notice exists; choice exists; what doesn't exist is any plausible world in which a person engages with either. Every “I agree” click is technically informed and practically blind, and the technicality is the entire foundation. The morning I described — alarm, weather, transit, coffee, email, news, ring — generated seven legal relationships before 9:15, each one defensible in court as consensual, none of them understood by the only party who wasn't paid to write it.
We finished the readings around lunch, behind schedule, having learned almost nothing about what happens to the data of an ordinary morning. But we did learn what the policies are for. They are not the internet's confession. They are its alibi — pre-written, exhaustively notarized, and counting on the fact that you will never read it closely enough to notice. So far, the counting has been correct.