Scanning your connection...
Back to Glossary
Data Protection

What is Privacy Washing?

The practice of companies marketing themselves as privacy-friendly while continuing to collect, share, or exploit user data — similar to 'greenwashing' in environmentalism, where the appearance of privacy is used as a marketing tool without meaningful protection.

Also known as: Privacy Theater, Privacy Washing, Fake Privacy

Privacy washing is when companies wrap data exploitation in privacy-friendly marketing. They say "your privacy matters to us" while their business model is built on violating it.

How to Spot Privacy Washing

Vague Privacy Claims

  • "We take your privacy seriously" — the most common privacy-washing phrase and almost always meaningless
  • "Your data is secure" — says nothing about how it's used or who it's shared with
  • "Privacy is our priority" — while the business model is advertising based on personal data

Misleading Product Names

  • Google "Privacy Sandbox" — Replaces third-party cookies with Google's own tracking system (Topics API)
  • Apple "Privacy Nutrition Labels" — While Apple's own apps collect significant data
  • "Private browsing" / "Incognito mode" — Doesn't prevent ISP, employer, or website tracking

Token Privacy Features

  • Offering a "privacy dashboard" while collecting the same data
  • Making privacy settings available but burying them in deep menus with confusing options
  • Allowing data deletion but retaining "anonymized" copies that can be re-identified

Privacy Policy Tricks

  • Writing policies that are intentionally long and complex (average: 4,000+ words)
  • Using legal language that technically allows anything while sounding restrictive
  • Changing policies with opt-out-by-default (you're consenting by continuing to use the service)

Notable Examples

Google

  • Markets Chrome's "Enhanced Safe Browsing" as a privacy feature — but it sends your browsing URLs to Google for analysis
  • "Privacy Sandbox" doesn't eliminate tracking; it consolidates it under Google's control
  • Paid $5 billion to settle a lawsuit over tracking users in Chrome's "Incognito" mode

Meta/Facebook

  • Claimed encryption was about "user privacy" while lobbying governments to weaken encryption for content monitoring
  • Introduced "Off-Facebook Activity" tool — but the data is still collected, just displayed to you

Amazon

  • Ring doorbell cameras marketed as "home security" while footage was shared with police without warrants
  • Alexa recordings reviewed by human employees despite marketing as "private"

Real Privacy vs. Privacy Washing

Privacy Washing Real Privacy
Privacy policy says "we may share data with partners" No data sharing with third parties, period
Opt-out available (if you find it) Privacy by default — no data collected unless you opt in
End-to-end encryption with a backdoor End-to-end encryption with no server-side access
"Anonymized" data that can be re-identified True data minimization — don't collect it at all
Open-source claims with proprietary server code Fully open-source, auditable client and server

Related Terms

Have more questions?

Use our guided flow to get the right next privacy step for Privacy Washing.

Open Guided Flow