The privacy policy is fourteen pages long. The data collection continues unchanged.
Literal meaning: Privacy washing describes the practice of using privacy rhetoric — statements, certifications, features, and marketing language — to create the impression of strong privacy protection without making substantive changes to data collection, processing, or sharing practices.
Origin: The term adapts the logic of greenwashing — environmental claims that exceed environmental practice — to privacy. It gained analytical traction after a series of high-profile corporate privacy commitments that were followed by documented privacy violations: Facebook’s repeated assurances about user data followed by the Cambridge Analytica revelations, Google’s privacy controls that were found to continue tracking after being disabled, and the gap between GDPR-compliant consent banners and actual data practices.
Privacy rhetoric deployed as marketing — where the reassurance functions as a substitute for the practice it describes.
The Appeal: Privacy washing produces real commercial benefits. Consumers prefer products that appear to protect their privacy; regulatory pressure creates incentives to signal compliance; privacy rhetoric builds trust with the public and policymakers without requiring the costly process of actually changing data practices. The statements are not always technically false — they are designed to be heard as meaning more than they say.
The Friction: Surveillance Capitalism — human behaviour as raw material for prediction products — is the commercial model that privacy washing protects. Dark Patterns are the interface-level tool: consent banners designed to minimise genuine refusals while appearing to offer meaningful choice. “We have never and will never sell user data.” — Zuckerberg’s formulation — is the canonical example of privacy washing language: technically accurate in a narrow sense, designed to be heard as something broader. Brussels Effect is the strongest structural counter: mandatory regulatory requirements that cannot be satisfied by rhetorical compliance.
Why This Matters: Privacy washing makes visible the gap between a privacy statement and a privacy practice. Once you know the move — reassuring language deployed as a substitute for substance — you can ask of any privacy claim: what specifically does this prevent, and how is it enforced?
Related terms: Security Theater · Surveillance Capitalism · Dark Patterns · Brussels Effect · “We have never and will never sell user data.” · Algorithmic Violence · Deceptive Design · Vendor Lock-in
Read more:
- The Age of Surveillance Capitalism — Zuboff, S. (2019). PublicAffairs
- Oversharing the super safe stuff: “Privacy-washing” in Apple iPhone and Google Pixel commercials — Cirucci, A.M. (2024). First Monday
- Privacy Washing and the Regulation of Online Platforms — Waldman, A.E. (2021). Emory Law Journal
- Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach — Cadwalladr, C. & Graham-Harrison, E. (2018). The Guardian