How to Find Red Flags in Privacy Policies: 7 Warning Signs You Shouldn’t Ignore

This is the single most abused phrase in modern privacy policy writing. When a company says it shares your data with “trusted partners,” “affiliated entities,” or “service providers,” it is using legal language so broad it covers data brokers, advertising networks, analytics firms, and political data companies — without ever naming a single one.

Facebook’s privacy policy refers to “third-party partners” over 40 times without listing them. Those “partners” include Oracle Data Cloud, Axciom, LiveRamp, and hundreds of others who build detailed profiles about you from cross-platform behavioral data.

Why it matters: If they don’t name their partners, you have no way to opt out of those specific relationships — even if GDPR or CCPA legally requires it.

Most companies don’t say “we sell your data” outright — because that sounds bad. Instead, they write that they may share data “for commercial purposes,” “to support our business,” or “with advertising partners.” In legal terms, this often means exactly the same thing as selling.

California’s CCPA broadened the legal definition of “sale” to include any sharing of personal data for valuable consideration — not just a direct cash payment. This means data swapped for advertising services, technology access, or analytics reports qualifies as a sale.

Under CCPA, California residents have the right to opt out of data sales. Under GDPR, European users have the right to object to processing for commercial purposes entirely. But you have to know it’s happening first.

Biometrics — facial geometry, voice prints, keystroke dynamics, gait patterns — are among the most sensitive data types that exist. They are permanent and cannot be changed if compromised. Unlike a password, you cannot reset your face.

TikTok’s privacy policy explicitly states it may collect “faceprints and voiceprints.” Snapchat applies proprietary facial mapping through its lenses and filters. Many apps collect behavioral biometrics — how you type, scroll, hold your phone — to build identity profiles.

Only a handful of US states (Illinois, Texas, Washington) have specific biometric privacy laws. Everywhere else? Mostly unregulated.

Good data practices require companies to delete your data once it’s no longer needed. Most companies, however, write policies that let them keep your data indefinitely — for “legitimate business purposes,” to “comply with legal obligations,” or simply “as long as your account exists.”

The problem: “legal obligations” and “business purposes” are never defined. This functionally means they keep everything forever. Some companies retain data for 10+ years after account deletion.

Under GDPR’s right to erasure, EU users can request deletion. But even then, many companies retain “de-identified” versions — which can often be re-identified with modern data analysis.

A company publishes a policy, you agree to it, and then they rewrite it to collect far more data — with a single email to your spam folder or a banner you’ve trained yourself to dismiss.

Most policies state that continued use of the service constitutes acceptance of any new terms. This means as long as you keep using the app, you’ve “agreed” to every policy change — even ones that fundamentally alter how your historical data is handled.

WhatsApp’s controversial 2021 policy update — which expanded data-sharing with Facebook — is a textbook example. Users were given a binary choice: accept or lose access. No opt-out for the data sharing itself.

You use Gmail on your laptop. Google Maps on your phone. YouTube on your TV. Google’s privacy policy allows it to link all of these into a single identity graph — tracking you continuously across every screen and service.

Meta operates the same cross-platform tracking across Facebook, Instagram, WhatsApp, and Messenger. TikTok tracks behavior both inside and outside its app through embedded tracking pixels used by websites and e-commerce stores.

Cross-device tracking makes browser privacy protections useless. Clearing your Chrome cookies doesn’t help if your account-linked data on Google’s servers still connects all your sessions.

A privacy-respecting policy requires a valid legal process — a court order or subpoena — before handing your data to governments. A dangerous one gives the company broad discretion to share data with any government entity it believes has a legitimate interest, without explaining what that means.

DeepSeek explicitly states in its policy that user data may be shared with Chinese government entities under national security laws — including the National Intelligence Law, which compels companies to cooperate with intelligence agencies. This is not hypothetical: it is a statutory requirement.

Ask: Does the policy commit to challenging overbroad requests? Does it promise to notify users before complying? If neither — that’s a red flag.