The public always tends to have some level of mistrust against giant conglomerates. After all, these organizations are all about maximizing shareholder returns. The general perception that people get is that conglomerates will do everything they need to in order to achieve that goal, regardless of how their actions might impact people.
When it comes to tech companies, the biggest concern that people have is the safety of their data. Users trust that the incredible amount of personal data that they turn over to tech companies will remain protected. The fact remains, though, that the vast majority of people have little or no idea how much of their data is being collected in the first place. Tech companies do provide lengthy privacy policies for their users to go through, but how many of us have ever read an entire privacy policy?
So when users ultimately come to know what's in those policies, they often get freaked out about everything that they've agreed to. A recent post regarding Samsung's privacy policy blew up on the r/Android subreddit and it's the perfect example of this. Samsung updated the policy in the US on October 1 and the poster likely went through it for the very first time and were taken aback by what they saw.
Samsung, like many other companies in this market, collects a lot of data. The company's policy indicates that it collects identifying information such as name, date of birth, gender, IP address, location, payment information, website activities, and more. The company also highlights that this data is collected to prevent fraud and protect users' identities as well to comply with legal requirements, meaning that the data may be shared with law enforcement if legally requested.
Samsung's policy also mentions that this data may be shared with its subsidiaries and affiliates in addition to third-party service providers. It does prevent these service providers from disclosing your data further unnecessarily. Much of this data is shared with service providers for serving ads, cross-site tracking, etc.
Since the state of California mandates additional disclosures from companies, the privacy policy's “Notice to California Residents” section highlights everything else that the company is collecting, including from users outside California but it's not breaking it down for them separately.
This includes geolocation data, information from the various sensors in your device, internet browsing and search history. Biometric information is also obtained, this may include data from fingerprint and face scans, but Samsung doesn't go into much detail abou what it does with the bioemtric information collected from users.
As you can imagine, all of this has people outraged on Reddit, and they've left hundreds of comments on the post to showcase their displeasure. What they don't realize is that this isn't a new addition. Samsung's privacy policy has included most, if not all, of these points for several years now. A Reddit user linked to last year's policy that reads almost identical to the one updated at the start of this month.
It just highlights the problem that people don't really take an interest in what tech companies may be doing with their data until some sections are cherry-picked and presented for generating outrage, even though the same policies have been in place for years. There's no need to be outraged by this now, but that doesn't mean Samsung can't do a better job of being more open about its collection and use of data.
Its track record leaves much to be desired. In early 2020 after the California Consumer Privacy Act was passed, Samsung had to add a new toggle in Samsung Pay to let users disable the selling of their personal data to Samsung Pay partners. That was the first time that most people found out that Samsung Pay could sell their data to partners.
In 2015, a sentence in Samsung's Smart TV privacy policy got people worried, since it was essentially warning customers not to talk about sensitive or personal matters in front of their Samsung smart TV as that information could be “among the data captured and transmitted to a third party through your use of Voice Recognition.” The company then had to edit the policy to better explain what the Voice Recognition feature was doing (it wasn't snooping on conversations) and how they could turn off that feature.
What users need to understand is that a privacy policy is more of an insurance policy for the company as much as it's a statement of disclosure. Samsung may not be collecting or sharing everything that the policy mentions but it needs to have the relevant legal cover to ensure that the company remains protected. Virtually every company does the same thing.
Samsung just needs to do a better job of explaining how some of the most sensitive data that it's collecting is utilized. Take fingerprints as an example. They're stored on a secure enclave on the chip and protected by Samsung Knox. The policy mentions that Samsung may “collect” biometric information. It's “collecting” your fingerprint data when you're setting up the feature, how could Knox secure something that hasn't been “collected” in the first place? There's also no compulsion to use any biometric recognition feature if you'd prefer not to.
Data is gold for tech companies and they will always be hungry for it. That's the reality of the world we live in now. Not many have the capability to live their entire life off the grid. It's just not possible. Remember, Samsung phones run Android and Google sucks up an incredible amount of data through its apps and services on your phone. Every time you use YouTube or the Gmail app on your device, data is being sent back to Google.
Every social network on your phone thrives on the data that you create. So does every game, health and fitness app, streaming service, etc. Every website is tracking you. The expectation of complete privacy in the digital age is futile. We're exchanging data for services that improve our lives. Whether that trade-off is fair or not is another matter entirely.
