Many Australian consumers are unaware of the extent of personal data being collected about them on a daily basis, a new report from the Australian Competition and Consumer Commission (ACCC) has revealed.
According to the ACCC's latest interim report on the Digital Platform Services Inquiry, it would take the average user nearly 46 hours a month to read every privacy policy they encountered in full.
On average, a typical privacy policy contains 6,876 words, taking about 29 minutes to read.
The consumer watchdog said consumers therefore do not engage with privacy policies and "in any event, usually have no choice but to accept the terms and conditions … to access a product or service".
"This raises the question of whether this can be considered informed consent," the report said.
"Further, privacy policies contain broad terms and conditions that facilitate the sharing of consumer data with third parties.
"As these parties are often not identified, consumers are unable to determine who their information has been shared with."
The ambiguous language and "take-it-or-leave-it" phrasing of privacy terms also made it difficult for consumers to understand what they were agreeing to when it came to their data.
This included the supply of it to data firms, and businesses supplying "data products and services". In this case, the report focused on firms that did not have a direct relationship with the customer.
ACCC deputy chair Catriona Lowe said the importance of data as a "critical commodity" was only going to increase with the rise in artificial intelligence.
"In many cases, the data firms do not have a direct relationship with the consumers whose data may be used," she said.
"Many consumers may be unaware of the scope of data that is collected and then shared or on-sold to data firms or other unidentified third parties.
"As consumers are increasingly required to provide personal information or other data on themselves to access important services, such as applying for a rental property or receiving an insurance quote, we are very concerned that consumers may be unable to exercise choice or meaningful control over how their data is shared and used."
Vulnerable people may also be more at risk of being targeted when they're identified via their data, according to the report.
Data firms placed consumers into "segments" in order to categorise and identify potential customers.
"These segments group together people based on common characteristics, such as 'households with young children' or 'those likely to purchase a budget holiday package'," the report said.
"These may be for innocuous purposes, such as a 'dog owner' segment being used to deliver targeted advertising for discounted pet food.
"However there is a risk of consumer segments being used to target vulnerable groups in potentially harmful ways.
"For example, a segment identifying people as 'frequent gamblers' may be used to serve gambling ads to people who have a gambling addiction.
"Even if such sensitive segments are not available, there may be ways to combine other data points to achieve similar results.
"For example, combining location data on visitors to a particular address with data showing the address is a place of worship could serve as a proxy for a segment likely to include people of a particular faith."
The inquiry into digital platform services – including search engines, social media, private messaging, online shopping and others – was first established in February 2020.
The ACCC's final report is set to be handed down in March 2025.