Privacy policies don’t build trust – new studies from the Department of Management
Almost every online shop today displays a privacy policy alongside its product recommendations. The policy is meant to reassure customers that their data is handled responsibly. However, two experiments by Marc Schewe and Štěpán Bahník from the Faculty of Business Administration at the Prague University of Economics and Business show that privacy policies do not fulfil this role. Long policies can even reduce trust.
“Customers who viewed this item also viewed…” Recommender systems are now standard in online shops. They save customers time when searching and increase companies’ revenues. They only work, however, if people trust them and are willing to share their data with them. This is why companies place privacy policies next to their recommendations. Whether this actually works has so far received little research attention.
Short policies don’t help, long ones hurt
In the first study, published in Behaviour & Information Technology, 354 regular online shoppers imagined using an online shop where they were considering a purchase. Some saw no privacy policy, some saw a short version, and some saw a long version with the same content. The system also asked them either for demographic data only or for all their data, including their purchase and browsing history.
Short policies did not increase trust: participants trusted the system just as much as when they saw no policy at all. Long policies, on the other hand, reduced trust. The authors explain that a long text without a clear structure can make people feel that something is being hidden. They also point out that the result does not mean “more transparency = less trust”. The problem is length that is not balanced by clarity.
Participants were even more reluctant to share their data. Only about a third of them were willing to do so. Showing a privacy policy reduced this willingness further, regardless of its length. According to the authors, privacy policies may therefore remind users that sharing data carries risks instead of reassuring them.
A cleverly worded introduction didn’t help either
The second study, published in Scientific Reports, used a sample of 500 UK respondents to test whether a better opening sentence would make privacy policies more effective. The sentence emphasised either the system’s ability to provide accurate recommendations, its good intentions towards the customer, or its honest handling of data. One version read, for example: “This privacy policy reflects our commitment to prioritizing your interests in every recommendation we make.”
None of the versions worked. None of them increased trust in the system, willingness to rely on its recommendations, or willingness to share data. The study also confirmed that short policies do not reduce trust. What mattered instead of the policy was a general sense that shopping online is a normal thing to do and that the internet is safe enough thanks to laws and technologies such as encryption. People with this sense trusted the system more, while older participants trusted it less. The authors suggest that in the GDPR era, when privacy policies appear on every website, users take them for granted and have stopped paying attention to them.
Lessons for companies
- Privacy policies are an obligation, not a marketing tool. They have no significant effect on customer trust.
- Less is more. It is better to offer a short, clear version and make the full text available on request.
- Ask only for the data you really need, and make privacy protection the default setting.
- Invest in how you actually handle data, not in fine-tuning the wording.
The authors also stress that efforts to collect more data must not lead companies to hide or downplay information about data protection. Both studies used a hypothetical shopping scenario and participants from the United Kingdom. According to the authors, testing the findings on a real online shop remains a task for future research.
Studies:
Schewe, M., & Bahník, Š. (2026). The effects of privacy policy presentation and length on trust in recommender systems: an online experiment. Behaviour & Information Technology, 1–22. https://doi.org/10.1080/0144929X.2026.2686167
Schewe, M., & Bahník, Š. (2026). Privacy policy framing and trust in recommender systems: An experimental study. Scientific Reports. https://doi.org/10.1038/s41598-026-66241-6
