AI Catches Websites Contradicting Their Own Privacy Policies

A new study introduces the concept of “privacy washing” — like greenwashing, but for privacy. It's when a privacy policy makes a promise on one page but quietly undermines it on another. Because these documents are long and written in legal language, most people never notice. Researchers built an AI pipeline that reads entire policies, compares statements, and flags contradictions that sound impossible to honor at the same time.

They tested it on two groups of privacy policies: 123 collected recently and 115 from 2015. The results are striking. More than 1 in 10 current companies had at least one confirmed contradiction — for example, claiming “we do not sell your personal data” while elsewhere stating that third-party partners can use that data for advertising. The older policies had an even higher rate: 36.5%. When they re-ran the study seven months later with entirely different AI models, the findings held up.

The most common contradiction involved third-party sharing. That suggests these issues aren't always deliberate deception — they may be a structural problem with how privacy policies are written by different teams, updated over time, or assembled from templates. Either way, the effect is the same: you can't trust what you read at face value.

There's an important catch. The AI's verdicts haven't been checked against human privacy law experts, so we don't know exactly how accurate they are. That means the real rate of contradictions could be even higher than the study reports. Still, this research gives consumers and regulators a powerful new tool to hold companies accountable — and a reason to treat “we care about your privacy” with healthy skepticism.