Companies routinely assure customers that their personal information is safe, but privacy policies and reassuring statements don’t always tell the whole story. As businesses collect, share and use data in increasingly complex ways, both individual consumers and business clients need to know whether privacy commitments are backed by responsible practices.
For businesses evaluating potential partners and consumers deciding which companies to trust with their information, recognizing potential red flags can help prevent problems before they arise. Below, members of Forbes Technology Council share warning signs that may indicate a company isn’t handling consumer data as carefully or responsibly as it claims.
Lack Of Clear Data Governance And Oversight
At the heart of privacy risk lie two familiar threats: data that escapes unnoticed and data that is shared beyond its intended use. When an organization lacks disciplined governance and effective access controls, it is not a true steward of privacy, and there’s no structure to ensure consumer data is managed responsibly. – Shefali Mookencherry, University of Illinois Chicago
Vague Explanations Of How Consumer Data Is Managed
Be wary of reassuring language paired with vague architecture. It’s a warning sign when a company can’t explain where your data actually lives, who touches it or how it’s deleted. That’s not privacy. That’s a policy wearing a costume. – Merlin Bise, Inbenta
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Excessive Collection Of Personal Data
Ignore the privacy policy. Watch the permissions. A flashlight app that wants your contacts or a coupon site that tracks your every move is telling you everything its lawyers won’t. Companies that truly respect your data collect only what the product needs and can explain every field. Companies that collect everything aren’t building trust. They’re building inventory. And inventory eventually gets sold, shared or breached. Believe what they take, never what they say. – Dr. Aditya Vikram Kashyap, Morgan Stanley
Privacy Promises That Don’t Match Actual Practices
A big warning sign is when a company’s actions don’t match its privacy promises. If it’s collecting more data than it clearly needs, retaining it indefinitely or making it difficult for consumers to access or delete their data, that’s worth questioning. – Stephen Clark, Vanguard Group Inc.
Limited Control Over Personal Data
It’s a warning sign when a company can’t show you how to delete your data. Privacy policies are easy to write. Data deletion is hard to build. If a company can’t clearly explain how a customer can see, export or permanently delete their data, it is a warning sign that the company is probably covering for weak practices underneath. In the age of AI, data piles up very quickly and quietly in training sets, logs and backups. Responsible companies decide up front what they collect, why they collect it, and when they get rid of it. – Rajesh Iyengar, Lincode Labs Inc.
Conflicts Between Privacy Claims And The Fine Print
A warning sign is a mismatch between reassuring language and the fine print: A company calls itself only a processor, yet its services or sub-processors, such as SMS carriers, can access, retain or reuse personally identifiable information. Check every data flow, especially whether “service improvement” includes sharing data to train LLMs. If consent isn’t clear, pause. – Rafael Flores, Treasure AI
Hard-To-Find Privacy Policies
A simple litmus test would be to start on the company’s home page and count the number of clicks you had to make in order to get to the company’s reassuring privacy language. If it was more than two, you may want to consider how closely that company wants its privacy practices examined. – Kim Bozzella, Protiviti
Vague Disclosures About How Consumer Data Is Used
One warning sign is privacy language that sounds reassuring but says little about how consumer data is collected, used, shared or stored. A company that cannot trace an application rejection or account flag back to the relevant data cannot explain its own decisions, and it will often miss when those decisions are wrong. – Ravi Nemalikanti, Abrigo
Undisclosed Machine Access To Customer Data
Ask how many machine identities have access to customer data. Every privacy policy is written about people—employees, partners, vendors. Nobody counts the service accounts, integrations and AI agents quietly reading records around the clock. A company can honestly say 12 employees see your data while 200 nonhuman identities do the same, hourly. – Nidhi Jain, CloudEagle.ai
Weak Controls Over Who Can Access Consumer Data
One warning sign is a lack of clear control over who—or what—can access consumer data. Organizations should be able to identify every user, system or agent with access to sensitive data; apply least-privilege permissions; and monitor for activity that falls outside expected behavior. Strong privacy language means little if those commitments aren’t backed by strong access controls in practice. – Grayson Milbourne, OpenText
Unclear Safeguards For AI Use Of Customer Data
One warning sign is when a company feeds customer data into AI tools without clear guardrails, like exclusions, retention limits or human review before use. Privacy language can sound reassuring while staying silent on this. If a policy doesn’t say how AI handles your data, don’t assume it’s handled responsibly. Ask directly. – Aruna Veerappan, Upwork
Evasive Answers About Why Data Is Needed
When “Why do you need this data?” gets answered with “We use bank-grade encryption,” be skeptical. That is a security answer to a privacy question. Encryption does not justify unnecessary collection, indefinite retention or intrusive profiling. Your data does not have to be stolen for your trust to be violated. – Shahen Minasyan, Twin Peaks Inc. (TPI)
No Clear Link Between Collected Data And Decisions
The warning sign: The company can tell you what data it collects but not what decisions that data drives. Responsible data handling isn’t about policy language—it’s about traceability. If no one inside the company can explain how your data connects to an outcome that affects you, the privacy statement is decoration. – Dhiraj Rajaram, Mu Sigma
Obstacles Or Penalties For Opting Out Of Data Sharing
Watch what happens when a customer says “no.” If opting out triggers dark patterns, degraded service, repeated prompts or mysterious data collection, the privacy policy is theater. In hospitality, consent should feel like choosing a pillow, not escaping a timeshare pitch. Test one opt-out journey yourself and see whether “no” is truly respected. – Joel Frenette, TravelFun.ai
Unnecessary Obstacles To Deleting An Account
Look at how hard it is to leave. If deleting your account takes an email to support, a waiting period and a follow-up, that friction is a design choice. Companies that treat data as a liability make deletion as easy as signup. Companies that treat it as an asset make it hard. The privacy policy tells you what they say; the delete button tells you what they’ve built. – Mayank Bhola, Testmu AI (Formally Lambdatest)
No Clear Answer About What Data Deletion Covers
Ask one question: “When a customer asks to be deleted, what happens to everything built from their data?” Most companies can delete a row. Few can pull it out of a model, a backup or a report already sent. If nobody can answer in one sentence, the policy is decoration. Responsible handling shows up as a delete that reaches the copies. – Jeetendra Gangele, BluePill
Customer Information Sent To The Wrong Recipients
If you receive emails clearly meant for someone else, invoices with the wrong name, references to products you never purchased, or mass emails where all recipients are exposed in CC instead of BCC, it suggests weak data handling practices. These mistakes may indicate poor controls, training or processes, raising concerns about how responsibly personal data is managed. – Pawel Rzeszucinski, WebPros
Privacy Choices That Don’t Carry Across Systems
A warning sign is when a consumer’s privacy choice only works in one place. If someone opts out or changes a preference, that decision should follow them across apps, channels and systems. When it doesn’t, privacy may exist at the interface but not in the infrastructure. Responsible data practices require consumer choices to travel with the data. – Vibhor Kapoor, AdRoll
Personal Data Corrections That Don’t Stick
Watch whether a corrected personal detail stays corrected. If a customer fixes an address but later messages or decisions still use the old one, the correction may not have reached every system. Ask the company to trace one correction through its downstream uses. That tests whether customers can actually influence the records used to make decisions about them. – Mani Padisetti, Almost Magic Tech Lab
Data Sharing Enabled By Default
Ignore the policy and check the defaults. When every data-sharing toggle ships switched on and the opt-out sits five screens deep, the company has told you its real priorities—the reassuring language is just what the legal team wrote afterward. Responsible handling is the opposite: Collection is off by default, deletion is possible with one step, and there’s a plain answer to where your data gets processed. – Kiran Kodithala, N2N Services, Inc.