My inbox has taken in forty-one privacy policy updates in nine days. I counted. A yoga studio I visited once in 2015. A shoe brand I have never bought from. An airline I flew in 2013 to a wedding I did not enjoy. Every one of them wants me to know that my privacy matters deeply to them, effective May 25.
Nobody believes this. The brands do not believe it and the recipients do not believe it. It is a legal notice wearing a friendship costume.
Which is exactly the opportunity everyone is missing.
GDPR lands in four weeks and most of the industry is treating it as a tax. I have watched this from inside brand strategy rooms: legal writes the language, marketing reformats it, and nobody asks what the document says about who the company actually is. Meanwhile Cambridge Analytica just taught several hundred million people the phrase data broker. The public is primed. That timing will not come around again.
A privacy policy is a brand document, and the brands that understand that first will spend the next decade being trusted by default.
Watch how a consent banner behaves. It greets you warmly. It uses the first person plural. It says it cares about you. Then it buries the decline option two clicks down in gray text, because what it wants is not your consent, it is your click. That is HAL, in 2001, explaining in the calmest voice available that he is sorry, he is afraid he cannot do that. The politeness is the mechanism, not a courtesy. Users are now fluent enough to hear the refusal underneath the warmth, and they resent it more than they would resent a plain no.
So do the opposite. Three moves, none of them expensive. One, write the policy in the same voice as everything else you publish, and sign it with a human name. Two, make the decline button the same size as the accept button. Three, say what you collect in the sentence where you ask for it, not in a linked appendix.
Patagonia does not need a privacy campaign, because Patagonia spent thirty years making it plausible they would not sell you out. That plausibility is the asset. Most brands have not built it and cannot buy it. They can start earning it in May, with a document they were legally required to write anyway.
It is a legal notice wearing a friendship costume.
Barnaby sits in the front window of my apartment in Southeast Portland and lets the entire block collect his data. Nobody has ever asked him to accept cookies. Truffles, who hides under the bed, has better privacy hygiene than most Fortune 500 companies and considerably less interest in the deadline.