Privacy Policy Statistics 2026: Length, Reading Time & Who Reads Them

Key findings

• Privacy policies have nearly tripled in length since 2008: the median policy was 2,514 words then (F1) versus 6,938 words for a top US site today (F5).
• Reading every policy you agree to in a year would take about 70 eight-hour workdays by current numbers (F7), close to the widely-repeated "76 workdays" figure, but for a completely different, unrelated reason (see below).
• The oft-cited "76 workdays" claim doesn't actually match the math of the 2008 study it's credited to, whose own number works out to about 30.5 workdays (F3, F4).
• Two independent surveys, four years apart, found the exact same figure: 56% of US adults routinely accept privacy policies without reading them, in both 2019 and 2023 (F8, F9).
• Only about 34% of websites have an accessible privacy policy at all, per a 2023 academic scan of 7 million sites (F10).

How long is a privacy policy, and how long does it take to read one

The most-cited figure for privacy policy length comes from a 2008 Carnegie Mellon study by Aleecia McDonald and Lorrie Faith Cranor, "The Cost of Reading Privacy Policies": a median length of 2,514 words (F1), taking about 10 minutes to read (F2). It's still the number Wikipedia's own "Privacy policy" article cites today, 18 years later.

A 2023 NordVPN study, which measured the actual policies of the top 20 most-visited websites in 19 countries, found something very different: an average of 6,938 words for the US sample (F5), nearly three times the 2008 median. The longest single policy they measured, Meta's, ran 19,434 words and took nearly 82 minutes to read on its own.

How long would it take to read every policy you agree to in a year

McDonald and Cranor didn't stop at one policy. They estimated that an average internet user encounters about 1,462 unique websites a year, and calculated that reading a privacy policy for every one of them would take roughly 244 hours a year (F3), or about 30.5 eight-hour workdays.

That's not the number most people have heard, though. A March 2012 TIME/Techland article turned this into a much bigger, catchier claim: "You'd Need 76 Work Days to Read All Your Privacy Policies Each Year" (F4). It's been repeated on blogs, forums, and "fun fact" sites ever since. The trouble is the arithmetic: 244 hours divided by an 8-hour workday is 30.5 days, not 76. TIME's own piece states the 76-day figure without showing how it got there, and I couldn't find a source that shows the working or checks it against the study it's credited to.

Here's the twist: using 2023 data instead of 2008 data, a modern equivalent lands in the same neighborhood, just for an unrelated reason. NordVPN's 2023 study found that reading the privacy policies of the 96 sites an average person visits monthly would take 46.6 hours a month in the US (F6). Annualized, that's 559.2 hours a year, or about 70 eight-hour workdays (F7). That isn't because the old "76 days" claim was right. Privacy policies have simply grown long enough since 2008 that a version of the old claim is closer to true today than it was when it was first published.

Does anyone actually read them

Two nationally representative US surveys, four years apart and run by different organizations, arrived at the same number. In February 2019, an Axios/SurveyMonkey poll of 4,048 US adults found 56% said they "always" or "usually" accept privacy policies without reading them, including 46% of 18-24-year-olds who said they skip every time, against just 15% of adults 65 and older (F9). In a 2023 survey of 5,101 US adults, 56% again said they accept privacy policies without reading them "always, almost always, or often" (F8).

A frequently-repeated older claim, that only 3% of consumers read privacy policies carefully, traces to a 2001 Privacy Leadership Initiative study. We looked for the original report to verify it and couldn't find a working copy anywhere, including in Wikipedia's own citation for it, which only points to a secondary blog post. We've left that one out rather than repeat a number we couldn't check ourselves. The two surveys above are the current, verifiable version of the same point.

How many websites even have a working privacy policy

A 2023 study out of Penn State, presented at the ACM Symposium on Document Engineering, scanned 7 million organization websites and found privacy policy URLs were only accessible on 34% of them (F10). That means roughly two-thirds had no working privacy policy a visitor could find. As of this writing, that finding has been reported by exactly one general-interest outlet, with no link back to the paper itself.