My research began with the maker's side: what happens when a website skips the small things. So I flipped it. Each rule is a reason a clause exists, and each clause tells you what a platform needs from you.
I chose Instagram and read Meta's Privacy Policy, which covers it. Optimize your reading: know what you are agreeing to, no matter how the policy is worded.
Amounts are the maximum exposure stated in each source, not a guaranteed fine.
R1No age gate
Up to $53,088[COPPA / per violation]
A 12-year-old signs up and your form never asked their age. COPPA can still apply the moment you have actual knowledge that a child under 13 is using it - even if your own terms say 13+.
Check it on InstagramMeta's Privacy Policy lists age among the information you give when you sign up, and says it cannot create an account without your email, phone number or age. It also says a parent or guardian can see some activity of a supervised teen account.
What you missYou never see who a platform is built to let in, or why a child's data is handled differently.
R2Google Fonts
EUR 100[GDPR / per visitor]
Fonts loaded live from Google send each visitor's IP address to Google. A Munich court awarded EUR 100 for it in January 2022, and EUR 100-500 warning letters followed. Other courts may disagree - the safe fix is hosting the font yourself.
Check it on InstagramMeta's Privacy Policy lists your IP address as network information it collects, and says it uses it to estimate your general location even when Location Services is off.
What you missYour IP address is personal data, and it travels to more companies than the one you think you are visiting.
R3Session replay
$5,000[CIPA / per violation]
Session replay records clicks, mouse movements and keystrokes. In California that can be argued as wiretapping at $5,000 per violation - courts are split, and the deciding question is whether the visitor consented first.
Check it on InstagramMeta's Privacy Policy says it collects what you do on your device, like whether the app is in the foreground or your mouse is moving, which it says helps tell humans from bots.
What you missYour behavior is data, not only what you type. 'Analytics' in the terms can mean being recorded.
R4No unsubscribe link
Up to $53,088[CAN-SPAM / per email]
Every marketing email needs a clear opt-out that keeps working for 30 days, with no login required. Order confirmations are exempt, but a launch email is not.
Check it on InstagramMeta's Privacy Policy says that, depending on your settings, it sends marketing messages, and it tracks how you interact with them, like whether you open an email. Look for Communication preferences, and the unsubscribe link in its marketing emails.
What you missWithout reading, you agree to marketing you may not easily leave.
R5Hidden renewal
A GIFT[ROSCA + California ARL]
Renewal terms must be clear before billing, with express consent and a simple way to cancel. In California, goods sent under a renewal without consent can count as an unconditional gift, and the business bears the cost.
Check it on InstagramMeta's Privacy Policy says that when you buy something, it collects your card and financial account details, billing and shipping details, and what you bought. It says it uses this for ads and personalization too, and keeps some transaction records for accounting obligations.
What you missA free trial quietly becomes a charge you never understood, and your payment details go along with it.
R6No copyright agent
Up to $150,000[DMCA / per work]
A site that hosts user uploads needs a registered DMCA agent ($6, renewed every 3 years) to keep its safe harbor. Without one, a single infringing registered work can reach $150,000 in statutory damages.
Check it on InstagramMeta's Privacy Policy says it collects metadata about your content, like where a photo was taken and when a file was created. If you allow camera roll access, it also collects metadata about your photos and videos.
What you missYou still own your photo, but it carries details you never typed, like location and date.
BONUSThe AI update
Dec 16, 2025[Meta Privacy Policy]
Interactions with Meta's AI features became a signal for personalizing content and ads, and are used to develop and improve AI. It applies everywhere except South Korea, the UK and the EU, so it covers us in the Philippines.
Check it on InstagramMeta's Privacy Policy lists your interactions with AI at Meta among the information it uses to decide the ads you see. It also says public content and those interactions are used to develop and improve its AI. Look in Ad preferences for what you can switch off.
What you missSomething typed casually shapes what you are shown and sold, and it can help train Meta's AI.
These are the policy's own sections. Here is what each one says.
1 What is collected
Your activity and what you provide, your connections, your device and network, and information from partners and other third parties. It collects some information even if you have no account.
2 How it is used
To personalize content and ads, improve products, keep people safe, measure ads for businesses, contact you and do research. Systems process it automatically, and some of it is reviewed by people.
3 Who it is shared with
It says it does not sell your information. It shares reports with advertisers, and information with vendors, service providers, researchers, other Meta companies and legal requests. Public content can be seen by anyone, even without an account.
4 How long it is kept
As long as it needs it, decided case by case. Deleting can take up to 90 days, then up to 90 more for backups. Some information can be kept longer for legal reasons, even after you delete your account.
5 Your controls
You can view, download, port and delete your information, and use Ad preferences and a privacy checkup. Under Philippines law, its Philippines Privacy Notice lists the right to access, rectify, port and erase your data.
6 When it changes
Meta says it will notify you before material changes and let you review the new policy before you keep using its products. The version I read is effective July 23, 2026.
The SQ3R study method, applied to the policy.
1 Survey
Scan the headings first: data, money, content, ads, age.
2 Question
Ask what each section wants from you, and what it gives away.
3 Read
Read the clauses that touch your data, your money and your uploads.
4 Recite
Say each clause in your own words. If you cannot, you do not know it yet.
5 Review
For example: An AI update arrived in Dec 2025, and a later version is dated July 23, 2026. Check the date, then review again.
6 Repeat
Run it on every new app until it becomes a habit.
Reverse planning
Plan it just like the military plans. Start from the end/ideal state - "is this website legal?" - then work backward through the what, the who and the where, until you reach the first step. The policy is that checklist, written by the maker.
Do not be oblivious
Convenience without human nuance is exactly what a one-tap "Agree" offers, and it works best on people who are oblivious. Do not be one of them. Read first, then tap.
Who keeps the information
Information flows through the keeper, the medium and the receiver. It has been decentralized: from radio, news, and etc. in the past, to content curated for you interconnected with the Internet. With more keepers than ever, the policy matters more, because it tells you who the keeper is.
Beyond digital literacy
For example: Notice the same AI-made look everywhere in graphic designs (and in Multimedia itself) that loses credibility, and the “taong masa” who Agree (or not question) without a second thought - just like how they do in privacy policies. Critical thinking is more than digital literacy.