A UK family would need about 83 hours to read the privacy small print behind one ordinary day, a Web3 Foundation study finds. The figure strengthens the case for data rules that rely less on individual consent.
Researchers at Web3 Foundation, the Zurich-based organisation behind the Polkadot blockchain, mapped a single day in the life of a model UK family. They counted 257 privacy and terms documents running to 1,184,835 words. Reading them would take about 83 hours, or 10.4 eight-hour working days, according to the white paper published on 28 September.
That’s 34% more text than the 884,647 words in Shakespeare’s complete works. In 2012, Carnegie Mellon researcher Lorrie Faith Cranor told NPR that reading every website’s policy meant people “could spend on the order of 200 to 250 hours a year” on the task. The new study finds between a third and two-fifths of that annual total in one day. Its method differs, because it also counts terms documents and the systems around a household.
Europe’s GDPR and most US state privacy laws lean heavily on notice and consent. Companies disclose what they do with personal data, and people agree to it. The study suggests the disclosure half of that bargain has grown beyond any household’s ability to check it.
What the small print allows
Across the 143 companies and institutions studied, 83% describe the ability to use personal data for marketing or advertising. Some 80% say they can combine it with other information and 71% describe sharing it with commercial partners. At least 24% have documents stating that user data may be used to train or improve AI or machine-learning systems.
Six model households in the UK and US formed the basis of the research. Between them they generated 1,195 relevant documents containing more than 5.38 million words. Web3 Foundation makes no claim to a national survey, and its methodology describes evidence-led model scenarios. Its figures show the permissions companies give themselves in public documents. They can’t show what any company did with a particular person’s data.
Gavin Wood, founder of Web3 Foundation, said: “We did what consumers are told to do: we read the privacy policies. For the modelled UK family, one ordinary day means more than ten working days of reading.” He added: “None of this is hidden. Rather, it is disclosed, in public, in full, and at a volume that functions as concealment.”
Web3 Foundation’s Your Day in Data tool lets readers compare their own lives with the research. It asks six short questions, starting with a choice between the UK and US. The answers are then matched to the closest model household by structure and age, with the evidence trail its day leaves behind. Answers stay in the browser, and the reading-time figure stays fixed to the model household.
Regulators start to look beyond consent
In the EU, the European Commission’s Digital Omnibus proposal from November 2025 would let people refuse cookies with a single click. Sites would also have to respect refusal signals sent automatically by browsers, and wait six months before asking again.
Since 5 February 2026, UK websites have been able to set analytics cookies without asking for consent. The Data (Use and Access) Act 2025 extends the same exemption to cookies that control a site’s appearance. That cuts the number of banners, but it also widens what happens without a user’s say.
In Oregon, businesses have been barred since 1 January 2026 from using the personal data of known under-16s for targeted advertising. No click from the user can change that. Claire Park, writing for the think tank New America in 2020, argued that “transparency alone is insufficient”. She called for a move away from notice and consent as the main safeguard.
Proving less, disclosing less
Bill Laboon, vice president of technical operations at Web3 Foundation, pointed to a different fix. “The report raises the question of whether we can build services differently, for example, by allowing people to prove what is needed without routinely disclosing the underlying information,” he said.
That approach sits close to the decentralised technology Web3 Foundation exists to support, so the foundation has a stake in the answer. The test now is whether the EU’s proposed browser signals and rules like Oregon’s shrink what households are asked to accept. If they don’t, families will keep agreeing to documents nobody could finish in a working fortnight.
Subscribe
Sign-up to receive our newsletter
