privacy terms-of-service hidden
Consequences of blank check on privacy policy?
<p>Some websites intentionally hide access to privacy policies and terms &amp; conditions they require users to agree to.</p>

<p>For example, consider the <a href="https://gc.synxis.com/rez.aspx?chain=&amp;hotel=62691&amp;locale=en-us&amp;start=&amp;shell=DHR_RBE&amp;template=DHR_RBE&amp;numMonths=1&amp;adults=1&amp;children=&amp;arrive=2019-08-28&amp;depart=2019-08-30&amp;submit=Check%20Availability" rel="nofollow noreferrer">Hotel De Anza</a>.  If you click through the steps of the reservation process, the final page has a section titled "Privacy &amp; Promotional Offers" which says "The privacy of our guests is very important to us. Please view our Privacy Policy." It then requires the would-be guest to check a box saying "Please acknowledge that you have read and accept our privacy policy."  </p>

<p>However, the words "Privacy Policy" are not links, and there are no other links available which allow the user to actually see the privacy policy.</p>

<p><a href="https://duckduckgo.com/?q=site%3Agc.synxis.com%20privacy%20policy&amp;t=ffab&amp;ia=web" rel="nofollow noreferrer">Searching</a> for "privacy policy" on the domain where the user must agree produces many results for "Search Criteria View" at different hotels.  Of the top five results, three had no privacy policy linked to from the page that turned up in search results, and two (Bedford Village Inn and The Heathman Hotel of Kirkland, Washington) had footer links to different privacy policies.  I don't think either apply to the Hotel De Anza.</p>

<p>This privacy policy, which the user must indicate they agree to, could say things like "We may sell your detailed personal information to whatever spammer we like for marketing purposes and not require them to keep it safe."  With the prices some of those hotels charge, their guest lists could fetch a good price as a list of potentially lucrative scam targets.</p>

<p>Additionally, secrecy laws protecting private companies would in most cases prevent any individual scam target from finding out how they got on the list.  Companies are apparently not required to accurately disclose how they got any individual's information, which is often through a many-layered chain of data brokers to help make sure no individual company can be held accountable for any violations. </p>

<p>The words about the importance of privacy and reviewing the privacy policy seem more than a bit disingenuous when the site hides any links to the policy.  The same goes for Terms and Conditions which other sites require similar explicit acceptance of, while hiding links to the actual policy.</p>

<p>Are there any negative consequences to a business which acts in this way, or are all the negative consequences on their [prospective or actual] customers? </p>

<p>The effect of not making Terms and Conditions available is generally that the consumer can void them. That is to say, usually they're voidable, not void from the start.</p>

<p>Lacking these terms, companies would have to act under default privacy rules which are generally strict. Under the GDPR, it's even further restricted. Consent requires informed consent, so no T&amp;C means no information and no consent. Furthermore, often these T&amp;C also serve to provide GDPR-mandated information about the identities of2 data processing parties, in which case not provinding that is a second violation.</p>

<p>As usual, this applies to companies worldwide that offer to trade with EU citizens. </p>
