Misleading Privacy Claims: The Promise No Customer Can Check Is Now a Contract Term
A privacy promise the customer cannot verify is not marketing copy. Under UK consumer law it becomes a term of the contract, and since April 2025 the regulator can fine you for breaking it without going near a court.
A VPN that promises "no logs" and a backup service that promises "end-to-end encryption" are selling the same unusual product: a claim the buyer can never check. If the logs are quietly kept, or the keys quietly escrowed, the service looks identical from the outside. That asymmetry used to be a philosophical curiosity. In the UK it is now a compliance problem with a price attached, because misleading privacy claims fall inside the Digital Markets, Competition and Consumers Act 2024, and since April 2025 the Competition and Markets Authority has been able to decide for itself that a trader misled consumers and impose penalties of up to 10% of global turnover, with no court proceedings required.
The sharper exposure comes from an older statute that engineering teams rarely read. Under section 50 of the Consumer Rights Act 2015, anything said or written about a service that the consumer takes into account when buying becomes a term of the contract. Your marketing is not adjacent to the product; contractually, it is the product. For ordinary features this hardly matters, because failure is self-evident: the app crashes, the route is wrong, and the remedy follows. A privacy feature inverts that. The customer has no sensory access to failure, so the only artefact they ever hold is the claim itself. The claim ends up doing the work a specification normally does, except it was drafted by the marketing department and, unlike your internal spec, it is enforceable.
Apple's Private Relay, the proxy service sold with iCloud+, is the live demonstration. Researchers Talal Haj Bakry and Tommy Mysk report that a user's real IP address can leak through passkey authentication traffic: when a website uses WebAuthn related origin requests, the operating system fetches a validation file directly from the device rather than through the proxy, while the toggle shows on throughout. Whatever fix ships, the structural fact remains that a paid privacy protection failed without anything in the product surface changing, which is precisely the condition under which the advert, not the architecture, defines what was sold.
Why do misleading privacy claims carry more legal risk than other marketing?
Because the statutory test looks at the consumer's expectation, not the trader's intent. The Act's unfair commercial practices regime asks whether a practice would mislead the average consumer and cause them to take a transactional decision they would not otherwise have taken. A privacy feature that fails invisibly leads that consumer to keep paying for a protection they are not receiving, and it is hard to imagine a cleaner fit with the test than that. The precedent for how such cases resolve already exists: Google's Incognito mode litigation ended in a settlement that required the company to delete billions of records and rewrite its disclosures, while the class received no monetary damages. The remedy was correction. Courts and regulators treat privacy marketing as a representation to be trued up against reality, which is another way of saying they treat it as a specification.
How do you prove a privacy feature is actually working?
This is an observability problem, and it has engineering answers that almost nobody making these claims has built. A verification surface for a privacy claim has three recognisable components. Attestable status gives the client a signed, third-party-checkable statement of what path its traffic actually took, rather than a toggle that reports intent. Canary probes are independent vantage points that continuously fetch what the service really exposes (the egress IP a website sees, whether plaintext is retrievable) and alarm on any mismatch with the promise. Signed transparency logs, in the mould of Certificate Transparency, give outside auditors an append-only record they can replay to confirm the claimed behaviour held over time. None of this is cheap. It costs design effort, standing infrastructure and an operational commitment, and it has the uncomfortable property that an honest verification surface will publish your failures for you. That discomfort is the point. The cost of making a claim checkable is the true price of making the claim, and if verification is too expensive to build, that is strong evidence the wording was too strong to ship.
Auditing your claims before the regulator does
The practical exercise is a claims audit, and it runs in four steps. First, extract every trust claim from your marketing pages, pricing tiers and in-product copy: private, secure, encrypted, anonymised, never used for training. Second, classify each one as customer-observable, auditor-verifiable or unfalsifiable from the outside. Third, put every unfalsifiable claim through the two legal tests above: would a consumer take it into account when buying, making it a section 50 term, and would silence about a known failure mode mislead them? Fourth, decide claim by claim whether to build the verification surface, weaken the wording until it matches what you can prove, or record that the business is knowingly carrying the exposure. Running marketing claims through the architecture as if they were system requirements is exactly the exercise a technical strategy review is built for.
The next wave of unfalsifiable promises is already being written. AI subscriptions now routinely assert that customer data is never used for training, that inference is private, that tenants are isolated. These are Private Relay-shaped claims: invisible in operation and impossible for the buyer to test, yet clearly the kind of statement a purchaser takes into account. We have argued before that safety properties should be observable by design, in the context of securing agentic systems and of keeping humans in control of AI deployments, and the legal position now reinforces the engineering one. Side channels will keep appearing, because complex platforms produce them; you cannot promise your way around that. What you can do is write the advert like a specification, because under UK law that is what it already is.
Questions people ask
Are marketing claims legally binding under UK consumer law?
For services, yes. Section 50 of the Consumer Rights Act 2015 provides that anything said or written to the consumer, by or on behalf of the trader, about the trader or the service is a term of the contract if the consumer takes it into account when deciding to buy. A privacy or security promise on a pricing page is therefore not mere puffery: if the service does not deliver it, the trader is in breach of contract as well as at risk under consumer protection rules.
What are the penalties for misleading consumers under the DMCCA?
The Digital Markets, Competition and Consumers Act 2024 gave the Competition and Markets Authority direct enforcement powers from April 2025. The CMA can now determine itself that a business has breached consumer protection law, without taking the case to court, and impose fines of up to 10% of global annual turnover. That moves misleading claims from a litigation risk that might never materialise to a regulatory exposure with a defined ceiling.
Did users get compensation in the Google Incognito privacy lawsuit?
No. As the Associated Press reported, the settlement required Google to delete billions of records, strengthen its Incognito disclosures and limit some data collection, but the represented class received no monetary damages. The remedy was correction and transparency rather than payouts, which illustrates how courts treat privacy marketing: as a representation to be brought into line with reality.
Related
- On Ubuntu 26.04 LTS, the coreutils Your Build Depends On Isn't GNU Anymore
- The Sovereignty Premium: Why Sovereign AI Solutions for Enterprise Are Winning on Access, Not Speed
- Trade-Secret Cases Are Won Years Before Anyone Resigns. Ask Faccenda Chicken.
- Security & Trust
Written by an AI editorial persona of Abyshire's proprietary editorial system and reviewed by our team.