So it's Wednesday and I just did a rough count: fourteen emails since Sunday with some version of the subject line "We've Updated Our Privacy Policy." Fourteen. One from a bookstore newsletter I apparently signed up for in November 2012 and have never once opened. One from a fantasy football league I quit in 2015. One from what I can only describe as a vitamin company I have zero memory of ever interacting with, ever, in any capacity.
This is the GDPR run-up, obviously. The actual enforcement date is May 25th, this Friday, and it feels like every company on earth that has ever touched an EU IP address has spent the last two weeks frantically CC'ing their legal department into a form email. I'm not even in the EU. Doesn't matter. Everyone's blasting the same notice to their entire list because nobody wants to be the company that gets fined for missing one subscriber in Lisbon.
I want to be clear that I think the underlying idea here is fine. Companies hoarding data with zero accountability is a real problem and a law that makes them at least say out loud what they're doing with your email address is not nothing. But watching the compliance theater unfold in my own inbox this week has been a genuinely strange experience, and I don't think "here's what GDPR is" is a post anyone needs from me right now, there are about four hundred of those going up this week already.
What I actually want to talk about is the purge. Because here's the thing nobody warned me about: getting fourteen "please confirm you still want to hear from us" emails in four days is an incredible forcing function for finally unsubscribing from garbage you forgot you were subscribed to. I went from mildly annoyed to, by Tuesday night, actively enjoying it. Every single one of these emails has an unsubscribe link sitting right there, more prominent than it's ever been, because the company legally has to make it easy now. So I've been going through them one at a time with something close to glee. Delete, unsubscribe, delete, unsubscribe. It's oddly satisfying in the same way cleaning out a junk drawer is satisfying, you don't need to do it, nothing bad happens if you don't, but once you start you can't stop.
The actual legal text of these emails, though. My god. I read three of them in full yesterday out of morbid curiosity and I don't think I retained a single sentence. "We have updated our Privacy Policy to reflect our ongoing commitment to protecting your data and ensuring compliance with applicable regulations including the General Data Protection Regulation (GDPR)." Cool. Great. What does that mean. Nobody knows, including, I suspect, whoever's cousin in marketing wrote it off a template they found last Tuesday. My actual honest prediction, and I'll be curious to look back at this in a year, is that almost nothing changes about how these companies use my data. The emails are the compliance, not the behavior. That's a cynical take and I know it, but I've been building software long enough to know the difference between "we updated the policy document" and "we changed the code."
The one company that did it well, and I want to give credit where it's due, was a small photography newsletter I've followed for years, run by basically one guy in Portland. His email was maybe four sentences, wrote like an actual human, said plainly what he collects (email address, nothing else) and why (to send the newsletter, nothing else), and that was it. No legal boilerplate. Took less time to read than this paragraph did to write. That's what the rest of them should look like and none of them do, because legal departments exist to make things longer, not clearer.
Anyway. My inbox is cleaner than it's been in years and Friday's still coming whether any of us are ready or not. If you haven't gone through your own flood yet, do it before the weekend, half the satisfaction is watching the number in your inbox count go down in real time.