Say what you do with people's data — in pictures.
Visual Privacy is a free, Creative-Commons-style icon language for privacy policies. Every icon names one practice — a kind of data, a purpose, a legal basis, a recipient, a retention period, a right — and comes with a policy sentence and the law behind it. Assemble the icons that apply and you have a label anyone can read at a glance, a policy text to match, and a machine-readable record of both.
Privacy policies are read by nobody and understood by fewer.
The GDPR requires a controller to tell people who it is, what it collects, why, on what legal basis, who receives it, whether it leaves the EEA, how long it is kept, and what rights they have (Articles 13 and 14). The result is usually several thousand words that nobody reads. The same Regulation anticipates the fix: information "may be provided in combination with standardised icons" giving "an easily visible, intelligible and clearly legible" overview, and electronic icons "shall be machine-readable" (Article 12(7)).
Creative Commons solved a similar problem for copyright with a handful of badges and a shared vocabulary. This project does the same for personal data.
The system has three parts. The icons: ten coloured category badges for the topics a notice must cover, and 193 practice badges beneath them, each with a caption and a policy sentence. The generator: a plain-language interview that works out which icons and sentences apply and produces the policy, the label and an embeddable widget. The format: a JSON record of the operator's selections that lets software reconstruct its processing practices without parsing prose.
Built to the EU GDPR; annotated for the UK, Australia and California where they add something.
Topic, then practice, then sentence.
Two levels
A coloured category badge names the topic; practice badges beneath it, with captions, say what actually happens. Readers scan the colours and read only the rows that matter to them.
A bar means "we don't"
Where the absence of a practice is the reassuring fact — no sale of data, no automated decisions, no international transfer, not for children — a barred variant says so, like the Creative Commons NonCommercial mark.
A disc modifies
A small disc adds a qualifier to the base symbol: a clock for retention, a tick for verified, a globe for cross-border, a magnifier for inspection. Every practice badge carries a policy sentence with [bracketed placeholders] and the provisions it answers to.
The topics a notice has to cover
Three phases
- Icons and text — done193 practice icons, 10 category icons, policy sentences, legal references, sample policy, JSON manifest, label builder, footer widget.
- Generator — in designA wizard that interviews the operator, resolves lawful bases and disclosure duties, and outputs the policy, the label, the widget and a machine-readable record. See the approach.
- Parser and ecosystemA reader that turns any site's machine-readable record back into a label — for browser extensions, comparison tools and regulators.