Misleading header "Information from Third Parties" in privacy policy

Question

The following section is in the SE privacy policy:

Information from Third Parties

We may share personal information with third parties who provide services to Stack Overflow, such as payment processors, email delivery services, and advertising providers. Additionally, to improve user experience, we offer single sign-on solutions for account login and these third parties (including Facebook and Google) may receive information from these services when you elect to use them. When Stack Overflow shares your personal information and other collected information with third party service providers, we require that they use your information only for the purpose of providing services to us and that their terms are consistent with this privacy policy.

The term "Information from Third Parties" is rather misleading because this section is about sharing information with third parties and not from third parties. I'm not sure I'm missing some legalese here that makes this correct, but to a non-laywer this header looks simply wrong.

I noticed this because I was looking for the specific terms under which SE shares information with third parties, and I missed it the first time because of the misleading heading. I think this part would benefit from some clarification. I suspect any update is difficult, but at least this could be considered when the policy is updated for any other reason anyway.

Answer 1

Have you ever had a conversation about something, left it feeling as if you had perfect clarity and a firm grasp on the matter, and then got back to your desk with a mind that couldn't seem to grasp the very thing you were certain that you just understood?

That happened to me a lot when we overhauled all of the legal things when the GDPR was going into effect. It's not legally misleading, but it is confusing. Since it raises confusion, and the whole point of the policy is to alleviate confusion surrounding how we use your information, we're going to change the heading to:

Information Shared With Third Parties

That's not to say that some of these exchanges aren't bidirectional in nature, in fact many are. The examples are good because they do help illustrate these scenarios, but we're often unaware of what many scenarios that this policy will cover actually look like until we encounter them. For instance, we transmit payment details to a processor, but information contained in responses can significantly vary.

What matters, and what we're most specific about is, our policies and their policies regarding any use of this information must be compatible. So using another example, any information Google sends us about you when you sign up is covered equally as information we might send to a fulfillment partner. If you wanted to allude to an engineering term, intrinsically safe would be a good metaphor.

So while it's going to remain to and from third parties as far as policy goes, since the policy exists to reassure you first and foremost, we are going to update the language.

Thank you for pointing it out. I'd read this section several times while we were moving things about and didn't really catch the perceived ambiguity until I had some distance from it.

The change will go out shortly.