Privacy policies are famously difficult to read, and in the world of LLMs, they’re impenetrable and longThe policy for Meta’s Muse Spark is over 14,000 words long, taking almost an hour to readCybersecurity firm Bridewell carried out the study, assessing the privacy policies of 20 popular LLMsWhen you input data into an AI chatbot, you expect it to interpret and process the words or numbers to save you time. But what is it doing with that data? You can check the privacy policy to find out – assuming, that is, that you have the time to do so. A new study has found that the average time it takes to read a privacy policy for an LLM is 20 minutes – and some are a much longer read.With around 75% of people admitting to using an AI chatbot at least once a month, understanding where the questions and data queries are going and how they are used is increasingly important.Ease of readingPrivacy policies provide that understanding, but are they easy to read? A study by Bridewell’s cyber security experts suggests not, with many having a poor Fleisch Reading Ease Score, meaning that in layman’s terms, these documents are pretty impenetrable.Bridewell’s study assessed privacy policies from 20 large language models (LLMs), and found that the average length of time to read one is 20 minutes. The average word count is 4,603, but the real challenge is understanding the information.The Flesch Reading Ease Score is a measure of readability devised by Rudolf Flesch in 1948, and is widely used to score texts. A score over 60 is good, whereas a score below that is not. The average Flesch score for these privacy policies is 40.2, suggesting a degree of jargon-based density that most people will not understand.How, then, might the general public safely use an LLM chatbot like ChatGPT or Google Gemini while in full knowledge of how the information they input is being used?Training on inputsIn evaluating the LLMs, Bridewell found that 13 of the 20 use inputs and outputs to train their models. Some LLMs offer the option to opt out of training, but others do not. Even where an opt out is possible, it isn’t always clear how to action it.“It’s essential for users to fully understand how their data is being processed by LLMs, and businesses need clear internal guidance on what can and can't be shared, and ideally proper enterprise accounts with the right protections in place," noted Chris Linnell, Associate Director of Data Privacy at Bridewell, "employees may be at risk of sharing highly sensitive or confidential information that may end up being used to train LLMs.”There isn’t just a personal risk from data input into an AI. Employees need to be aware of how they are using the technology for work.As a rule of thumb, the more complex the LLM (e.g., Meta's Muse Spark, or Moonshot AI’s Kimi K), the longer the privacy policy takes to read.