Privacy policy length varies sharply by industry: shopping, adult, and recreation sites post policies running 900 to 2,500 words longer than the cross-category average, while reference, science, and society sites run 900 to 1,600 words shorter, according to a 2022 longitudinal study of 2,181 websites spanning 1996 to 2021. That average itself has climbed to 4,191 words, nearly four times its year-2000 length. The gap between industries turns out to matter almost as much as the gap between decades.
How much does privacy policy length vary by industry?
Figure 1: The reported word count gap from the 2021 cross-category average, by direction. Source: Isabel Wagner, "Privacy Policies Across the Ages" (2022).
Researcher Isabel Wagner built a corpus of 2,181 unique websites' privacy policies, tracking each site's policy text from 1996 through 2021 using historical Alexa toplist data and, more recently, the Tranco rank list. Grouping policies by the second-level website category that Alexa assigns each domain, six categories showed a statistically significant difference from the overall 2021 average (p less than .001, with at least a small effect size). Adult, shopping, and recreation sites ran 900 to 2,500 words longer than that average. Reference, science, and society sites ran 900 to 1,600 words shorter.
The pattern lines up with what each type of site actually has to disclose. A retailer typically layers payment processing, loyalty programs, marketing consent, and third-party ad partners into one document, while a reference or informational site with no checkout and no accounts simply has less to say. Sites in the longer-running categories can close that complexity gap without over-lengthening the document further by using a privacy policy generator built for e-commerce and consent disclosures, which assembles only the clauses a given business model actually needs.
This same rank gap shows up in how many websites carry a privacy policy at all, where policy presence itself, not just length, tracks a site's traffic tier.
How long is the average privacy policy today?
The cross-category average has climbed steadily for two decades. Wagner's dataset shows a monthly mean word count of 1,146 words in 2000, 2,159 words by March 2011, roughly 3,200 words across 2018, and 4,191 words by March 2021. That is close to quadruple the year-2000 figure and nearly double the 2011 figure, all within one dataset using a consistent collection method.
Figure 2: Average privacy policy length by year, 2000 to 2021. Source: Isabel Wagner, "Privacy Policies Across the Ages" (2022).
Growth was not perfectly smooth. It accelerated visibly around May 2018, when the GDPR's disclosure requirements took effect, and again around the CCPA's start date in 2020, though both effects were measured as statistically significant with only a small effect size in Wagner's own data. For a closer look at the trend on its own, see our companion piece on how many words the average privacy policy runs, which uses a different dataset's median figures to tell a related but distinct part of the same story.
Does a website's popularity affect privacy policy length?
Barely. Wagner tested whether a site's rank, using the Tranco list as of July 20, 2020, predicted a longer or shorter policy. Top-100-ranked sites averaged 3,079 words, compared with 2,853 words for lower-ranked sites in the same corpus, and the correlation between rank and length came out to Pearson's R of negative 0.015, a value close enough to zero that the study treats rank as having essentially no influence on length.
Figure 3: Average privacy policy length by site popularity tier. Source: Isabel Wagner, "Privacy Policies Across the Ages" (2022), Tranco rank as of July 20, 2020.
That is a useful finding for any small or mid-sized site owner: a modest traffic ranking is not an excuse to run a shorter, less complete policy, and a top-100 ranking does not automatically demand a longer one either. Industry and actual data practices predict length far better than popularity does.
Did GDPR make privacy policies longer?
Yes, and one of the clearest single before-and-after measurements comes from a separate NDSS 2019 study by Degeling and colleagues, which tracked EU-facing websites directly across the GDPR's May 25, 2018 effective date. Average privacy policy length on those sites grew from 2,145 words in 2016 to 3,603 words by May 2018, a jump of roughly 68% in under two years, as cited in Wagner's own literature comparison.
Figure 4: Average EU website privacy policy length before and after GDPR's effective date. Source: Degeling et al., NDSS 2019, as cited in Wagner (2022).
The GDPR jump and the industry gap are related but separate effects. GDPR added length across nearly every category at once, while the industry-by-industry gap persists on top of that shared baseline; a shopping site's policy is longer than a reference site's policy in every year Wagner measured, not just after 2018.
How does the mean compare with other published length figures?
| Measure | Word count | Source | Year |
|---|---|---|---|
| Adult, shopping, recreation sites vs. average | +900 to +2,500 words | Wagner (2022) | 2021 |
| Reference, science, society sites vs. average | -900 to -1,600 words | Wagner (2022) | 2021 |
| All categories combined (mean) | 4,191 words | Wagner (2022) | 2021 |
| EU sites, post-GDPR (mean) | 3,603 words | Degeling et al. (2019) | 2018 |
| All sites, Alexa top 100K (median) | 1,522 words | Amos et al. (2021) | 2019 |
Source: Wagner (2022), Degeling et al. (2019) as cited in Wagner, and Amos et al. (2021).
The bottom row is the one worth reading carefully. The Princeton and KU Leuven team's 1,522-word figure is a median from a much larger, differently sampled corpus, not a contradiction of Wagner's 4,191-word mean. A mean gets pulled upward by the small number of very long policies in the longer-running categories, while a median sits closer to what a typical site actually publishes. Both numbers are correct descriptions of different things.
The Bottom Line
Industry is the strongest predictor of privacy policy length that this research has isolated, well ahead of a site's traffic ranking. Shopping, adult, and recreation sites run 900 to 2,500 words longer than the cross-category average of 4,191 words, largely because they have more categories of data collection, more third parties, and more consumer rights to disclose in the first place. Reference, science, and society sites run shorter for the same reason in reverse: less to disclose. For a site owner, the practical lesson is not to target a specific word count at all. It is to make sure every actual data practice, every third party, and every consumer right the business touches gets its own clear disclosure, whatever that ends up costing in word count for that particular kind of business.
Frequently Asked Questions
How much longer are shopping site privacy policies than average? Shopping, adult, and recreation sites post privacy policies running 900 to 2,500 words longer than the 2021 cross-category average of 4,191 words, according to Isabel Wagner's 2022 longitudinal study of 2,181 websites collected from 1996 to 2021.
What is the average privacy policy length right now? The most recent large-scale measurement is 4,191 words as of March 2021, the mean figure from Wagner's dataset. A separate Princeton and KU Leuven study puts the 2019 median at just 1,522 words, a reminder that mean and median tell different stories for a right-skewed distribution like this one.
Does a website's popularity affect its privacy policy length? Barely. Top-100-ranked sites averaged 3,079 words versus 2,853 words for lower-ranked sites in the same dataset, a gap so small the study's own correlation test, Pearson's R of negative 0.015, calls essentially meaningless.
Did GDPR make privacy policies longer? Yes. A separate NDSS 2019 study found EU site privacy policies grew from 2,145 words on average in 2016 to 3,603 words by May 2018, the month GDPR's disclosure duties took effect, a 68% jump in just two years.
Where the Numbers Come From
- Wagner, Isabel. (2022). "Privacy Policies Across the Ages: Content and Readability of Privacy Policies 1996-2021." Longitudinal corpus of 2,181 websites; mean word count 1,146 words (2000) to 4,191 words (March 2021); industry-category length gaps of 900 to 2,500 words above and 900 to 1,600 words below the 2021 average; Tranco-rank length comparison of 3,079 vs. 2,853 words. Also published in the ACM Digital Library, DOI 10.1145/3590152.
- Degeling, M., Utz, C., Lentzsch, C., Hosseini, H., Schaub, F., and Holz, T. (2019). "We Value Your Privacy... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy." NDSS Symposium 2019. EU site average policy length of 2,145 words (2016) growing to 3,603 words (May 2018); figures as cited in Wagner (2022)'s related-work comparison.
- Amos, R., Acar, G., Lucherini, E., Kshirsagar, M., Narayanan, A., and Mayer, J. (2021). "Privacy Policies over Time: Curation and Analysis of a Million-Document Dataset." Proceedings of WWW '21. Median privacy policy word count of 876 words (2009) to 1,522 words (2019) across a separate Alexa top-100K corpus.
Note: All figures verified as of October 2026. Wagner's industry-category breakdown is the most recent published academic analysis of privacy policy length by website category, measured as of 2021; no larger or more recent academic re-crawl of this specific scope has been published as of this writing. Figures are refreshed at least twice a year as newer research becomes available.
