TechPrivacyHow-To

I Graded Every App on My Phone From A to E. Instagram and PayPal Both Failed.

A volunteer project called Terms of Service; Didn't Read has spent since 2012 reading the agreements nobody else does, grading them A through E. I checked what's actually on my phone: Instagram and PayPal both land at E, the worst grade, for reasons including PayPal tracking you even after you opt out of tracking. Headspace — the meditation app — isn't much better. There's a free browser extension that shows you the grade before you tap agree, which is the closest thing to actually reading the fine print that most people will ever do.

2026-07-28·The BL:UF Desk·first-person

I Graded Every App on My Phone From A to E. Instagram and PayPal Both Failed.

When I signed up for a meditation app during a bad month, I clicked "I agree" without reading a word. Most people do. Turns out there's a volunteer project that already read it for me — for that app, and thousands of others — and graded it A through E, the same way a restaurant gets a health inspection.

What "agreeing" actually means

A 2008 study calculated that reading every privacy policy the average person encounters in a year would take about 244 hours — a figure later popularized as "76 work days" by The Atlantic. Nobody does this. Companies know nobody does this. That's the whole design: a "clickwrap" agreement (the box you check) creates a real record you agreed to something specific, and courts enforce it; a "browsewrap" agreement (just using the site counts as agreeing) is weaker in court but used constantly anyway, and it's been upheld often enough that "if you keep using this, you agree" functions as real consent. Not a loophole in the law. The law working exactly as designed, on a "yes" nobody meaningfully gave.

The grades — and what mine looked like

Terms of Service; Didn't Read (ToS;DR) is a volunteer project that's been reading these agreements since 2012 and grading them A (best) to E (worst), with a free browser extension that shows you the grade before you agree to anything. I checked what's actually on my phone.

Grade E — "very serious concerns." Instagram: reads your private messages, uses your identity in ads shown to other people, keeps your content after you delete it. PayPal: changes its policy retroactively and keeps tracking you even after you opt out of tracking. Credit Karma, Flickr, Rotten Tomatoes, CouchSurfing, and Discovery (Food Network, HGTV, TLC) all carry the same grade.

Grade D — "very uneven." Headspace — yes, the meditation app: even changes to its terms are inferred from you just continuing to use it, not something you're actually asked to agree to, and your data may be sold if the company is acquired or goes bankrupt. The BBC, Skillshare, Urban Dictionary, and MyAnimeList are all here too.

Grade C — "okay, but issues need your attention." Apple has 16 flagged issues on its own page — more than any other service that didn't land in D or E territory. USPS, Ecosia, Bandcamp, and Canonical (Ubuntu) all land here too — genuinely mixed, not disqualifying.

Grade B — "fair, could be improved." Waze, the privacy-focused search engine Qwant, FastMail, Nextcloud. Qwant's entire bad list is three items. This is what "pretty good" actually looks like in writing.

Grade A — the best rating — was the most telling thing I found. The services that earn it are almost all small, privacy-focused tools most people have never heard of. Not one thing I actually use every day cleared that bar.

The catch: grading it doesn't stop it

A grade tells you what you're agreeing to. It doesn't make the company stop. Instagram doesn't read your messages less because it's rated E. This is a transparency tool, not an enforcement one — the same limit every label has, from nutrition facts to a car's crash-test rating. Useful precisely because it's honest about what it isn't.

Do it yourself (about 2 minutes)

Install the free ToS;DR browser extension — it shows a letter grade on sites as you visit them.
Before your next "I agree," check the grade instead of the document.
If something you rely on grades D or E, that's not a reason to panic — it's a reason to know, and to check whether a real opt-out exists (many do; California's DROP tool is the strongest one currently running).
Report a bad or missing grade yourself — it's volunteer-run, and it's only as good as who shows up to read.

You can't read every agreement you click through. You can glance at a letter grade in the time it takes to tap "I agree" anyway.

The Receipts

Terms of Service; Didn't Read — grade and point data pulled directly from its own service pages via its public API, 2026-07-28
Instagram — Grade E
PayPal — Grade E
Credit Karma — Grade E
Flickr — Grade E
Rotten Tomatoes — Grade E
CouchSurfing — Grade E
Discovery — Grade E
Headspace — Grade D
BBC — Grade D
Skillshare — Grade D
Urban Dictionary — Grade D
MyAnimeList — Grade D
Apple — Grade C
USPS — Grade C
Ecosia — Grade C
Bandcamp — Grade C
Canonical (Ubuntu) — Grade C
Waze — Grade B
Qwant — Grade B
FastMail — Grade B
Nextcloud — Grade B
Reading-time estimate: a 2008 Carnegie Mellon-affiliated study (244 hours/year), popularized as "76 work days" by The Atlantic, 2012

Spotted an error? editor@thebluf.news

Found this worth knowing? Pass it on.

Share on Bluesky Share on X

Follow the desk

Bluesky · @thebluf.news X · @theblufnews Mastodon · @theblufnews

:More Stories

Politics Health

A Federal Agency That Regulates Lawnmowers Is Now Demanding Your ER Records. Its Own Press Release Leaves Out the Part Where Hospitals Were Told It's Mandatory.

The Consumer Product Safety Commission — the agency that recalls dangerous toys and coffeemakers — is quietly pushing at least 100 hospitals to hand over identifiable emergency-room records for every patient, not just consumer-product injuries: names, addresses, diagnoses. A private Kansas contractor, Konza Health, is running the pipeline under a contract worth up to $15.9 million. Internal correspondence calls hospital participation "mandatory." Federal law requires public notice and a comment period before any agency collects information from 10 or more entities — CPSC hasn't done it, and its own spokesperson admits that. And when CPSC finally announced the program publicly, its press release never mentioned Konza by name, never mentioned that hospitals were told sharing was mandatory, and never mentioned the legally required public notice it hasn't filed.

2026-07-27 · analysis

Politics The Trip Report

Police Used License-Plate Cameras to Stalk Their Exes. One of the Officers Who Investigated the First Case Was Caught Doing the Same Thing.

Milwaukee police officer Josue Ayala used the department's Flock license-plate-reader system to look up his romantic partner's location 124 times and her ex's location 55 times. He resigned and pleaded guilty. One of the two detectives assigned to investigate him, Tehrangi Chapman, was later charged with the same kind of misuse — tracking two people himself and secretly planting a GPS tracker on one of their cars. Georgia's state investigators have arrested five more officers this month for the same pattern; two more were fired in South Carolina. An Institute for Justice count puts documented cases like this at two dozen and climbing. And in Norfolk, Virginia — Flock's own backyard for one of the most consequential pending court fights over whether any of this requires a warrant in the first place — the city just voted to add more cameras, not fewer.

2026-07-27 · analysis

Politics Privacy

Every Privacy Law in America Exempts the Government. That's Exactly Where Your Data Is Moving Fastest.

Three separate government surveillance stories broke this month — a police drone leak, license-plate cameras used to stalk exes, a consumer-safety agency demanding hospital ER records — and they're the same story: agencies are sharing and buying data across walls that used to separate them, almost always without a public vote. The part almost no coverage gets to: every one of America's 20 state privacy laws, and the federal proposals that died before becoming law, explicitly exempts government from the rules that bind companies. Add in the terms-of-service agreements nobody reads — a 2008 study put the reading time at roughly 244 hours a year, popularized since as "76 work days" — and the honest answer is that citizens have a little real recourse against companies and functionally none against the government programs documented here.

2026-07-27 · analysis

Get the BL:UF

Real stories. The bottom line, up front. No clickbait, no filler.