The Data Human Index

How human does a brand’s data experience actually feel?

Most brands say they respect your data. The Index measures whether they actually do, using only what any user can observe, in about twenty minutes.

Score a brand Compare two by hand

Spotify 14 / 20
LinkedIn 13 / 20
Apple 13 / 20
H&M 12 / 20
Four brands within two points of each other. The shapes say everything.

Why this matters

You already feel it. You just can’t name it yet.

You feel it when a cancellation flow traps you. When a cookie banner is designed to be clicked, not read. When a privacy policy exists purely to protect the brand, not to inform you.

These are not oversights. They are decisions.

The Data Human Index puts a number on that feeling. For curious people, it is a way to understand what they are experiencing. For brands, it is a starting point for doing better.

The five dimensions

One observable question per dimension.

Each is scored zero to four on what you can see from the outside. No inside access, no special tools. The full rubric is below, and it is the same one used for every published score.

01

Transparency

How many clicks to find the privacy policy from the homepage?

How it is scored, 0 to 4
0No privacy policy exists anywhere on the site.
1Buried. Four or more clicks from the homepage.
2Accessible but indirect. Three clicks, or a search is required.
3Easy to find. Two clicks, linked from the main nav or footer.
4Immediately visible. Homepage footer, or one click.

Count clicks from the homepage in a private browser window. If the policy opens as a PDF rather than a web page, cap the score at 3 regardless of click count.

02

Consent

Does the site give a meaningful choice about cookies and tracking before data is collected?

How it is scored, 0 to 4
0No consent mechanism anywhere. Data collected without notice or opt-out of any kind.
1Nothing visible on the homepage. Any opt-out is buried, login-gated, implied through sign-up, or outsourced to browser settings.
2Choice is unequal or unclear. Includes unequal banner design, and sites with no banner where the reason is not communicated.
3A meaningful choice exists but takes an extra step. Accept and decline are visually equal, or granular control sits behind a clearly labelled settings option.
4Accept and decline are equally easy to click, with granular category control. Or the site uses no tracking cookies and says so proactively.

Consent measures the gate, what happens before data is collected. Control measures the lever, what happens after. Some platforms offer Control as a substitute for Consent; note it in the evidence and score the two independently. If no banner appears, check whether the site explains why before assuming privacy by design. If the reason is ambiguous, score a 2.

03

Clarity

How hard is the privacy policy to read, how much of it is there, and can you get hold of it in one piece?

How it is scored, 0 to 4
0No privacy policy exists anywhere.
1Punishing on every count. Postgraduate reading level, enormous, or scattered so widely it cannot be assembled.
2Hard work. Typically undergraduate reading level, or long enough that almost nobody finishes it.
3Readable with effort. Around senior secondary level and a length a determined person would get through.
4Plain, short enough to read, and available in one place.

Scored as the mean of three parts, each 0 to 4: difficulty from the consensus reading grade, length from the word count, and access from whether the document is one findable thing or fragments you have to assemble. Difficulty and length are measured; access is a judgment. Measure it with the tool at thedatahuman.com/clarity, which publishes its thresholds and runs entirely in your browser. No brand has yet scored 4 on Clarity, and none has scored 0. Full marks need a reading grade of 9.5 or better, roughly senior secondary, and no privacy policy measured here has come in under grade 10. That empty top is deliberate: the thresholds measure against a plain-language standard, not against the rest of the field, so they stay where they are even when nobody reaches them.

04

Control

How many clicks to reach data settings, and can you delete your account yourself?

How it is scored, 0 to 4
0No data controls anywhere, and no privacy contact either. Nothing to click and nobody to write to.
1No usable self-serve route, and no dedicated privacy contact. Requests go through general support, or nowhere.
2No usable self-serve route, but a dedicated, clearly labelled privacy contact that is easy to find.
3A usable self-serve route that gives up one of the two things level 4 asks for: it sits behind a sign-in, or it is three or four clicks deep.
4Self-serve deletion or a privacy request form within one or two clicks, reachable without an account.

Score while logged in to a standard user account for account-based platforms. "Usable" means reachable within four clicks, however you get there; a route buried deeper than that does not count as one. Login-gated controls with no guest alternative cap at 3, because requiring an account is a real cost and building the tooling is real work. "Dedicated" means a route that exists for privacy: a privacy address, a named privacy officer, a rights request form. A general support inbox that also handles privacy is not dedicated, however the policy labels it.

05

Empathy

How many clicks to the support page, and is there a way to speak to a human?

How it is scored, 0 to 4
0No support page or contact channel exists anywhere.
1Hard to find, four or more clicks, and no human contact. Automated, FAQ, or public forum only.
2Either hard to find but a human is reachable, or easy to find with no human contact available.
3Human contact available and reachable within three clicks.
4Human contact clearly and prominently offered, within one or two clicks.

Score from the homepage in a private browser window while logged out. Note whether the support experience changes once logged in.

What the score tells you

A number that means something.

The Index is scored out of twenty across five dimensions. Here is what landing in each band actually means, for the brand and for you as a user.

0–7 Extraction-first

Data practices are built around the brand's needs. Users are a source of value, not a person to be respected. Expect dark patterns, buried controls and walls of legal text.

8–13 Compliance-bound

Some genuine effort is visible but significant gaps remain. Probably compliant on paper, but not yet designed for trust. You can navigate it, but you have to work for it.

14–18 Trust-aware

Real care is present across most dimensions with one or two specific weaknesses. The brand is thinking about the user experience of data, not just the legal requirement.

19–20 Human-centred

Transparent, respectful and genuinely designed with the user in mind. These brands treat data as a relationship, not a resource.

Real scores, real brands

We scored these brands ourselves, one dimension at a time.

Using only what any visitor can observe in a private browser window. No inside access, no special tools.

Facebook
10/20 · Compliance-bound

Scores at the ceiling on Transparency and at the floor on Consent and Control. The information is there but the power is not.

TikTok
9/20 · Compliance-bound

The only brand in our dataset to score zero on any dimension, Consent. Account deletion is self-serve in four clicks, better than Facebook’s six, though not exceptional.

The score is just the starting point. The shape is where the story is.

See every brand scored so far

Or the full evidence behind Facebook, TikTok and Apple

Take it with you

Download the DHI Scorecard

A printable version of the scoring framework with evidence notes, free to use for personal or professional projects.

No spam. Just the scorecard. Unsubscribe any time.

Common questions

What the Index is not

Is this anti-data?

No. Collecting data isn’t the problem. Extraction is: value taken without the person understanding it, agreeing to it, or getting anything back. There is no dimension here that rewards collecting less, and none that penalizes collecting more. A brand can hold a great deal of data and still score well, as long as the person understood what was happening, agreed to it, and could change their mind.

Isn’t a good score just the same as being compliant?

No, and this is where most brands are surprised. A company can be entirely lawful and still score badly. Permission isn’t understanding. A consent banner nobody reads satisfies a regulator without satisfying a person, and the Index scores the second one. You can measure any policy yourself with the same tool used here, or start a full score from a brand address.

Is this a campaign against particular companies?

No. Every score is published with the reasoning behind it, so it can be argued with rather than simply believed. The bands run from Extraction through Compliance and Trust to Human, which makes a score a position on a path rather than a verdict.

We think our score is wrong. Now what?

Tell me. The reasoning behind every score is published precisely so it can be challenged, and a specific objection is more useful to me than agreement. Get in touch and point at the dimension you think is misjudged. The same applies if you want to know how to move it.

This is an ongoing project

The Index is part of a larger body of work on human-centred data strategy. Follow along on LinkedIn for new brand analyses, framework updates and the thinking behind the scores.