Bruce Schneier has popularized the term "security theater," denoting security measures that look impressive but don't actually protect us---they create the appearance of security but not the reality. When a security guard asks to see your ID but doesn't do more than glance at it, that's security theater. Much of what happens at airport checkpoints is security theater too.

Privacy theater is the same concept, applied to privacy. Facebook's privacy policy runs to almost 6000 words of dense legalese. We are all supposed to have read it and agreed to accept its terms. But that's just theater. Hardly any of us have actually read privacy policies, and even fewer consider carefully their provisions. As I wrote in the Times piece, we pretend to have read sites' privacy policies, and the sites pretend that we have understood and consented to all of their terms. It's privacy theater.

Worse yet. privacy policies are subject to change. When sites change their policies, we get another round of privacy theater, in which sites pretend to notify us of the changes, and we pretend to consider them before continuing our use of the site.

And yet, if we're going to replace the notice-and-consent model, we need something else to put in its place. At this point, It's hard to see what that might be. It might help to set up default rules, on the theory that a policy that states how it differs from the default might be shorter and simpler than a stand-alone policy, but that approach will only go so far.

In the end, we may be stuck with privacy theater, just as we're often stuck with security theater. If we can't provide the reality of privacy or security, we can settle for theater, which at least makes us feel a bit better about our vulnerability.