The current law allows website companies to protect themselves from liability for sharing or selling visitors’ personal information to third parties by focusing on disclosures in privacy policies, not on substantive treatment of personal information. Because of the low likelihood that a visitor will read or understand that policy, websites have an incentive to protect themselves by allowing for a broad use of the visitor’s personal information. In turn, websites word those policies as contractual commitments, purportedly binding visitors to their terms, which often include forum selection provisions as well as privacy terms. In light of these two factors – little substantive protection, and privacy provisions that allow for broad use of personal information – such visitors may well find themselves in the position of challenging the enforceability of the privacy policy. I argue that the policies are challengeable primarily on lack of assent and unconscionability grounds.