These days AT&T knows a great deal about its customers: who they call, where they travel, what they watch on TV, what sites they visit on the Web. It has taken a new shot at explaining to them what information it collects and why in a new privacy policy that it posted Thursday morning. The policy is a draft that in 45 days will replace the 17 policies now used by its various subsidiaries.

I can hear the chorus of yawns and wisecracks already.

Privacy policies are typically little more than boilerplate that have very little to do with protecting people’s privacy or even giving them useful information to help them understand which companies to do business with. But AT&T has decided that appearing to take the high ground on privacy will help it in Washington in its battle with Google, and perhaps will improve its image among those who are angry about its cooperation with the government’s warrantless wiretapping program.

But I’ve been talking to Dorothy Attwood, AT&T’s chief privacy officer, about this project for several weeks. And it does seem like an earnest effort to lay out for people what AT&T knows about them.

“It shows we are a big company,” she said. “We have lots of information and lots of uses of the information.”

Ms. Attwood said that this effort didn’t really change AT&T’s standard for how it handles customer information but that it did make the disclosure more explicit. Even this exercise in writing may have an impact.

“Clarity brings the potential for greater scrutiny about what our privacy and our usage of data practices are,” she said. “Other companies don’t have that clarity.”

To my reading, there is in fact a directness to the policy that is often lacking. (If you are interested, read it yourself and leave your reaction in the comments.)

It has a prominent section on location information, one of the biggest new types of information being collected by cellphone companies. It makes clear that AT&T knows where its cellphone customers are and uses that information to show ads for local merchants when they check yellow pages and use other services.

The policy is certainly explicit in addressing many practices that other companies gloss over. For example, it says that AT&T buys information about customers from credit bureaus and mailing list aggregators. And it explains how it tracks users of its Web sites and then can use that data to tailor ads to them on other sites. (This came up when Ms. Attwood misspoke about this practice at a Congressional hearing.)

AT&T’s new policy even addresses the topic of that hearing directly, asserting that the company does not use technology called deep packet inspection to track the surfing behavior of its Internet customers to use in advertising. It promises to ask permission before it does so. The policy says the company is working on other ways to explain how data is used to tailor advertisements.

AT&T’s privacy policy, perhaps more than for other companies, has a political component. Its previous policy, released six months after the warrantless wiretapping program was first published, says in the third paragraph:



We also have an obligation to assist law enforcement and other government agencies responsible for protecting the public welfare, whether it be an individual or the security interests of the entire nation.

Taken as a whole, the new document shows that AT&T has access to a vast amount of information about people, and it claims the right for all parts of AT&T to do almost anything with that data, including trying to sell customers other services, set prices and sell advertising to other companies.

AT&T set a few limits, most significantly that it won’t sell personal information about customers to third parties, except, of course, that it publishes the name, address and phone numbers of all its local telephone customers who don’t pay for unlisted numbers.

The site is up front about the fact that it will give information about you in response to government subpoenas, government orders and lawful discovery requests in civil suits. AT&T does not say it will notify you in advance that it is going to turn over information in response to a government order or lawsuit, except in the case of TV viewing information where such notice is required by law. (The company offers television programming through its U-verse Internet service.)

The policy offers only one significant choice: Customers can send an e-mail to request that AT&T not market to them by e-mail, telephone or postal mail. It also offers a procedure for customers to request the billing information AT&T keeps about them, but it doesn’t offer a window onto the Web tracking, television usage monitoring and location following that the company does.

The company says it can keep all the information it collects about customers as long as they do business with AT&T. Many privacy advocates argue that a policy to have records regularly destroyed can be an important way to prevent their misuse.

And the company gives itself wide authority to do most anything with data that it defines as anonymous or aggregate. That means it well create a service that would let advertisers put ads on the cellphones of “American Idol” fans in Pittsburgh who call florists more than once a week.

But interestingly, AT&T has created a rather broad definition of what is personal information, rather than anonymous information. This is important because a lot of data that some companies assert is not personally identifiable, like Internet Protocol addresses, sometimes can be used to track down individuals. AT&T says it will treat as personal “information that directly identifies or reasonably can be used to identify an individual Customer or User.” That definition forces the company to protect anything that can reasonably be used to track someone down.

I don’t want to make too much of this. Privacy policies have generally been ways for companies to protect themselves from lawsuits, rather than protecting their customers from hucksters, nosy government officials or Peeping Toms. And AT&T is not breaking new ground in giving customers information and control over how it tracks them.

But the company is saying more clearly than most other big companies that it knows a lot about you, that it will use that information to help it make more money in any number of ways, that it will keep the data for as long as you remain a customer, and that it can be forced to give all that information to the government without giving you the chance to object.