Watching Terms and Conditions May Apply (TACMA) is sort of like watching Ars’ tech policy coverage—but in an 80-minute feature film.

The documentary, released last week, will particularly interest your smart (but less tech-savvy) friends who shrug at things like the most recent NSA metadata surveillance scandal. American technology law and policy can often feel too niche, despite the fact that the issues in question apply in some way to nearly everyone on the Internet, as American companies are so dominant online. But this film might just be the most fun and accessible way to learn about what’s been happening to all of us, online, over the last 15 years.

Filmmaker Cullen Hoback adeptly uses a combination of cutesy animation, archival footage, and even guerilla journalism to make a movie that’s informative, frightening, and compelling to watch. Hyrax Films provided Ars with an advance copy—it opened in New York earlier this month and is currently being screened this weekend in Denver. In late July and early August, TACMA will screen in tech hubs San Francisco and San Jose, as well as Phoenix, Portland, Dallas, Richmond (Virginia), Toronto, and San Diego.

“One says that you’re totally anonymous, the other says ‘when necessary,’ you’re not.”

Within the first 10 minutes of the film, Hoback reminds us of the halcyon days of the late 1990s commercial Web, when startups rose and fell and a real digital privacy policy in America was bubbling beneath the surface. In early 2001, over a dozen privacy bills were introduced in Congress. But after Sept 11, 2001, the narrator (Hoback himself) intones: “all privacy legislation was either killed or abandoned, and the PATRIOT Act was, of course, initiated.” The film deftly reminds us that this was the initial seed that gave rise to the National Security Agency’s blanket telephony metadata collection program. (A Congressional vote to shut down that program was defeated by a slim margin just this past week.)

TACMA goes to the Internet Archive to examine Google’s own privacy policy from December 2000, which states:

Upon your first visit to Google, Google sends a "cookie" to your computer. A cookie is a file that identifies you as a unique user. Google uses cookies to track user trends and patterns to better understand our user base and to improve the quality of our service. Google may also choose to use cookies to store user preferences. A cookie can tell us, "This is the same computer that visited Google two days ago," but it cannot tell us, "This person is Joe Smith" or even, "This person lives in the United States."

But then, Google made a fundamental change to that policy in December 2001.

Upon your first visit to Google, Google sends a "cookie" to your computer. A cookie is a piece of data that identifies you as a unique user. Google uses cookies to improve the quality of our service and to understand our user base more. Google does this by storing user preferences in cookies and by tracking user trends and patterns of how people search. Google will not disclose its cookies to third parties except as required by a valid legal process such as a search warrant, subpoena, statute, or court order.

Again, the narrator reminds us that this is a very important difference: “One says that you’re totally anonymous, the other says ‘when necessary,’ you’re not.”

“It’s not actually gone. It’s still there.”

Hoback then transitions from talking about Google’s privacy policies, to how Facebook has forcibly shifted “social norms” for how and what people share online. The film visits Max Schrems, who has been a thorn in Facebook's side, particularly in Europe, for a few years now.

Ars readers may remember that we profiled the young Austrian law student last fall in the article, “How one law student is making Facebook get serious about privacy.” More recently, we covered Schrems' efforts to challenge Facebook’s datasharing with the National Security Agency, which he argues should be illegal under European law. (Facebook, with its international headquarters in Ireland, has to follow these laws.)

Schrems shows Hoback, in his Vienna apartment, with the 1,222 pages of his own data that he compelled Facebook to share with him in 2011. With a few keystrokes, Schrems demonstrates how easy it is to search his own data in the PDF that Facebook provided, showing any time the word “sex” shows up in his entire data file.

“If you hit the ‘remove’ button, it just means that it’s been flagged as deleted—you hide it, actually from yourself. But anyone at Facebook or any government agency who wants to look at it later, can still retrieve it and get it back,” Schrems says. “It’s not actually gone. It’s still there.”

“Mark Zuckerberg smiled at me.”

Another civil rights advocate that the film quotes from liberally—and who has shown up on the pages of Ars just as much—is Chris Soghoian, now a privacy researcher at the American Civil Liberties Union.

Early on in the film, Soghoian reminds us of the proposed Total Information Awareness program, which was publicly killed, but nearly all of which was shifted over to black operations programs to be run by the NSA and other intelligence agencies.

Even Barrett Brown, the self-proclaimed spokesperson for Anonymous, gets a few minutes of screen time—presumably before getting arrested in September 2012. (He currently faces a slew of federal criminal charges.)

The film closes with Hoback staking out Mark Zuckerberg’s house in Palo Alto (which he found with some easy Googling). When Zuck does finally emerge, Hoback approaches him, tells him that he’s tried to get an interview through the normal PR channels, but hasn’t received any response. Zuck sees the camera and tells Hoback to stop filming—but what he doesn’t realize is that Hoback has a hidden camera in his glasses.

Mark loosens up after he thinks we’ve stopped recording. And you see that? That right there. That’s a smile. Mark Zuckerberg smiled at me. And you know why? Because he thought I’d stopped recording. And he was relieved. Imagine what a relief it would be if all of these companies, and the government, stopped recording everything that we do.

“It’s like data slavery.”

After watching the film, I called Hoback—currently on tour with his film—and asked him how his own behavior had changed after making the film.

“I always imagine that I’m having a conversation with whoever I’m having a conversation with, and the NSA,” he told Ars. “It absolutely [changes my behavior.] It changes how I communicate in phone conversation or what I text. It’s frustrating that anything that I do can be logged as a time machine—that’s a frightening concept. I use Ghostery and Disconnect, and Firefox with cookies turned off, and DuckDuckGo.”

As Hoback continues to show the film around North America, he hopes to see more European-style data protection principles implemented in the United States.

“I think the film is about building awareness,” he said. “It’s about taking people on the same journey that I went through: taking users to understand the implications of what they’re using, then you can open up new opportunities for innovation. There’s not a big market for encryption—services that put encryption and privacy at the forefront, these things haven’t done well. I think there’s room for growth in that field.”

Finally, Hoback questioned why the United States doesn’t have a concept of habeas data enshrined into our law, as is the case in many other countries.

“Why is that data property of the company?” he asked. “Why isn’t it the property of the individual? It’s like data slavery. You don’t have the right to lend it, it’s just taken from you. If we don’t have access, and then it’s a lack of control—it dis-empowers you. Why is data not a right? These services only exist if users continue to use them."

"Unfortunately, as it stands, I think we’re trapped on Facebook, on Google. It’s hard to get your data off of them. It’s impossible. In order to have some sort of say in all of this, the government needs to step in and say that the Fourth Amendment matters online. How do you make that happen? How do you make the Constitution apply in this space? It’s not impossible. It’s perfectly doable. [Companies and the government] just don’t want to do it.”

“Ultimately I hope that [my film] supports a movement and relationship to what Snowden has done ... We need shifts in the PATRIOT Act, and all of that is a trickle down of one simple premise: that the Constitution applies online—the next step is data access and data control.”

Terms and Conditions May Apply is currently being screened across North America over the coming weeks, but Cullen Hoback is encouraging groups and individuals to hold their own screening, as well.