9 ms·

> This transaction breaks a core promise using the internet: just because I visit a website doesn’t mean I consent to getting spam from it. No it doesn't. Ther

> This transaction breaks a core promise using the internet: just because I visit a website doesn’t mean I consent to getting spam from it. No it doesn't. There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. I'm not condoning this behavior, but we're in territory that we don't have prior art for. It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. When you do it at scale, the old rules don't apply. If you think it's spam, hit the spam button in gmail and get rid of it. Use an adblocker. Talk to your congressman about data privacy and sharing laws, because we don't have anything that's effective. Frankly, continue to write Medium posts, because it raises awareness :) But, I disagree with the notion that this is a solved problem with bad actors, because we're in unknown waters.

sp332 10y ago
This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails. You shouldn't be allowed to pretend that visiting a site is a solicitation. Edit: I misunderstood the mechanism of collecting the addresses. This isn't skirting "unsolicited mail", but it is circumventing the ban on harvested email addresses.
- jamiesonbecker 10y ago
  > You're not allowed to send unsolicited emails. Actually, you ARE allowed to send unsolicited email, even commercial (UCE). It has to be clearly labeled, contain the postal address of the sender, and contain unsubscribe links. Also, CAN-SPAM only applies to senders in the U.S. (unfortunately). https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicability https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicabi...
  - sp332 10y ago
    I don't know if I would call it a "relationship" message, but maybe it's a "transactional" message, where serving the webpage counts as the transaction?
    - the_watcher 10y ago
      When I worked somewhere that did a decent amount of email marketing, we were told our abandoned cart emails were not transactional, as there were not actually a part of any kind of transaction (yet). Not sure on the actual status though.
  - derefr 10y ago
    > CAN-SPAM only applies to senders in the U.S. Given that SMTP is a relay system, would the first US-soil SMTP gateway machine a message travels through be its legal "sender" (in the way that e.g. the importer of a foreign medical device is liable if it's not FDA-approved)? One would think this would legally force those gateways, when handling foreign-originated spam, to slap their own address on them with their own unsubscribe link, that would—if clicked—then block those messages from coming through that gateway.
    - jameshart 10y ago
      Mail is not actually sent over a series of SMTP relays, though. It's basically routed directly to the MX SMTP server for the domain.
      - majewsky 10y ago
        Except in some corporate intranet setups, but that's not really relevant for this discussion.
  - rbritton 10y ago
    It's pretty amazing the number of senders that do not obey the requirement for a minimal unsubscribe flow: > Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request. Once people have told you they don’t want to receive more messages from you, you can’t sell or transfer their email addresses, even in the form of a mailing list. To me it seems more of an honor-based system rather than one there's any enforcement for. Much like the Do Not Call list.
    - ianlevesque 10y ago
      There have been a handful of prosecutions, but not nearly enough.
  - mike-cardwell 10y ago
    "unfortunately" ? Thank God we don't have the CAN-SPAM act in the UK. I'd be receiving unsolicited spam from all sorts of UK businesses if we did. I don't care if a spam email has an unsubscribe link or the sender is clearly labelled. Once it's received and seen, the damage is done.
  - wtbob 10y ago
    > Also, CAN-SPAM only applies to senders in the U.S. (unfortunately). We could always send gunboats to reduce cities whose citizens send unsolicited emails to the U.S. … /s More seriously, this does seem like the sort of thing which could be addressed through bilateral or multilateral negotiations, including between the private firms who own the international Internet connexions.
- hoorayimhelping 10y ago
  >You're not allowed to send unsolicited emails. Sorry, this is completely false information that is easily verifiable by looking at the wikipedia page for the can spam act: https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Sending_behavior_compliance https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Sending_b... >But when sending unsolicited commercial emails, it must be stated that the email is an advertisement or a marketing solicitation.
  - arm 10y ago
    Sorry, this is completely correct information if you don’t assume that the US in the only country in the world. For example, Canada’s Bill C-28¹ explicitly prohibits it. ―――――― ¹ — http://www.ctvnews.ca/sci-tech/canada-s-new-anti-spam-law-applies-to-almost-all-businesses-1.1885477 http://www.ctvnews.ca/sci-tech/canada-s-new-anti-spam-law-ap...
    - oarsinsync 10y ago
      Looking at the full context of the quote is useful. > This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails. The USA is not the only country in the world, but the CAN-SPAM act totally permits unsolicited emails, which is the context of this thread.
    - pc86 10y ago
      > if you don’t assume that the US in the only country in the world. The US is the only country with a CAN-SPAM Act. Unless Canada has one of those too?
- actsasbuffoon 10y ago
  California and New Jersey have laws that go above and beyond the protections outlined in CAN-SPAM. I used to work for a company that sent spam (I swear, I didn't know until after I'd already accepted the job), and we avoided sending to those states. If more states would adopt laws like this, we could dramatically curtail spam. As for what constitutes solicitation, I wish it was that simple. In some instances, companies will buy your email address from another company, and they believe that constitutes consent. In other words, you did business with Company Foo, and I did business with Company Foo, so you consented to do business with me. It's insane. Having been inside one of these businesses, I have three pieces of advice. First: Mark spam emails as spam when you see them. You only have to get a few of your messages marked as spam to get your IP address blacklisted. You have far more power over spammers than you think. Not only that, but spammers fear this so much that they keep databases of complainers, and they'll leave you alone in the future. Sometimes they'll even share lists of complainers with other companies so they won't risk your wrath. Spam companies love non-complainers. Even if you don't open the spam, not complaining helps their numbers with the email provider. By not complaining, you're sending a signal to your email provider that this is a good email, and other users would like to receive it. Not only that, they'll remember you as a person who can be relied upon to not complain, so you'll get more spam than other people. Second: Read EULAs. We did business with some super-shady companies who sold us tons of really invasive user info. One company even sold us the contents of people's email. Not just meta data, we could actually read the content. They don't mention any of this on their site, but it's subtly stated in the EULA. Read them and check for references to sharing your data with business partners. I've steered clear of some browsers and email clients as a result of vague EULAs that leave the potential for harvesting my data and selling it. Third: This one is going to be unpopular on Hackernews, but the best way to avoid being fingerprinted by advertisers is to block JavaScript by default. There are bajillions of ways to uniquely identify your computer, right down to having your browser report which fonts you have installed. Almost every single technique relies on Flash, Java, or JavaScript. Ad-blockers help, but they don't catch everything. I use NoScript to turn off JavaScript by default, and I only enable a site if it seems legitimate and the site is broken without it. Here's a terrifying list of the things advertisers can do to uniquely identify you without consent and without a cookie. As the article says, disabling JavaScript by default is by far the most effective method for protecting yourself from fingerprinting: https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting It's a little inconvenient, but good security always is. The locks on your front door are inconvenient (what if you lose your key?), but hopefully they're even more inconvenient for would-be intruders.
- downandout 10y ago
  First, CAN-SPAM doesn't outlaw the sending of unsolicited commercial messages - on the contrary, it lays out rules for sending them. Second, in this case, at some point this guy agreed to receive emails from Criteo when entering his email address somewhere. The fact that people don't read TOS before they agree to them does not invalidate them.
  - majewsky 10y ago
    The question is not a legal one, but a moral one. Of course the TOS are agreed on by the user, but it's still not what they want, so I still consider it unsolicited from a moral POV.
rmc 10y ago
> There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. There is in Europe, in the Charter of Fundamental Rights of the European Union (basically the EU's Bill of Rights).
deleted 10y ago
[deleted]
guelo 10y ago
> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. Huh? Outside of some tiny village the shopkeeper would not know the name and address of customers that are just browsing. If a shopkeeper hired private investigators to stalk those customers, following them around everywhere gathering as much personal information as possible, it would probably run afoul of some law.
- sintaxi 10y ago
  Not only that, in this example the shopkeeper is simply helping the customer find what they are most likely requesting simply to be helpful. A more accurate example would have shopkeepers buying customer data from each other using a 3rd party entirely for their own benefit. This really isn't the same thing at all.
TeMPOraL 10y ago
> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. When you do it at scale, the old rules don't apply. The on-line equivalent of that would be e-commerce sites sharing their detailed analytics data with each other. What was described in the article is more alike to a shopkeeper saying to another, "Did you see that woman in red scarf? Her name is Jane Doe, she lives in the house over that hill. She seems to be interested in this particular item, so your best bet is to upsell her something similar."
- taneq 10y ago
  "She's just received a big payout from her ex-husband so she'll be willing to pay more, and she likes cats, especially white ones. Also her sister's birthday is coming up and the sister is obsessed with horse racing so you might be able to sell her some memorabilia. Jack up the price so she'll think it's valuable."
  - wangchow 10y ago
    Nowadays more like: Her genetic makeup is abc so she's prone to disease xyz. Use fear tactic and she'll be at your doorstep begging for a cure. Disgusting, but captures the information age in a nutshell..
- deleted 10y ago
  [deleted]
- alex_hitchins 10y ago
  And rather than just telling your shopkeeper friend, you sell this to anyone and everyone you can.
spacehunt 10y ago
> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. No it wasn't fine at all. I certainly do not expect them to share my contact details without my consent, offline or not.
- calbear81 10y ago
  They didn't share your contact information since technically the SPAM came from them (via a technology provider Criteo) so it's still Sears that's owning the communication and responsibility. It's different if let's say you were browsing Sears and then somehow got an ad for the Home Depot.
  - mirimir 10y ago
    > It's different if let's say you were browsing Sears and then somehow got an ad for the Home Depot. That's close to what happened. OP got email from Sears, after browsing their site. But OP had never given an email address to Sears. OP had an account with (say) Home Depot. And then Criteo got OP's email address from Home Depot, and provided it to Sears.
xg15 10y ago
The web exists for 20+ years now. How exactly is visiting a website unknown waters?
- onion2k 10y ago
  It's quite similar to the me going to the store to buy a carton of milk. I have practically no knowledge of what's involved in the complex chain of interactions that gets the milk out of the cow and into my shopping basket. I don't need to know, and so long as the store always has milk I don't really care. If someone out there were to invent a way to track the exact milk I buy I wouldn't instantly know how it works or understand it. I don't think I'd like the idea though. The details of what actually happens when you visit a website are known to a tiny number of highly technical people (a few tens of millions globally). Most people have no idea what sort of data can be gathered and used to track you across the internet. People don't understand that Amazon, Facebook, Apple, etc all use the same third parties to share information and build immense profiles about every aspect of who they are and what they do, nor do they understand the way statistical analyse can be used to glean even more insight from that information. Nothing like the internet has really existed before. Although browsers have existed for 25 years most people didn't use one before about 15 years ago, and most people weren't tracked in the way they are now until 10 years ago. This is new ground. We can't expect non-technical people to grok this stuff quickly.
Houshalter 10y ago
> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. I dunno. If a shopkeeper kept detailed records of everything you've ever bought or looked at, and gave that info away, it would be pretty creepy.
- TheHydroImpulse 10y ago
  What about when they don't give that info away but keep it for themselves? Still creepy?
- toomanybeersies 10y ago
  Supermarkets do that. It's actually scary how much data they collect and what they can do with it. Target managed to figure out when people were pregnant: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/#208842e434c6 http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...
  - majewsky 10y ago
    And yet people laugh at me when I tell them how I buy as much as possible with cash.
  - bbradley406 10y ago
    Much like RMS, I use a friend's discount card (and pay in cash) at the grocery store for this reason. Will a purchase of soda and cookies be linked to me and impact my health insurance cost down the road? Will targeted Mountain Dew ads make their way into every website I visit? Probably not, but I'd rather be sure. The self-checkout machines only ask for the phone number, with no id challenge. I get the discounts + no tracking, my friend gets more gas points, and the store is left wondering why he buys so much toilet paper. I wonder how long it will be before they start cracking down on this somehow, and how far they'll take it.
rdiddly 10y ago
> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. When you do it at scale, the old rules don't apply. Right, because: 1) You're talking about a town so small that everybody knows everybody else's business anyway and fully expects this; 2) (yet paradoxically) I doubt the conversation would include much in the way of detailed personal info (unless it was gossip); 3) Regardless, in those days you probably saw both shopkeepers in church the following Sunday and could get any grievances resolved very quickly, and the shopkeeper is eager to resolve it rather than risk a bad reputation in a small tight-knit community.
the_watcher 10y ago
> No it doesn't. There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. I agree that it doesn't break a core promise of the internet. It does, however, potentially break the law. To be clear, it doesn't necessarily break it. But if the author actually has never given his email address to anyone who explicitly stated that it could be resold or transferred to a partner, then this violates CAN-SPAM.
bhrgunatha 10y ago
Why is there no downvote button on this and other comments in this thread? I have the ability to downvote and many other comments have it available. Why are some unable to be downvoted?
- DanBC 10y ago
  The window of time for downvoting was reduced from 24 hours to 8 hours.
  - bhrgunatha 10y ago
    Thanks, I wasn't aware of that.
zer0gravity 10y ago
> There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. Sure there isn't. The internet is just a jungle where predatory animals can hunt you down if you go in their teritory. They say we've exited from the jungle once, but apparently the jungle is still in us. Besides ad blockers, we need more plugins to help us mark these animals and keep us away from them. A nice plugin would be to just remove from your searches all the links to domains known to be involved in spam.
- yeknap 10y ago
  At this point a plugin probably isn't enough. We need a better browser that gets back to the document viewing roots. Something better than NoScript that has a rough idea of the types of transforms a domain's JS performs so that it can serve me the "page" w/out running suspicious code. Although I suspect this would just start a new style arms race of obfuscation similar to adblock, etc.
  - zer0gravity 10y ago
    > Although I suspect this would just start a new style arms race of obfuscation similar to adblock, etc. Then so be it. Apparently life is an arms race..
  - amelius 10y ago
    > Although I suspect this would just start a new style arms race of obfuscation similar to adblock, etc. We could use AI to detect and remove ads, perhaps combined with collaborative filtering.
    - timlyo 10y ago
      And what would the advertisers do next? That would just further the arms race.
      - amelius 10y ago
        I don't think so. If a really smart AI cannot detect the ad, why would a user be able to consciously detect it? AI will perhaps push ads into the subconscious space. But an arms race will make ads more and more subconscious, until they basically disappear.

sp332 10y ago

This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails. You shouldn't be allowed to pretend that visiting a site is a solicitation. Edit: I misunderstood the mechanism of collecting the addresses. This isn't skirting "unsolicited mail", but it is circumventing the ban on harvested email addresses.

jamiesonbecker 10y ago
> You're not allowed to send unsolicited emails. Actually, you ARE allowed to send unsolicited email, even commercial (UCE). It has to be clearly labeled, contain the postal address of the sender, and contain unsubscribe links. Also, CAN-SPAM only applies to senders in the U.S. (unfortunately). https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicability https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicabi...
- sp332 10y ago
  I don't know if I would call it a "relationship" message, but maybe it's a "transactional" message, where serving the webpage counts as the transaction?
  - the_watcher 10y ago
    When I worked somewhere that did a decent amount of email marketing, we were told our abandoned cart emails were not transactional, as there were not actually a part of any kind of transaction (yet). Not sure on the actual status though.
- derefr 10y ago
  > CAN-SPAM only applies to senders in the U.S. Given that SMTP is a relay system, would the first US-soil SMTP gateway machine a message travels through be its legal "sender" (in the way that e.g. the importer of a foreign medical device is liable if it's not FDA-approved)? One would think this would legally force those gateways, when handling foreign-originated spam, to slap their own address on them with their own unsubscribe link, that would—if clicked—then block those messages from coming through that gateway.
  - jameshart 10y ago
    Mail is not actually sent over a series of SMTP relays, though. It's basically routed directly to the MX SMTP server for the domain.
    - majewsky 10y ago
      Except in some corporate intranet setups, but that's not really relevant for this discussion.
- rbritton 10y ago
  It's pretty amazing the number of senders that do not obey the requirement for a minimal unsubscribe flow: > Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request. Once people have told you they don’t want to receive more messages from you, you can’t sell or transfer their email addresses, even in the form of a mailing list. To me it seems more of an honor-based system rather than one there's any enforcement for. Much like the Do Not Call list.
  - ianlevesque 10y ago
    There have been a handful of prosecutions, but not nearly enough.
- mike-cardwell 10y ago
  "unfortunately" ? Thank God we don't have the CAN-SPAM act in the UK. I'd be receiving unsolicited spam from all sorts of UK businesses if we did. I don't care if a spam email has an unsubscribe link or the sender is clearly labelled. Once it's received and seen, the damage is done.
- wtbob 10y ago
  > Also, CAN-SPAM only applies to senders in the U.S. (unfortunately). We could always send gunboats to reduce cities whose citizens send unsolicited emails to the U.S. … /s More seriously, this does seem like the sort of thing which could be addressed through bilateral or multilateral negotiations, including between the private firms who own the international Internet connexions.
hoorayimhelping 10y ago
>You're not allowed to send unsolicited emails. Sorry, this is completely false information that is easily verifiable by looking at the wikipedia page for the can spam act: https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Sending_behavior_compliance https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Sending_b... >But when sending unsolicited commercial emails, it must be stated that the email is an advertisement or a marketing solicitation.
- arm 10y ago
  Sorry, this is completely correct information if you don’t assume that the US in the only country in the world. For example, Canada’s Bill C-28¹ explicitly prohibits it. ―――――― ¹ — http://www.ctvnews.ca/sci-tech/canada-s-new-anti-spam-law-applies-to-almost-all-businesses-1.1885477 http://www.ctvnews.ca/sci-tech/canada-s-new-anti-spam-law-ap...
  - oarsinsync 10y ago
    Looking at the full context of the quote is useful. > This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails. The USA is not the only country in the world, but the CAN-SPAM act totally permits unsolicited emails, which is the context of this thread.
  - pc86 10y ago
    > if you don’t assume that the US in the only country in the world. The US is the only country with a CAN-SPAM Act. Unless Canada has one of those too?
actsasbuffoon 10y ago
California and New Jersey have laws that go above and beyond the protections outlined in CAN-SPAM. I used to work for a company that sent spam (I swear, I didn't know until after I'd already accepted the job), and we avoided sending to those states. If more states would adopt laws like this, we could dramatically curtail spam. As for what constitutes solicitation, I wish it was that simple. In some instances, companies will buy your email address from another company, and they believe that constitutes consent. In other words, you did business with Company Foo, and I did business with Company Foo, so you consented to do business with me. It's insane. Having been inside one of these businesses, I have three pieces of advice. First: Mark spam emails as spam when you see them. You only have to get a few of your messages marked as spam to get your IP address blacklisted. You have far more power over spammers than you think. Not only that, but spammers fear this so much that they keep databases of complainers, and they'll leave you alone in the future. Sometimes they'll even share lists of complainers with other companies so they won't risk your wrath. Spam companies love non-complainers. Even if you don't open the spam, not complaining helps their numbers with the email provider. By not complaining, you're sending a signal to your email provider that this is a good email, and other users would like to receive it. Not only that, they'll remember you as a person who can be relied upon to not complain, so you'll get more spam than other people. Second: Read EULAs. We did business with some super-shady companies who sold us tons of really invasive user info. One company even sold us the contents of people's email. Not just meta data, we could actually read the content. They don't mention any of this on their site, but it's subtly stated in the EULA. Read them and check for references to sharing your data with business partners. I've steered clear of some browsers and email clients as a result of vague EULAs that leave the potential for harvesting my data and selling it. Third: This one is going to be unpopular on Hackernews, but the best way to avoid being fingerprinted by advertisers is to block JavaScript by default. There are bajillions of ways to uniquely identify your computer, right down to having your browser report which fonts you have installed. Almost every single technique relies on Flash, Java, or JavaScript. Ad-blockers help, but they don't catch everything. I use NoScript to turn off JavaScript by default, and I only enable a site if it seems legitimate and the site is broken without it. Here's a terrifying list of the things advertisers can do to uniquely identify you without consent and without a cookie. As the article says, disabling JavaScript by default is by far the most effective method for protecting yourself from fingerprinting: https://wiki.mozilla.org/Fingerprinting https://wiki.mozilla.org/Fingerprinting It's a little inconvenient, but good security always is. The locks on your front door are inconvenient (what if you lose your key?), but hopefully they're even more inconvenient for would-be intruders.
downandout 10y ago
First, CAN-SPAM doesn't outlaw the sending of unsolicited commercial messages - on the contrary, it lays out rules for sending them. Second, in this case, at some point this guy agreed to receive emails from Criteo when entering his email address somewhere. The fact that people don't read TOS before they agree to them does not invalidate them.
- majewsky 10y ago
  The question is not a legal one, but a moral one. Of course the TOS are agreed on by the user, but it's still not what they want, so I still consider it unsolicited from a moral POV.

rmc 10y ago

> There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. There is in Europe, in the Charter of Fundamental Rights of the European Union (basically the EU's Bill of Rights).

deleted 10y ago

[deleted]

guelo 10y ago

> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. Huh? Outside of some tiny village the shopkeeper would not know the name and address of customers that are just browsing. If a shopkeeper hired private investigators to stalk those customers, following them around everywhere gathering as much personal information as possible, it would probably run afoul of some law.

sintaxi 10y ago
Not only that, in this example the shopkeeper is simply helping the customer find what they are most likely requesting simply to be helpful. A more accurate example would have shopkeepers buying customer data from each other using a 3rd party entirely for their own benefit. This really isn't the same thing at all.

TeMPOraL 10y ago

> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. When you do it at scale, the old rules don't apply. The on-line equivalent of that would be e-commerce sites sharing their detailed analytics data with each other. What was described in the article is more alike to a shopkeeper saying to another, "Did you see that woman in red scarf? Her name is Jane Doe, she lives in the house over that hill. She seems to be interested in this particular item, so your best bet is to upsell her something similar."

taneq 10y ago
"She's just received a big payout from her ex-husband so she'll be willing to pay more, and she likes cats, especially white ones. Also her sister's birthday is coming up and the sister is obsessed with horse racing so you might be able to sell her some memorabilia. Jack up the price so she'll think it's valuable."
- wangchow 10y ago
  Nowadays more like: Her genetic makeup is abc so she's prone to disease xyz. Use fear tactic and she'll be at your doorstep begging for a cure. Disgusting, but captures the information age in a nutshell..
deleted 10y ago
[deleted]
alex_hitchins 10y ago
And rather than just telling your shopkeeper friend, you sell this to anyone and everyone you can.

spacehunt 10y ago

> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. No it wasn't fine at all. I certainly do not expect them to share my contact details without my consent, offline or not.

calbear81 10y ago
They didn't share your contact information since technically the SPAM came from them (via a technology provider Criteo) so it's still Sears that's owning the communication and responsibility. It's different if let's say you were browsing Sears and then somehow got an ad for the Home Depot.
- mirimir 10y ago
  > It's different if let's say you were browsing Sears and then somehow got an ad for the Home Depot. That's close to what happened. OP got email from Sears, after browsing their site. But OP had never given an email address to Sears. OP had an account with (say) Home Depot. And then Criteo got OP's email address from Home Depot, and provided it to Sears.

xg15 10y ago

The web exists for 20+ years now. How exactly is visiting a website unknown waters?

onion2k 10y ago
It's quite similar to the me going to the store to buy a carton of milk. I have practically no knowledge of what's involved in the complex chain of interactions that gets the milk out of the cow and into my shopping basket. I don't need to know, and so long as the store always has milk I don't really care. If someone out there were to invent a way to track the exact milk I buy I wouldn't instantly know how it works or understand it. I don't think I'd like the idea though. The details of what actually happens when you visit a website are known to a tiny number of highly technical people (a few tens of millions globally). Most people have no idea what sort of data can be gathered and used to track you across the internet. People don't understand that Amazon, Facebook, Apple, etc all use the same third parties to share information and build immense profiles about every aspect of who they are and what they do, nor do they understand the way statistical analyse can be used to glean even more insight from that information. Nothing like the internet has really existed before. Although browsers have existed for 25 years most people didn't use one before about 15 years ago, and most people weren't tracked in the way they are now until 10 years ago. This is new ground. We can't expect non-technical people to grok this stuff quickly.

Houshalter 10y ago

> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. I dunno. If a shopkeeper kept detailed records of everything you've ever bought or looked at, and gave that info away, it would be pretty creepy.

TheHydroImpulse 10y ago
What about when they don't give that info away but keep it for themselves? Still creepy?
toomanybeersies 10y ago
Supermarkets do that. It's actually scary how much data they collect and what they can do with it. Target managed to figure out when people were pregnant: http://www.forbes.com/sites/kashmirhill/2012/02/16/how-target-figured-out-a-teen-girl-was-pregnant-before-her-father-did/#208842e434c6 http://www.forbes.com/sites/kashmirhill/2012/02/16/how-targe...
- majewsky 10y ago
  And yet people laugh at me when I tell them how I buy as much as possible with cash.
- bbradley406 10y ago
  Much like RMS, I use a friend's discount card (and pay in cash) at the grocery store for this reason. Will a purchase of soda and cookies be linked to me and impact my health insurance cost down the road? Will targeted Mountain Dew ads make their way into every website I visit? Probably not, but I'd rather be sure. The self-checkout machines only ask for the phone number, with no id challenge. I get the discounts + no tracking, my friend gets more gas points, and the store is left wondering why he buys so much toilet paper. I wonder how long it will be before they start cracking down on this somehow, and how far they'll take it.

rdiddly 10y ago

> It used to be totally fine for one shopkeeper to mention to another that he saw a customer looking for a particular item. When you do it at scale, the old rules don't apply. Right, because: 1) You're talking about a town so small that everybody knows everybody else's business anyway and fully expects this; 2) (yet paradoxically) I doubt the conversation would include much in the way of detailed personal info (unless it was gossip); 3) Regardless, in those days you probably saw both shopkeepers in church the following Sunday and could get any grievances resolved very quickly, and the shopkeeper is eager to resolve it rather than risk a bad reputation in a small tight-knit community.

the_watcher 10y ago

> No it doesn't. There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. I agree that it doesn't break a core promise of the internet. It does, however, potentially break the law. To be clear, it doesn't necessarily break it. But if the author actually has never given his email address to anyone who explicitly stated that it could be resold or transferred to a partner, then this violates CAN-SPAM.

bhrgunatha 10y ago

Why is there no downvote button on this and other comments in this thread? I have the ability to downvote and many other comments have it available. Why are some unable to be downvoted?

DanBC 10y ago
The window of time for downvoting was reduced from 24 hours to 8 hours.
- bhrgunatha 10y ago
  Thanks, I wasn't aware of that.

zer0gravity 10y ago

> There is no core privacy premise of the internet, and certainly not one that everybody used it signed up for. Sure there isn't. The internet is just a jungle where predatory animals can hunt you down if you go in their teritory. They say we've exited from the jungle once, but apparently the jungle is still in us. Besides ad blockers, we need more plugins to help us mark these animals and keep us away from them. A nice plugin would be to just remove from your searches all the links to domains known to be involved in spam.

yeknap 10y ago
At this point a plugin probably isn't enough. We need a better browser that gets back to the document viewing roots. Something better than NoScript that has a rough idea of the types of transforms a domain's JS performs so that it can serve me the "page" w/out running suspicious code. Although I suspect this would just start a new style arms race of obfuscation similar to adblock, etc.
- zer0gravity 10y ago
  > Although I suspect this would just start a new style arms race of obfuscation similar to adblock, etc. Then so be it. Apparently life is an arms race..
- amelius 10y ago
  > Although I suspect this would just start a new style arms race of obfuscation similar to adblock, etc. We could use AI to detect and remove ads, perhaps combined with collaborative filtering.
  - timlyo 10y ago
    And what would the advertisers do next? That would just further the arms race.
    - amelius 10y ago
      I don't think so. If a really smart AI cannot detect the ad, why would a user be able to consciously detect it? AI will perhaps push ads into the subconscious space. But an arms race will make ads more and more subconscious, until they basically disappear.