14 ms·
Buried lede here: "They spent much of their energy one-upping rivals like Lyft. Uber devoted teams to so-called competitive intelligence, purchasing data from
by ErikAugust 10y ago
Buried lede here:
"They spent much of their energy one-upping rivals like Lyft. Uber devoted teams to so-called competitive intelligence, purchasing data from an analytics service called Slice Intelligence. Using an email digest service it owns named Unroll.me, Slice collected its customers’ emailed Lyft receipts from their inboxes and sold the anonymized data to Uber. Uber used the data as a proxy for the health of Lyft’s business. (Lyft, too, operates a competitive intelligence team.)"
- blackmarker 10y agoEvery company with large resources does this. NYT gains more clicks and views with this angle.
- cocktailpeanuts 10y agoWow I think this unroll.me thing is the real scandal here. I am an unroll.me user, but had no idea they sell user data to companies this way. Their whole value proposition is to help people control their own privacy and now I kind of feel betrayed..
- mee_too 10y agoHahaha, welcome to the future ...
- rosser 10y agoFrom their own site: "Unroll.Me is a free service", emphasis added. If it's free for you, you're the product.
- jldugger 10y agoWhile it's generally true, I'm not sure that's really an excuse for deceptive behavior.
- jlarocco 10y agoThe saying isn't meant to be an excuse for companies, it's a reminder to end users to pay attention what they're signing up for. Situations like this one are exactly why the saying became popular.
- cocktailpeanuts 10y agoLike i said below, the most obvious expectation was thinking that they would monetize with ads, which is why people didn't think twice about this. There's a difference between ad supported businesses and business that actually directly sell user data behind the scenes. Equating all the ad-supported businesses with this case is not really fair because the types of businesses you're talking about here are not actually literally selling you out. They are simply pushing you ads on THEIR platform which YOU agreed to use. Sure there are lots of shady things going on in this department as well, but it's a completely different game than what this looks like. Based on this article it looks like they took your data and actually sold it to a third party, this is different from simply displaying ads on their platform. They literally sold you. And it happened OFF of the platform you signed up for.
- paep3nguin 10y agoYou're describing my assumptions exactly! I incorrectly assumed that the occasional ads for Dashlane, HelloFresh, etc. in the "Daily Rollup" were how they monetized their service. But hey, turns out they're straight up selling my emails to third-parties. I've deleted my account and revoked their access on my Google account.
- kristianc 10y agoIt's trite, and aside from belonging in the big dustbin of Hacker News cliches like linking to XKCD Standards, 'Just because you can doesn't mean you should' and 'Conflating Causation and Correlation' in this case it obscures more than it illuminates. A product may be free - and you may still be happy to be the product if you think your attention is being sold, or that they plan to upsell you onto a premium plan. 'If you're not a paying user' doesn't immediately lead you to 'They're going to scan my email and sell the data to fucking Uber' and shouldn't require the user to scan the ToS / rack their brains for every nefarious bit of fuckery the company might conceivably use the data for.
- pyre 10y agoIf you take out a loan from a loan shark, you should probably know what to expect. That doesn't mean that the loan shark isn't breaking the law when you get roughed up for non-payment.
- cocktailpeanuts 10y agoAlso, the thing is this is not really the loan shark situation. People who go to loan shark know exactly what they're getting into--borrowing money. People who signed up for unroll.me signed up because they got sick of all the the spammers and wanted to get away from all that easily. Most people including me, thought they would somehow monetize with ads or something like that, but never thought they would sell our info to 3rd parties like this. So No, it wasn't at all obvious what to expect.
- rhizome 10y agoIt would be an interesting challenge to popularize free services as loan-sharking your personal information.
- uzoodoo 10y agoYou have to be naive to give a service access to a trove of your private data and expect them to just leave it there...
- Spivak 10y agoAre we really at the point where people are being called naive for trusting a company to act ethically? It's no wonder people outside of tech hate us.
- uzoodoo 10y agoCompanies only act ethically if it has a potential to affect their bottom line and they have the foresight. It's not just tech, think pharmaceuticals or finance. As for naivete - as the old saying goes, the only free cheese is in a mousetrap.
- sgustard 10y ago>If it's free for you, you're the product. So hypothetically, if you paid $5 a month for this service, you would be confident they were NOT selling your information? Since the answer is obviously no (and in fact, purchasing behavior is the juiciest stuff to sell, be it Comcast, Target, etc), then this tired trope is meaningless.
- abritishguy 10y agoBut if you aren't paying then they must be making money elsewhere.
- gdulli 10y agoIf X then Y doesn't imply anything about not-X, but that doesn't mean it's less useful for describing X. It's moot anyway because the answer is out there publicly and no heuristic is needed to resolve it.
- jwdunne 10y agoIn the UK, O2 has a line in their terms and conditions that pretty much say they're allowed to sell your data to 3rd parties. Now it's obvious why I've got people calling me asking about my recent loan that may have had PPI or that traumatic car crash I was in a few years ago, even though I've never in my life on both fronts. It's my bloody carrier! If you use Google, shop in a supermarket, use a mobile phone, have the internet, your data is being collected and, in most cases, being sold to "chosen partners for marketing purposes". Everyone's doing it because they can make money from it.
- rosser 10y agoWhether I'm paying for a service is orthogonal to what its ToS allows them to do with my data. When I'm not paying for it, you can be pretty confident the ToS explicitly allows it, with even money on its being phrased in abstrusely arcane legalese. They have to make money somehow...
- goflyapig 10y agoSo hypothetically, if you paid $5 a month for this service, you would be confident they were NOT selling your information? No. A statement's truth doesn't imply its inverse [1]. It simply means if a company has employees, and they're receiving paychecks, and the money is not coming from you, then it's definitely coming from someone else. If you are giving them money, it doesn't mean they're not also getting money from somewhere else. But they're less likely to need to do that, especially if it would upset their paying customers. [1] https://en.wikipedia.org/wiki/Denying_the_antecedent https://en.wikipedia.org/wiki/Denying_the_antecedent
- ovi256 10y agoI'm sure it's buried somewhere in the Terms of Use. Contemporary terms of use are a classic dark pattern. If one would like to setup an useful ML project, take as input Terms of Use, spit out the highlights, the buried ledes, such as user data being sold.
- ForHackernews 10y agoWasn't there a project similar to that featured on here at one point? I don't think it used sophisticated machine learning or anything, but it used basic keyword search to produce "plain English" summaries of ToS. I remember it being somebody's hobby project; I can't seem to find it now.
- jvoorhis 10y agoHere it is: https://tosdr.org https://tosdr.org.
- bigbento 10y agoI was a little creeped out when--long after I deauthorized the app and enabled 2FA on my Gmail account--I got an email from them saying "We've found 141 new subscriptions". I wonder if that was just marketing spam, or if they have a weird way of accessing my email still.
- yjftsjthsd-h 10y agoI believe Google lets you view all apps with access to your account. Check that, change your password, and you should be good.
- bigbento 10y agoOh, that's what I meant by "deauthorized the app". I removed it on the Google side, and shortly after even got an email from Unroll.me saying that it no longer had access. So I was surprised to see an email a couple months later saying they'd found more stuff to unsubscribe from. It could have been a bug or just a message they sent to everyone who'd unplugged their email, but was quite jarring.
- ninetax 10y agoMe too. I'm pissed.
- gonzo 10y ago"kind of"?
- gdulli 10y ago> Wow I think this unroll.me thing is the real scandal here. How is it a scandal? Competitive intel is a normal and widespread thing and it's not a scandal that people don't read a privacy policy that says, "We may collect, use, transfer, sell, and disclose non-personal information for any purpose."
- deleted 10y ago[deleted]
- eropple 10y ago> it's not a scandal that people don't read a privacy policy that says, "We may collect, use, transfer, sell, and disclose non-personal information for any purpose." That companies are allowed to have such a non-privacy policy damned well should be. The number of privacy policies I'd have to read on a daily basis to function on the Internet is ludicrous and it is only because of my job working for companies like that that I know that those privacy policies exist in the first place.
- the_watcher 10y ago> Their whole value proposition is to help people control their own privacy and now I kind of feel betrayed.. Really? I never got that. While I'm also a little unsettled by the selling data part, the value prop was always pretty clearly simplifying unsubscribing en masse, which necessarily involved handing over access to the contents of your emails.
- snikolic 10y agoSlice (unroll.me) is owned by Rakuten, who also owns a whole family of companies including Ebates, Rakuten Marketing (a fairly large adtech company), Viber, Buy.com, and lots of others. Slice's data has all sorts of interesting applications, both within the Rakuten family and to third parties like Uber. If you're a Slice/unroll.me user, I'd bet that a lot of your online experience is shaped by the data you share with Slice. A lot of Rakuten's other properties actually share office space with Slice in San Mateo, so there's obviously plenty of opportunity for collaboration. :-) The irony is that Rakuten also owns a significant (12 percent?) stake in Lyft. Pretty funny that one Rakuten property was selling data to Uber who used it to hurt a second Rakuten property.
- karlkatzke 10y agoI worked for a company that nearly acquired unroll.me. At the time, which was over three years ago, they had kept a copy of every single email of yours that you sent or received while a part of their service. Those emails were kept in a series of poorly secured S3 buckets. A large part of Slice buying unroll.me was for access to those email archives. Specifically, they wanted to look for keyword trends and for receipts from online purchases. The founders of unroll.me were pretty dishonest, which is a large part of why the company I worked for declined to purchase the company. As an example, one of the problems was how the founders had valued and then diluted equity shares that employees held. To make a long story short, there weren't any circumstances in which employees who held options or an equity stake would see any money. I hope you weren't emailed any legal documents or passwords written in the clear.
- digitalzombie 10y ago... This is why I treat equity and ipo as monopoly money. It's ok that we pay you sub market salary because you get great ipo and equity. Yeaaaah no.
- meric 10y agoIt's comparative to the "espresso machine in the office" perk. When you bump into your colleagues in the morning you have an extra talking point.
- Natsu 10y agoIn terms only of capabilities, that makes me wonder a lot about Gmail. I don't see anything there that they couldn't do if they wished to do it on a far grander scale. Granted, I tend to think the people who run Gmail are more honest than that, but if someday the wrong people retired and others took over or what have you, I wonder just how suddenly that could change?
- Iv 10y agoWho knows? Maybe at one point people will realize the value of local mail storage and end to end cryptography.
- deleted 10y ago[deleted]
- thatdrew 10y agohere's the CEOapology http://blog.unroll.me/we-can-do-better/ http://blog.unroll.me/we-can-do-better/
- taude 10y agoI agree, the unenroll.me is a whole other story here that should be dug into deeper
- InclinedPlane 10y agoDid you pay money for unroll.me? Did you read the entirety of the TOU/EULA? How can you be so naive? If you're not the customer you're the product.
- hayd 9y agoThis is nonsense. What prevents you being the product even if you pay? Companies can still sell your data. If unrollme made it clear they were making their money by selling every one of your emails in plaintext they'd never have signed up anyone.
- rattray 10y agoHere's the link to revoke perms: https://myaccount.google.com/permissions https://myaccount.google.com/permissions I just disconnected from one or two services which had access to my gmail (reasonably so).
- S3curityPlu5 10y agoYes thanks I just deactivated unroll.me and deleted my account, make sure you change your email password and deny them access from your email provider as well.
- grushabh 10y agoSeems to be a recurring theme for services that scrape your email inbox. For example, see https://context.io https://context.io which is a popular service for building these kinds of apps. They clearly state that the free version is funded by collecting anonymized data from the end users' email inboxes. Just another reminder that nothing is free =)
- gnuarch 10y agoWhat do you guys think of Mixmax? Heard of people liking their service for making appointments within Gmail, and e.g. receiving read receipts. From their privacy policy: > [...] Mixmax may securely access or store your name, your Gmail email address, your Gmail emails and other conversations, and your Gmail contact list [...] We may anonymize your Personal Information so that you are not individually identified, and provide that information to our partners. https://mixmax.com/privacy.html https://mixmax.com/privacy.html https://mixpanel.com/privacy/ https://mixpanel.com/privacy/
- devy 10y agoThis is why I didn't and never will trust 3rd parties products/services getting accessed to my inbox and reading my emails wholesale in order to mine data or provide value. Paribus is another of such services that I am aware that require you open your inbox access to them (the pull model). There is nothing wrong with reading your emails with your explicit consent but I believe a push model like TripIt/Kayak's previous push model (send email receipts to trips@tripit/kayak.com) is a safer way to avoid privacy being violated and abused.
- benwikler 10y agoBTW: unroll.me's parent company Slice has the exact same business model.
- adg 10y agoThis jumped out at me, too. Here's how Unroll.me describes their service: Clean up your inbox Instantly see a list of all your subscription emails. Unsubscribe easily from whatever you don’t want. It's not clear at all that they are reading people's emails and selling the data.
- ovi256 10y agoWhat you read on the public site is the USP for the users that install the unroll.me app. They are not the economic buyers, the ones who pay for the service. Those are the people that buy the user's aggregate data. They get in-person pitches on confidential slides, because if their USP leaked to the public, nobody would install and use the app.
- ihattendorf 10y ago"We may collect, use, transfer, sell, and disclose non-personal information for any purpose. For example, when you use our services, we may collect data from and about the “commercial electronic mail messages” and “transactional or relationship messages” (as such terms are defined in the CAN-SPAM Act (15 U.S.C. 7702 et. seq.) that are sent to your email accounts. We may collect and use your commercial transactional messages and associated data to build anonymous market research products and services with trusted business partners. If we combine non-personal information with personal information, the combined information will be treated as personal information for as long as it remains combined. Aggregated data is considered non-personal information for the purposes of this Privacy Notice." https://unroll.me/legal/privacy/ https://unroll.me/legal/privacy/
- rhizome 10y agoTo be sure, CAN-SPAM was not aimed at end users so much as defining what they can complain about, which is not much, and the law is toothless besides.
- chinathrow 10y ago"if their USP leaked to the public" That just happen, at last. Slide deck 1 of 44: "Learn how your competitors are doing."
- mathattack 10y agoIf they sell your receipt data to Uber, who else might they sell it to? An insurance company? A hedge fund? Your bank?
- savanaly 10y ago>anonymized It would be much bigger news if they were selling data that could be used against the consumers on an individual basis.
- trowawee 10y agoGiven sufficient data, nothing's really anonymous. That's a bullshit hedge.
- mootothemax 10y agoEspecially if eg Facebook notification emails count as transactional. Group memberships alone massively narrow things down. Throw in a few business notifications and it's game over. Even without that angle, I find it absolutely scandalous that a company is able to do this, even with the T&Cs permission of their users. Surely at some point this is going to bite them in the behind? The possibilities of it going massively wrong seem endless. Then again - common sense and the law rarely seem to intersect.
- ethbro 10y agoThe problem is likely suable entities. I'd imagine there's a fair number of corporate cut-outs in shady schemes like this. With the expectation that if there are ever lawsuits a sacrificial faux-company goes bankrupt and takes the damages.
- JorgeGT 10y ago"Hmm, 90% of this anonymous guy rides start/end at this residential address which the public property deed says it's registered to Mr. John Smith, I wonder who this anonymous guy could be."
- deleted 10y ago[deleted]
- fullshark 10y agoI'm confused as you why you find this remarkable. Slice is up front about this also (click on intelligence): https://www.slice.com/about https://www.slice.com/about.
- irfansharif 10y agoI had revoked unroll.me permissions right after via google connected apps & sites, amusing that in order to delete your unroll.me account[1] you'd have to give them the very same permissions again. [1]: https://unrollme.zendesk.com/hc/en-us/articles/200165526-How-do-I-delete-my-Unroll-Me-account- https://unrollme.zendesk.com/hc/en-us/articles/200165526-How...
- chinathrow 10y agoA friend recommended unroll.me once. I carefully read their ToS and it was clear that they get full read access to your whole Gmail-Inbox. Now we know what they are doing it and how. I hope they get shutdown within the aftermath of this story.
- gdulli 10y agoWhy on earth would a service get shut down for allowing consenting adults to opt into an agreement that allows anonymized data to be shared in a compliant way?
- allover 10y agoThey wouldn't 'get shut down' for it, but if the service was transparent about what they were doing people would likely unsubscribe/cease to sign up. It really depends if anyone is prepared to take them to task on it. > 'consenting adults' Are you consenting if you don't know what you're consenting to. > anonymized data Widely understood that anonymized data is bullshit, which is why the term "de-anonymized" exists. It's especially bullshit when there are no 'standards' as to what constitutes it. > shared in a compliant way What does that even mean.
- gdulli 10y agoDeciding not to read the terms of service isn't the same as being in a situation without transparency. The beef industry would also collapse if all the meat-eaters who thought killing animals wasn't ideal in principle had to watch the cow get killed before every meal.
- urbanj 10y agoGosh, look at you trying to be cool by being contrarian.
- hackuser 10y ago> lede It may be of interest to you, but it isn't the lede of the story. The lede is a pattern of behavior by the CEO, of which that is one element.
- gsteinb88 10y agohttps://en.wiktionary.org/wiki/bury_the_lede https://en.wiktionary.org/wiki/bury_the_lede OP is implying the "real story" (i.e. the most important part of the article) is not what the article begins with
- amitagarwal 10y agoHere's an open source Google Script that lets you easily unsubscribe from bulk emails in Gmail. Source on Github. https://www.labnol.org/internet/gmail-unsubscribe/28806/ https://www.labnol.org/internet/gmail-unsubscribe/28806/
- deleted 10y ago[deleted]
- noamhacker 10y agoA couple years ago, I almost signed up for unroll.me but I stopped myself. It didn't seem worth it to give some service full access to my gmail account, when I could just spend a few minutes unsubscribing manually.
- vogt 10y agohttps://www.slice.com/ https://www.slice.com/ This Slice? That headline "Your inbox security is our top priority" sure seems hilarious now. Also, I wonder why the article refers to it as Slice Intelligence? Is that their official company name on the paperwork? Is it to portray this shadowy intelligence gathering agency for hire? Both?
- ranman 10y agoFrom: Me To: support@slice.com Please delete my account and all my data.
- jamonholmgren 10y agoI used to recommend unroll.me to people but eventually found that relentlessly unsubscribing from things worked better anyway. I assumed they were making money from ads, but should have known better. I have a few simple rules I follow to hit inbox zero...works quite well: 1. Unsubscribe Relentlessly 2. Use Keyboard Shortcuts or Gestures 3. Snooze Important Emails 4. Use a To-Do App (I wrote it up in more detail here: https://shift.infinite.red/how-i-achieve-inbox-zero-every-day-and-you-can-too-2751cca6bb3e https://shift.infinite.red/how-i-achieve-inbox-zero-every-da...)
- bmpafa 10y agoIf anyone is looking to kick unroll.me, but still has a problem w/ massive subscription piles, I wrote a quick tutorial on Medium about how to unsub from everything at once w/ their product (so you can delete it once & for all): https://goo.gl/B4HLPX https://goo.gl/B4HLPX