14 ms·
Wow I think this unroll.me thing is the real scandal here. I am an unroll.me user, but had no idea they sell user data to companies this way. Their whole valu
by cocktailpeanuts 10y ago
Wow I think this unroll.me thing is the real scandal here.
I am an unroll.me user, but had no idea they sell user data to companies this way.
Their whole value proposition is to help people control their own privacy and now I kind of feel betrayed..
- mee_too 10y agoHahaha, welcome to the future ...
- rosser 10y agoFrom their own site: "Unroll.Me is a free service", emphasis added. If it's free for you, you're the product.
- jldugger 10y agoWhile it's generally true, I'm not sure that's really an excuse for deceptive behavior.
- jlarocco 10y agoThe saying isn't meant to be an excuse for companies, it's a reminder to end users to pay attention what they're signing up for. Situations like this one are exactly why the saying became popular.
- cocktailpeanuts 10y agoLike i said below, the most obvious expectation was thinking that they would monetize with ads, which is why people didn't think twice about this. There's a difference between ad supported businesses and business that actually directly sell user data behind the scenes. Equating all the ad-supported businesses with this case is not really fair because the types of businesses you're talking about here are not actually literally selling you out. They are simply pushing you ads on THEIR platform which YOU agreed to use. Sure there are lots of shady things going on in this department as well, but it's a completely different game than what this looks like. Based on this article it looks like they took your data and actually sold it to a third party, this is different from simply displaying ads on their platform. They literally sold you. And it happened OFF of the platform you signed up for.
- paep3nguin 10y agoYou're describing my assumptions exactly! I incorrectly assumed that the occasional ads for Dashlane, HelloFresh, etc. in the "Daily Rollup" were how they monetized their service. But hey, turns out they're straight up selling my emails to third-parties. I've deleted my account and revoked their access on my Google account.
- kristianc 10y agoIt's trite, and aside from belonging in the big dustbin of Hacker News cliches like linking to XKCD Standards, 'Just because you can doesn't mean you should' and 'Conflating Causation and Correlation' in this case it obscures more than it illuminates. A product may be free - and you may still be happy to be the product if you think your attention is being sold, or that they plan to upsell you onto a premium plan. 'If you're not a paying user' doesn't immediately lead you to 'They're going to scan my email and sell the data to fucking Uber' and shouldn't require the user to scan the ToS / rack their brains for every nefarious bit of fuckery the company might conceivably use the data for.
- gdulli 10y agoHow is it nefarious for Uber to use anonymized data to come to conclusions like: 1. Emails with subject [xxx] are opened more often than emails with subject [yyy]. 2. Lyft does more business in Scottsdale than we expected. 3. 25% of people who use ridesharing use multiple services and 75% are loyal to one service. 4. 33% of people who don't use ridesharing services also don't use traditional taxi services. "Nefarious" is a strong word.
- CodeMage 10y ago> 'If you're not a paying user' doesn't immediately lead you to 'They're going to scan my email and sell the data to fucking Uber' and shouldn't require the user to scan the ToS / rack their brains for every nefarious bit of fuckery the company might conceivably use the data for. I agree with the first half of what you said and disagree with the second. That's precisely the value of the original saying: it's not there to be an excuse for a company, it's there to spread awareness and remind people that they should get informed about just _how_ they're being productized _before_ they have cause to regret using the service. If more of us scanned the ToS carefully, we might catch the nefarious bits of fuckery on time and pressure the company to change. Does the privacy policy say your data will be sold to third parties? Great, find out what data, to what third parties and questions like that.
- gdulli 10y agoSince the privacy policy explains in clear English that your data will be sold it would be more deceptive if they didn't sell your data.
- Spivak 10y agoAnd since no one actually reads the privacy policy, users likely expect that the only data they're retaining is about email subscriptions, and that it will only be used internally and not sold to 3rd parties. It's still unethical.
- gdulli 10y agoIf someone has strict privacy needs, why wouldn't they read the privacy policy? Read it or don't read it, it's your choice. But if you choose not to, don't complain that the terms you agreed to don't work the way you arbitrarily expected them to. That's on you, it's not unethical that the terms don't work the way you want them to.
- matt4077 10y agoSo you've read every TOS for every iTunes, or Android, or Windows update, ever? And if not, you'd be fine with handing over the keys for your house if one of them had a sentence in there that transferred it to Apple/Google/MS?
- pyre 10y agoIf you take out a loan from a loan shark, you should probably know what to expect. That doesn't mean that the loan shark isn't breaking the law when you get roughed up for non-payment.
- cocktailpeanuts 10y agoAlso, the thing is this is not really the loan shark situation. People who go to loan shark know exactly what they're getting into--borrowing money. People who signed up for unroll.me signed up because they got sick of all the the spammers and wanted to get away from all that easily. Most people including me, thought they would somehow monetize with ads or something like that, but never thought they would sell our info to 3rd parties like this. So No, it wasn't at all obvious what to expect.
- rhizome 10y agoIt would be an interesting challenge to popularize free services as loan-sharking your personal information.
- uzoodoo 10y agoYou have to be naive to give a service access to a trove of your private data and expect them to just leave it there...
- Spivak 10y agoAre we really at the point where people are being called naive for trusting a company to act ethically? It's no wonder people outside of tech hate us.
- uzoodoo 10y agoCompanies only act ethically if it has a potential to affect their bottom line and they have the foresight. It's not just tech, think pharmaceuticals or finance. As for naivete - as the old saying goes, the only free cheese is in a mousetrap.
- sgustard 10y ago>If it's free for you, you're the product. So hypothetically, if you paid $5 a month for this service, you would be confident they were NOT selling your information? Since the answer is obviously no (and in fact, purchasing behavior is the juiciest stuff to sell, be it Comcast, Target, etc), then this tired trope is meaningless.
- abritishguy 10y agoBut if you aren't paying then they must be making money elsewhere.
- gdulli 10y agoIf X then Y doesn't imply anything about not-X, but that doesn't mean it's less useful for describing X. It's moot anyway because the answer is out there publicly and no heuristic is needed to resolve it.
- jwdunne 10y agoIn the UK, O2 has a line in their terms and conditions that pretty much say they're allowed to sell your data to 3rd parties. Now it's obvious why I've got people calling me asking about my recent loan that may have had PPI or that traumatic car crash I was in a few years ago, even though I've never in my life on both fronts. It's my bloody carrier! If you use Google, shop in a supermarket, use a mobile phone, have the internet, your data is being collected and, in most cases, being sold to "chosen partners for marketing purposes". Everyone's doing it because they can make money from it.
- rosser 10y agoWhether I'm paying for a service is orthogonal to what its ToS allows them to do with my data. When I'm not paying for it, you can be pretty confident the ToS explicitly allows it, with even money on its being phrased in abstrusely arcane legalese. They have to make money somehow...
- goflyapig 10y agoSo hypothetically, if you paid $5 a month for this service, you would be confident they were NOT selling your information? No. A statement's truth doesn't imply its inverse [1]. It simply means if a company has employees, and they're receiving paychecks, and the money is not coming from you, then it's definitely coming from someone else. If you are giving them money, it doesn't mean they're not also getting money from somewhere else. But they're less likely to need to do that, especially if it would upset their paying customers. [1] https://en.wikipedia.org/wiki/Denying_the_antecedent https://en.wikipedia.org/wiki/Denying_the_antecedent
- ovi256 10y agoI'm sure it's buried somewhere in the Terms of Use. Contemporary terms of use are a classic dark pattern. If one would like to setup an useful ML project, take as input Terms of Use, spit out the highlights, the buried ledes, such as user data being sold.
- ForHackernews 10y agoWasn't there a project similar to that featured on here at one point? I don't think it used sophisticated machine learning or anything, but it used basic keyword search to produce "plain English" summaries of ToS. I remember it being somebody's hobby project; I can't seem to find it now.
- jvoorhis 10y agoHere it is: https://tosdr.org https://tosdr.org.
- bigbento 10y agoI was a little creeped out when--long after I deauthorized the app and enabled 2FA on my Gmail account--I got an email from them saying "We've found 141 new subscriptions". I wonder if that was just marketing spam, or if they have a weird way of accessing my email still.
- yjftsjthsd-h 10y agoI believe Google lets you view all apps with access to your account. Check that, change your password, and you should be good.
- bigbento 10y agoOh, that's what I meant by "deauthorized the app". I removed it on the Google side, and shortly after even got an email from Unroll.me saying that it no longer had access. So I was surprised to see an email a couple months later saying they'd found more stuff to unsubscribe from. It could have been a bug or just a message they sent to everyone who'd unplugged their email, but was quite jarring.
- ninetax 10y agoMe too. I'm pissed.
- gonzo 10y ago"kind of"?
- gdulli 10y ago> Wow I think this unroll.me thing is the real scandal here. How is it a scandal? Competitive intel is a normal and widespread thing and it's not a scandal that people don't read a privacy policy that says, "We may collect, use, transfer, sell, and disclose non-personal information for any purpose."
- deleted 10y ago[deleted]
- eropple 10y ago> it's not a scandal that people don't read a privacy policy that says, "We may collect, use, transfer, sell, and disclose non-personal information for any purpose." That companies are allowed to have such a non-privacy policy damned well should be. The number of privacy policies I'd have to read on a daily basis to function on the Internet is ludicrous and it is only because of my job working for companies like that that I know that those privacy policies exist in the first place.
- the_watcher 10y ago> Their whole value proposition is to help people control their own privacy and now I kind of feel betrayed.. Really? I never got that. While I'm also a little unsettled by the selling data part, the value prop was always pretty clearly simplifying unsubscribing en masse, which necessarily involved handing over access to the contents of your emails.
- snikolic 10y agoSlice (unroll.me) is owned by Rakuten, who also owns a whole family of companies including Ebates, Rakuten Marketing (a fairly large adtech company), Viber, Buy.com, and lots of others. Slice's data has all sorts of interesting applications, both within the Rakuten family and to third parties like Uber. If you're a Slice/unroll.me user, I'd bet that a lot of your online experience is shaped by the data you share with Slice. A lot of Rakuten's other properties actually share office space with Slice in San Mateo, so there's obviously plenty of opportunity for collaboration. :-) The irony is that Rakuten also owns a significant (12 percent?) stake in Lyft. Pretty funny that one Rakuten property was selling data to Uber who used it to hurt a second Rakuten property.
- karlkatzke 10y agoI worked for a company that nearly acquired unroll.me. At the time, which was over three years ago, they had kept a copy of every single email of yours that you sent or received while a part of their service. Those emails were kept in a series of poorly secured S3 buckets. A large part of Slice buying unroll.me was for access to those email archives. Specifically, they wanted to look for keyword trends and for receipts from online purchases. The founders of unroll.me were pretty dishonest, which is a large part of why the company I worked for declined to purchase the company. As an example, one of the problems was how the founders had valued and then diluted equity shares that employees held. To make a long story short, there weren't any circumstances in which employees who held options or an equity stake would see any money. I hope you weren't emailed any legal documents or passwords written in the clear.
- digitalzombie 10y ago... This is why I treat equity and ipo as monopoly money. It's ok that we pay you sub market salary because you get great ipo and equity. Yeaaaah no.
- meric 10y agoIt's comparative to the "espresso machine in the office" perk. When you bump into your colleagues in the morning you have an extra talking point.
- Natsu 10y agoIn terms only of capabilities, that makes me wonder a lot about Gmail. I don't see anything there that they couldn't do if they wished to do it on a far grander scale. Granted, I tend to think the people who run Gmail are more honest than that, but if someday the wrong people retired and others took over or what have you, I wonder just how suddenly that could change?
- Iv 10y agoWho knows? Maybe at one point people will realize the value of local mail storage and end to end cryptography.
- deleted 10y ago[deleted]
- thatdrew 10y agohere's the CEOapology http://blog.unroll.me/we-can-do-better/ http://blog.unroll.me/we-can-do-better/
- taude 10y agoI agree, the unenroll.me is a whole other story here that should be dug into deeper
- InclinedPlane 10y agoDid you pay money for unroll.me? Did you read the entirety of the TOU/EULA? How can you be so naive? If you're not the customer you're the product.
- hayd 10y agoThis is nonsense. What prevents you being the product even if you pay? Companies can still sell your data. If unrollme made it clear they were making their money by selling every one of your emails in plaintext they'd never have signed up anyone.
- rattray 10y agoHere's the link to revoke perms: https://myaccount.google.com/permissions https://myaccount.google.com/permissions I just disconnected from one or two services which had access to my gmail (reasonably so).
- S3curityPlu5 10y agoYes thanks I just deactivated unroll.me and deleted my account, make sure you change your email password and deny them access from your email provider as well.
- grushabh 10y agoSeems to be a recurring theme for services that scrape your email inbox. For example, see https://context.io https://context.io which is a popular service for building these kinds of apps. They clearly state that the free version is funded by collecting anonymized data from the end users' email inboxes. Just another reminder that nothing is free =)
- gnuarch 10y agoWhat do you guys think of Mixmax? Heard of people liking their service for making appointments within Gmail, and e.g. receiving read receipts. From their privacy policy: > [...] Mixmax may securely access or store your name, your Gmail email address, your Gmail emails and other conversations, and your Gmail contact list [...] We may anonymize your Personal Information so that you are not individually identified, and provide that information to our partners. https://mixmax.com/privacy.html https://mixmax.com/privacy.html https://mixpanel.com/privacy/ https://mixpanel.com/privacy/
- devy 10y agoThis is why I didn't and never will trust 3rd parties products/services getting accessed to my inbox and reading my emails wholesale in order to mine data or provide value. Paribus is another of such services that I am aware that require you open your inbox access to them (the pull model). There is nothing wrong with reading your emails with your explicit consent but I believe a push model like TripIt/Kayak's previous push model (send email receipts to trips@tripit/kayak.com) is a safer way to avoid privacy being violated and abused.
- benwikler 10y agoBTW: unroll.me's parent company Slice has the exact same business model.