7 ms·

How Calls for Privacy May Upend Business for Facebook and Google

161 points by domevent 9y ago

IBM 9y ago
>The United States does not have a consumer privacy law like the General Data Protection Regulation. But after years of pushing for similar legislation, privacy groups said that recent events were giving them new momentum — and they were looking to Europe for inspiration. >“With the new European law, regulators for the first time have real enforcement tools,” said Jeffrey Chester, the executive director of the Center for Digital Democracy, a nonprofit group in Washington. “We now have a way to hold these companies accountable.” I'm super excited about the prospect of GDPR in America.
- ttul 9y ago
  Effectively, you will have it, because it applies to European residents, and it is difficult for companies to know for sure that you aren’t a European resident.
  - madez 9y ago
    Well, not so much if the companies are really willing to. They can block traffic coming from European IP addresses and require a legal document saying that the customer is not European.
    - pandler 9y ago
      So, for all intents and purposes, shut themselves out of the European market?
      - madez 9y ago
        Yes. "Obey our rules or stay out of our market" seems like a reasonable thing.
    - pimmen 9y ago
      They can if they are willing to, but I doubt many companies are willing to. "This is a tough one; spend a year rebuilding our backend and terms of services or shut ourselves out from a market of almost 500 million people (not including the UK) probably forever?"
ForHackernews 9y ago
One can only hope.
- bitxbitxbitcoin 9y ago
  If we continue demanding and building the tools that enable privacy, we will be able to get there. More cuz of the building than the demanding.
  - portofcall 9y ago
    This is definitely the right attitude, and I’d add the critical step of talking about these issues with people who don’t know about them. It’s frustrating, it can be alienating and it definitely takes time, but it can pay off. Nothing beats building a useful tool (like Signal), but even useful tools require publicity.
  - tedwilliamshock 9y ago
    Related and ongoing ; https://www.crowdrise.com/o/en/campaign/ostif1 https://www.crowdrise.com/o/en/campaign/ostif1 Part of the DuckDuckGo $500,000 Privacy Challenge 2018 ; https://www.crowdrise.com/duckduckgoprivacychallenge https://www.crowdrise.com/duckduckgoprivacychallenge
sqdbps 9y ago
The Equifax thing didn't result in regulation and that was an actual scandal with real ramification not a pile-on by a press seeking to vilify an ad financed competitor. Funny how the Times is using silly metafilter vernacular now: "the consumer surveillance model" -- it's the same business model that's been supporting news publication for more than a century. As for the GDPR it's similar to the recent digital tax proposal and numerous other initiatives by the EU intended to attack US businesses, the US government doesn't share that motivation and it must condemn and push against these EU actions.
- corvallis 9y ago
  >It's the same business model that's been supporting publication for more than a century. I think there's an enormous difference between advertising in print, advertising on the internet, and what is currently the status quo, which is active surveillance of all information consumed and every movement that individuals make across the internet and in the real world by data linked through GPS/ cell phone location, credit card purchases, etc. I'm aware that this is the new reality, but comparing it to print advertising (or even pop up ads of the early internet) is disingenuous at best.
  - sqdbps 9y ago
    Print ads were always backed by market research and data brokerage (buying lists of magazine subscribers, club memberships etc). As for storing data that is generated by their platform that is these companies' prerogative, it's their data as much as it is yours.
    - ionised 9y ago
      > it's their data as much as it is yours. Debatable. The EU has decided that is in fact, yours.
  - username223 9y ago
    > comparing it to print advertising is disingenuous at best. Right. First, print advertising could only target the entire subscriber base. Second, they had a limited amount of data on you based on voluntary surveys and census tracts, not a list of every single thing you read, and where you are every minute of every day. Finally, print publications actually cared about reuse/misuse of their address lists. The list they sold you would include some addresses they controlled, so if you resold or reused it, they would catch you. There are ways to deliver effective ads with a whole lot less surveillance.
tedwilliamshock 9y ago
Related and ongoing ; https://www.crowdrise.com/o/en/campaign/ostif1 https://www.crowdrise.com/o/en/campaign/ostif1 Part of the DuckDuckGo $500,000 Privacy Challenge 2018 ; https://www.crowdrise.com/duckduckgoprivacychallenge https://www.crowdrise.com/duckduckgoprivacychallenge
shady-lady 9y ago
Hopefully it will also change the "move fast & proper security is an afterthought" model of startups. Years ago(in CS degree before professional work), I used to wonder & be amazed by how fast new companies(mainly U.S.) moved so quickly. It wasn't because they had some secret sauce or 10x devs, it was because all they did was focus solely on features & take shortcuts. Their customers data security was an afterthought - e.g. production DBs open to anyone in company(even the world in some cases(mongo)), no auditing or logging of data access. Maybe YC(& other accelerators) will make a security expert available to these people...because young adults with 0 professional experience will probably not consider security & rely on the defaults of whatever stack they're using to be good enough. Even less consideration will be given when they're fed & surrounded by a grow fast at all costs mentality. Good security in their products needs thought & critical analysis put into it & I'm not sure new devs appreciate it.
- extralego 9y ago
  A motto for the coming decades: “Move fast and fix things”
  - EGreg 9y ago
    "Move carefully - lots of people are depending on us."
    - madez 9y ago
      Thats how all other engineers are working, except software developers, particularly in certain big companies in the US. It's reckless to not be careful and deeply think of your actions consequences as an engineer, because you yield so much power.
      - lurker456 9y ago
        Only when the regulatory environment demands it. Normal engineers also cut corners in third world countries with weaker protections.
everdev 9y ago
Data breaches can take down a business, but privacy concerns are there historical examples of that? My thought is management gets fired and the company changes course by the time the bottom line gets measurably impacted. Companies are much more likely to fail by not innovating fast enough.
- IAmEveryone 9y ago
  Cambridge Analytica, in about three weeks.
yuhong 9y ago
I just wrote a second draft of my essay on this exact topic: http://yuhongbao.blogspot.ca/2018/03/google-doubleclick-mozilla-essay-second.html http://yuhongbao.blogspot.ca/2018/03/google-doubleclick-mozi... Among other things, I wrote about the sharing of remarketing lists.
dabei 9y ago
Maybe we should pause and think what value does Facebook provide to the users? Is that value worth the $400B? Given how much we are connected through all kinds of channels, the answer is a clear no. Sure you can say their advertising business is worth that, but if they don't provide their users that much value it's not going to last.
- beagle3 9y ago
  The value can be argued either way. But remember the old adage: The market can remain irrational longer than you can stay solvent.
stedaniels 9y ago
OT: is this domevent account a new bot on HN? The name, frequency of posts, closeness to article published times...
jernejzen 9y ago
1. Convenience is fuckup of all the privacy 2. Old enemies Google and Facebook unite when it goes to privacy breaches. 3. Do they know my porn preferences (damn you cross browser fingerprinting) 4. Well, Instagram showed my that pretty unknown girl follow, suggestion just hours after getting out of train. That was pretty coolscary. 5. Insomnia made it. I woke up in the middle of the night just day after I put custom mod on my ole Android phone. Found out that Google Keep wanted to have my location (just like from nowhere). Went to the store next day and bought iPhone. Never looked back.
akerro 9y ago
Guys, seriously. Why is this a surprise for people? Facebook is a corporation that literally lives from analysing and selling data about everyone, even people who have not signed up for Facebook, WhatsUp or Instagram accounts. Facebook android application asks you for the following permissions when you install it: This app has access to: Device & app history retrieve running apps Identity find accounts on the device add or remove accounts read your own contact card Calendar read calendar events plus confidential information add or modify calendar events and send email to guests without owners' knowledge Contacts find accounts on the device read your contacts modify your contacts Location approximate location (network-based) precise location (GPS and network-based) SMS read your text messages (SMS or MMS) Phone directly call phone numbers read call log read phone status and identity write call log Photos/Media/Files read the contents of your USB storage modify or delete the contents of your USB storage Storage read the contents of your USB storage modify or delete the contents of your USB storage Camera take pictures and videos Microphone record audio Wi-Fi connection information view Wi-Fi connections Device ID & call information read phone status and identity Other download files without notification adjust your wallpaper size receive data from Internet view network connections create accounts and set passwords read battery statistics send sticky broadcast change network connectivity connect and disconnect from Wi-Fi expand/collapse status bar full network access change your audio settings read sync settings run at startup reorder running apps set wallpaper draw over other apps control vibration prevent device from sleeping toggle sync on and off install shortcuts read Google service configuration It does literally ask you to grant access to your text messages and call logs. Why would anyone expect Facebook NOT to use that data? You all cant be such native, right?
- rando444 9y ago
  Most people aren't that naïve. The problem is not allowing a company access to your data. The problem is how it's used. Just because you allowed another company to handle your data should not give them carte blanche to do whatever with it they want. This is exactly why Europe created the GDPR.. to prevent your personal data from being processed by companies in unintended ways, or sharing your information with 3rd parties without your consent, and heavy fines for breaking these rules. Just allowing a company access to your data and giving up at that point is the attitude that people are trying to change, because that's not the way the world should work.
bogomipz 9y ago
>"But some trade group executives also warned that any attempt to curb the use of consumer data would put the business model of the ad-supported internet at risk." Yes the "ad-supported internet" may be at risk. So what? Is it unreasonable to think that this model might not actually be sustainable long term? Why should this business model be any less vulnerable than any other business model? Note to Big Tech - public opinion also has the power to "disrupt."
- krylon 9y ago
  Furthermore, it is possible to run ads without collecting creepy amounts of data on everybody. Ads themselves are not so problematic. But the idea that companies have to collect amounts of data that make the Stasi look like a bunch of privacy activists is very much problematic.
  - bogomipz 9y ago
    Agreed. It's funny you mention the Stasi. When touring the old Stasi headquarters in Berlin its tough not to think about how 25 years later a company has amassed much more data on private citizens than Stasi could ever imagined.

161 points by domevent 9y ago

IBM 9y ago

>The United States does not have a consumer privacy law like the General Data Protection Regulation. But after years of pushing for similar legislation, privacy groups said that recent events were giving them new momentum — and they were looking to Europe for inspiration. >“With the new European law, regulators for the first time have real enforcement tools,” said Jeffrey Chester, the executive director of the Center for Digital Democracy, a nonprofit group in Washington. “We now have a way to hold these companies accountable.” I'm super excited about the prospect of GDPR in America.

ttul 9y ago
Effectively, you will have it, because it applies to European residents, and it is difficult for companies to know for sure that you aren’t a European resident.
- madez 9y ago
  Well, not so much if the companies are really willing to. They can block traffic coming from European IP addresses and require a legal document saying that the customer is not European.
  - pandler 9y ago
    So, for all intents and purposes, shut themselves out of the European market?
    - madez 9y ago
      Yes. "Obey our rules or stay out of our market" seems like a reasonable thing.
  - pimmen 9y ago
    They can if they are willing to, but I doubt many companies are willing to. "This is a tough one; spend a year rebuilding our backend and terms of services or shut ourselves out from a market of almost 500 million people (not including the UK) probably forever?"

ForHackernews 9y ago

One can only hope.

bitxbitxbitcoin 9y ago
If we continue demanding and building the tools that enable privacy, we will be able to get there. More cuz of the building than the demanding.
- portofcall 9y ago
  This is definitely the right attitude, and I’d add the critical step of talking about these issues with people who don’t know about them. It’s frustrating, it can be alienating and it definitely takes time, but it can pay off. Nothing beats building a useful tool (like Signal), but even useful tools require publicity.
- tedwilliamshock 9y ago
  Related and ongoing ; https://www.crowdrise.com/o/en/campaign/ostif1 https://www.crowdrise.com/o/en/campaign/ostif1 Part of the DuckDuckGo $500,000 Privacy Challenge 2018 ; https://www.crowdrise.com/duckduckgoprivacychallenge https://www.crowdrise.com/duckduckgoprivacychallenge

sqdbps 9y ago

The Equifax thing didn't result in regulation and that was an actual scandal with real ramification not a pile-on by a press seeking to vilify an ad financed competitor. Funny how the Times is using silly metafilter vernacular now: "the consumer surveillance model" -- it's the same business model that's been supporting news publication for more than a century. As for the GDPR it's similar to the recent digital tax proposal and numerous other initiatives by the EU intended to attack US businesses, the US government doesn't share that motivation and it must condemn and push against these EU actions.

corvallis 9y ago
>It's the same business model that's been supporting publication for more than a century. I think there's an enormous difference between advertising in print, advertising on the internet, and what is currently the status quo, which is active surveillance of all information consumed and every movement that individuals make across the internet and in the real world by data linked through GPS/ cell phone location, credit card purchases, etc. I'm aware that this is the new reality, but comparing it to print advertising (or even pop up ads of the early internet) is disingenuous at best.
- sqdbps 9y ago
  Print ads were always backed by market research and data brokerage (buying lists of magazine subscribers, club memberships etc). As for storing data that is generated by their platform that is these companies' prerogative, it's their data as much as it is yours.
  - ionised 9y ago
    > it's their data as much as it is yours. Debatable. The EU has decided that is in fact, yours.
- username223 9y ago
  > comparing it to print advertising is disingenuous at best. Right. First, print advertising could only target the entire subscriber base. Second, they had a limited amount of data on you based on voluntary surveys and census tracts, not a list of every single thing you read, and where you are every minute of every day. Finally, print publications actually cared about reuse/misuse of their address lists. The list they sold you would include some addresses they controlled, so if you resold or reused it, they would catch you. There are ways to deliver effective ads with a whole lot less surveillance.

tedwilliamshock 9y ago

Related and ongoing ; https://www.crowdrise.com/o/en/campaign/ostif1 https://www.crowdrise.com/o/en/campaign/ostif1 Part of the DuckDuckGo $500,000 Privacy Challenge 2018 ; https://www.crowdrise.com/duckduckgoprivacychallenge https://www.crowdrise.com/duckduckgoprivacychallenge

shady-lady 9y ago

Hopefully it will also change the "move fast & proper security is an afterthought" model of startups. Years ago(in CS degree before professional work), I used to wonder & be amazed by how fast new companies(mainly U.S.) moved so quickly. It wasn't because they had some secret sauce or 10x devs, it was because all they did was focus solely on features & take shortcuts. Their customers data security was an afterthought - e.g. production DBs open to anyone in company(even the world in some cases(mongo)), no auditing or logging of data access. Maybe YC(& other accelerators) will make a security expert available to these people...because young adults with 0 professional experience will probably not consider security & rely on the defaults of whatever stack they're using to be good enough. Even less consideration will be given when they're fed & surrounded by a grow fast at all costs mentality. Good security in their products needs thought & critical analysis put into it & I'm not sure new devs appreciate it.

extralego 9y ago
A motto for the coming decades: “Move fast and fix things”
- EGreg 9y ago
  "Move carefully - lots of people are depending on us."
  - madez 9y ago
    Thats how all other engineers are working, except software developers, particularly in certain big companies in the US. It's reckless to not be careful and deeply think of your actions consequences as an engineer, because you yield so much power.
    - lurker456 9y ago
      Only when the regulatory environment demands it. Normal engineers also cut corners in third world countries with weaker protections.

everdev 9y ago

Data breaches can take down a business, but privacy concerns are there historical examples of that? My thought is management gets fired and the company changes course by the time the bottom line gets measurably impacted. Companies are much more likely to fail by not innovating fast enough.

IAmEveryone 9y ago
Cambridge Analytica, in about three weeks.

yuhong 9y ago

I just wrote a second draft of my essay on this exact topic: http://yuhongbao.blogspot.ca/2018/03/google-doubleclick-mozilla-essay-second.html http://yuhongbao.blogspot.ca/2018/03/google-doubleclick-mozi... Among other things, I wrote about the sharing of remarketing lists.

dabei 9y ago

Maybe we should pause and think what value does Facebook provide to the users? Is that value worth the $400B? Given how much we are connected through all kinds of channels, the answer is a clear no. Sure you can say their advertising business is worth that, but if they don't provide their users that much value it's not going to last.

beagle3 9y ago
The value can be argued either way. But remember the old adage: The market can remain irrational longer than you can stay solvent.

stedaniels 9y ago

OT: is this domevent account a new bot on HN? The name, frequency of posts, closeness to article published times...

jernejzen 9y ago

1. Convenience is fuckup of all the privacy 2. Old enemies Google and Facebook unite when it goes to privacy breaches. 3. Do they know my porn preferences (damn you cross browser fingerprinting) 4. Well, Instagram showed my that pretty unknown girl follow, suggestion just hours after getting out of train. That was pretty coolscary. 5. Insomnia made it. I woke up in the middle of the night just day after I put custom mod on my ole Android phone. Found out that Google Keep wanted to have my location (just like from nowhere). Went to the store next day and bought iPhone. Never looked back.

akerro 9y ago

Guys, seriously. Why is this a surprise for people? Facebook is a corporation that literally lives from analysing and selling data about everyone, even people who have not signed up for Facebook, WhatsUp or Instagram accounts. Facebook android application asks you for the following permissions when you install it: This app has access to: Device & app history retrieve running apps Identity find accounts on the device add or remove accounts read your own contact card Calendar read calendar events plus confidential information add or modify calendar events and send email to guests without owners' knowledge Contacts find accounts on the device read your contacts modify your contacts Location approximate location (network-based) precise location (GPS and network-based) SMS read your text messages (SMS or MMS) Phone directly call phone numbers read call log read phone status and identity write call log Photos/Media/Files read the contents of your USB storage modify or delete the contents of your USB storage Storage read the contents of your USB storage modify or delete the contents of your USB storage Camera take pictures and videos Microphone record audio Wi-Fi connection information view Wi-Fi connections Device ID & call information read phone status and identity Other download files without notification adjust your wallpaper size receive data from Internet view network connections create accounts and set passwords read battery statistics send sticky broadcast change network connectivity connect and disconnect from Wi-Fi expand/collapse status bar full network access change your audio settings read sync settings run at startup reorder running apps set wallpaper draw over other apps control vibration prevent device from sleeping toggle sync on and off install shortcuts read Google service configuration It does literally ask you to grant access to your text messages and call logs. Why would anyone expect Facebook NOT to use that data? You all cant be such native, right?

rando444 9y ago
Most people aren't that naïve. The problem is not allowing a company access to your data. The problem is how it's used. Just because you allowed another company to handle your data should not give them carte blanche to do whatever with it they want. This is exactly why Europe created the GDPR.. to prevent your personal data from being processed by companies in unintended ways, or sharing your information with 3rd parties without your consent, and heavy fines for breaking these rules. Just allowing a company access to your data and giving up at that point is the attitude that people are trying to change, because that's not the way the world should work.

bogomipz 9y ago

>"But some trade group executives also warned that any attempt to curb the use of consumer data would put the business model of the ad-supported internet at risk." Yes the "ad-supported internet" may be at risk. So what? Is it unreasonable to think that this model might not actually be sustainable long term? Why should this business model be any less vulnerable than any other business model? Note to Big Tech - public opinion also has the power to "disrupt."

krylon 9y ago
Furthermore, it is possible to run ads without collecting creepy amounts of data on everybody. Ads themselves are not so problematic. But the idea that companies have to collect amounts of data that make the Stasi look like a bunch of privacy activists is very much problematic.
- bogomipz 9y ago
  Agreed. It's funny you mention the Stasi. When touring the old Stasi headquarters in Berlin its tough not to think about how 25 years later a company has amassed much more data on private citizens than Stasi could ever imagined.