11 ms·

I think we are talking differently about this permission concept. Legally yes, they had permission. But the fact that they used those dark ux patterns to reques

I think we are talking differently about this permission concept. Legally yes, they had permission. But the fact that they used those dark ux patterns to request that permission should not be forgotten. Even though legally they are in the right, we as users should make this fact irrelevant and just abandon the platform. Let them be right, let them win the argument but lose the battle with the general public.

sametmax 9y ago
The problem is not that they took it. There are always bad actors. The problem is that very few people cared. So even if people start leaving facebook in mass, it will just start all over again with another bad actor.
- kenning 9y ago
  > So even if people start leaving facebook in mass, it will just start all over again with another bad actor. unless they want to prevent this from happening in the long run?
  - sametmax 9y ago
    Who are "they" in your sentence ? If "they" are Facebook, then it's not the point. If "they" are the user, then I doubt that the current outrage is anything more than the scandal "du jour". I spent 10 years talking about this with people around me. Very little cared enough to even start thinking about it for a minute. Not to mention taking life decision with it in mind.
- xstartup 9y ago
  Or you can say, they did not care because bad actors paid them?
  - sametmax 9y ago
    Again, leaders are not the main issue. The problem is more that very little users cared.
- pbhjpbhj 9y ago
  It was probably autocorrect, but just FYI: en masse - it's from French, meaning something like, "in a large group". https://en.m.wiktionary.org/wiki/en_masse https://en.m.wiktionary.org/wiki/en_masse
  - sametmax 9y ago
    The irony is, I'm french, and I tried to "englishify" "en masse", thinking it made sense.
    - logfromblammo 9y ago
      English is already partly French, thanks to the Normans. You can usually drop individual French words straight in without a problem, and sometimes short idiomatic phrases. Trying to translate will just shed any idiomatic character. En masse is already idiomatically associated with groups of people, whereas "in mass" makes us think in terms of kilograms. How many tons of people are leaving Facebook now? As another example, if you translated tete a tete into "head to head", those actually have slightly different meanings in English. Tete a tete translates idiomatically to "one on one", a private meeting of the minds, while "head to head" is a direct--usually public--confrontation or encounter, as one might find in a sporting match.
      - sametmax 9y ago
        Voila, I learned the fact du jour. This makes my day, or my joie de vivre if I may say. Do I do it right ?
        logfromblammo 9y ago
        Yes. Those are all meaningful to native Anglophones. Those who learned English as a secondary language might have some trouble, though. You could think of English as a contest between other languages, to see which one can get the biggest share of the etymology. French is one of the leaders. A lot of the core words come from Norman, but modern terms, particularly those drawn from cuisine and fashion, have made it in as well.
vanderZwan 9y ago
> Even though legally they are in the right Even that is dubious. Law is interpreted by judges for this exact reason: people pushing it to extremes.
- groestl 9y ago
  What Facebook acquired from their users was "expressed consent", which is notoriously easy to get using dark UI patterns. But the technical community has been using "informed consent" in their definition of malware for a while now, and it is highly questionable if dark UI patterns and "informed consent" are compatible concepts. The legal system (at least in US and EU) needs to catch up to this, but it does. In the EU, the GDPR [0] will require "freely given, specific, informed and unambiguous indication of the data subject", which is a lot more than Facebook's claim of having "permission". We will see how judges interpret that. [0] https://www.eugdpr.org/ https://www.eugdpr.org/
  - pbalau 9y ago
    What the fuck is a "dark ui pattern"? //edit: I googled it.
  - soziawa 9y ago
    > What Facebook acquired from their users was "expressed consent" I'm not so sure about that, but that's what courts are for.
    - vanderZwan 9y ago
      I think that was groestl's point: there is what it literally says on paper, and there is the question of whether users can reasonably be expected to understand this.
      - soziawa 9y ago
        I don't think it was even clear on paper. It never said store forever or even store.
akuji1993 9y ago
I'm still completely convinced that this whole scandal will not damage Facebook a bit, in the long term. Yeah, the stock is going to be a bit lower for some weeks, some people will leave, but the largest part of the Facebook users has not even realised the scandal in full scale. They're not going anywhere, they're going to continue as is, since there really is not alternative for Facebook right now and tbh they would just probably do the same thing to their users so why bother. The only solution for people concerned with this is giving up on social media all together. The majority however won't care at all and still continue using Facebook.
- mk89 9y ago
  Wait until GDPR is here, then we might discuss about it. I really wonder how they will pass all those "privacy checks".
  - adventured 9y ago
    It doesn't matter. They have the money, people and time to throw at compliance. GDPR won't dent Facebook in the least. They'll bend where they have to, and no further. They'll pay occasional fines and that won't matter either. If you take it to an extreme and the only thing they can do is show non-personalized advertising and do zero tracking, they'll still print billions in profit in the EU market. That's what owning most of Europe does for you. Their gross profit margin globally is just under ~87%. Cut that in half and they still have a very profitable business with margins comparable to Google. Facebook could run entirely untargeted advertising on their platform globally and still yield enviable profit margins. Their platform is extremely tightly run on costs compared to most tech giants. People talking about doom on this, aren't discussing facts or using logic, they're projecting a revenge fantasy out of emotion. It's driven by a desire to punish Facebook.
    - aje403 9y ago
      Please stop, what you’re saying is too accurate. Could you potentially edit some pitchforks and such into your comment?
    - 9y ago
awalton 9y ago
> Legally yes, they had permission. California is a two-party consent state for recording, and it's not an unreasonable stretch to say this should also include call metadata. If one party (i.e. Me) opted out, and someone else didn't, they now have a log that I didn't give them permission to make. I think this is probably the most strong case users will have against Facebook, and I honestly think it's a pretty damned good one, but IANAL, YMMV, etc. Either way, if you're still using the Facebook app after this has come to light... you're probably setting yourself up for a world of pain. Even if you don't delete Facebook outright, the risks of having their terribly coded app on your phone vastly outweigh the benefits at this point (you know, if you didn't delete it when people realized it decreased their battery life by 10-20%, or that it asked for every permission Android had an option for, with no way to tell Android to restrict access back-in-the-day...)
- torstenvl 9y ago
  it's not an unreasonable stretch to say this should also include call metadata Yes. It is an unreasonable stretch. Cal. Penal Code § 632 prohibits "eavesdrop[ping] upon or record[ing] [a] confidential communication." There is no set of circumstances in the history of telecommunications where seeing your itemized phone bill is the same as eavesdropping. I understand you feel violated. You should. What Facebook did is vile. But that's not a reason to throw due process out the window.
  - pbhjpbhj 9y ago
    Recording that a confidential communication happened appears to read on to that law, that's still part of "recording a communication". If a law said i couldn't "record your visit to a shop" and I shared commercially that you "went to the shop at X time and stayed Y minutes" even if I didn't record the details of your purchases, or what you were wearing, or whatever, it would still appear to be a contravention of the letter of that law.
- smnrchrds 9y ago
  > California is a two-party consent state for recording, and it's not an unreasonable stretch to say this should also include call metadata It is very unreasonable. All modern phones automatically keep a log of your phone calls (call history). Should I ask for the consent of anyone I call or delete the phone call from phone history immediately after, otherwise I face criminal penalties?
austincheney 9y ago
There is nothing to suggest dark UX patterns were at play here. People simply gave Facebook access to everything because it was fashionable and convenient. People simply do not care about their privacy if its in conflict with convenience. It has been common knowledge for years that Facebook will directly use that data against you and still people, completely aware of this, didn't care. The only thing that made people care about their loss of privacy was a change in fashion. A new trend. Somehow, now, it is suddenly bad where before it wasn't. I simply cannot find the words to blame Facebook for this.
- helloindia 9y ago
  I'm a frequent Facebook user, and I'm connected to most of my relatives and close friends on Facebook. I have absolutely no need to share my phone contact list(where I have numbers of colleagues and people who I wouldn't call friends) to Facebook.
- netsharc 9y ago
  It's probably like a spouse having racy pictures of you, and now you've found out they've done something bad with racy pictures of previous spouses. You gave them the pictures, and now you feel uncomfortable that you did. Legally you gave them permission, but how you feel about it has changed. Also, Zuck arguing he has your consent is like the spouse saying "You mumbled 'okay' when I badgered to take pictures of you naked! That's permission!". Also Zuck saying it's secure is like your spouse having those pictures in a Windows share in his frat house but telling his frat bros "tell me that you agree not to look at those pictures." (More like your spouse saying the small print says he's allowed to distribute those pics to other people, but only if they promise not to misuse them...).
- mk89 9y ago
  I think the statement > People simply do not care about their privacy if its in conflict with convenience is only partially correct. So far I have been able to distinguish these kinds of people: - people unaware - people aware that try their best to keep privacy (if they are on facebook, they limit their usage - more or less like "lurkers") - people aware and still posting stuff on FB/giving some permissions and they still do "something" (a bit more than lurkers above) - people aware but "I don't have anything to hide", yet still unaware of the full potential of lack of privacy and they post whatever they want - people aware and educated about privacy and "I don't have anything to hide" (yes, they do exist) and they still post whatever they want > I simply cannot find the words to blame Facebook for this. I have to disagree here as well. There are certain things which I agree with you on, e.g., this feature was enabled by default, because users want to have more convenience. Indeed! However, what about last week's scandal with Cambridge Analytica? And what else aren't we aware of? I am trying my best not to connect these two facts, yet, it seems there is a pattern when it's about user data => who cares, they don't know what they want.
dm319 9y ago
I think the business sector needs to have a look at the way consent is done in the medical field, where huge terms and conditions with nasty stuff hidden away isn't ok. The concept in medicine is that consent for treatment is done in a simple way that encompasses things that are commonly an issue (but often a minor inconvenience), things that are rarely an issue but are disastrous, and things that might specifically be an extra-big issue for the patient (i.e. damage to fingertip sensation for a typist, or something like that). This gives the responsibility of getting the salient issues communicated to the person requesting consent - forcing it to be phrased in an understandable way. I see some companies are doing a summary of the terms and conditions (seen it with Virgin and Google), which is welcome, as long as they are including what is common and important in that summary and not hiding things in the T&Cs.
- mtgx 9y ago
  I imagine that's exactly what the business sector doesn't want to do. I remember when Google and Microsoft changed their privacy policies 2-3 years ago to become much more generic and "unified" - as in they could now use your data however they found fit from across all of their services and products. Great piece of PR that "unified" trick, though, so props to the PR team, I suppose. The tech media mostly treated it with a shrug even when there was something that sounded quite suspicious in there, and had a tone of "yeah, but that's probably just used for X, and it's unlikely Google/Microsoft will use it for other nefarious purposes. It's just for legal reasons, you see." No, those provisions weren't put in there "just for legal reasons" and they were put in there on purpose because they were meant to be used. Also, if they put it in there "for legal reasons" it's also because they intend to use it and need the legal cover. It's weird how the media took out exactly the wrong message from it back then. It also bares repeating, because the media didn't cover it much back then, and it was quite a sneaky thing for Google to do - Google changed its privacy policy to no longer keep your data "anonymized." Many people even on HN like to defend the companies' data collection "because they anonymize it", which in itself has always been a joke, as studies have proven, but they no longer even do that: https://www.extremetech.com/internet/238093-google-quietly-changed-its-privacy-policy-no-longer-promises-to-anonymize-your-personal-information-when-selling-ads https://www.extremetech.com/internet/238093-google-quietly-c...
- 9y ago
xphilter 9y ago
I prefer to think of it like “technical” permission (like obtaining the permission from android) and legal permission (aka consent). I doubt FB got consent.
- inetknght 9y ago
  I think this is a very good way of describing the issue. Unfortunately, there's also the little matter of EULAs.
  - xphilter 9y ago
    Right. And judges have enforced those to the letter. But with GDPR and the like coming into play, I think judges will have to accept the reality that EULAs can’t give actual consent.
pweissbrod 9y ago
More than likely youre right. Your statement brings me a curiousity: What the legal precedence is for UX patterns considered deceptive enough to be intentionally malicious? The best I could find was a settlement with linkedin in 2015: https://www.fastcodesign.com/3051906/after-lawsuit-settlement-linkedins-dishonest-design-is-now-a-13-million-problem https://www.fastcodesign.com/3051906/after-lawsuit-settlemen...
jimmies 9y ago
Totally agree. My mom wouldn't know that damn dialog has two buttons. This is the epitome of “we’re shitty by default, but if you know your way around our system, then you’re fine.” Yeah... how about no? Just wrote about it here: http://www.tnhh.net/posts/shitty-by-default.html http://www.tnhh.net/posts/shitty-by-default.html
mtgx 9y ago
We don't even know they always did this with permission, because in the past they didn't actually need permission for it, which could be why Facebook is trying to make such a big deal out saying that collecting call history and text is "normal" when they collect your contacts. It was required in 8.0 to tell the users that they're collecting this data. So the question is, did they collect it before 8.0 w/o permission? https://developer.android.com/about/versions/oreo/android-8.0-changes.html#rmp https://developer.android.com/about/versions/oreo/android-8....
mikeash 9y ago
Of course we’re talking about different things. Facebook knows it and is confusing the issue intentionally. The last thing they want is a nuanced discussion of informed consent and how it relates to click-through alerts nobody ever reads.
aylmao 9y ago
> But the fact that they used those dark ux patterns to request that permission should not be forgotten. I posted this in another thread, but it's relevant here too: Isn't this an Android issue? I mean, Facebook is collecting the data, but they're asking for it like every other Android app does. As an example, iOS used to just show a dialog that mentions an app wants to use your location, and it was later changed to: 1. a dialog that asks if it's ok to use your location while "you use the App" with, 2. a required blurb by the app that specifies how it's used, and 3. a separate dialog for when the usage of your location also applies "even when you are not using the app", with a clear option to instead grant the permission only if the app is running in the foreground. iOS also warns you when you use a custom keyboard if the keyboard wants "full access". And clearly explains this means it can "transmit anything you type, including things you have previously typed with this keyboard", including "sensitive information such as your credit card numbers or street address". I quoted directly from the dialog boxes because I think the wording is well crafted to make it very clear for non-savvy users. Android on the other hand literally just asks you if you want to use Messenger as your "SMS app". This tells nothing to the user, doesn't inform them what data can be accessed, what can be done with it (can it leave the phone?), nor gives the user any further options. I know Facebook privacy is the hot-topic right now, but my problem with this is there's lots of other apps that can and probably have used these permissions too, and are probably storing this information. This is the opportunity to put Google under fire for their terrible Android permission system, which extends to random games asking for full phone access and a myriad of other sketchy things, but by focusing on Facebook this opportunity is being lost.

sametmax 9y ago

The problem is not that they took it. There are always bad actors. The problem is that very few people cared. So even if people start leaving facebook in mass, it will just start all over again with another bad actor.

kenning 9y ago
> So even if people start leaving facebook in mass, it will just start all over again with another bad actor. unless they want to prevent this from happening in the long run?
- sametmax 9y ago
  Who are "they" in your sentence ? If "they" are Facebook, then it's not the point. If "they" are the user, then I doubt that the current outrage is anything more than the scandal "du jour". I spent 10 years talking about this with people around me. Very little cared enough to even start thinking about it for a minute. Not to mention taking life decision with it in mind.
xstartup 9y ago
Or you can say, they did not care because bad actors paid them?
- sametmax 9y ago
  Again, leaders are not the main issue. The problem is more that very little users cared.
pbhjpbhj 9y ago
It was probably autocorrect, but just FYI: en masse - it's from French, meaning something like, "in a large group". https://en.m.wiktionary.org/wiki/en_masse https://en.m.wiktionary.org/wiki/en_masse
- sametmax 9y ago
  The irony is, I'm french, and I tried to "englishify" "en masse", thinking it made sense.
  - logfromblammo 9y ago
    English is already partly French, thanks to the Normans. You can usually drop individual French words straight in without a problem, and sometimes short idiomatic phrases. Trying to translate will just shed any idiomatic character. En masse is already idiomatically associated with groups of people, whereas "in mass" makes us think in terms of kilograms. How many tons of people are leaving Facebook now? As another example, if you translated tete a tete into "head to head", those actually have slightly different meanings in English. Tete a tete translates idiomatically to "one on one", a private meeting of the minds, while "head to head" is a direct--usually public--confrontation or encounter, as one might find in a sporting match.
    - sametmax 9y ago
      Voila, I learned the fact du jour. This makes my day, or my joie de vivre if I may say. Do I do it right ?
      - logfromblammo 9y ago
        Yes. Those are all meaningful to native Anglophones. Those who learned English as a secondary language might have some trouble, though. You could think of English as a contest between other languages, to see which one can get the biggest share of the etymology. French is one of the leaders. A lot of the core words come from Norman, but modern terms, particularly those drawn from cuisine and fashion, have made it in as well.

vanderZwan 9y ago

> Even though legally they are in the right Even that is dubious. Law is interpreted by judges for this exact reason: people pushing it to extremes.

groestl 9y ago
What Facebook acquired from their users was "expressed consent", which is notoriously easy to get using dark UI patterns. But the technical community has been using "informed consent" in their definition of malware for a while now, and it is highly questionable if dark UI patterns and "informed consent" are compatible concepts. The legal system (at least in US and EU) needs to catch up to this, but it does. In the EU, the GDPR [0] will require "freely given, specific, informed and unambiguous indication of the data subject", which is a lot more than Facebook's claim of having "permission". We will see how judges interpret that. [0] https://www.eugdpr.org/ https://www.eugdpr.org/
- pbalau 9y ago
  What the fuck is a "dark ui pattern"? //edit: I googled it.
- soziawa 9y ago
  > What Facebook acquired from their users was "expressed consent" I'm not so sure about that, but that's what courts are for.
  - vanderZwan 9y ago
    I think that was groestl's point: there is what it literally says on paper, and there is the question of whether users can reasonably be expected to understand this.
    - soziawa 9y ago
      I don't think it was even clear on paper. It never said store forever or even store.

akuji1993 9y ago

I'm still completely convinced that this whole scandal will not damage Facebook a bit, in the long term. Yeah, the stock is going to be a bit lower for some weeks, some people will leave, but the largest part of the Facebook users has not even realised the scandal in full scale. They're not going anywhere, they're going to continue as is, since there really is not alternative for Facebook right now and tbh they would just probably do the same thing to their users so why bother. The only solution for people concerned with this is giving up on social media all together. The majority however won't care at all and still continue using Facebook.

mk89 9y ago
Wait until GDPR is here, then we might discuss about it. I really wonder how they will pass all those "privacy checks".
- adventured 9y ago
  It doesn't matter. They have the money, people and time to throw at compliance. GDPR won't dent Facebook in the least. They'll bend where they have to, and no further. They'll pay occasional fines and that won't matter either. If you take it to an extreme and the only thing they can do is show non-personalized advertising and do zero tracking, they'll still print billions in profit in the EU market. That's what owning most of Europe does for you. Their gross profit margin globally is just under ~87%. Cut that in half and they still have a very profitable business with margins comparable to Google. Facebook could run entirely untargeted advertising on their platform globally and still yield enviable profit margins. Their platform is extremely tightly run on costs compared to most tech giants. People talking about doom on this, aren't discussing facts or using logic, they're projecting a revenge fantasy out of emotion. It's driven by a desire to punish Facebook.
  - aje403 9y ago
    Please stop, what you’re saying is too accurate. Could you potentially edit some pitchforks and such into your comment?
  - 9y ago

awalton 9y ago

> Legally yes, they had permission. California is a two-party consent state for recording, and it's not an unreasonable stretch to say this should also include call metadata. If one party (i.e. Me) opted out, and someone else didn't, they now have a log that I didn't give them permission to make. I think this is probably the most strong case users will have against Facebook, and I honestly think it's a pretty damned good one, but IANAL, YMMV, etc. Either way, if you're still using the Facebook app after this has come to light... you're probably setting yourself up for a world of pain. Even if you don't delete Facebook outright, the risks of having their terribly coded app on your phone vastly outweigh the benefits at this point (you know, if you didn't delete it when people realized it decreased their battery life by 10-20%, or that it asked for every permission Android had an option for, with no way to tell Android to restrict access back-in-the-day...)

torstenvl 9y ago
it's not an unreasonable stretch to say this should also include call metadata Yes. It is an unreasonable stretch. Cal. Penal Code § 632 prohibits "eavesdrop[ping] upon or record[ing] [a] confidential communication." There is no set of circumstances in the history of telecommunications where seeing your itemized phone bill is the same as eavesdropping. I understand you feel violated. You should. What Facebook did is vile. But that's not a reason to throw due process out the window.
- pbhjpbhj 9y ago
  Recording that a confidential communication happened appears to read on to that law, that's still part of "recording a communication". If a law said i couldn't "record your visit to a shop" and I shared commercially that you "went to the shop at X time and stayed Y minutes" even if I didn't record the details of your purchases, or what you were wearing, or whatever, it would still appear to be a contravention of the letter of that law.
smnrchrds 9y ago
> California is a two-party consent state for recording, and it's not an unreasonable stretch to say this should also include call metadata It is very unreasonable. All modern phones automatically keep a log of your phone calls (call history). Should I ask for the consent of anyone I call or delete the phone call from phone history immediately after, otherwise I face criminal penalties?

austincheney 9y ago

There is nothing to suggest dark UX patterns were at play here. People simply gave Facebook access to everything because it was fashionable and convenient. People simply do not care about their privacy if its in conflict with convenience. It has been common knowledge for years that Facebook will directly use that data against you and still people, completely aware of this, didn't care. The only thing that made people care about their loss of privacy was a change in fashion. A new trend. Somehow, now, it is suddenly bad where before it wasn't. I simply cannot find the words to blame Facebook for this.

helloindia 9y ago
I'm a frequent Facebook user, and I'm connected to most of my relatives and close friends on Facebook. I have absolutely no need to share my phone contact list(where I have numbers of colleagues and people who I wouldn't call friends) to Facebook.
netsharc 9y ago
It's probably like a spouse having racy pictures of you, and now you've found out they've done something bad with racy pictures of previous spouses. You gave them the pictures, and now you feel uncomfortable that you did. Legally you gave them permission, but how you feel about it has changed. Also, Zuck arguing he has your consent is like the spouse saying "You mumbled 'okay' when I badgered to take pictures of you naked! That's permission!". Also Zuck saying it's secure is like your spouse having those pictures in a Windows share in his frat house but telling his frat bros "tell me that you agree not to look at those pictures." (More like your spouse saying the small print says he's allowed to distribute those pics to other people, but only if they promise not to misuse them...).
mk89 9y ago
I think the statement > People simply do not care about their privacy if its in conflict with convenience is only partially correct. So far I have been able to distinguish these kinds of people: - people unaware - people aware that try their best to keep privacy (if they are on facebook, they limit their usage - more or less like "lurkers") - people aware and still posting stuff on FB/giving some permissions and they still do "something" (a bit more than lurkers above) - people aware but "I don't have anything to hide", yet still unaware of the full potential of lack of privacy and they post whatever they want - people aware and educated about privacy and "I don't have anything to hide" (yes, they do exist) and they still post whatever they want > I simply cannot find the words to blame Facebook for this. I have to disagree here as well. There are certain things which I agree with you on, e.g., this feature was enabled by default, because users want to have more convenience. Indeed! However, what about last week's scandal with Cambridge Analytica? And what else aren't we aware of? I am trying my best not to connect these two facts, yet, it seems there is a pattern when it's about user data => who cares, they don't know what they want.

dm319 9y ago

I think the business sector needs to have a look at the way consent is done in the medical field, where huge terms and conditions with nasty stuff hidden away isn't ok. The concept in medicine is that consent for treatment is done in a simple way that encompasses things that are commonly an issue (but often a minor inconvenience), things that are rarely an issue but are disastrous, and things that might specifically be an extra-big issue for the patient (i.e. damage to fingertip sensation for a typist, or something like that). This gives the responsibility of getting the salient issues communicated to the person requesting consent - forcing it to be phrased in an understandable way. I see some companies are doing a summary of the terms and conditions (seen it with Virgin and Google), which is welcome, as long as they are including what is common and important in that summary and not hiding things in the T&Cs.

mtgx 9y ago
I imagine that's exactly what the business sector doesn't want to do. I remember when Google and Microsoft changed their privacy policies 2-3 years ago to become much more generic and "unified" - as in they could now use your data however they found fit from across all of their services and products. Great piece of PR that "unified" trick, though, so props to the PR team, I suppose. The tech media mostly treated it with a shrug even when there was something that sounded quite suspicious in there, and had a tone of "yeah, but that's probably just used for X, and it's unlikely Google/Microsoft will use it for other nefarious purposes. It's just for legal reasons, you see." No, those provisions weren't put in there "just for legal reasons" and they were put in there on purpose because they were meant to be used. Also, if they put it in there "for legal reasons" it's also because they intend to use it and need the legal cover. It's weird how the media took out exactly the wrong message from it back then. It also bares repeating, because the media didn't cover it much back then, and it was quite a sneaky thing for Google to do - Google changed its privacy policy to no longer keep your data "anonymized." Many people even on HN like to defend the companies' data collection "because they anonymize it", which in itself has always been a joke, as studies have proven, but they no longer even do that: https://www.extremetech.com/internet/238093-google-quietly-changed-its-privacy-policy-no-longer-promises-to-anonymize-your-personal-information-when-selling-ads https://www.extremetech.com/internet/238093-google-quietly-c...
9y ago

xphilter 9y ago

I prefer to think of it like “technical” permission (like obtaining the permission from android) and legal permission (aka consent). I doubt FB got consent.

inetknght 9y ago
I think this is a very good way of describing the issue. Unfortunately, there's also the little matter of EULAs.
- xphilter 9y ago
  Right. And judges have enforced those to the letter. But with GDPR and the like coming into play, I think judges will have to accept the reality that EULAs can’t give actual consent.

pweissbrod 9y ago

More than likely youre right. Your statement brings me a curiousity: What the legal precedence is for UX patterns considered deceptive enough to be intentionally malicious? The best I could find was a settlement with linkedin in 2015: https://www.fastcodesign.com/3051906/after-lawsuit-settlement-linkedins-dishonest-design-is-now-a-13-million-problem https://www.fastcodesign.com/3051906/after-lawsuit-settlemen...

jimmies 9y ago

Totally agree. My mom wouldn't know that damn dialog has two buttons. This is the epitome of “we’re shitty by default, but if you know your way around our system, then you’re fine.” Yeah... how about no? Just wrote about it here: http://www.tnhh.net/posts/shitty-by-default.html http://www.tnhh.net/posts/shitty-by-default.html

mtgx 9y ago

We don't even know they always did this with permission, because in the past they didn't actually need permission for it, which could be why Facebook is trying to make such a big deal out saying that collecting call history and text is "normal" when they collect your contacts. It was required in 8.0 to tell the users that they're collecting this data. So the question is, did they collect it before 8.0 w/o permission? https://developer.android.com/about/versions/oreo/android-8.0-changes.html#rmp https://developer.android.com/about/versions/oreo/android-8....

mikeash 9y ago

Of course we’re talking about different things. Facebook knows it and is confusing the issue intentionally. The last thing they want is a nuanced discussion of informed consent and how it relates to click-through alerts nobody ever reads.

aylmao 9y ago

> But the fact that they used those dark ux patterns to request that permission should not be forgotten. I posted this in another thread, but it's relevant here too: Isn't this an Android issue? I mean, Facebook is collecting the data, but they're asking for it like every other Android app does. As an example, iOS used to just show a dialog that mentions an app wants to use your location, and it was later changed to: 1. a dialog that asks if it's ok to use your location while "you use the App" with, 2. a required blurb by the app that specifies how it's used, and 3. a separate dialog for when the usage of your location also applies "even when you are not using the app", with a clear option to instead grant the permission only if the app is running in the foreground. iOS also warns you when you use a custom keyboard if the keyboard wants "full access". And clearly explains this means it can "transmit anything you type, including things you have previously typed with this keyboard", including "sensitive information such as your credit card numbers or street address". I quoted directly from the dialog boxes because I think the wording is well crafted to make it very clear for non-savvy users. Android on the other hand literally just asks you if you want to use Messenger as your "SMS app". This tells nothing to the user, doesn't inform them what data can be accessed, what can be done with it (can it leave the phone?), nor gives the user any further options. I know Facebook privacy is the hot-topic right now, but my problem with this is there's lots of other apps that can and probably have used these permissions too, and are probably storing this information. This is the opportunity to put Google under fire for their terrible Android permission system, which extends to random games asking for full phone access and a myriad of other sketchy things, but by focusing on Facebook this opportunity is being lost.