29 ms·
Unroll.me to close to EU users saying it can’t comply with GDPR
- jacquesm 9y agoExcellent. The GDPR is working as intended. Let's see how many other unscrupulous actors will try to pin the blame for their own malicious behavior on the new legislation.
- reilly3000 9y agoThat will be most of ad tech and 100% of arbitrage publishers in the least.
- apexalpha 9y agoJust like Uber circumventing labour laws to beat taxi firms. "EU not good for innovation". Ehm, no. These laws represent how we want (our data) to be treated. If you're business model can't exist within that legal realm than your business model is one we don't want.
- dmitriid 9y agoEverytime you see news of a company" not being able to operate due to" or "shutting down because of" GDPR, the only actual reason is "our business model is unsolicited unrestricted access to, processing of, and selling of personal data." So sad to see these businesses go (not)
- megaman22 9y agoOr they are not actually doing anything shady, but the revenue coming in from the EU is not sufficient to justify the increased costs and liabilities.
- geofft 9y agoDo you have an example of this? I totally believe this is possible, but every thing I've seen in practice has matched GP's description.
- megaman22 9y agoThere was at least one that landed on the front page this week. https://news.ycombinator.com/item?id=16954306 https://news.ycombinator.com/item?id=16954306
- geofft 9y agoThanks. Interesting that some folks in the comments say "actually, this site was abusing your data to make money" - but I don't have a good sense of whether a similar site that didn't use Amazon ads, and either took a small membership fee or was run out of the founder's pocket as a side project, would have things to worry about from GDPR. On the flip side, does anyone know of side projects or community projects that have said "We chatted with a European lawyer, who said we don't have anything to worry about, and we'll keep doing our thing"? I know Debian is having that chat (https://lists.debian.org/debian-devel-announce/2018/04/msg00012.html https://lists.debian.org/debian-devel-announce/2018/04/msg00... - and there are some privacy things I think Debian should change, like not keeping people's support emails from years ago public) but I'm curious about projects that are smaller in scope and are basically not trying to hold personal data at all.
- y_molodtsov 9y agoThere also was some online game that did the same, I doubt they had a lot of user data.
- krapp 9y ago> Or they are not actually doing anything shady, but the revenue coming in from the EU is not sufficient to justify the increased costs and liabilities. Refusing to protect your users from your own predatory use of their personal data because the ROI isn't there is still shady.
- ben_jones 9y agoOr it's a free pass to cut out a less profitable market segment. Or it's an excuse for bad developers. Or its an excuse to shift blame from your already failing business.
- nukeop 9y agoExactly, the GDPR regulations are completely reasonable and it's actually quite odd to see them being put into practice so late. The user data selling wild west had to be regulated at some point to curb predatory practices of Google, Facebook, and many others. If your business model isn't based on exploitation and profiling, it isn't hard at all to comply with GDPR.
- Hamuko 9y agoYeah, I've wondered why everyone has been so late to the party. I mean, we have lived in a world with GDPR for two years now. Companies should have already been complying with it for two years. There was just a transitional period during which there was no enforcement. Then there's all the GDPR expert blog posts, blasting the EU for not giving any leeway or transition periods. You were in it!
- tchock23 9y agoSome of us running small businesses don’t spend our free time studying up on the latest in EU regulations. I only found out about it through a random comment on HN in March.
- nukeop 9y agoCool, then you probably don't care about EU customers anyway
- tchock23 9y agoActually, I do. They represent 30% to 40% of my business (depending on the month). GDPR compliance has cost me a ton of time and money. Wish someone could have notified me somehow before I randomly found out in March because it completely derailed our development roadmap.
- drivingmenuts 9y agoI did some work for a small game company that collects an email address as part of the registration for a contest within the mobile game. They may well be shut out of the EU now, which is sad, because I know for a fact there was zero malicious intent.
- craigsmansion 9y ago> collects an email address as part of the registration [..] they may well be shut out of the EU now Why would that be? I think there's a lot of misunderstanding and/or uncertainty about the scope of the GDPR. The fact itself that you know, for a fact, there is no malicious intent, means that the GPDR will have little to no bearing on you. If you're having a simple free e-mail raffle of goodies for a list of players that signed up for that, there's nothing that prevents you from doing that. What would change is that if someone asks you what you have on them, you have to mail back "we have your email address in a list of email addresses", and you have to really delete it if they request it. These are things any decent company would normally comply with regardless. It's only problematic if you would be harvesting data for non-transparent purposes, but that's not something that could reasonable be included with "zero malicious intent".
- ginko 9y ago>They may well be shut out of the EU now Why would you think that? Collecting email addresses for an optional contest is a legitimate use case. The company just needs to ensure that these addresses are stored securely and must give users the option to get their data deleted.
- hedora 9y agoI am increasingly tempted to VPN everything through Europe, and maintain a token postal address there.
- bastawhiz 9y agoI don't mean this sarcastically, but why? It sounds like this impacts users that willingly signed up for this service. Why would you VPN/forward mail through Europe to be locked out of services that you signed up for?
- dijit 9y agoBecause a company being unable to comply with GDPR is a red flag for how they treat user data. GDPR is written in such a way that you as a company are given freedom to use data if its for business reasons. But you need you need to keep track of it. Enhanced data protections are a good reason to (by default) be a European.
- taeric 9y agoI think the point is that this would be a good reason to go elsewhere. However, if you have already signed up, it is a silly way to lock yourself out of something you have signed up for. Which is to reveal the point of the VPN idea. Instead of having to do a lot of extra research on all companies you deal with to know who can comply with the style of rules that GDPR requires, being VPN'd might force them to reveal themselves to you. At least, that is my guess on what each of those posts was getting at.
- derefr 9y agoI think the GP is assuming that there will be services that don’t close to the EU; nor become 100% GDPR compliant for every user; but rather become GDPR-compliant for EU users while continuing to sell the data of non-EU users.
- oneeyedpigeon 9y ago> if its for business reasons How could a company use it for anything else?
- mvid 9y agoI'm curious to know how they enforce the limit on EU users
- Hamuko 9y agoWhatever they are thinking of, I can guarantee that it doesn't work.
- bastawhiz 9y agoAlmost certainly geoip lookup.
- usr1106 9y agoI don't think they have to enforce that very strictly. If the user incorrectly answers "No" to being a resident of EU, I doubt the company could be sued for violating the rights of "dishonest" EU users. As a matter of fact I wonder how a company without physical presence in the EU could ever be fined for any violations. And even if they can be fined on paper, I doubt many non-EU countries will cooperate collecting the fines.
- nukeop 9y agoThis is fantastic news, if a company can't behave responsibly with user data, it deserves to go bankrupt. It's like a restaurant saying it can't comply with health regulations. Absolutely unacceptable. If the business model is to exploit and sell personal information, then the world is better off without that company.
- ocdtrekkie 9y agoThe only thing I am sad about with this news: Unroll.me is still able to function in the United States.
- tomcooks 9y agoI don't understand the downvotes you're getting
- tobyhinloopen 9y ago
- jahvo 9y agoI couldn't have said it better myself.
- Barrin92 9y ago>Put on your best unsurprised face: Unroll.me, a company that has, for years, used the premise of ‘free’ but not very useful ’email management’ services to gain access to people’s email inboxes in order to data-mine the contents for competitive intelligence — and controversially flog the gleaned commercial insights to the likes of Uber — is to stop serving users in Europe ahead of a new data protection enforcement regime incoming under GDPR, which applies from May 25. [...] >"We may share personal information we collect with our parent company, other affiliated companies, and trusted business partners. We also will share personal information with service providers that perform services on our behalf. Our non-affiliated business partners and service providers are not authorized by us to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements". If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen.
- apexalpha 9y agoExactly! On their website you have to go to 'FAQ' on the bottom of the page and then to the bottom of that to find: >When you sign up for Unroll.Me, Unroll.Me uses your data to provide you email management services, and for other purposes described in Unroll.Me’s Privacy Policy and Terms of Service. Unroll.Me is a part of Slice Technologies, whose market research organization Slice Intelligence provides the world’s leading brands, retailers, and marketers e-commerce insights to help them better understand market and consumer trends. In accordance with Unroll.Me’s Privacy Policy and Terms of Service, Unroll.Me shares information from your commercial and transactional emails with Slice. Slice’s technology automatically extracts purchase information from these emails and uses that information to build anonymized market research products for its clients. Slice’s market research products do not include your personal information. I think it is safe to say that 99% of the users using unroll.me have no idea how much data they are handing over. If your business model is incompatible with GDPR then your business model in not compatible with how we want (our data) to be treated. Companies complaining about GDPR goes into the same category as companies complaining about minimum wage for me.
- fossuser 9y ago
- akerro 9y agoGood, this way we can filter shitty services that don't care about my data but only care about using me as a product when I'm not looking.
- ddtaylor 9y agoI'm sure there are still many services operating as "complying" that do in fact only care about the data they can extract from you, eg. Facebook.
- gerdesj 9y agoIf FB complies with GDPR, then cool. If not then it will get expensive. GDPR protects individuals from bad big data. BTW I own a small IT related and UK based business. However you only have 50 karma and look a little errr "shill" despite the nice green profile link.
- dang 9y agoThat breaks the site guidelines. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and don't do this again.
- lol768 9y agoHadn't heard of unroll.me prior to this, but it looks like nothing of value was lost. GDPR doing its job and it hasn't even come into (en)force(ment) yet! Do they do anything that a quick grep for "Unsubscribe" can't? I guess the digests are somewhat niche
- Hamuko 9y agoSorry, but GDPR came into force in 2016.
- apexalpha 9y agoThat's when they passed the bill I think, but as the article says: > [...] is to stop serving users in Europe ahead of a new data protection enforcement regime incoming under GDPR, which applies from May 25.
- Hamuko 9y agoNope, GDPR was adopted in 2016. It just hasn't been enforced for the last two years in order to give companies time to transition.
- joncampbelldev 9y agoSo to say it "came into force" before its being enforced is at best a poor choice of words.
- gerdesj 9y agoIt was enacted at the EU (err: thingie) level in 2016 and required that all EU member states enact local legislation within two years, deadline 25 May 2018. The EU is pretty complicated. Oh and by the way, the UK will 99.99999% maintain GDPR related statutes on the books, post Brexit. Either that or we are madder than I thought.
- 9y ago
- toyg 9y agoScore one for GDPR. Between this and the umpteen services forced to purge my address unless I "resubscribe" (when of course I never subscribed in the first place), it has already achieved concrete results. If only the EU could also fix the mess with cookies and VAT, we could say we're finally entering an era of decent lawmaking over the digital space.
- jMyles 9y agoSo, everyone seems to be celebrating the blow stricken against this seemingly unscrupulous company. Fair enough. But doesn't anybody else think this has at least some worrying optics of censorship? Are we going to end up with another great firewall around Europe? And are you sure that only companies which enjoy a consensus as evil will be clawing the outside? Won't the internet interpret this as damage and route around it?
- matthewmacleod 9y agoBut doesn't anybody thinks this has at least some worrying optics of censorship? No. No more than I think being able to sell fake medicine is a censorship.
- jMyles 9y agoI just don't have a great deal of confidence in my own ability to tell the difference between an arbiter who is making good judgments about which medicines are real and someone who is censoring a competitor by adjudicating their medicine as "fake." In fact, I think I have better instincts about detecting fake medicine than I do about detecting the fake arbiter.
- deleted 9y ago[deleted]
- thefifthsetpin 9y agoSince I like torturing metaphors, let's say that the GDPR was instead a law prohibiting the sale of fake medicine. What happened in this case is that the Unroll me pill manufacturer announced that they'd not be selling their pills in the EU anymore due to the GDPR. So, though your concerns remain valid in the general case, in this particular case there could be no shifty arbiter. Unroll me self-assessed and decided that their own pills are fake.
- jMyles 9y agoIn this case, you're probably right. ...but what if you were selling a medicine that you knew worked, that you really believed in, but that you knew was going to be labeled fake by an arbiter in the employ of your competitor (and I think it's not unfair to say that the FDA is, at times, exactly this)? Might you decide not to spend the money to attempt to achieve compliance? Don't you think that some well-meaning organizations, knowing that they have powerful, well-connected beasts who wish failure for them, might opt to just stay out of Europe (either initially or always) instead of facing the costs of assuring compliance?
- blatherard 9y agoI’m no GDPR expert, but wouldn’t it apply to data of European citizens even if they’re not the customer? Since unroll.me slurps up email, don’t they still have to comply with all the rules for data because presumably some of that email data originates from the EU?
- andypanik 9y agoI am not an expert myself. But how should the EU enforce anything against a company that doesn't do business with EU citizens? They can't restrict any market access and they have no jurisdiction outside the EU.
- deleted 9y ago[deleted]
- crispyporkbites 9y agoNo, because they’re pulling out of the EU market there is no judiciary oversight from the EU of their business, so the rules simply don’t apply.
- JeanMarcS 9y agoSo they don’t think privacy matters?
- apexalpha 9y agoSelling your privacy / data is 100% of their business. The service they provide is 'free' as in a 'free toolbar' that then steals data off your system.
- dvfjsdhgfv 9y agoThat's great! I hope more companies like these follow their footsteps.
- Grue3 9y agoI hope so too. Countries that try to regulate Internet don't deserve Internet. I wish more websites had the balls to not give in to every ridiculous law passed around the globe (e.g. Github removing perfectly normal files because Roskomnadzor asked them too [1]). [1] https://en.wikipedia.org/wiki/Censorship_of_GitHub#Russia https://en.wikipedia.org/wiki/Censorship_of_GitHub#Russia
- nukeop 9y agoThis is a basic protection that should have been passed a long time ago, don't try to frame it as "censorship", it was created to give you control over your own personal information.
- mirimir 9y agoI suspect this strategy will fail. I'm currently using a VPN with an exit in Germany. But through some sort of geolocation glitch, it's being identified as UAE. So unroll.me doesn't display the warning for EU residents. Given the chaos around IPv4 assignments, I doubt that only VPN services are affected.
- kowdermeister 9y agoUnroll.me's ToS was one of the first I checked in detail and it shocked me how invasive it is. I noped the f* out before I granted access to all my mail.
- hidiegomariani 9y agoIt won't be missed
- mplewis 9y agoI'm waiting to see what happens in the class action (COOPER v. SLICE TECHNOLOGIES, INC., https://www.leagle.com/decision/infdco20170920f18 https://www.leagle.com/decision/infdco20170920f18). "UnrollMe does not adequately disclose its true business model to users. Instead, UnrollMe disguises itself as an email-management service to mislead users to sign up for the service so that it (and Slice) can access their data."
- michaelgiba 9y agoJudging from the other comments I guess I’m in the vast minority, but I think the fine structure is really bad for small businesses. I’m not a GDPR fan.
- DanBC 9y agoI think you're making the mistake of thinking the fines mentioned are the minimum fines, when they're the maximum possible fines for the worst repeat deliberate violations. EU regulators tend not to apply fines for companies making simple mistakes. They do want the companies to come back into compliance.
- y_molodtsov 9y agoFor SMBs that probably is really bad. Just the fact that a small website you’ve just heard about requires a lot of your data would be negative for their customer acquisition, while other people would continue trust major companies.
- birksherty 9y agoIf small businesses don't have manpower or money to handle user's information transparently, they should not collect those information in the first place. That's why I like GDPR.
- dawhizkid 9y agoI feel like we’re living in the golden age of free personal financial apps - shocking to me how much we care when it comes to protecting our likes but so careless we are to giving third parties logins to our online banking and all balance and transactional data that comes with it
- kelnos 9y agoIf there's one good thing that's coming out of stories like this, it's that I (as a non-EU citizen) can avoid companies like this that clearly don't care enough about being good stewards of my personal data.
- gerdesj 9y agoYes, GDPR really is a force for good. It is also a bit of a bugger to prepare for (I own a small UK based IT business) but it is a good thing in my opinion. There are ~0.5 billion EU citizens and GDP is roughly 22% of the world. So it has some clout. The EU as a whole has decided that people's data is important and have come up with some rules about the same. Bear in mind the EU is a very diverse place and getting 28 states to agree on something is akin to cat herding. I am still in shock about it. I am also very happy about it but it is only a start. Getting FB and Co into line will take a lot longer as will the world getting a decently diversified and mutually compatible, healthy social presence environment working.
- elahd 9y agoI prodded unroll.me a couple of years ago about their data retention policy. Their answer was sketchy so I ended up not using the service. Unroll.me users irreversibly hand over all of their emails to an unknown entity -- it's crazy to subscribe. Original thread: https://twitter.com/elahd/status/575692415132135425 https://twitter.com/elahd/status/575692415132135425 DMs: http://imgur.com/H0UABYa http://imgur.com/H0UABYa
- fiatjaf 9y agoThat's amazing. I hope more and more companies will forbid the entrance of european users. If at the moment you put your feet on my company you're already making unreasonable demands the most decent thing to do is to put you out and refuse to serve you. I hope GDPR defenders will understand that if more and more companies adopt this strategy.