5 ms·

I happened to be looking into pinterest's 'updated privacy policy' for the last 30 mins. They just seems to wiggle and bend in every direction to make it seem l

by roel_v 8y ago

I happened to be looking into pinterest's 'updated privacy policy' for the last 30 mins. They just seems to wiggle and bend in every direction to make it seem like they're complying, but even my blind granny can see they're not. I wonder how companies like them will survive - because their whole existence is based on doing the exact things the gdpr wants to stop.

Spearchucker 8y ago
Not sure why the doom and gloom. Because they can carry on as always except in Europe. If that's 90% of their base then yes, they may have problems. For such companies GDPR simply shrinks profits, no?
- kungtotte 8y ago
  GDPR applies for non-EU based operations as long as the users are EU-based. I guess theoretically they only have to comply with GDPR specifically for EU-based operations and/or EU citizens, so they could technically keep at it if their servers are outside the EU and for any non-EU users. But I think in the long run it'll be easier to have sitewide compliance.
  - dahdum 8y ago
    Sitewide compliance could reduce revenue worldwide, in those cases it could often make sense to exit the EU market entirely.
    - kungtotte 8y ago
      That is of course one alternative. Depending on your business it might be viable, but the EU is a pretty big market to skip out on assuming your business model itself doesn't violate the GDPR.
    - s73v3r_ 8y ago
      If the only reason you're making money is by disrespecting your user's privacy, then one has to question whether you should be in business in the first place.
      - dahdum 8y ago
        GDPR isn’t perfect, and those not in compliance with a new, vaguely written, policy aren’t automatically evil.
        s73v3r_ 8y ago
        The policy is 2 years old. It's hardly new; there was lots of time to ask questions and come into compliance.
        dahdum 8y ago
        Plenty of time to ask questions but no one who can give straight answers.
- mrweasel 8y ago
  Europe is 500 million potential users, so if you're not privately held, then you also need to explain to stockholders that you intent to leave that market open to competitors. Sure all EU citizens aren't equally wealthy, but a large number of those 500 million are in a lucrative segment. Let's say that Instagram decides that the EU isn't worth the hassle, and leaves. Now competitors have 500 million users to target and build a platform for, without the annoying interference from US based companies. If some is successful under the GDPR, there's no real reason they could easily enter other, less strict markets later, using the profit from their EU business,.
  - Spearchucker 8y ago
    The assumption is Pintrest can't be successful in the EU.
  - taysic 8y ago
    There are some services that wouldn't exist if it wasn't for targeted advertising. Instagram may have millions of users in the EU but how many would pay for the service? The number that would probably would not be enough to sustain the network effect. And if Instagram users switched to mainly non-targeted advertising, Instagram may find itself not making enough money to sustain its company. While a 'competitor' willing to make less money could show up, their ability to collect / store photos or videos / update the ui / filter out inappropriate content would be decreased if they were barely profitable, making it a less useful service than Instagram was.
- roel_v 8y ago
  I didn't mean it as 'doom and gloom' - I'm just interested in the economics and management/business aspects of it. Is it possible to turn a company around that has 'ads' woven so deeply in its DNA? Would such a company just give up on a target demographic sized 500mm? What would that do to their valuation and funding? Maybe the answer is 'nothing', I'm not sure - but plenty of companies were punished by the markets the last 15 years for not at least trying to get into Chinese and Indian markets, which are (if you only count the people that can actually buy something) much smaller than the EU, and much harder to break into culturally.
- taysic 8y ago
  Shrinks profits or destroys their business model (ie apps/games that people wouldn't buy but survive well on targeted advertising)
notimetorelax 8y ago
Hm, that’s interesting. It should be possible for Pinterest to be compliant, e.g. Twitter is compliant. Was there anything specific that caught your eye?
- neuland 8y ago
  Do you know how Twitter is complying? I'd be interested to hear. In the last month or so, I have started seeing consent interstitials in Tweet embeds on news sites and stuff. They say something to the effect of "Twitter uses analytics to track ..., do you agree?". But, there's only an agree button.
  - notimetorelax 8y ago
    Our SaaS consumes Twitter data through GNIP API (company they bought a couple years ago). Twitter was the first data provider to require reviews of all the usage scenarios and they are very serious about enforcing the correct use. Twitter also publishes compliance feed which all downstream services are required to respect. E.g. if a user removes their twit or profile we remove their data from our service. We had to negotiate with other social networks to provide similar functionality.
    - neuland 8y ago
      Wow, that's good to hear that there's a compliance feed. That sounds like exactly what I was talking about in a different thread, where there needs to be a webhook, feed, or some other communication mechanism to disperse deletion requests to processors.
- PeterisP 8y ago
  It's certainly possible for Pinterest to be compliant if they actually try to be compliant and change their behavior (not only the privacy policy) accordingly. That doesn't mean that they're going to be compliant.
- roel_v 8y ago
  All from https://policy.pinterest.com/en/privacy-policy https://policy.pinterest.com/en/privacy-policy . - "We collect information in a few different ways: ... 3. Our partners and advertisers share information with us". Unless I have explicitly given those partners and advertisers consent to share that information with pinterest (and specifically with pinterest), I don't think this is compliant. But wait, there's a setting in your profile that you can turn on and off: "Use information from our partners to improve which recommendations and ads you see • Learn more". Note how it doesn't say 'don't collect information on me'. It only says 'don't use information to personalize'. I've read several sections of their website on this, and it's all carefully worded to make sure they never promise not to collect information on you - just that they won't show you what they can do with the information they collect on you. - The section "What we do with the info we collect:" contains the phrase 'legitimate interest' 5 times. This is a desperate attempt to justify themselves using the phrasing of the law. Take this for example: "We also have a legitimate interest to improve Pinterest, maintain our relationship with you, and protect users. We both benefit when we use your information to: Help your friends and contacts find you on Pinterest, if you agree to this in your settings. For example, if you sign up using a Facebook account, we can help your Facebook friends find you on Pinterest when they first sign up for Pinterest. Or, people can search for your account on Pinterest using your email." That's severely stretching 'legitimate interest'. Now you might say 'hey but it says 'if you agree to this in your settings'. Yeah except that in the settings, it says 'Use your Facebook account to log in', it doesn't say anything about slurping up all your Facebook contacts so that they can be spammed with 'hey do you know xyz' when they first log on. Or here: "We have a legitimate interest in delivering ads that are relevant, interesting and personal to you in order to generate revenue (providing this Service is expensive!) To further these interests we use the information we collect to: ". Yeah under that definition of 'legitimate interest', we might as well scrap this whole gdpr thing. 'We have a legitimate interest to use every method we can think of to squeeze every last advertising penny out of your personal data' would at least have been honest. - "Tell our ad partners the types of products you might be interested in. For example, if you create a board dedicated to sneakers, we can tell a retailer that you’re more interested in sneakers than, say, sweaters." Yes well that's the exact thing I do not want. Look, I'm fine with paying for stuff with my personal data - up to a point. But pinterest sending every interest of mine they think they can derive from my activity to anyone who will pay for it - no. OK, let me just go to my profile and turn that off, like all other, trivial features they repeatedly point out can be disabled 'in your profile' - uh what do you know, there's no such setting! Look, maybe it won't turn out as bad as it looks, and maybe the above relies on a strict interpretation of the law that, in practice, will turn to be more... let's say lenient. But reading that 'privacy policy' just feels like being fed a shit sandwich while surrounded by 12 harp-playing angels singing about how delicious it is.
dgellow 8y ago
I would expect Pinterest to focus on the US market.
- roel_v 8y ago
  They have their products translated into languages that are only spoken in Europe, they know I'm in Europe and show me pins that are relevant to my country, and they work with merchants to show you geo-targeted ads. I mean, spending 51% of your effort on US demographics is technically still 'focusing' I guess - but I don't think it'll be enough to be able to claim that this law doesn't apply to them.
dominotw 8y ago
> but even my blind granny can see they're not. Curious what you see, if you have any examples.
- roel_v 8y ago
  Have replied to other comment asking the same, above.
hodgesrm 8y ago
Leaving aside questions of business model, many large online services simply don't have an easy way to track from downstream information back to the original source. That will make it almost impossible to implement notifications or "right to be forgotten" in any strict sense. One possible outcome is a new set of businesses designed for GDPR will arise in place of Pinterest and others. That outcome seems to be a not-so-hidden goal of GDPR.
- neuland 8y ago
  Isn't the burden on the data controller to ensure that they only transmit data to processors that are setup to handle deletion requests? In this case, that'd mean Pintrest or whoever is required to get their advertising partners or API consumers to setup some kind of webhook or feed for deletion requests.
  - hodgesrm 8y ago
    It's just not very clear how easy that protocol would be to implement. The problem is siloed data without clear identifiers to track sources. For example, it's common in services like Pinterest to have upstream collectors that feed information into a Kafka pipeline to downstream services that use the data as they see fit. They don't necessarily have consistent identifiers that would allow you to determine that person A's data lives in derived form in services 1, 5, and 14. In the limit you might have to scan all persistent data. It gets much harder once the data leave the company and travel to other online services. Depending on the case law and administrative guidance that develops to interpret GDPR more precisely this problem may be simply unsolvable for some businesses.
    - neuland 8y ago
      I totally agree, re: possibly being unsolvable for some companies. It'll be very interesting to see how the actual enforcement develops. I suspect the regulators want companies to create these kinds of consistent identifiers where they don't already exist and make sure that they ride along with personal data wherever it finds it's way. There's a comment in the article about an oblique reference in an email to "a tall, bald guy living on East Whatever St." being PII and must be included in data subject review/deletion requests. How do you find that, even if you're scanning everywhere? What about users' computers with excel sheets with personal data? That's how reporting is done a lot of places that I know of. You can make them install an agent to scan data or require all data be put in centralized storage like a network share or corporate subscription to a service like dropbox or something. But, I 100% guarantee that Andy from HR or Jane from marketing going to "forget" to do that or put it in some insane format that the scanner can't handle.

by roel_v 8y ago

Spearchucker 8y ago

Not sure why the doom and gloom. Because they can carry on as always except in Europe. If that's 90% of their base then yes, they may have problems. For such companies GDPR simply shrinks profits, no?

kungtotte 8y ago
GDPR applies for non-EU based operations as long as the users are EU-based. I guess theoretically they only have to comply with GDPR specifically for EU-based operations and/or EU citizens, so they could technically keep at it if their servers are outside the EU and for any non-EU users. But I think in the long run it'll be easier to have sitewide compliance.
- dahdum 8y ago
  Sitewide compliance could reduce revenue worldwide, in those cases it could often make sense to exit the EU market entirely.
  - kungtotte 8y ago
    That is of course one alternative. Depending on your business it might be viable, but the EU is a pretty big market to skip out on assuming your business model itself doesn't violate the GDPR.
  - s73v3r_ 8y ago
    If the only reason you're making money is by disrespecting your user's privacy, then one has to question whether you should be in business in the first place.
    - dahdum 8y ago
      GDPR isn’t perfect, and those not in compliance with a new, vaguely written, policy aren’t automatically evil.
      - s73v3r_ 8y ago
        The policy is 2 years old. It's hardly new; there was lots of time to ask questions and come into compliance.
        dahdum 8y ago
        Plenty of time to ask questions but no one who can give straight answers.
mrweasel 8y ago
Europe is 500 million potential users, so if you're not privately held, then you also need to explain to stockholders that you intent to leave that market open to competitors. Sure all EU citizens aren't equally wealthy, but a large number of those 500 million are in a lucrative segment. Let's say that Instagram decides that the EU isn't worth the hassle, and leaves. Now competitors have 500 million users to target and build a platform for, without the annoying interference from US based companies. If some is successful under the GDPR, there's no real reason they could easily enter other, less strict markets later, using the profit from their EU business,.
- Spearchucker 8y ago
  The assumption is Pintrest can't be successful in the EU.
- taysic 8y ago
  There are some services that wouldn't exist if it wasn't for targeted advertising. Instagram may have millions of users in the EU but how many would pay for the service? The number that would probably would not be enough to sustain the network effect. And if Instagram users switched to mainly non-targeted advertising, Instagram may find itself not making enough money to sustain its company. While a 'competitor' willing to make less money could show up, their ability to collect / store photos or videos / update the ui / filter out inappropriate content would be decreased if they were barely profitable, making it a less useful service than Instagram was.
roel_v 8y ago
I didn't mean it as 'doom and gloom' - I'm just interested in the economics and management/business aspects of it. Is it possible to turn a company around that has 'ads' woven so deeply in its DNA? Would such a company just give up on a target demographic sized 500mm? What would that do to their valuation and funding? Maybe the answer is 'nothing', I'm not sure - but plenty of companies were punished by the markets the last 15 years for not at least trying to get into Chinese and Indian markets, which are (if you only count the people that can actually buy something) much smaller than the EU, and much harder to break into culturally.
taysic 8y ago
Shrinks profits or destroys their business model (ie apps/games that people wouldn't buy but survive well on targeted advertising)

notimetorelax 8y ago

Hm, that’s interesting. It should be possible for Pinterest to be compliant, e.g. Twitter is compliant. Was there anything specific that caught your eye?

neuland 8y ago
Do you know how Twitter is complying? I'd be interested to hear. In the last month or so, I have started seeing consent interstitials in Tweet embeds on news sites and stuff. They say something to the effect of "Twitter uses analytics to track ..., do you agree?". But, there's only an agree button.
- notimetorelax 8y ago
  Our SaaS consumes Twitter data through GNIP API (company they bought a couple years ago). Twitter was the first data provider to require reviews of all the usage scenarios and they are very serious about enforcing the correct use. Twitter also publishes compliance feed which all downstream services are required to respect. E.g. if a user removes their twit or profile we remove their data from our service. We had to negotiate with other social networks to provide similar functionality.
  - neuland 8y ago
    Wow, that's good to hear that there's a compliance feed. That sounds like exactly what I was talking about in a different thread, where there needs to be a webhook, feed, or some other communication mechanism to disperse deletion requests to processors.
PeterisP 8y ago
It's certainly possible for Pinterest to be compliant if they actually try to be compliant and change their behavior (not only the privacy policy) accordingly. That doesn't mean that they're going to be compliant.
roel_v 8y ago
All from https://policy.pinterest.com/en/privacy-policy https://policy.pinterest.com/en/privacy-policy . - "We collect information in a few different ways: ... 3. Our partners and advertisers share information with us". Unless I have explicitly given those partners and advertisers consent to share that information with pinterest (and specifically with pinterest), I don't think this is compliant. But wait, there's a setting in your profile that you can turn on and off: "Use information from our partners to improve which recommendations and ads you see • Learn more". Note how it doesn't say 'don't collect information on me'. It only says 'don't use information to personalize'. I've read several sections of their website on this, and it's all carefully worded to make sure they never promise not to collect information on you - just that they won't show you what they can do with the information they collect on you. - The section "What we do with the info we collect:" contains the phrase 'legitimate interest' 5 times. This is a desperate attempt to justify themselves using the phrasing of the law. Take this for example: "We also have a legitimate interest to improve Pinterest, maintain our relationship with you, and protect users. We both benefit when we use your information to: Help your friends and contacts find you on Pinterest, if you agree to this in your settings. For example, if you sign up using a Facebook account, we can help your Facebook friends find you on Pinterest when they first sign up for Pinterest. Or, people can search for your account on Pinterest using your email." That's severely stretching 'legitimate interest'. Now you might say 'hey but it says 'if you agree to this in your settings'. Yeah except that in the settings, it says 'Use your Facebook account to log in', it doesn't say anything about slurping up all your Facebook contacts so that they can be spammed with 'hey do you know xyz' when they first log on. Or here: "We have a legitimate interest in delivering ads that are relevant, interesting and personal to you in order to generate revenue (providing this Service is expensive!) To further these interests we use the information we collect to: ". Yeah under that definition of 'legitimate interest', we might as well scrap this whole gdpr thing. 'We have a legitimate interest to use every method we can think of to squeeze every last advertising penny out of your personal data' would at least have been honest. - "Tell our ad partners the types of products you might be interested in. For example, if you create a board dedicated to sneakers, we can tell a retailer that you’re more interested in sneakers than, say, sweaters." Yes well that's the exact thing I do not want. Look, I'm fine with paying for stuff with my personal data - up to a point. But pinterest sending every interest of mine they think they can derive from my activity to anyone who will pay for it - no. OK, let me just go to my profile and turn that off, like all other, trivial features they repeatedly point out can be disabled 'in your profile' - uh what do you know, there's no such setting! Look, maybe it won't turn out as bad as it looks, and maybe the above relies on a strict interpretation of the law that, in practice, will turn to be more... let's say lenient. But reading that 'privacy policy' just feels like being fed a shit sandwich while surrounded by 12 harp-playing angels singing about how delicious it is.

dgellow 8y ago

I would expect Pinterest to focus on the US market.

roel_v 8y ago
They have their products translated into languages that are only spoken in Europe, they know I'm in Europe and show me pins that are relevant to my country, and they work with merchants to show you geo-targeted ads. I mean, spending 51% of your effort on US demographics is technically still 'focusing' I guess - but I don't think it'll be enough to be able to claim that this law doesn't apply to them.

dominotw 8y ago

> but even my blind granny can see they're not. Curious what you see, if you have any examples.

roel_v 8y ago
Have replied to other comment asking the same, above.

hodgesrm 8y ago

Leaving aside questions of business model, many large online services simply don't have an easy way to track from downstream information back to the original source. That will make it almost impossible to implement notifications or "right to be forgotten" in any strict sense. One possible outcome is a new set of businesses designed for GDPR will arise in place of Pinterest and others. That outcome seems to be a not-so-hidden goal of GDPR.

neuland 8y ago
Isn't the burden on the data controller to ensure that they only transmit data to processors that are setup to handle deletion requests? In this case, that'd mean Pintrest or whoever is required to get their advertising partners or API consumers to setup some kind of webhook or feed for deletion requests.
- hodgesrm 8y ago
  It's just not very clear how easy that protocol would be to implement. The problem is siloed data without clear identifiers to track sources. For example, it's common in services like Pinterest to have upstream collectors that feed information into a Kafka pipeline to downstream services that use the data as they see fit. They don't necessarily have consistent identifiers that would allow you to determine that person A's data lives in derived form in services 1, 5, and 14. In the limit you might have to scan all persistent data. It gets much harder once the data leave the company and travel to other online services. Depending on the case law and administrative guidance that develops to interpret GDPR more precisely this problem may be simply unsolvable for some businesses.
  - neuland 8y ago
    I totally agree, re: possibly being unsolvable for some companies. It'll be very interesting to see how the actual enforcement develops. I suspect the regulators want companies to create these kinds of consistent identifiers where they don't already exist and make sure that they ride along with personal data wherever it finds it's way. There's a comment in the article about an oblique reference in an email to "a tall, bald guy living on East Whatever St." being PII and must be included in data subject review/deletion requests. How do you find that, even if you're scanning everywhere? What about users' computers with excel sheets with personal data? That's how reporting is done a lot of places that I know of. You can make them install an agent to scan data or require all data be put in centralized storage like a network share or corporate subscription to a service like dropbox or something. But, I 100% guarantee that Andy from HR or Jane from marketing going to "forget" to do that or put it in some insane format that the scanner can't handle.