4 ms·

Hm, that’s interesting. It should be possible for Pinterest to be compliant, e.g. Twitter is compliant. Was there anything specific that caught your eye?

neuland 8y ago
Do you know how Twitter is complying? I'd be interested to hear. In the last month or so, I have started seeing consent interstitials in Tweet embeds on news sites and stuff. They say something to the effect of "Twitter uses analytics to track ..., do you agree?". But, there's only an agree button.
- notimetorelax 8y ago
  Our SaaS consumes Twitter data through GNIP API (company they bought a couple years ago). Twitter was the first data provider to require reviews of all the usage scenarios and they are very serious about enforcing the correct use. Twitter also publishes compliance feed which all downstream services are required to respect. E.g. if a user removes their twit or profile we remove their data from our service. We had to negotiate with other social networks to provide similar functionality.
  - neuland 8y ago
    Wow, that's good to hear that there's a compliance feed. That sounds like exactly what I was talking about in a different thread, where there needs to be a webhook, feed, or some other communication mechanism to disperse deletion requests to processors.
PeterisP 8y ago
It's certainly possible for Pinterest to be compliant if they actually try to be compliant and change their behavior (not only the privacy policy) accordingly. That doesn't mean that they're going to be compliant.
roel_v 8y ago
All from https://policy.pinterest.com/en/privacy-policy https://policy.pinterest.com/en/privacy-policy . - "We collect information in a few different ways: ... 3. Our partners and advertisers share information with us". Unless I have explicitly given those partners and advertisers consent to share that information with pinterest (and specifically with pinterest), I don't think this is compliant. But wait, there's a setting in your profile that you can turn on and off: "Use information from our partners to improve which recommendations and ads you see • Learn more". Note how it doesn't say 'don't collect information on me'. It only says 'don't use information to personalize'. I've read several sections of their website on this, and it's all carefully worded to make sure they never promise not to collect information on you - just that they won't show you what they can do with the information they collect on you. - The section "What we do with the info we collect:" contains the phrase 'legitimate interest' 5 times. This is a desperate attempt to justify themselves using the phrasing of the law. Take this for example: "We also have a legitimate interest to improve Pinterest, maintain our relationship with you, and protect users. We both benefit when we use your information to: Help your friends and contacts find you on Pinterest, if you agree to this in your settings. For example, if you sign up using a Facebook account, we can help your Facebook friends find you on Pinterest when they first sign up for Pinterest. Or, people can search for your account on Pinterest using your email." That's severely stretching 'legitimate interest'. Now you might say 'hey but it says 'if you agree to this in your settings'. Yeah except that in the settings, it says 'Use your Facebook account to log in', it doesn't say anything about slurping up all your Facebook contacts so that they can be spammed with 'hey do you know xyz' when they first log on. Or here: "We have a legitimate interest in delivering ads that are relevant, interesting and personal to you in order to generate revenue (providing this Service is expensive!) To further these interests we use the information we collect to: ". Yeah under that definition of 'legitimate interest', we might as well scrap this whole gdpr thing. 'We have a legitimate interest to use every method we can think of to squeeze every last advertising penny out of your personal data' would at least have been honest. - "Tell our ad partners the types of products you might be interested in. For example, if you create a board dedicated to sneakers, we can tell a retailer that you’re more interested in sneakers than, say, sweaters." Yes well that's the exact thing I do not want. Look, I'm fine with paying for stuff with my personal data - up to a point. But pinterest sending every interest of mine they think they can derive from my activity to anyone who will pay for it - no. OK, let me just go to my profile and turn that off, like all other, trivial features they repeatedly point out can be disabled 'in your profile' - uh what do you know, there's no such setting! Look, maybe it won't turn out as bad as it looks, and maybe the above relies on a strict interpretation of the law that, in practice, will turn to be more... let's say lenient. But reading that 'privacy policy' just feels like being fed a shit sandwich while surrounded by 12 harp-playing angels singing about how delicious it is.

neuland 8y ago

Do you know how Twitter is complying? I'd be interested to hear. In the last month or so, I have started seeing consent interstitials in Tweet embeds on news sites and stuff. They say something to the effect of "Twitter uses analytics to track ..., do you agree?". But, there's only an agree button.

notimetorelax 8y ago
Our SaaS consumes Twitter data through GNIP API (company they bought a couple years ago). Twitter was the first data provider to require reviews of all the usage scenarios and they are very serious about enforcing the correct use. Twitter also publishes compliance feed which all downstream services are required to respect. E.g. if a user removes their twit or profile we remove their data from our service. We had to negotiate with other social networks to provide similar functionality.
- neuland 8y ago
  Wow, that's good to hear that there's a compliance feed. That sounds like exactly what I was talking about in a different thread, where there needs to be a webhook, feed, or some other communication mechanism to disperse deletion requests to processors.

PeterisP 8y ago

It's certainly possible for Pinterest to be compliant if they actually try to be compliant and change their behavior (not only the privacy policy) accordingly. That doesn't mean that they're going to be compliant.

roel_v 8y ago

All from https://policy.pinterest.com/en/privacy-policy https://policy.pinterest.com/en/privacy-policy . - "We collect information in a few different ways: ... 3. Our partners and advertisers share information with us". Unless I have explicitly given those partners and advertisers consent to share that information with pinterest (and specifically with pinterest), I don't think this is compliant. But wait, there's a setting in your profile that you can turn on and off: "Use information from our partners to improve which recommendations and ads you see • Learn more". Note how it doesn't say 'don't collect information on me'. It only says 'don't use information to personalize'. I've read several sections of their website on this, and it's all carefully worded to make sure they never promise not to collect information on you - just that they won't show you what they can do with the information they collect on you. - The section "What we do with the info we collect:" contains the phrase 'legitimate interest' 5 times. This is a desperate attempt to justify themselves using the phrasing of the law. Take this for example: "We also have a legitimate interest to improve Pinterest, maintain our relationship with you, and protect users. We both benefit when we use your information to: Help your friends and contacts find you on Pinterest, if you agree to this in your settings. For example, if you sign up using a Facebook account, we can help your Facebook friends find you on Pinterest when they first sign up for Pinterest. Or, people can search for your account on Pinterest using your email." That's severely stretching 'legitimate interest'. Now you might say 'hey but it says 'if you agree to this in your settings'. Yeah except that in the settings, it says 'Use your Facebook account to log in', it doesn't say anything about slurping up all your Facebook contacts so that they can be spammed with 'hey do you know xyz' when they first log on. Or here: "We have a legitimate interest in delivering ads that are relevant, interesting and personal to you in order to generate revenue (providing this Service is expensive!) To further these interests we use the information we collect to: ". Yeah under that definition of 'legitimate interest', we might as well scrap this whole gdpr thing. 'We have a legitimate interest to use every method we can think of to squeeze every last advertising penny out of your personal data' would at least have been honest. - "Tell our ad partners the types of products you might be interested in. For example, if you create a board dedicated to sneakers, we can tell a retailer that you’re more interested in sneakers than, say, sweaters." Yes well that's the exact thing I do not want. Look, I'm fine with paying for stuff with my personal data - up to a point. But pinterest sending every interest of mine they think they can derive from my activity to anyone who will pay for it - no. OK, let me just go to my profile and turn that off, like all other, trivial features they repeatedly point out can be disabled 'in your profile' - uh what do you know, there's no such setting! Look, maybe it won't turn out as bad as it looks, and maybe the above relies on a strict interpretation of the law that, in practice, will turn to be more... let's say lenient. But reading that 'privacy policy' just feels like being fed a shit sandwich while surrounded by 12 harp-playing angels singing about how delicious it is.