29 ms·

Instapaper is temporarily shutting off access for European users due to GDPR

252 points by anotherevan 8y ago

cconstantin 8y ago
I'm sad to see that as I am an avid Instapaper user living in EU. The whole GDPR issue caused a lot of changes and friction, but hopefully that's a good thing on the long term
mstolpm 8y ago
This is a terrible move. They had effectively years to prepare for the GDPR and they already have some sort of rudimentary export and delete options. This step removes all the trust in Instapaper that I had in the past: They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU.
- coddingtonbear 8y ago
  It could also just be liability concerns -- I know I personally considered turning off a (free & gdpr-compliant) side project I maintain out of concern around what might happen to my bank account were a security incident were to occur affecting EU citizens.
- wutbrodo 8y ago
  > They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU. I don't know a ton about GDPR, but the article makes it look like it has less to do with Instapaper (aside from risk tolerance) and more to do with the ambiguity of the law. Some relevant quotes: > it’s more than likely to be the GDPR’s data subject access request, which allows any EU resident to request any and all data collected and stored about them. As The Verge reported yesterday, that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases. > It’s clear that few companies, if any, will be 100 percent compliant when the law goes into effect. But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. So that’s why companies are rushing and, in the case of Instapaper, literally shutting down.
  - djhworld 8y ago
    What...data are they collecting? It's a site that pins articles people have saved, the only piece of user data they should hold would be email address and maybe IP address? Simple to put in policies to expire the IP address data after a reasonable amount of time.
    - bthdonohue 8y ago
      We detail the types of information we collect and how we use the data in our privacy policy here: https://www.instapaper.com/privacy https://www.instapaper.com/privacy
      - dmitriid 8y ago
        If that's the only info you collect, it would take you way less than two years to get compliant with GDPR. So there's something you're not telling.
        deleted 8y ago
        [deleted]
  - TomK32 8y ago
    An email-address to send requests to and someone setting up a process for those requests along with a definition of which data to be returned to the user, all that isn't hard to implement. GDPR has caused some panic that's unnecessary. The violations won't be fined with 4%/€20m (€ not $) right away, there's more steps before that, starting with "a warning in writing in cases of first and non-intentional noncompliance"
    - brownbat 8y ago
      > GDPR has caused some panic that's unnecessary. Maybe some companies have overreacted, but dismissing them feels a bit like blaming the user for bad UX. Couldn't you argue that a law that causes a panicked overreaction was a poorly written law in at least one respect, given that laws have a communicative function? Especially if all these complaints were raised well in advance of the passage of the law, so that the drafters had plenty of warning that several groups were struggling to understand the text?
- dspillett 8y ago
  > effectively years Not quite. LITERALLY years. Two of them. A bit more if they were keeping an eye on the matter while the regulation was being drafted (though I doubt very many were, I know I wasn't).
bthdonohue 8y ago
Hey all – Brian from Instapaper here. We worked really hard to try to avoid a service interruption in the EU, but unfortunately we were unable to. We continue to work hard to ensure that the service interruption is as brief as possible. Let me know if you have any questions...
- deleted 8y ago
  [deleted]
- Angostura 8y ago
  > Let me know if you have any questions... It sounds as if you're unwilling to talk about the issues that you're facing. So what can you say? The only reason I can think of that you can't say is that are trying to get some infrastructure suppliers to be compliant and those talks are confidential. Correct?
  - bthdonohue 8y ago
    The email we sent to EU users (quoted in linked article) has the important details regarding the service interruption in the EU. Additionally, I can say that our privacy policy is concise, clear, and accurate with respect to the types of information we collect and how the data is used: https://www.instapaper.com/privacy https://www.instapaper.com/privacy If you have other specific questions, I will do my best to answer them.
    - yoz-y 8y ago
      Weirdly enough I am an European citizen, haven't received the mail and the service is working. Not complaining, I prefer it this way. Hope you will sort the issues quickly.
      - kingosticks 8y ago
        Me too. And I can see I am definitely subscribed to "account update" emails. I'm not sure how they would decide if I was European or not, can't see a tick box for that in the profile page.
Fradow 8y ago
Obviously, IANAL, but my company talked to a few over the past week. This move is, in my opinion, a bad read on the odds and European culture. First, culture. The goal (at least in France, but that's probably the same in other countries) is to get you in compliance, NOT to fine you. What this means is that before you get lawsuit and fines, someone will talk to you and work with you to see how you can get compliant. Second, the odds. Unless you are a big company that thrives on GDPR violations (doesn't seem to me Instapaper is one, but I could be mistaken as I never used the service), you aren't likely to be targeted before a while, at least until a big case is done and over (let's take the odds Facebook is first). Third, the delay. While the GDPR takes effect tomorrow, you have a grace period of a year for part of it (for example, getting consent for newsletter). I would really be surprised if enforcement start tomorrow. Well, at least that's my read on the situation. And that's how I intend to do it: pro-actively work into getting in compliance without rushing it too much, and handle things properly as they come.
- TomK32 8y ago
  Wikipedia disagrees on the enforcement start and claims that is tomorrow. But I agree with you, the way most interpret the regulation and its sanction is not how Europeans do laws. The "administrative fines up to ..." as you can read in the text http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e6226-1-1 http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... Those high fines are meant for large ill-meaning companies, but the small 2-ppl-SaaS that doesn't report or act on a data breach will get a slap on the wrist and a fine proportionally to their size.
  - Fradow 8y ago
    Actual quote of the GDPR: (171) Directive 95/46/EC should be repealed by this Regulation. Processing already under way on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force. [...] I can't say for sure what's the scope, but I stand by my point that PART of it have a delay to get into conformity.
ahoka 8y ago
Maybe The Verge should sweep around its own door: https://imgur.com/a/0r28SZb https://imgur.com/a/0r28SZb
- merlish 8y ago
  Yes - but never mind the requests, what's up with that "GDPR bar"? Where's the 'No, I do not want you to do this' button?
  - merlish 8y ago
    Ah, never mind! It's a simple 56-step opt out process: https://www.voxmedia.com/pages/cookie-policy#your-cookie-choices-and-how-to-opt-out https://www.voxmedia.com/pages/cookie-policy#your-cookie-cho...
  - deleted 8y ago
    [deleted]
chewz 8y ago
My impression is that Instapaper team is terribly understaffed and probably lost control over it's code base. They had changed hands twice over the years (Betaworks (Digg) 2013 and Pinterest 2016) with practically zero changes in code or the app. Zero progress, zero updates. That says something. And the instapaper.com when downloading is sharing data with third parties like there is no tomorrow. Simply it is downloading a lot of crap from original sites (images etc.) which could be used for tracking - no way they could be compliant with GDPR and let user decide which third parties to share data with.
- raverbashing 8y ago
  "its code base" But yeah, most likely the code is all over the place.
- bthdonohue 8y ago
  Hey – Brian from Instapaper here. I've been at Instapaper since the betaworks acquisition in 2013, so I have a lot of context here. We've made tons of progress since I joined, redesigning the apps, websites, launching highlights, rebooting our business model, text-to-speech, speed reading, re-writing our parser, re-building our full-text search engine. The list goes on. We currently don't have an image proxy for Instapaper, so yes when you visit the site we load the original images. We have discussed adding an image proxy but felt it would be a lot of overhead in server costs and maintenance for minimal value. Additionally, I'm not sure it's fair to represent that fetching images from the original sources that a user saved is tantamount to sharing data with third parties, which has a different set of implications.
  - chewz 8y ago
    Of course, that was just my impression and not really an accusation based on facts. I apologize if I got it wrong. I actually liked it that way, that Instapaper stays the same and reliable while other feels the urge to 'innovate' giving it's loyal users only trouble. Scripts that I have written years ago for uploading articles still work and Instapaper is still my Read-It-Later of choice. As for images - I had to accept that Instapaper works that way - but always had been little annoyed that it is possible to turn off images but that's not persistent option.
rollulus 8y ago
How does shutting down fix GDPR issues? Does all user data magically disappear by shutting down?
- latk 8y ago
  It doesn't. But if you notice you might be doing something illegal, it's a great first step towards compliance to stop doing _more_ of it. Here, Instapaper is likely not misusing user data, but has to catch up on compliance documentation and small details (e.g. signing data processing agreements with services they use, raising the age limit from 13 to 16, …)
  - linker3000 8y ago
    Um, no - The GDPR treats the simple act of storing personal data as 'processing', so turning off the service while still keeping the data resolves nothing. It doesn't even matter if you take the data offline, or temporarily obfuscate it.
    - taysic 8y ago
      But what would you be violating exactly? How could those violations be detected? It seems if the EU is so generous in not wanting to fine and you and walking you through the process, then shutting down would look like a reasonable thing to do if you are still attempting to comply.
      - Hamuko 8y ago
        >How could those violations be detected? You can tip off the regulators if you believe that there is a violation and they will then investigate it. Instapaper is giving a pretty good reason to be suspicious.
        taysic 8y ago
        What would be in violation exactly? Not clear on this. How would regulators investigate? Do they require full access to your database/ backend?
mstolpm 8y ago
Asked a lawyer: If Instapaper doesn't delete the data from its EU users tomorrow, all the rules of the GDPR might still fall on their head. Most likely, they are then storing EU user data without given consent and have to follow all the requests about data storage, use, deletion and so on. Denying service without data deletion is not an option.
- dejv 8y ago
  Also: how they are going to decide who is EU user. GDPR apply to all EU citizens living abroad.
  - bthdonohue 8y ago
    The ban that goes into effect tomorrow will be IP-based for IPs in EU countries.
    - deleted 8y ago
      [deleted]
  - BlackFly 8y ago
    GDPR applies to data processors in the EU or for data subjects in the EU. Citizenship is irrelevant.
    - dejv 8y ago
      It might be not. But those falls into weird space and we will see how things are going to be played out in practice. I still think they have to conform GDPR, especially having prior data on EU users and involvement of parent company.
      - jkaplowitz 8y ago
        There are many unclear things in the GDPR, but the relevance of citizenship is not among them: Nothing in the text of the GDPR or any official guidance mentions citizenship or nationality. The only sources which do mention those are informal and imprecise third-party summaries. But yes, this mistake has been spread widely. The more precise compliance guides from, say, European law firms don't mention citizenship or nationality either.
dejv 8y ago
What are good alternatives to Instapaper? There is Pocket, any other recomendation? Maybe it is also time for somebody to create new app as tiny side apps owned by corporations seems to be sunseted sooner or later.
- tobltobs 8y ago
  Creating new apps has just become more effort, while monetization options have become more difficult.
  - danieldk 8y ago
    So? Profit maximization of the developer is not the only thing that matters, users deserve to be protected as well. Applications have become terrible in this respect. I use Little Snitch and see many paid applications report to Google Analytics. I don’t want the developer to know how often and how I use the application, let alone Google. Technical users know how to use an application firewall, uBlock or uMatrix. But the average user was robbed of their privacy without them even knowing, let alone having any choice. The GDPR finally corrects this.
    - freeone3000 8y ago
      Google Analytics isn't usually used as a revenue stream, but instead for analytics and telemetry.
      - danieldk 8y ago
        One motivation for doing analytics/telemetry is being able to set optimal price points, etc. For example, i f 80% of your user population uses your app daily, it is more attractive to switch to a subscription model than if most people use it very irregularly.
        deleted 8y ago
        [deleted]
Grue3 8y ago
Jesus christ, these cookie warnings are getting out of control. I'm not in EU, stop blocking half of my screen with them!
- nicky0 8y ago
  Those of us in the EU hate them too.
  - drusepth 8y ago
    I wonder why someone hasn't created a browser extension to just automatically accept them, yet.
    - a3_nm 8y ago
      Because AFAIK there's no standard way to identify them because each website comes up with its own design... This is all rather silly, given that the choice to allow/refuse cookies, and the prompt, could have been better implemented at the level of the Web browser...
      - guitarbill 8y ago
        Like Do Not Track (DNT)? Oh, wait, that exists, and almost all companies ignore it.
        a3_nm 8y ago
        The cookie warnings are about refusing cookies, which is something that is completely up to the Web browser. Specifically, Web browsers could warn when a website sets a cookie and ask for user consent before storing it (and if the user does not consent then the website becomes unavailable).
telson 8y ago
They had years to prepare for that. I don't feel comfortable with them not being ready. Time to move to Pocket.
pfg 8y ago
> But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. Can everyone just stop repeating this, pretty please? That is the maximum penalty. You'd have to try really, really hard to get that kind of penalty. For minor transgressions, you're likely to get away with a reprimand.
- cortesoft 8y ago
  I don't think 'likely' is enough to stop concern. You have to act under the assumption that you will get the worst, not just hope that you will get the best.
- freeone3000 8y ago
  Why would a government impose anything other than the maximum?
  - dragonwriter 8y ago
    > Why would a government impose anything other than the maximum? Because it's bound to apply a bunch of other rules in setting penalties by the same regulation that set the maximum cited. Saying that every offense will get the maximum is saying that the government will ignore the regulation, in which case you can just as justifiably say that any behavior, even if it isn't a violation of the rules, will get a fine of €1.337 quintillion, or 1,000% of global combined GDP, whichever is greater. Heck, even ignoring the casd-by-case factors that must be considered, the 4% or €20 million maximum is much greater than the maximum for many violations, there are only certain GDPR violations that have that maximum.
  - marvin 8y ago
    Because the regulation is meant to enforce lawful behavior, not make the government richer. If they break out the maximum penalty for a minor violation, it will obviously stifle business and cause economic harm to the EU. But they do need a credible threat to really punish wilful disregard of the law, for companies that profit from breaking the rules. We see how well it works when the fine costs less than the profits from breaking the rules. The EU is making sure that this will not be the case for the GDPR.
relics443 8y ago
I'm still struggling with the fact that the EU can compel me to add what will be a funnel shattering dialog to my onboarding. I've shelved a bunch of side projects that I was excited to work on because I have no interest in dealing with any of this ambiguous law. Implementing it would most likely cause a large percentage of users to uninstall my app, because who wants to be greeted with a scary sounding dialog as their first experience in an app. I know many folks here are privacy oriented, but unless this tiny slice of the population is willing to fund my app, I have 0 interest in pandering to them vs the majority of users that would get scared away by it. I know that there's an almost 0% chance of any repercussion for not being compliant in a tiny app that'll probably never get anywhere, but I'm just so sickened by this whole thing that I don't want to deal with any of it.
- Symbiote 8y ago
  A significant proportion of the 500 million citizens of the EU are "privacy oriented". If you can't keep our data safe, why should you be trusted with it?
  - relics443 8y ago
    My point is, I have no clue what's collecting data in an improper way, and I'm not going to hire a lawyer for a hobby app. The amount of conflicting information about whether I do or don't need consent based on what services I use is just stupid. And I wouldn't even be showing ads. Part of the apps function is related to location, do I need consent? Maybe. It will use Firebase, do I need consent? Maybe. It will collect crash data so I can debug the stupid thing, do I need consent? Maybe. Etc...
    - hekfu 8y ago
      Welcome to the real world. If your little hobby project leaks the personal information of a real person, then they don't care how much of an unimportant side project it was to you. For purely personal use "hey guys, this is just a hobby use at your own risk" you won't get hit with gdpr Imagine if you were building cars for a hobby then selling them. Would you complain about all of those onerous regulations like seatbelts, crunch zones etc when all zou really want to do is tinker with some cool engine tech?
protomyth 8y ago
A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A?
msh 8y ago
One days notice, pretty shitty treatment of customers.
pmarin 8y ago
that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases. (Granted, companies have had two years to prepare for this.) That is bollocks. The most stupid excuse I have ever read.
mike 8y ago
If anyone is looking to export a list of their saved pages the links for this are on the Settings page: https://www.instapaper.com/user https://www.instapaper.com/user A list of all saved pages in all folders can be downloaded in CSV or HTML.
snissn 8y ago
Cloud flare needs a feature that let's you ban all EU ips
- jarito 8y ago
  They do. You can do that with their WAF (and maybe without it). https://www.cloudflare.com/waf/ https://www.cloudflare.com/waf/
j16sdiz 8y ago
Not-So-Related question: How can I shut off access for European user to my service? Blocking IPs ? Ask if they are European? What if they lie? What if they become European citizen later but fail to notify me?
apazgo 8y ago
For people living outside of EU, this should scare you, Instapaper are unable to take care of your personal data...
ksec 8y ago
Theoretical Question, If I am a startup now and has an global audience, does that means I need to enforce GDPR from the get go? Or are there time limit before I have to comply?
favadi 8y ago
I could not find Instapaper addon for firefox anymore, is it somewhat related to this news?

252 points by anotherevan 8y ago

I'm sad to see that as I am an avid Instapaper user living in EU. The whole GDPR issue caused a lot of changes and friction, but hopefully that's a good thing on the long term

mstolpm 8y ago

This is a terrible move. They had effectively years to prepare for the GDPR and they already have some sort of rudimentary export and delete options. This step removes all the trust in Instapaper that I had in the past: They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU.

coddingtonbear 8y ago
It could also just be liability concerns -- I know I personally considered turning off a (free & gdpr-compliant) side project I maintain out of concern around what might happen to my bank account were a security incident were to occur affecting EU citizens.
wutbrodo 8y ago
> They either are mismanaged or are not willing to tell the users what data they are collecting and how they use and monetize this data. And it should worry all users, not only users from the EU. I don't know a ton about GDPR, but the article makes it look like it has less to do with Instapaper (aside from risk tolerance) and more to do with the ambiguity of the law. Some relevant quotes: > it’s more than likely to be the GDPR’s data subject access request, which allows any EU resident to request any and all data collected and stored about them. As The Verge reported yesterday, that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases. > It’s clear that few companies, if any, will be 100 percent compliant when the law goes into effect. But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. So that’s why companies are rushing and, in the case of Instapaper, literally shutting down.
- djhworld 8y ago
  What...data are they collecting? It's a site that pins articles people have saved, the only piece of user data they should hold would be email address and maybe IP address? Simple to put in policies to expire the IP address data after a reasonable amount of time.
  - bthdonohue 8y ago
    We detail the types of information we collect and how we use the data in our privacy policy here: https://www.instapaper.com/privacy https://www.instapaper.com/privacy
    - dmitriid 8y ago
      If that's the only info you collect, it would take you way less than two years to get compliant with GDPR. So there's something you're not telling.
      - deleted 8y ago
        [deleted]
- TomK32 8y ago
  An email-address to send requests to and someone setting up a process for those requests along with a definition of which data to be returned to the user, all that isn't hard to implement. GDPR has caused some panic that's unnecessary. The violations won't be fined with 4%/€20m (€ not $) right away, there's more steps before that, starting with "a warning in writing in cases of first and non-intentional noncompliance"
  - brownbat 8y ago
    > GDPR has caused some panic that's unnecessary. Maybe some companies have overreacted, but dismissing them feels a bit like blaming the user for bad UX. Couldn't you argue that a law that causes a panicked overreaction was a poorly written law in at least one respect, given that laws have a communicative function? Especially if all these complaints were raised well in advance of the passage of the law, so that the drafters had plenty of warning that several groups were struggling to understand the text?
dspillett 8y ago
> effectively years Not quite. LITERALLY years. Two of them. A bit more if they were keeping an eye on the matter while the regulation was being drafted (though I doubt very many were, I know I wasn't).

bthdonohue 8y ago

Hey all – Brian from Instapaper here. We worked really hard to try to avoid a service interruption in the EU, but unfortunately we were unable to. We continue to work hard to ensure that the service interruption is as brief as possible. Let me know if you have any questions...

deleted 8y ago
[deleted]
Angostura 8y ago
> Let me know if you have any questions... It sounds as if you're unwilling to talk about the issues that you're facing. So what can you say? The only reason I can think of that you can't say is that are trying to get some infrastructure suppliers to be compliant and those talks are confidential. Correct?
- bthdonohue 8y ago
  The email we sent to EU users (quoted in linked article) has the important details regarding the service interruption in the EU. Additionally, I can say that our privacy policy is concise, clear, and accurate with respect to the types of information we collect and how the data is used: https://www.instapaper.com/privacy https://www.instapaper.com/privacy If you have other specific questions, I will do my best to answer them.
  - yoz-y 8y ago
    Weirdly enough I am an European citizen, haven't received the mail and the service is working. Not complaining, I prefer it this way. Hope you will sort the issues quickly.
    - kingosticks 8y ago
      Me too. And I can see I am definitely subscribed to "account update" emails. I'm not sure how they would decide if I was European or not, can't see a tick box for that in the profile page.

Fradow 8y ago

Obviously, IANAL, but my company talked to a few over the past week. This move is, in my opinion, a bad read on the odds and European culture. First, culture. The goal (at least in France, but that's probably the same in other countries) is to get you in compliance, NOT to fine you. What this means is that before you get lawsuit and fines, someone will talk to you and work with you to see how you can get compliant. Second, the odds. Unless you are a big company that thrives on GDPR violations (doesn't seem to me Instapaper is one, but I could be mistaken as I never used the service), you aren't likely to be targeted before a while, at least until a big case is done and over (let's take the odds Facebook is first). Third, the delay. While the GDPR takes effect tomorrow, you have a grace period of a year for part of it (for example, getting consent for newsletter). I would really be surprised if enforcement start tomorrow. Well, at least that's my read on the situation. And that's how I intend to do it: pro-actively work into getting in compliance without rushing it too much, and handle things properly as they come.

TomK32 8y ago
Wikipedia disagrees on the enforcement start and claims that is tomorrow. But I agree with you, the way most interpret the regulation and its sanction is not how Europeans do laws. The "administrative fines up to ..." as you can read in the text http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e6226-1-1 http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE... Those high fines are meant for large ill-meaning companies, but the small 2-ppl-SaaS that doesn't report or act on a data breach will get a slap on the wrist and a fine proportionally to their size.
- Fradow 8y ago
  Actual quote of the GDPR: (171) Directive 95/46/EC should be repealed by this Regulation. Processing already under way on the date of application of this Regulation should be brought into conformity with this Regulation within the period of two years after which this Regulation enters into force. [...] I can't say for sure what's the scope, but I stand by my point that PART of it have a delay to get into conformity.

ahoka 8y ago

Maybe The Verge should sweep around its own door: https://imgur.com/a/0r28SZb https://imgur.com/a/0r28SZb

merlish 8y ago
Yes - but never mind the requests, what's up with that "GDPR bar"? Where's the 'No, I do not want you to do this' button?
- merlish 8y ago
  Ah, never mind! It's a simple 56-step opt out process: https://www.voxmedia.com/pages/cookie-policy#your-cookie-choices-and-how-to-opt-out https://www.voxmedia.com/pages/cookie-policy#your-cookie-cho...
- deleted 8y ago
  [deleted]

chewz 8y ago

My impression is that Instapaper team is terribly understaffed and probably lost control over it's code base. They had changed hands twice over the years (Betaworks (Digg) 2013 and Pinterest 2016) with practically zero changes in code or the app. Zero progress, zero updates. That says something. And the instapaper.com when downloading is sharing data with third parties like there is no tomorrow. Simply it is downloading a lot of crap from original sites (images etc.) which could be used for tracking - no way they could be compliant with GDPR and let user decide which third parties to share data with.

raverbashing 8y ago
"its code base" But yeah, most likely the code is all over the place.
bthdonohue 8y ago
Hey – Brian from Instapaper here. I've been at Instapaper since the betaworks acquisition in 2013, so I have a lot of context here. We've made tons of progress since I joined, redesigning the apps, websites, launching highlights, rebooting our business model, text-to-speech, speed reading, re-writing our parser, re-building our full-text search engine. The list goes on. We currently don't have an image proxy for Instapaper, so yes when you visit the site we load the original images. We have discussed adding an image proxy but felt it would be a lot of overhead in server costs and maintenance for minimal value. Additionally, I'm not sure it's fair to represent that fetching images from the original sources that a user saved is tantamount to sharing data with third parties, which has a different set of implications.
- chewz 8y ago
  Of course, that was just my impression and not really an accusation based on facts. I apologize if I got it wrong. I actually liked it that way, that Instapaper stays the same and reliable while other feels the urge to 'innovate' giving it's loyal users only trouble. Scripts that I have written years ago for uploading articles still work and Instapaper is still my Read-It-Later of choice. As for images - I had to accept that Instapaper works that way - but always had been little annoyed that it is possible to turn off images but that's not persistent option.

rollulus 8y ago

How does shutting down fix GDPR issues? Does all user data magically disappear by shutting down?

latk 8y ago
It doesn't. But if you notice you might be doing something illegal, it's a great first step towards compliance to stop doing _more_ of it. Here, Instapaper is likely not misusing user data, but has to catch up on compliance documentation and small details (e.g. signing data processing agreements with services they use, raising the age limit from 13 to 16, …)
- linker3000 8y ago
  Um, no - The GDPR treats the simple act of storing personal data as 'processing', so turning off the service while still keeping the data resolves nothing. It doesn't even matter if you take the data offline, or temporarily obfuscate it.
  - taysic 8y ago
    But what would you be violating exactly? How could those violations be detected? It seems if the EU is so generous in not wanting to fine and you and walking you through the process, then shutting down would look like a reasonable thing to do if you are still attempting to comply.
    - Hamuko 8y ago
      >How could those violations be detected? You can tip off the regulators if you believe that there is a violation and they will then investigate it. Instapaper is giving a pretty good reason to be suspicious.
      - taysic 8y ago
        What would be in violation exactly? Not clear on this. How would regulators investigate? Do they require full access to your database/ backend?

mstolpm 8y ago

Asked a lawyer: If Instapaper doesn't delete the data from its EU users tomorrow, all the rules of the GDPR might still fall on their head. Most likely, they are then storing EU user data without given consent and have to follow all the requests about data storage, use, deletion and so on. Denying service without data deletion is not an option.

dejv 8y ago
Also: how they are going to decide who is EU user. GDPR apply to all EU citizens living abroad.
- bthdonohue 8y ago
  The ban that goes into effect tomorrow will be IP-based for IPs in EU countries.
  - deleted 8y ago
    [deleted]
- BlackFly 8y ago
  GDPR applies to data processors in the EU or for data subjects in the EU. Citizenship is irrelevant.
  - dejv 8y ago
    It might be not. But those falls into weird space and we will see how things are going to be played out in practice. I still think they have to conform GDPR, especially having prior data on EU users and involvement of parent company.
    - jkaplowitz 8y ago
      There are many unclear things in the GDPR, but the relevance of citizenship is not among them: Nothing in the text of the GDPR or any official guidance mentions citizenship or nationality. The only sources which do mention those are informal and imprecise third-party summaries. But yes, this mistake has been spread widely. The more precise compliance guides from, say, European law firms don't mention citizenship or nationality either.

dejv 8y ago

What are good alternatives to Instapaper? There is Pocket, any other recomendation? Maybe it is also time for somebody to create new app as tiny side apps owned by corporations seems to be sunseted sooner or later.

tobltobs 8y ago
Creating new apps has just become more effort, while monetization options have become more difficult.
- danieldk 8y ago
  So? Profit maximization of the developer is not the only thing that matters, users deserve to be protected as well. Applications have become terrible in this respect. I use Little Snitch and see many paid applications report to Google Analytics. I don’t want the developer to know how often and how I use the application, let alone Google. Technical users know how to use an application firewall, uBlock or uMatrix. But the average user was robbed of their privacy without them even knowing, let alone having any choice. The GDPR finally corrects this.
  - freeone3000 8y ago
    Google Analytics isn't usually used as a revenue stream, but instead for analytics and telemetry.
    - danieldk 8y ago
      One motivation for doing analytics/telemetry is being able to set optimal price points, etc. For example, i f 80% of your user population uses your app daily, it is more attractive to switch to a subscription model than if most people use it very irregularly.
      - deleted 8y ago
        [deleted]

Grue3 8y ago

Jesus christ, these cookie warnings are getting out of control. I'm not in EU, stop blocking half of my screen with them!

nicky0 8y ago
Those of us in the EU hate them too.
- drusepth 8y ago
  I wonder why someone hasn't created a browser extension to just automatically accept them, yet.
  - a3_nm 8y ago
    Because AFAIK there's no standard way to identify them because each website comes up with its own design... This is all rather silly, given that the choice to allow/refuse cookies, and the prompt, could have been better implemented at the level of the Web browser...
    - guitarbill 8y ago
      Like Do Not Track (DNT)? Oh, wait, that exists, and almost all companies ignore it.
      - a3_nm 8y ago
        The cookie warnings are about refusing cookies, which is something that is completely up to the Web browser. Specifically, Web browsers could warn when a website sets a cookie and ask for user consent before storing it (and if the user does not consent then the website becomes unavailable).

telson 8y ago

They had years to prepare for that. I don't feel comfortable with them not being ready. Time to move to Pocket.

pfg 8y ago

> But because the fines are so steep — violating GDPR will cost a company 4 percent of its global turnover or $20 million, whichever is larger — no one really wants to be caught non-compliant. Can everyone just stop repeating this, pretty please? That is the maximum penalty. You'd have to try really, really hard to get that kind of penalty. For minor transgressions, you're likely to get away with a reprimand.

cortesoft 8y ago
I don't think 'likely' is enough to stop concern. You have to act under the assumption that you will get the worst, not just hope that you will get the best.
freeone3000 8y ago
Why would a government impose anything other than the maximum?
- dragonwriter 8y ago
  > Why would a government impose anything other than the maximum? Because it's bound to apply a bunch of other rules in setting penalties by the same regulation that set the maximum cited. Saying that every offense will get the maximum is saying that the government will ignore the regulation, in which case you can just as justifiably say that any behavior, even if it isn't a violation of the rules, will get a fine of €1.337 quintillion, or 1,000% of global combined GDP, whichever is greater. Heck, even ignoring the casd-by-case factors that must be considered, the 4% or €20 million maximum is much greater than the maximum for many violations, there are only certain GDPR violations that have that maximum.
- marvin 8y ago
  Because the regulation is meant to enforce lawful behavior, not make the government richer. If they break out the maximum penalty for a minor violation, it will obviously stifle business and cause economic harm to the EU. But they do need a credible threat to really punish wilful disregard of the law, for companies that profit from breaking the rules. We see how well it works when the fine costs less than the profits from breaking the rules. The EU is making sure that this will not be the case for the GDPR.

relics443 8y ago

I'm still struggling with the fact that the EU can compel me to add what will be a funnel shattering dialog to my onboarding. I've shelved a bunch of side projects that I was excited to work on because I have no interest in dealing with any of this ambiguous law. Implementing it would most likely cause a large percentage of users to uninstall my app, because who wants to be greeted with a scary sounding dialog as their first experience in an app. I know many folks here are privacy oriented, but unless this tiny slice of the population is willing to fund my app, I have 0 interest in pandering to them vs the majority of users that would get scared away by it. I know that there's an almost 0% chance of any repercussion for not being compliant in a tiny app that'll probably never get anywhere, but I'm just so sickened by this whole thing that I don't want to deal with any of it.

Symbiote 8y ago
A significant proportion of the 500 million citizens of the EU are "privacy oriented". If you can't keep our data safe, why should you be trusted with it?
- relics443 8y ago
  My point is, I have no clue what's collecting data in an improper way, and I'm not going to hire a lawyer for a hobby app. The amount of conflicting information about whether I do or don't need consent based on what services I use is just stupid. And I wouldn't even be showing ads. Part of the apps function is related to location, do I need consent? Maybe. It will use Firebase, do I need consent? Maybe. It will collect crash data so I can debug the stupid thing, do I need consent? Maybe. Etc...
  - hekfu 8y ago
    Welcome to the real world. If your little hobby project leaks the personal information of a real person, then they don't care how much of an unimportant side project it was to you. For purely personal use "hey guys, this is just a hobby use at your own risk" you won't get hit with gdpr Imagine if you were building cars for a hobby then selling them. Would you complain about all of those onerous regulations like seatbelts, crunch zones etc when all zou really want to do is tinker with some cool engine tech?

protomyth 8y ago

A general question for the GDPR experts: If user A does a request of their data and user B added a page their Instapaper account that had user A listed, does that page have to be included in the response to user A?

msh 8y ago

One days notice, pretty shitty treatment of customers.

pmarin 8y ago

that’s causing companies trouble because it’s not entirely clear right now what information residents will request, what format that information needs to be in, how to locate it and package it, and whether new infrastructure needs to be created to manage this request pipeline. Personal info is a somewhat nebulous concept, and the fact that experts are describing the GDPR as “staggeringly complex” is not making it easy to cover all the bases. (Granted, companies have had two years to prepare for this.) That is bollocks. The most stupid excuse I have ever read.

mike 8y ago

If anyone is looking to export a list of their saved pages the links for this are on the Settings page: https://www.instapaper.com/user https://www.instapaper.com/user A list of all saved pages in all folders can be downloaded in CSV or HTML.

snissn 8y ago

Cloud flare needs a feature that let's you ban all EU ips

jarito 8y ago
They do. You can do that with their WAF (and maybe without it). https://www.cloudflare.com/waf/ https://www.cloudflare.com/waf/

j16sdiz 8y ago

Not-So-Related question: How can I shut off access for European user to my service? Blocking IPs ? Ask if they are European? What if they lie? What if they become European citizen later but fail to notify me?

apazgo 8y ago

For people living outside of EU, this should scare you, Instapaper are unable to take care of your personal data...

ksec 8y ago

Theoretical Question, If I am a startup now and has an global audience, does that means I need to enforce GDPR from the get go? Or are there time limit before I have to comply?

favadi 8y ago

I could not find Instapaper addon for firefox anymore, is it somewhat related to this news?