9 ms·

Not a single "news" article I can find links to the actual text of the bill. Here it is: https://www.scribd.com/document/405606873/Detour-Act-Final https://

by sbov 8y ago

Not a single "news" article I can find links to the actual text of the bill. Here it is: https://www.scribd.com/document/405606873/Detour-Act-Final https://www.scribd.com/document/405606873/Detour-Act-Final

jjcm 8y ago
Thank you, was the first thing I looked for. While the intention of the bill seems good, I worry that this will become the next cookie popup. From the text of the bill: "Any large online operator that engages in any form of behavioral or psychological research based on the activity or data of its users shall disclose to its users on a routine basis, but not less than once each 90 days, any experiments or studies that user was subjected to or enrolled in" Based on their definitions of behavioral research, simple analytics would fall under the purview. This means that every site that has over 100m MAU will have to have a popup disclosing that they're running analytics and A/B testing (because honestly this won't stop any of them from doing it - these things are industry standards). I don't need to be informed that Facebook tracks what links I click on their site. I don't need google to tell me that they have a history of every search I've made, and that they tailored those results based on my past searches. We're trying to create a safe space web at the detriment of UX. I support a lot of the stuff around younger kids, but I think the stuff for adults is just going to become a nuisance.
- awinder 8y ago
  Given historical relevance it’s hard to imagine a time when someone would make a comment like “Regulations on human psychological experiments, what are we, a bunch of delicate flowers?!” But I have a hard time believing it would be seriously novel to conflate what goes on online with group psychological experiments. I’m not sure which side of the debate I would land on, but I do think it’s a reasonable enough thing for a deliberative body to consider, and certainly reasonable enough for a healthy debate without trying to sandbag it as “safe space”
  - gradys 8y ago
    Framing it as "human psychological experiments" evokes famous psych experiments like the marshmallow test and the Stanford Prison Experiment. Tech companies run these kinds of experiments occasionally (I believe Facebook is known to have tried to manipulate mood with a Newsfeed change), but I feel like this way of describing it masks the fact that 99% of large scale A/B tests are things like - We slightly changed the color of the submit button - The forward button was removed from the context menu on chat bubbles - An infrastructure change reduces the load time of the comments on articles by 10ms - The weekly ad relevance model update is being certified, yielding a 0.000001 increase in CTR for small segments of the market. On average, much more mundane than "human psychological experiments".
    - slavik81 8y ago
      In academia, those sorts of tests would still need to be approved by the human experimentation ethics board. There are no exceptions for trivial tests.
      - AnthonyMouse 8y ago
        > In academia, those sorts of tests would still need to be approved by the human experimentation ethics board. There are no exceptions for trivial tests. That's the point. It's like requiring a report to be filed whenever there is a "use of force" but then applying that rule using the Newtonian definition of force. Sat in your chair? File a report. Stand back up? File a report. Filed a report? File a report. Worse, this kind of thing can happen retroactively. If you discover that your numbers are different than expected, but you hadn't declared any experiment, comparing what changed before and after is the experiment. But you hadn't notified those users that you were doing an experiment because you hadn't expected to have any reason to, so now you can't even have the people with the before and after data communicate with the people who know what changes were made to the system in that time frame because comparing that information would constitute doing the experiment. It's like telling a car company they can't see their sales data when deciding which models to continue producing because it would constitute doing a psychological experiment on what kind of cars people like. (On the other hand, it sounds like the law would only apply to entities the size of Facebook, and screw those guys in general. But it really is kind of a silly rule.)
- arrosenberg 8y ago
  A simple disclosure, akin to the GDPR disclosure, doesn't seem unreasonable. Meatspace psychological tests would require informed consent and IRB approval. I agree that a more nuanced definition of what requires disclosure would be preferable (e.g. link tracking and testing button colors seems benign, messing with peoples moods with different content algorithms is not).
  - Mirioron 8y ago
    GDPR disclosure is atrocious. We literally legislated pop ups back into websites and mandated that they basically exist. I'd rather they not ask me anything and just assume consent. It's not like EU legislation is going to stop a Chinese company anyway.
    - jfk13 8y ago
      Assume consent...for what, exactly? To note which links on their site you clicked, and which you ignored - OK, that may be reasonable. To share/sell that information to a multitude of other businesses, most of which you've never heard of? I'm not so sure. To follow your activity across the rest of the internet for the following month, and sell access to that data? No thanks.
      - chr1 8y ago
        When you see a popup about cookies on a site, what do you do? Read the agreement, close the site, or just click "Allow"? Absolute majority of people simply click "Allow". But even for the people who want to read the agreement, it would be much better if this was implemented as a browser feature, giving users control and consistency, instead of different popups on each site.
        jfk13 8y ago
        If I get a popup just saying that a site uses cookies, I may well allow it (knowing that my browser will clear the cookies when I close my incognito session, perhaps). If I get a popup listing various kinds of data collection that the site wants to do, and lists of "trusted partners" it will be shared with, etc., I generally refuse everything except "essential". If the site's idea of what is "essential" sounds excessive compared to the use I expect to make of it (just how much tracking is reasonably required in order to read an article?), I simply won't use it. And if it makes the process of refusing consent particularly opaque or cumbersome (in violation of GDPR requirements), I certainly won't trust or use the site at all (I'm looking at you, Oath...)
- pcmaffey 8y ago
  Does this apply then to telcoms too I wonder?
- deleted 8y ago
  [deleted]
- chr1 8y ago
  Disclose here should not mean opening a popup, it should be a separate page where user can see what data have been collected and what did the algorithm decide based on that data. Similarly GDPR should have been about a requirement to provide s page listing all of the user data, not about endless popups on every site asking to accept cookies. If i use a browser that supports cookies then i already accept them.
  - chr1 8y ago
    I wonder why people disagree with this, do people think that a popup is better than a settings page where user can see what data was gathered and how it was used, or my point about accepting cookies being a browser feature, seemed to some as an attack on privacy in general?
- tehjoker 8y ago
  I think the hope is more along the lines that they'll have to tell you if they are running something like the emotional contagion study. https://www.forbes.com/sites/gregorymcneal/2014/06/28/facebook-manipulated-user-news-feeds-to-create-emotional-contagion/#3c42c6f939dc https://www.forbes.com/sites/gregorymcneal/2014/06/28/facebo... https://www.theatlantic.com/technology/archive/2014/06/everything-we-know-about-facebooks-secret-mood-manipulation-experiment/373648/ https://www.theatlantic.com/technology/archive/2014/06/every...
  - nordsieck 8y ago
    The text of the law is what matters, and it's pretty clear that > Any large online operator that engages in any form of behavioral or psychological research based on the activity or data of its users shall disclose to its users on a routine basis ... any experiments or studies that user was subjected to or enrolled in means that every A/B test needs to be disclosed.
    - isoskeles 8y ago
      No. Not every A/B test. > (6) LARGE ONLINE OPERATOR > The term "large online operator" means any person that— > (A) provides an online service; > (B) has more than 100,000,000 authenticated users of an online service in any 30 day period; and > (C) is subject to the jurisdiction of the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.). Presumably there are definitions of other terms in that sentence (e.g. experiments, studies). Here, it is: > BEHAVIORAL OR PSYCHOLOGICAL EXPERIMENTS OR RESEARCH— > The term "behavioral or psychological experiments or research" means the study, including through human experimentation, of overt or observable actions and mental phenomena inferred from behavior, including interactions between and among individuals and the activities of social groups. Honestly, I don't think this is clear enough. Person clicks BLUE instead of GREEN may or may not fall under this definition. I don't think it should, but if I have 100M+ authenticated users per month, I'm probably going to put up a notice anyway.
      - nordsieck 8y ago
        > Honestly, I don't think this is clear enough. Person clicks BLUE instead of GREEN may or may not fall under this definition. I don't think it should, but if I have 100M+ authenticated users per month, I'm probably going to put up a notice anyway. I'm not sure why you think an A/B test is not covered by > the study ... of overt or observable actions and mental phenomena inferred from behavior but it seem to me to be the very thing targeted by this legislation. I agree that the end result: Google disclosing 100k A/B tests each quarter is a grotesque tax on private industry without any social gain. However, it doesn't strike me as terribly out of line from other legislation in its effect.
- sushisushisushi 8y ago
  Popup or not, I think you're overestimating the average user's familiarity with these concepts.
- zby 8y ago
  A/B testing is usually trivial and the disclosure will be trivial too. It does not need to be any burden to the readers (like a popup), and with a good tooling (and A/B testing requires tooling) it will not add much work to the developers too. It might be just automatically recorded in a public log. From time to time there will be something more interesting in that log and that will be the task of the media to analyse the logs and discover the interesting stuff. The disclosure just makes this work easier.
- Mirioron 8y ago
  At least this has a reasonable lower limit, so it doesn't screw over small platforms.
- prolikewhoa 8y ago
  This is not "psychological research", the research has already been done to get the human to fall for it. The dark patterns are designed to sell advertisement and product. Framing it as simply "psychological research" is what I'd expect from a PR team trying to deceive its users.
- prolikewhoa 8y ago
  This is not "psychological research", the research has already been done to get the human to fall for it. The dark patterns are designed to sell advertisement and product. Framing it as simply "psychological research" is what I'd expect from a PR team trying to deceive its users. It's incredibly dishonest.
ShorsHammer 8y ago
Why is law so inaccessible? I've always thought about trying to scrape government websites for law changes and drafts, shift them onto github and give the respective politicians clearly labelled pseudo accounts in an organisation in which they all vote on pull requests.
- beauzero 8y ago
  If you take a look at different states online legislation you will see the level of tech is very poor. I would say it's around 2000-2001 standards even if the platforms are newer.

by sbov 8y ago

jjcm 8y ago

Thank you, was the first thing I looked for. While the intention of the bill seems good, I worry that this will become the next cookie popup. From the text of the bill: "Any large online operator that engages in any form of behavioral or psychological research based on the activity or data of its users shall disclose to its users on a routine basis, but not less than once each 90 days, any experiments or studies that user was subjected to or enrolled in" Based on their definitions of behavioral research, simple analytics would fall under the purview. This means that every site that has over 100m MAU will have to have a popup disclosing that they're running analytics and A/B testing (because honestly this won't stop any of them from doing it - these things are industry standards). I don't need to be informed that Facebook tracks what links I click on their site. I don't need google to tell me that they have a history of every search I've made, and that they tailored those results based on my past searches. We're trying to create a safe space web at the detriment of UX. I support a lot of the stuff around younger kids, but I think the stuff for adults is just going to become a nuisance.

awinder 8y ago
Given historical relevance it’s hard to imagine a time when someone would make a comment like “Regulations on human psychological experiments, what are we, a bunch of delicate flowers?!” But I have a hard time believing it would be seriously novel to conflate what goes on online with group psychological experiments. I’m not sure which side of the debate I would land on, but I do think it’s a reasonable enough thing for a deliberative body to consider, and certainly reasonable enough for a healthy debate without trying to sandbag it as “safe space”
- gradys 8y ago
  Framing it as "human psychological experiments" evokes famous psych experiments like the marshmallow test and the Stanford Prison Experiment. Tech companies run these kinds of experiments occasionally (I believe Facebook is known to have tried to manipulate mood with a Newsfeed change), but I feel like this way of describing it masks the fact that 99% of large scale A/B tests are things like - We slightly changed the color of the submit button - The forward button was removed from the context menu on chat bubbles - An infrastructure change reduces the load time of the comments on articles by 10ms - The weekly ad relevance model update is being certified, yielding a 0.000001 increase in CTR for small segments of the market. On average, much more mundane than "human psychological experiments".
  - slavik81 8y ago
    In academia, those sorts of tests would still need to be approved by the human experimentation ethics board. There are no exceptions for trivial tests.
    - AnthonyMouse 8y ago
      > In academia, those sorts of tests would still need to be approved by the human experimentation ethics board. There are no exceptions for trivial tests. That's the point. It's like requiring a report to be filed whenever there is a "use of force" but then applying that rule using the Newtonian definition of force. Sat in your chair? File a report. Stand back up? File a report. Filed a report? File a report. Worse, this kind of thing can happen retroactively. If you discover that your numbers are different than expected, but you hadn't declared any experiment, comparing what changed before and after is the experiment. But you hadn't notified those users that you were doing an experiment because you hadn't expected to have any reason to, so now you can't even have the people with the before and after data communicate with the people who know what changes were made to the system in that time frame because comparing that information would constitute doing the experiment. It's like telling a car company they can't see their sales data when deciding which models to continue producing because it would constitute doing a psychological experiment on what kind of cars people like. (On the other hand, it sounds like the law would only apply to entities the size of Facebook, and screw those guys in general. But it really is kind of a silly rule.)
arrosenberg 8y ago
A simple disclosure, akin to the GDPR disclosure, doesn't seem unreasonable. Meatspace psychological tests would require informed consent and IRB approval. I agree that a more nuanced definition of what requires disclosure would be preferable (e.g. link tracking and testing button colors seems benign, messing with peoples moods with different content algorithms is not).
- Mirioron 8y ago
  GDPR disclosure is atrocious. We literally legislated pop ups back into websites and mandated that they basically exist. I'd rather they not ask me anything and just assume consent. It's not like EU legislation is going to stop a Chinese company anyway.
  - jfk13 8y ago
    Assume consent...for what, exactly? To note which links on their site you clicked, and which you ignored - OK, that may be reasonable. To share/sell that information to a multitude of other businesses, most of which you've never heard of? I'm not so sure. To follow your activity across the rest of the internet for the following month, and sell access to that data? No thanks.
    - chr1 8y ago
      When you see a popup about cookies on a site, what do you do? Read the agreement, close the site, or just click "Allow"? Absolute majority of people simply click "Allow". But even for the people who want to read the agreement, it would be much better if this was implemented as a browser feature, giving users control and consistency, instead of different popups on each site.
      - jfk13 8y ago
        If I get a popup just saying that a site uses cookies, I may well allow it (knowing that my browser will clear the cookies when I close my incognito session, perhaps). If I get a popup listing various kinds of data collection that the site wants to do, and lists of "trusted partners" it will be shared with, etc., I generally refuse everything except "essential". If the site's idea of what is "essential" sounds excessive compared to the use I expect to make of it (just how much tracking is reasonably required in order to read an article?), I simply won't use it. And if it makes the process of refusing consent particularly opaque or cumbersome (in violation of GDPR requirements), I certainly won't trust or use the site at all (I'm looking at you, Oath...)
pcmaffey 8y ago
Does this apply then to telcoms too I wonder?
deleted 8y ago
[deleted]
chr1 8y ago
Disclose here should not mean opening a popup, it should be a separate page where user can see what data have been collected and what did the algorithm decide based on that data. Similarly GDPR should have been about a requirement to provide s page listing all of the user data, not about endless popups on every site asking to accept cookies. If i use a browser that supports cookies then i already accept them.
- chr1 8y ago
  I wonder why people disagree with this, do people think that a popup is better than a settings page where user can see what data was gathered and how it was used, or my point about accepting cookies being a browser feature, seemed to some as an attack on privacy in general?
tehjoker 8y ago
I think the hope is more along the lines that they'll have to tell you if they are running something like the emotional contagion study. https://www.forbes.com/sites/gregorymcneal/2014/06/28/facebook-manipulated-user-news-feeds-to-create-emotional-contagion/#3c42c6f939dc https://www.forbes.com/sites/gregorymcneal/2014/06/28/facebo... https://www.theatlantic.com/technology/archive/2014/06/everything-we-know-about-facebooks-secret-mood-manipulation-experiment/373648/ https://www.theatlantic.com/technology/archive/2014/06/every...
- nordsieck 8y ago
  The text of the law is what matters, and it's pretty clear that > Any large online operator that engages in any form of behavioral or psychological research based on the activity or data of its users shall disclose to its users on a routine basis ... any experiments or studies that user was subjected to or enrolled in means that every A/B test needs to be disclosed.
  - isoskeles 8y ago
    No. Not every A/B test. > (6) LARGE ONLINE OPERATOR > The term "large online operator" means any person that— > (A) provides an online service; > (B) has more than 100,000,000 authenticated users of an online service in any 30 day period; and > (C) is subject to the jurisdiction of the Commission under the Federal Trade Commission Act (15 U.S.C. 41 et seq.). Presumably there are definitions of other terms in that sentence (e.g. experiments, studies). Here, it is: > BEHAVIORAL OR PSYCHOLOGICAL EXPERIMENTS OR RESEARCH— > The term "behavioral or psychological experiments or research" means the study, including through human experimentation, of overt or observable actions and mental phenomena inferred from behavior, including interactions between and among individuals and the activities of social groups. Honestly, I don't think this is clear enough. Person clicks BLUE instead of GREEN may or may not fall under this definition. I don't think it should, but if I have 100M+ authenticated users per month, I'm probably going to put up a notice anyway.
    - nordsieck 8y ago
      > Honestly, I don't think this is clear enough. Person clicks BLUE instead of GREEN may or may not fall under this definition. I don't think it should, but if I have 100M+ authenticated users per month, I'm probably going to put up a notice anyway. I'm not sure why you think an A/B test is not covered by > the study ... of overt or observable actions and mental phenomena inferred from behavior but it seem to me to be the very thing targeted by this legislation. I agree that the end result: Google disclosing 100k A/B tests each quarter is a grotesque tax on private industry without any social gain. However, it doesn't strike me as terribly out of line from other legislation in its effect.
sushisushisushi 8y ago
Popup or not, I think you're overestimating the average user's familiarity with these concepts.
zby 8y ago
A/B testing is usually trivial and the disclosure will be trivial too. It does not need to be any burden to the readers (like a popup), and with a good tooling (and A/B testing requires tooling) it will not add much work to the developers too. It might be just automatically recorded in a public log. From time to time there will be something more interesting in that log and that will be the task of the media to analyse the logs and discover the interesting stuff. The disclosure just makes this work easier.
Mirioron 8y ago
At least this has a reasonable lower limit, so it doesn't screw over small platforms.
prolikewhoa 8y ago
This is not "psychological research", the research has already been done to get the human to fall for it. The dark patterns are designed to sell advertisement and product. Framing it as simply "psychological research" is what I'd expect from a PR team trying to deceive its users.
prolikewhoa 8y ago
This is not "psychological research", the research has already been done to get the human to fall for it. The dark patterns are designed to sell advertisement and product. Framing it as simply "psychological research" is what I'd expect from a PR team trying to deceive its users. It's incredibly dishonest.

ShorsHammer 8y ago

Why is law so inaccessible? I've always thought about trying to scrape government websites for law changes and drafts, shift them onto github and give the respective politicians clearly labelled pseudo accounts in an organisation in which they all vote on pull requests.

beauzero 8y ago
If you take a look at different states online legislation you will see the level of tech is very poor. I would say it's around 2000-2001 standards even if the platforms are newer.