19 ms·

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/la

• hkai 7y ago
  If you favor an idea that a private company should be compelled to provide a service for free, even if you don't share your data, would you also agree to the idea that a private company should be compelled to respect freedom of speech on their platform even if they don't benefit from it?
• jakelazaroff 7y ago
  I am on board with this law, but I’m curious how these two points will shake out: > - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. > - Businesses can, however, offer “financial incentives” for being allowed to collect data. Seems to me that it’s a distinction without a difference. Is there something I’m missing?
  • danaris 7y ago
    It sounds like this means it'll have to be clearly disclosed up front as a bonus, rather than being charged after the fact as a penalty and hidden somewhere in the ToS.
  • danharaj 7y ago
    Maybe something like the advertised price of the service must be the price without data collection.
  • jtchang 7y ago
    It's all about marketing and perception. See how credit card companies set rules regarding surcharges and cash. Before credit card companies tried to prevent a discount being offered if a customer paid cash as stipulation for taking credit cards. Durbin Act of 2010 changed that which made it legal in all 50 states.
    • jedberg 7y ago
      > Durbin Act of 2010 changed that Ah! I was always saying I'm surprised by the brazenness of gas stations to offer cash discounts in violation of their credit processing agreements. Today I learned that as of 2010 the law protects them. Thanks!
      • paulmd 7y ago
        The gimmick has always been that you can't charge more for using a credit card, but you can offer a cash discount. So basically you just have to advertise the credit card price rather than it being a surprise fee added on at the last second. Which makes sense, most other countries actually roll sales tax and others into the advertised prices, and what you see is what you'll pay out the door.
        • jedberg 7y ago
          Right, but before 2010 the credit processing agreements could (and always did) include language that you could not offer a different price to credit customers and cash customers, discount or not. Otherwise you would lose your ability to accept credit cards. Some places would still offer a cash discount and assume they wouldn't get caught, but most places didn't risk it.
  • kelnos 7y ago
    It might be a matter of semantics? You can quote a standard price, and then give a discount for allowing data collection, but you can't quote a standard price, and then add a surcharge for disallowing data collection. I agree that there is no practical difference between the two, but given how deceptive companies can be when disclosing various pricing and hidden fees, this might be an attempt to curb that behavior?
    • nabnob 7y ago
      There's definitely a difference in outcomes between 1) allowing customers to opt-in to data collection by giving a them reward. In this case, the default behavior does not involve data collection 2) allowing customers to opt out of data collection by paying a penalty. In this case, the default behavior involves data collection. People usually don't bother to opt out.
  • moosey 7y ago
    The way I'm guessing that will be clarified is that if you are charging for your product, you cannot offer a lower price point for allowing data collection. This will probably boil down to professional, paid for services, being allowed to collect only a small amount of information, and what is strictly needed. The second line would allow companies to pay people to permit them to collect information. I imagine that because of the first statement, a company that is charging for the service cannot take advantage of this statement.
  • jassmith87 7y ago
    Its intended to fuck over Facebook. If you're charging for a service you can simply offer a discount for allowing data collection after bumping prices for everyone by the same amount, Facebook however isn't charging. Facebook can't offer a discount on free, and they can't just force only users who opt-out to go pay (because that falls afoul of the first quote you put). Basically this puts Facebook in a real tight situation, I honestly wonder how they will survive it.
    • StavrosK 7y ago
      They can start charging everyone and offer a "data-share discount" back to free.
      • mattnewton 7y ago
        They would survive but I imagine that would either cause enourmous sign-up friction, or if they hide it too well, might run afoul of the law?
        • StavrosK 7y ago
          Yeah, it would not go well for them for sure.
    • taurath 7y ago
      Opt-out for GDPR is under 1%. Most people don't care at the moment, sadly. However, a mass movement to opt-out would absolutely affect them. This lays the groundwork for that, and thats what they should be afraid of.
      • chronic71819 7y ago
        > Opt-out for GDPR is under 1%. Most people don't care at the moment, sadly. Correct. On top of that, many people on HN, aware of the privacy implications, continue to have a Google Home / Alexa in their homes. Myself included. Sadly, I (and many people) simply don't care about privacy. The probability/expected negatives of surveillance abuse is far less than the benefit of being able to turn my lights on and off with my voice. The US will for sure become like China in 10-20 years, with regards to surveillance.
  • nabnob 7y ago
    IANAL, but I'm guessing it's the difference between opting in and opting out? For example, I think it would be legal for Verizon to get around this law by increasing their prices by $5 across the board, and offering a $5 rebate for customers who want to opt-in to their data being sold. But it would not be legal for Verizon to allow customers to opt-out of data collection by paying an extra $5 a month. In the first approach, Verizon will not track by default and customers have to opt-in. In the second approach, Verizon will track by default and customers have to opt-out.
    • BoiledCabbage 7y ago
      Assuming that's true, then it's just accounting for social behavior. A user isn't "paying" for privacy. Privacy comes by default (for a price) and a company can pay a user to harvest their data. Financially, they both work out the same, but based on opt-in, opt-out behaviors and perception I presume they have a different impact. The wording specified by the law says that users should have a default expectation of privacy. They can actively choose to give that up for a fee. The business profit loss side of it says, you can't build a business that assumes it gets to profit off harvesting user's data for free. User data has value, place a value on it, and make it an explicit part of the transaction.
  • taurath 7y ago
    Because then they'll have to be up front about "why" they're charging you a lower amount, which puts a real dollar value on the data for the user, something which previously was never disclosed.
• deleted 7y ago
  [deleted]
• aeternum 7y ago
  I don't think lawmakers have thought through the ramifications. Here are a few: Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization? What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be banned as well? Many companies, including Google would have to significantly change their pricing model if so.. yet that is apparently illegal.
  • JohnFen 7y ago
    > Will that be banned as well? I sure hope so. > Many companies, including Google would have to significantly change their pricing model if so Good. It would be even better if they have to change their business model.
    • fbonetti 7y ago
      Are you willing to pay to use a search engine? How much?
      • nabnob 7y ago
        Those aren't the only two options. Duckduckgo shows you ads based on your search terms.
      • JohnFen 7y ago
        Depends on the search engine, of course, but I am not opposed to the notion. That said, I am also not arguing against advertising as a funding model. I'm arguing against business models that rely on invading people's privacy.
    • chroma 7y ago
      I don't understand this mentality. If someone is fine giving a company some information, and the company uses that to give them a better product, where is the harm? And what right do you have to stop those two parties from voluntarily exchanging goods and services?
• mahmoudimus 7y ago
  I think the idea is that regulation always has unexpected side effects, some of which can be abused to actually do the perverse inverse of what they're intended to protect against. This is intuitive because regulation + law can really put a competitive barrier for established incumbents who (and arguably, they would be the target for lawsuits here) have resources to implement and comply with these regulations. The law does sound great as a consumer, but I think the question is still up in the air about how will it be enforced and what will be the unexpected side effects? Definitely something to watch for. P.S. We've been working on a developer-friendly SaaS that helps companies automatically comply with jurisdictional controls + data security / privacy controls. Feel free to email me: mahmoud - @ - https://verygoodsecurity.com https://verygoodsecurity.com and I can dive deeper to answer any questions.
  • dangus 7y ago
    On the flip side, the downsides of regulations don’t outweigh their utility. We don’t scrap seatbelt and airbag regulations just because they’ve had some unintended side effects. Regulations aren’t set in stone forever, either, and a functional legislative body can always modify and update them as their effects become more well known. Or, well, maybe I sound too idealistic. But...I think most of us can all agree that consumer data protections are highly lacking.
    • Jach 7y ago
      I live in Washington and this is the last year I'll have to do emissions testing for my vehicle registration. I'm still kind of amazed (my default is pessimism) that this was put into motion in 2005 and nothing seems to be in the way of stopping the removal of the requirement next year: https://ecology.wa.gov/Air-Climate/Air-quality/Vehicle-emissions/Emissions-check-ends https://ecology.wa.gov/Air-Climate/Air-quality/Vehicle-emiss... My only point is to support your case that it's not always idealistic to believe that some regulations, even ones that have been in place for decades, even with today's questionably functional government, can go away.
      • evilantnie 7y ago
• briffle 7y ago
  I see a lot of comments deriding this law, can someone explain to me why these are bad things? Jeff Hammerbacher: ‘The best minds of my generation are thinking about how to make people click ads… That sucks.’ Those best minds are now having to change the way they generate revenue..
  • nabnob 7y ago
    When I first wrote that comment, it was at -2 after three minutes. Which is interesting because usually HN users claim they care about privacy.
    • NeedMoreTea 7y ago
      Well, going on the endless GDPR discussions last year, that very much depends whether it's a time it's mostly America awake or mostly Europe. There's far too much of SV wedded to the idea of farming customer data infinitely. Which is why data privacy laws are becoming a thing.
    • paulmd 7y ago
      Oh hell no, HN users are largely startup types who are all-in on adtech/tracking tech and metrics for building their businesses. There is an incessant amount of whining about GDPR for example, and how "confusing" the regulations supposedly are. What it comes down to is many HN denizens are doing things that are explicitly prohibited by these data collection laws and want to continue doing the things that have been outlawed. As they say, it is difficult to get a man understand something when his salary depends on his not understanding it.
      • nabnob 7y ago
        Yup agreed. I wanted to see someone spell out why they opposed this law, because it would make it obvious that they have no problems with the horribly unethical things some of these tech companies are doing.
      • pnw_hazor 7y ago
        You are well on your way to having this comment pulled. Heaven forbid you cast any blame on those who are building our dark-patterned surveillance dystopia. Note, I have been told on good authority that the pay is good and the work is interesting. And that makes it okay. Good luck!
• rodgerd 7y ago
  You're on a web site chock-full of people whose income or dreams of wealth depends on unfettered surveillance capitalism. “It is difficult to get a man to understand something, when his salary depends on his not understanding it.”
• chooseaname 7y ago
  > - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. If you're ad dependent, would this basically mean you have to give your service to this user for free after this?
  • mdavidn 7y ago
    No. It just means you need to make ads relevant to the content rather than to the individual user.
• bcheung 7y ago
  Some problematic scenarios: - How do you identify what is customer data? There may be information stored in logs somewhere. Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal information can manifest in logs. How do you ensure compliance with something when you don't fully understand what can come out of it? Any engineers now must fully understand the consequences of anything they log and design delete mechanisms for it. This extends to any 3rd party software you use that generates logs. You must now fully and deterministically understand your entire system just to comply with this law. Such a request is essentially NP-complete. - How do you prune said data from logs? - How do you delete data that are archived in write only media formats and/or that are in cold storage somewhere? You'd have to physically destroy the media and make a copy of everything minus the part you want to exclude. This dramatically increases archive storage complexity and cost.
  • darknoon 7y ago
    Yes, if you log personal information like IP addresses you need to have a plan to delete it. Maybe storing it long term is a liability not a benefit. Don't bring complexity theory into it.
  • codeulike 7y ago
    In Europe, we have GDPR which is broadly similar. And the answer to your question about logs is basically "Tough shit. Personal data is important and if you've been leaving it in logs all over the place then you're going to have to sort that shit out". The Backups question is a bit more complex. One source I've seen: "According to France’s GDPR supervisory authority, CNIL, organisations don’t have to delete backups when complying with the right to erasure. Nonetheless, they must clearly explain to the data subject that backups will be kept for a specified length of time (outlined in your retention policy)." Paired with that is that if you're keeping data (or backups) for any length of time beyond the immediate needs of the customer then you need to be able to justify it.
  • allover 7y ago
• deleted 7y ago
  [deleted]
• darawk 7y ago
  > - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. This is something I object to. It's just fundamentally stupid and doesn't make sense. The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free. EDIT: I'll also add that it strongly favors incumbent tech companies, by explicitly carving out "selling to third parties" as a disfavored tactic. Google can monetize your data internally. Your average startup may not be able to. Specifically carving out "selling to third parties" favors large, incumbent players over small startups. But then, regulation always does.
  • tikiman163 7y ago
    I think you've missed the point. This does not make it illegal to collect or even sell user data, it makes it illegal to do so without consent. Any concern regarding whether consent is likely to be withheld really just points out how stupid a company's business model is. Incumbent vs. Startup is also a false premise because Facebook is an incumbent that relies on selling user data. They do make some money from purely internal advertising, but in total Facebook only makes less than $5 per user when selling data, and that's lifetime, not per year. So the only way to make real profits from selling data is if you sell millions of people's data. Their internal data use however, is just for add targeting which they make more money from each year. This internal use makes more per user and is therefore a more viable strategy for a small company than selling data. There are already regulations that make it impossible to sell user data that would be valuable that apply to more than just internet collected information. So, any data selling strategy a startup or incumbent company might have will either not earn significant profits or is very likely already illegal. In any case, advertising revenue rarely ever covers a company's expenses. If a company is only staying afloat because of selling data, then that company is achieving a very poor return on investment and is wasting the time of everyone involved. Either they need better business processes, strategies or they're not offering something of sufficient value to be worth the time put into the business.
  • 7y ago
• paggle 7y ago
  Regulations that don’t achieve anything create a massive drag on innovation and commerce. Every regulation is a compliance check that needs to be paid for, a lawyer that needs to be hired, etc. which advantages incumbents. It’s like lines of code in a program — each one makes the application worse, so each one should have a purpose that it achieves.
  • mdavidn 7y ago
    The law would not be necessary if companies were upfront with how they collect and process information about individual consumers. Now this is a compromise many consumers want.
• danShumway 7y ago
  I've commented in the past that the privacy community is diverse. I divide the community into (at least) two major groups: - People who believe that privacy means being able to anonymously use services. - People who believe that privacy means being able to control what other people do with data about you. These are not compatible views, and they often conflict with each other -- both philosophically and practically. If you believe you should be able to compel a business to delete data you gave them, then necessarily there needs to be a way for that business to confirm your identity and link you to that data. You become more concerned with this idea of "owning" information about yourself. If you believe you should be able to do everything anonymously, then it becomes much harder to control information after it's been leaked. You can't implement things like geo-locking users because what you do with the information doesn't matter -- just collecting it is a problem. If you're in the "everything should be anonymous" crowd, you're also less likely to agree with efforts like Right to Be Forgotten; you may even reject the idea of data ownership entirely. For someone in the "I control my own data" crowd, the Right to Be Forgotten is absolutely critical -- it's one of the most important safeguards we have against a future where everything is permanently indexed forever. I'm oversimplifying, but at the moment, the majority of pure-tech solutions for privacy are on the "everything should be anonymous" side, and (at least for the moment) most legislative solutions are falling into the "you should control your own data" side. That leads to conflict. Not always, but sometimes. It's important to keep in mind that even though the privacy movement is aligned on many issues, there is no binary "pro" or "anti" privacy, because there's disagreement from privacy advocates on both where we're going and how to get there. In this case, California's law is very much a "control my data" law. Points like, "Businesses would be required to comply with official consumer requests to delete that data" conflict with the way that "be anonymous" privacy advocates see the world.
  • lemoncucumber 7y ago
    Thanks, this clarified my thinking on the issue in a really useful way.
  • BoiledCabbage 7y ago
    I think this is a very important distinction you make, but it doesn't necessarily mean that they are fundamentally incompatible. It today's world, data about a person is an asset. A person should own their assets, and have control over them. If there were only one option, this would have to be it - it's the only one that aligns with business interests. If you instead go purely the route of anonymous data collection, because data is such an asset it just gives businesses the strong incentive to find ways to de-anonymize your data. That is an unstable situation, and a societal counter-productive incentive. Since data on me has value (clearly since businesses are run off it), make it a true product. Give it value, allow me as a consumer to trade it, allow businesses to quantify it's value in the market place, and explicitly bid on. That aligns incentives. As data becomes more (or less) valuable, businesses will adjust their prices for it. This aligns incentives, the more data is worth to a business, the more they'll be willing to pay for it. IMHO this is clearly the right approach. That said, there is still a world where both methods exist. Users choose when they interact if they want to perform anonymous interaction (or pseudoanonymous), and people provide services to ensure it is anonymous. HN, reddit those are forms people would likely choose pseudoanon for, but there would be a firewall between someones pseudoanon identity and their true identity. And people would be pseudoanon knowing the risks and taking care to not divulge linking identityy info, and businesses would ensure there are limits on data preservation / recording of pseudoanon interactions. The same way people post on HN and use care in what they choose to disclose, HN would also ensur data expiry is short enough and would not share/sell pseudoanon data to 3rd parties. Again, if you can only pick one, it has to be consumer ownership of their data, but I think they both can work together.
• rco8786 7y ago
  They’re not bad for the consumer. They’re just hard to implement in practice. I’m going through this right now at a well known tech co. Nobody, including the lawyers on both sides of the table, knows exactly what to do to be compliant because a lot of the bill is pretty vague on details. And for some companies doing shit like selling customer data is the only reason they’re in business. Good riddance to them though.
• the_watcher 7y ago
  - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. If the price of the service is based on the ability to sell data, how is it reasonable to disallow the business from changing the price of the service for those who opt out? Also, how can you reconcile this with being allowed to offer financial incentives for being allowed to collect it?
• andrewmutz 7y ago
  These laws may be targeted at companies that deal in advertising data relating to consumers, but the laws as written affect all of us. Are these the right laws to regulate SaaS companies that build business software? Should a consumer be allowed to request that data about them be deleted if that data are records of legitimate business transactions? If you buy a car from a dealership, do you "own" the data in their systems about your transaction and should you be able to request its deletion?
  • leesalminen 7y ago
    Agreed. It’s been tough for us as well. We don’t monetize customer data in any way yet these regulations add real cost for us. We’re in the business software SaaS world as well, so it’s not really even our data to delete. We end up having to have a 3-way ticket between the business, the customer and us (the SaaS provider) and explain how we are deleting data from their system.
  • biesnecker 7y ago
    There are a bunch of exceptions to the requirement to delete user data in the law (full text: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...), the exception for data that is collected "to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business" would probably apply in the cases you cite.
• thorwasdfasdf 7y ago
  It's pretty presumptious of people to assume that when they visit a website that it's just "their" data. The website receives the user, just as much as the user comes to the website. The data of visiting a website belongs to both the company and the user. To simply assume that it entirely belongs to the user is just wrong.
• domnomnom 7y ago
  Every state will end up having a different law like this, and it will be terrible adhering to each one.
  • nickjj 7y ago
    Yeah this is a really good point and with 50 states that's a lot of things to keep track of. Let's hope it isn't able to be broken down like sales tax. Remember last year when there was a big hoopla about that Massachusetts court case that hinted that any online vendor would now be responsible for collecting and reporting on sales tax for purchases coming from any US state (even if you as the business owner didn't have a business location there). Basically changing the requirement of the buyer to report sales tax for out of state purchases onto the business. The only problem is there's 9,998 different tax jurisdictions (as of 5 years ago)[1] spread across 50 states. [1]: https://taxfoundation.org/state-sales-tax-jurisdictions-approach-10000/ https://taxfoundation.org/state-sales-tax-jurisdictions-appr...
  • deleted 7y ago
    [deleted]
• narrator 7y ago
  Good way to make sure all companies support scrubbing of evidence of crimes so wikileaks or government investigators can't get at the evidence. Basically Hillary's private email server getting bleachbitted, but for everyone now. Makes running an organized crime gang, political corruption graft ring or chinese espionage ring much easier. Same with banning facial recognition. Makes getting away with crime a lot easier than it would otherwise be. If you are a corrupt politician, this is really important stuff.
• 4ntonius8lock 7y ago
  I think there are a lot of people here whose employment depends on being able to sell and buy peoples data freely. Many of the people here who work for these companies truly and honestly believe the online services they are offering are/will change the world for the better. As such, they view hindrances to this as threatening to the progress they are trying to help bring about. Personally, I support this privacy initiative and think SV companies are many times viewed through rose tinted glasses by their employees, but that's just my perspective. I can totally see how viewed through the lens of a hindrance to progress, some people would feel very strongly that I'm wrong in supporting such legislation.
• chaostheory 7y ago
  > I totally understand that this will impact a lot of tech companies' profits...but that's to be expected if you're making money selling people's data to third parties without their permission. Yes, it is also subsidizing what would normally be paid services. Before online advertising, people would pay for services like email. Sure, $5 / month is cheap for us, but what about the developing world and the lower class?
• tylerl 7y ago
  It makes it extremely difficult to legally be a tech firm unless you're already a tech giant, just like the FDAs procedures make it impossible to invent a new drug unless you're already an established, giant pharma company. None of the big names in tech will have any trouble at all complying with this; I'd be very surprised if any at all are not already compliant today. At the same time, the percentage of tech startups that are already compliant with this law is likely around zero, and few will ever become so. Unless this is precisely what your startup is about, small firms, especially with venture funding, can't afford to invest anything at all into privacy beyond the surface. If your startup fails because it gets sued into oblivion, that's no worse (and way less likely) than it failing because nobody actually wanted a chat app for dogs.
  • drusepth 7y ago
    This law's implementation is bad for the same reason GDPR's implementation is bad: the people it's meant to target are easily capable of complying (and likely already do) and it's good for "the people" on paper, but disproportionately affects (hurts) small businesses that don't have the means to comply (or even know if they're properly complying to the extent of avoiding a lawsuit).
    • Renaud 7y ago
      Most of these requirements are perfectly reasonable and i don’t see any that are technologically difficult to implement unless you underlying business model relies on selling user data without regards, in which case, good riddance.
      • drusepth 7y ago
        I feel like the "GDPR doesn't affect you unless you sell data" line is the new version of "surveillance doesn't affect you unless you've got something to hide". Every time GDPR is mentioned in a HN thread you see dozens+ of comments asking for clarifications on how to "get around" GDPR issues for legitimate uses. The point is you don't have to be a bad guy to be affected by GDPR and need to spend time+money on not only complying (auditing and implementing systems), but also verifying you're actually compliant with an expert, and the smaller you are the more relative time you have to spend on this work yourself (instead of e.g. hiring lawyers+developers to just do it for you).