10 ms·

Stripe customer here. The question raised is, more broadly, "Is Stripe collecting this data in a legal and ethical way?" This too can be readily answered in the

Stripe customer here. The question raised is, more broadly, "Is Stripe collecting this data in a legal and ethical way?" This too can be readily answered in the negative. It doesn't matter whether "Stripe.js collects this data only for fraud prevention" or if it works in practice. Under CalOPPA [1], Stripe still has to disclose the collection of the data, and (among other things) allow customers to opt out of collection of this data, and allow customers to inspect the data collected. Stripe's privacy policy refers to opt-out and inspection rights about certain data, but AFAICT not this. [This is not legal advice] [1] http://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=BPC&division=8.&title=&part=&chapter=22.&article= http://leginfo.legislature.ca.gov/faces/codes_displayText.xh... [2] https://stripe.com/privacy#your-rights-and-choices https://stripe.com/privacy#your-rights-and-choices

pc 6y ago
https://stripe.com/privacy https://stripe.com/privacy describes what we do in some detail (including disclosing that we use this kind of browsing data). More broadly, I assure you that Stripe.js and our fraud prevention technologies are very carefully designed with full compliance with the relevant California (and other) statutes in mind. I’d be happy to connect you with our legal team if you’d like to discuss this in more detail. (I'm patrick@stripe.com.)
- jonny_eh 6y ago
  Why not address it here publicly? I don't think you want/expect everyone observing this discussion on HN to reach out to you.
  - deleted 6y ago
    [deleted]
  - pc 6y ago
    Oh, offer was made in case GP wants to have a deeper discussion/back-and-forth than is readily achievable with an online forum. Timing constraints notwithstanding, we work hard to answer questions on HN too.
- deleted 6y ago
  [deleted]
- ThePhysicist 6y ago
  For your European customers you should likely make it more clear what stripe.js does before urging them to install it on every page of their website. Using it as soon as a user has a probable interest to purchase a product (e.g. when he/she clicks on “Register” and chooses a plan) would very likely be acceptable as a legitimate interest under GDPR, tracking all users even if they don’t have a clear intent of purchasing something and e.g. only want to get information about the product will definitely not be acceptable as a legitimate interest and would therefore require clear consent first.
Alex3917 6y ago
> The question raised is, more broadly, "Is Stripe collecting this data in a legal and ethical way?" This too can be readily answered in the negative. I think the real issue is that in the U.S. most people's views on things like basic analytics software aren't shaped by reading books on digital privacy or taking classes on privacy law, but rather by some vague cultural memory of the holocaust. It makes it very difficult to have a rational discussion with people.
Kalium 6y ago
I am not an attorney. This is not legal advice. Based on a plain reading of the law, several things about CalOPPA stand out to me. For one, it's not clear to me that the mouse movements in question qualify as "personally identifiable information". Mouse movements are not a first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?). Second, it seems to me that opt-out, right to inspect and update, and more are all contingent upon the data being PII within the scope of CalOPPA. Perhaps you can help me with something I've overlooked that would show me where I've erred? Further, what do you think the correct legal and ethical way for Stripe to use mouse movement data would be? From your comment I can guess that you believe it should be treated as PII. Is that correct?
- techbio 6y ago
  > first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?) What about a face? Fingerprints? Voice? Aren't those identifiable information even though it didn't make your (common sensical) short list? Mouse movements are on the same order of specificity. Edit: Also not giving legal advice. Edit2: Please see https://news.ycombinator.com/item?id=22939145 https://news.ycombinator.com/item?id=22939145
  - swsieber 6y ago
    I have yet to hear of legally binding definition of PII that involves mouse movements.
    - techbio 6y ago
      Not a lawyer, but not that surprised that the laws you refer to are growing technical loopholes. Here are a couple things that mouse movements can identify in case no one knows what I'm talking about: https://www.researchgate.net/publication/221325920_User_re-authentication_via_mouse_movements https://www.researchgate.net/publication/221325920_User_re-a... https://medium.com/stanford-magazine/your-computer-may-know-you-have-parkinsons-shall-it-tell-you-e8f8907f4595 https://medium.com/stanford-magazine/your-computer-may-know-...
mytailorisrich 6y ago
All this existing legislation is about protecting personal data, not any data. If what is collected is not linked to an individual and does not allow to identify an individual then these are not personal data and the legal point is moot.
ganstyles 6y ago
You mentioned legal and ethical but only addressed the legal side. Of course legality and ethicality are not the same, can you also address the ethics side?
- hnzix 6y ago
  If Stripe are indeed tracking mouse movements to detect bot traffic (which is plausible) then that seems broadly ethical and reasonable from an ethical perspective.
  - ganstyles 6y ago
    In the same way that if the government is tracking our private conversations to detect human traffickers then it's broadly ethical and reasonable from an ethical perspective?
    - joshuamorton 6y ago
      Can you explain how the privacy violation of tracking mouse movements on a subset of online markets is similar in scope or substance to tracking all conversation? I see a number of obvious differences: I can opt out of purchasing from stripe-managed sites, while I cannot opt out of dragnet government monitoring. I can imagine less invasive ways of stopping human trafficking, while I cannot for fraud prevention, etc.
suyash 6y ago
Is there a good Stripe alternate that respect customers privacy?
- scurvy 6y ago
  Square Payments? Adyen?
suyash 6y ago
Exactly so if your business is using stripe and customer sues you in court under CalOPPA, will stripe be cover your lawsuit and pay for it?
stanfordkid 6y ago
From a legal perspective, isn't the burden of communicating privacy to the customer on the website/content provider, not Stripe? Stripe.js is an API -- developers use this API to build something used by their customers. The customer is the one who's data is being collected, and the developers are the one's facilitating that collection via their service. The fact that it got sent to Stripe is not really relevant to who bears responsibility on clarifying data rights to the customer.
- abiogenesis 6y ago
  The data is collected by Stripe, though. The content provider doesn't have access to the mouse movement data, and might not be even aware of that the data is collected.
  - stanleydrew 6y ago
    That doesn't necessarily mean the content provider isn't responsible though. I can break a law even if I don't know that the law exists.
    - abiogenesis 6y ago
      Fair enough, but this specific collection of data has not been clearly disclosed by Stripe (until now?).
- threepio 6y ago
  It’s specifically different in this case: a big part of Stripe's value to a web vendor is that Stripe can collect credit-card info directly from the buyer (thereby exempting the vendor from PCI compliance and other issues related to storing and processing CCs). "The simplest way for you to be PCI compliant is to never see (or have access to) card data at all. Stripe makes this easy for you as we can do the heavy lifting to protect your customers’ card information." [1] Interesting question whether Stripe incurs statutory privacy duties to the web vendor and the buyer separately. I would imagine so, because given the "triangular" nature of this kind of Stripe transaction, Stripe ends up collecting data from two parties. [This is not legal advice] [1] https://stripe.com/docs/security https://stripe.com/docs/security
badrabbit 6y ago
Still seems unethical if the collected data is stored or stored in a processed form. The same technology can be used to uniquely identify users across devices. Keyword:consent.

pc 6y ago

https://stripe.com/privacy https://stripe.com/privacy describes what we do in some detail (including disclosing that we use this kind of browsing data). More broadly, I assure you that Stripe.js and our fraud prevention technologies are very carefully designed with full compliance with the relevant California (and other) statutes in mind. I’d be happy to connect you with our legal team if you’d like to discuss this in more detail. (I'm patrick@stripe.com.)

jonny_eh 6y ago
Why not address it here publicly? I don't think you want/expect everyone observing this discussion on HN to reach out to you.
- deleted 6y ago
  [deleted]
- pc 6y ago
  Oh, offer was made in case GP wants to have a deeper discussion/back-and-forth than is readily achievable with an online forum. Timing constraints notwithstanding, we work hard to answer questions on HN too.
deleted 6y ago
[deleted]
ThePhysicist 6y ago
For your European customers you should likely make it more clear what stripe.js does before urging them to install it on every page of their website. Using it as soon as a user has a probable interest to purchase a product (e.g. when he/she clicks on “Register” and chooses a plan) would very likely be acceptable as a legitimate interest under GDPR, tracking all users even if they don’t have a clear intent of purchasing something and e.g. only want to get information about the product will definitely not be acceptable as a legitimate interest and would therefore require clear consent first.

Alex3917 6y ago

> The question raised is, more broadly, "Is Stripe collecting this data in a legal and ethical way?" This too can be readily answered in the negative. I think the real issue is that in the U.S. most people's views on things like basic analytics software aren't shaped by reading books on digital privacy or taking classes on privacy law, but rather by some vague cultural memory of the holocaust. It makes it very difficult to have a rational discussion with people.

Kalium 6y ago

I am not an attorney. This is not legal advice. Based on a plain reading of the law, several things about CalOPPA stand out to me. For one, it's not clear to me that the mouse movements in question qualify as "personally identifiable information". Mouse movements are not a first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?). Second, it seems to me that opt-out, right to inspect and update, and more are all contingent upon the data being PII within the scope of CalOPPA. Perhaps you can help me with something I've overlooked that would show me where I've erred? Further, what do you think the correct legal and ethical way for Stripe to use mouse movement data would be? From your comment I can guess that you believe it should be treated as PII. Is that correct?

techbio 6y ago
> first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?) What about a face? Fingerprints? Voice? Aren't those identifiable information even though it didn't make your (common sensical) short list? Mouse movements are on the same order of specificity. Edit: Also not giving legal advice. Edit2: Please see https://news.ycombinator.com/item?id=22939145 https://news.ycombinator.com/item?id=22939145
- swsieber 6y ago
  I have yet to hear of legally binding definition of PII that involves mouse movements.
  - techbio 6y ago
    Not a lawyer, but not that surprised that the laws you refer to are growing technical loopholes. Here are a couple things that mouse movements can identify in case no one knows what I'm talking about: https://www.researchgate.net/publication/221325920_User_re-authentication_via_mouse_movements https://www.researchgate.net/publication/221325920_User_re-a... https://medium.com/stanford-magazine/your-computer-may-know-you-have-parkinsons-shall-it-tell-you-e8f8907f4595 https://medium.com/stanford-magazine/your-computer-may-know-...

mytailorisrich 6y ago

All this existing legislation is about protecting personal data, not any data. If what is collected is not linked to an individual and does not allow to identify an individual then these are not personal data and the legal point is moot.

ganstyles 6y ago

You mentioned legal and ethical but only addressed the legal side. Of course legality and ethicality are not the same, can you also address the ethics side?

hnzix 6y ago
If Stripe are indeed tracking mouse movements to detect bot traffic (which is plausible) then that seems broadly ethical and reasonable from an ethical perspective.
- ganstyles 6y ago
  In the same way that if the government is tracking our private conversations to detect human traffickers then it's broadly ethical and reasonable from an ethical perspective?
  - joshuamorton 6y ago
    Can you explain how the privacy violation of tracking mouse movements on a subset of online markets is similar in scope or substance to tracking all conversation? I see a number of obvious differences: I can opt out of purchasing from stripe-managed sites, while I cannot opt out of dragnet government monitoring. I can imagine less invasive ways of stopping human trafficking, while I cannot for fraud prevention, etc.

suyash 6y ago

Is there a good Stripe alternate that respect customers privacy?

scurvy 6y ago
Square Payments? Adyen?

suyash 6y ago

Exactly so if your business is using stripe and customer sues you in court under CalOPPA, will stripe be cover your lawsuit and pay for it?

stanfordkid 6y ago

From a legal perspective, isn't the burden of communicating privacy to the customer on the website/content provider, not Stripe? Stripe.js is an API -- developers use this API to build something used by their customers. The customer is the one who's data is being collected, and the developers are the one's facilitating that collection via their service. The fact that it got sent to Stripe is not really relevant to who bears responsibility on clarifying data rights to the customer.

abiogenesis 6y ago
The data is collected by Stripe, though. The content provider doesn't have access to the mouse movement data, and might not be even aware of that the data is collected.
- stanleydrew 6y ago
  That doesn't necessarily mean the content provider isn't responsible though. I can break a law even if I don't know that the law exists.
  - abiogenesis 6y ago
    Fair enough, but this specific collection of data has not been clearly disclosed by Stripe (until now?).
threepio 6y ago
It’s specifically different in this case: a big part of Stripe's value to a web vendor is that Stripe can collect credit-card info directly from the buyer (thereby exempting the vendor from PCI compliance and other issues related to storing and processing CCs). "The simplest way for you to be PCI compliant is to never see (or have access to) card data at all. Stripe makes this easy for you as we can do the heavy lifting to protect your customers’ card information." [1] Interesting question whether Stripe incurs statutory privacy duties to the web vendor and the buyer separately. I would imagine so, because given the "triangular" nature of this kind of Stripe transaction, Stripe ends up collecting data from two parties. [This is not legal advice] [1] https://stripe.com/docs/security https://stripe.com/docs/security

badrabbit 6y ago

Still seems unethical if the collected data is stored or stored in a processed form. The same technology can be used to uniquely identify users across devices. Keyword:consent.