6 ms·

I am not an attorney. This is not legal advice. Based on a plain reading of the law, several things about CalOPPA stand out to me. For one, it's not clear to m

by Kalium 7y ago

I am not an attorney. This is not legal advice. Based on a plain reading of the law, several things about CalOPPA stand out to me. For one, it's not clear to me that the mouse movements in question qualify as "personally identifiable information". Mouse movements are not a first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?). Second, it seems to me that opt-out, right to inspect and update, and more are all contingent upon the data being PII within the scope of CalOPPA. Perhaps you can help me with something I've overlooked that would show me where I've erred? Further, what do you think the correct legal and ethical way for Stripe to use mouse movement data would be? From your comment I can guess that you believe it should be treated as PII. Is that correct?

techbio 7y ago
> first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?) What about a face? Fingerprints? Voice? Aren't those identifiable information even though it didn't make your (common sensical) short list? Mouse movements are on the same order of specificity. Edit: Also not giving legal advice. Edit2: Please see https://news.ycombinator.com/item?id=22939145 https://news.ycombinator.com/item?id=22939145
- swsieber 7y ago
  I have yet to hear of legally binding definition of PII that involves mouse movements.
  - techbio 7y ago
    Not a lawyer, but not that surprised that the laws you refer to are growing technical loopholes. Here are a couple things that mouse movements can identify in case no one knows what I'm talking about: https://www.researchgate.net/publication/221325920_User_re-authentication_via_mouse_movements https://www.researchgate.net/publication/221325920_User_re-a... https://medium.com/stanford-magazine/your-computer-may-know-you-have-parkinsons-shall-it-tell-you-e8f8907f4595 https://medium.com/stanford-magazine/your-computer-may-know-...
    - Kalium 7y ago
      Thank you for bringing hard research to this discussion! I find it interesting that the one that contemplates authentication requires supervised machine learning and goes on to explicitly state that "analyzing mouse movements alone is not sufficient for a stand-alone user re-authentication system". Taken together, this suggests that a sizable corpus of mouse movement data known to be associated with one user may qualify as PII under some definitions. Again, thank you for sharing this timely information.
      - DrShila 7y ago
        This is how we can say mouse movements can lead to privacy violation: mouse movements as such doesn't contain PII like name, zipcode or gender. But when mouse movements are run through the machine learning algorithm, it can NOT only help you to identify the person (mouse dynamics are behavioral factors and you can map across different sites. By mapping across different sites, you will learn basically the same person is surfing these three sites and valuable information for advertising world, as an example) but you can analyze the mouse movements to identify your health issues. Now you take this information and link to other publicly available databases to identify the person!! So, overall, if stripe doesn't sell this data to analyze other patterns like id or health issues, its fine...but guaranteeing it is hard. So at Unknot.id, we learn similar patterns to detect fraud but using smartphones. But we make sure, only needed results (that is fraud or not) can be achieved and not his health or other privacy related.
      - deleted 7y ago
        [deleted]
- Kalium 7y ago
  It's less my short list and more the one in the text of the law being cited. Other things, such as finger-, voice-, and face-prints were probably not contemplated by lawmakers in 2003 and thus go unmentioned. They may fall under the "maintains in personally identifiable form in combination with an identifier" clause, though. Of course, that also provides an easy way to comply. Don't store mouse movements in a way that ties them to PII under CalOPPA, and you don't meet any criteria.
  - techbio 7y ago
    Makes sense, but I don't trust it to never be tied to PII.
    - Kalium 7y ago
      That's definitely a question of implementation, policy, compliance, and liability. You are absolutely correct. The law in question also requires data to be maintained in personally identifiable form. I am uncertain if a small number of mouse movements is likely to reach this. I do not see how, but that's not a reason why it cannot be so.
Xelbair 7y ago
you have to account for someone using a on screen keyboard to input their credentials.
- Scaevolus 7y ago
  Javascript code cannot see mouse movements outside of its page, like in an on screen keyboard or another webpage.
- mattigames 7y ago
  They are a minority so its likely easy to account for, stuff like tracking them by learning their IP and transaction history to mark them with certain degree of trustability; on the other hand tracking mouse movements and other techniques are essential for users you have no record of (new ip, new user, new cc, etc)
- lucb1e 7y ago
  You mean on a touchscreen device, or because of a physical disability? Because the latter case seems exceptional enough that I'm not sure how that would legally work (do you have to think of all possible edge cases? What if someone uses dictation because they can't type, does that mean you'd potentially capture social security numbers if you use the microphone for gunshot detection and process the sound server-side?) and in the former case I'm pretty sure taps on a keyboard are not registered as a mouse movement in JavaScript.
  - shakna 7y ago
    > or because of a physical disability? Because the latter case seems exceptional enough that I'm not sure how that would legally work There have been a number of accessibility-based lawsuits recently. Generally speaking, yes, you absolutely have to allow for them to use an alternative system without locking them out. Because if your particular methodology breaks things for a people group that way, all kinds of discrimination laws become a hammer that someone can toss your way.
    - lucb1e 7y ago
throwaway284629 7y ago
mouse movements will contain personally identifiable information if the user has any kind of writing to text system turned on. You definitely can't rule it out. (not a lawyer) I think what stripe is doing is illegal
- three_seagrass 7y ago
  Writing-to-text tools are technographic data, not really personally identifiable information (PII), and not run in-browser. When used with other technographic data it can be used to fingerprint a user, but without any PII, you don't know who that user is.
  - throwaway284629 7y ago
    if they write their SSN in the tool and it gets recorded in the mouse movements, how is that not PII?
lucb1e 7y ago
> Mouse movements are not a first or last name, physical or email address, [or one of a dozen other obvious examples] You misunderstand what personally identifiable information is. Each individual letter of my name is also not identifiable, the letters of the alphabet are not PII, but when stored in in the same database row, the separate letters do form PII no matter that you stored them separately or even hashed or encrypted them. My phone number is also not something that just anyone could trace to my name, but since my carrier stores my personal data together with the number (not to mention the CIOT database where law enforcement can look it up at will), there exists a way to link the number to my person, making it PII. Everything about me is PII, unless you make it no longer about me. Mouse movements may not be PII if you don't link it to a session ID, but then it would be useless in fraud detection because you don't know whose transaction you should be blocking or allowing since it's no longer traceable to a person. Another example[1] mentioned on a website that the Dutch DPA links to (from [2]) is location data. Coordinates that point to somewhere in a forest aren't personal data, but if you store them with a user ID... [1] (English) https://www.privacy-regulation.eu/en/4.htm https://www.privacy-regulation.eu/en/4.htm [2] (Dutch) https://autoriteitpersoonsgegevens.nl/nl/over-privacy/persoonsgegevens/wat-zijn-persoonsgegevens https://autoriteitpersoonsgegevens.nl/nl/over-privacy/persoo...
- Kalium 7y ago
  > You misunderstand what personally identifiable information is. Not to belabor a point discussed elsewhere, but those were not arbitrarily chosen types of PII. They are how PII is defined in the specific law that was cited - CalOPPA. The comment to which I responded contains a link. The text of the law contains its definition of PII. Please accept my apologies. I can see I failed to communicate clearly and readers interpreted my statements as broad comment about what is or isn't PII across a union of all potentially relevant laws and jurisdictions. This was in no way, shape, form, or manner my intended meaning. Again, please accept my apologies for failing to be clear. > Mouse movements may not be PII if you don't link it to a session ID, but then it would be useless in fraud detection because you don't know whose transaction you should be blocking or allowing since it's no longer traceable to a person. Maybe it's just me, but I was under the distinction impression that some patterns of input are characteristic of humans and others of inhuman actors. Is it possible that a user could be identifiable as human or inhuman without having to know which specific human an input pattern corresponds to? Have I misunderstood something?
masterfooo 7y ago
Yeah? It is clearly personally identifiable. In fact it is pyschologically identifiable when Stripe can associate that with your name, credit card, Ip address, time of the purchase, the vendor, type of the item, how you get to the store, the items you are paying for, how much time you spent on the item or the store, which links you clicked, the browser you are using, the device you are on, your location etc. Do you want me to list all the possibilities they are recording?. You are out of touch with reality here.
wpearse 7y ago
Counter-point: if your business is selling digital or physical product into New Zealand the NZ tax department requires you to collect two different types of data for the transaction that prove the customer is located in NZ. This can include IP address, phone number, address. So, in some instances, Stripe is legally required to collect some of this data.
- sib 7y ago
  How does an IP address (in a world with VPN) or a phone number (which is likely to be mobile and could be located anywhere in the world) "prove that the customer is located in NZ"?
  - deleted 7y ago
    [deleted]

by Kalium 7y ago

techbio 7y ago

> first or last name, physical or email address, SSN, telephone number, or any contact method I am familiar with (maybe you know a way?) What about a face? Fingerprints? Voice? Aren't those identifiable information even though it didn't make your (common sensical) short list? Mouse movements are on the same order of specificity. Edit: Also not giving legal advice. Edit2: Please see https://news.ycombinator.com/item?id=22939145 https://news.ycombinator.com/item?id=22939145

swsieber 7y ago
I have yet to hear of legally binding definition of PII that involves mouse movements.
- techbio 7y ago
  Not a lawyer, but not that surprised that the laws you refer to are growing technical loopholes. Here are a couple things that mouse movements can identify in case no one knows what I'm talking about: https://www.researchgate.net/publication/221325920_User_re-authentication_via_mouse_movements https://www.researchgate.net/publication/221325920_User_re-a... https://medium.com/stanford-magazine/your-computer-may-know-you-have-parkinsons-shall-it-tell-you-e8f8907f4595 https://medium.com/stanford-magazine/your-computer-may-know-...
  - Kalium 7y ago
    Thank you for bringing hard research to this discussion! I find it interesting that the one that contemplates authentication requires supervised machine learning and goes on to explicitly state that "analyzing mouse movements alone is not sufficient for a stand-alone user re-authentication system". Taken together, this suggests that a sizable corpus of mouse movement data known to be associated with one user may qualify as PII under some definitions. Again, thank you for sharing this timely information.
    - DrShila 7y ago
      This is how we can say mouse movements can lead to privacy violation: mouse movements as such doesn't contain PII like name, zipcode or gender. But when mouse movements are run through the machine learning algorithm, it can NOT only help you to identify the person (mouse dynamics are behavioral factors and you can map across different sites. By mapping across different sites, you will learn basically the same person is surfing these three sites and valuable information for advertising world, as an example) but you can analyze the mouse movements to identify your health issues. Now you take this information and link to other publicly available databases to identify the person!! So, overall, if stripe doesn't sell this data to analyze other patterns like id or health issues, its fine...but guaranteeing it is hard. So at Unknot.id, we learn similar patterns to detect fraud but using smartphones. But we make sure, only needed results (that is fraud or not) can be achieved and not his health or other privacy related.
    - deleted 7y ago
      [deleted]
Kalium 7y ago
It's less my short list and more the one in the text of the law being cited. Other things, such as finger-, voice-, and face-prints were probably not contemplated by lawmakers in 2003 and thus go unmentioned. They may fall under the "maintains in personally identifiable form in combination with an identifier" clause, though. Of course, that also provides an easy way to comply. Don't store mouse movements in a way that ties them to PII under CalOPPA, and you don't meet any criteria.
- techbio 7y ago
  Makes sense, but I don't trust it to never be tied to PII.
  - Kalium 7y ago
    That's definitely a question of implementation, policy, compliance, and liability. You are absolutely correct. The law in question also requires data to be maintained in personally identifiable form. I am uncertain if a small number of mouse movements is likely to reach this. I do not see how, but that's not a reason why it cannot be so.

Xelbair 7y ago

you have to account for someone using a on screen keyboard to input their credentials.

Scaevolus 7y ago
Javascript code cannot see mouse movements outside of its page, like in an on screen keyboard or another webpage.
mattigames 7y ago
They are a minority so its likely easy to account for, stuff like tracking them by learning their IP and transaction history to mark them with certain degree of trustability; on the other hand tracking mouse movements and other techniques are essential for users you have no record of (new ip, new user, new cc, etc)
lucb1e 7y ago
You mean on a touchscreen device, or because of a physical disability? Because the latter case seems exceptional enough that I'm not sure how that would legally work (do you have to think of all possible edge cases? What if someone uses dictation because they can't type, does that mean you'd potentially capture social security numbers if you use the microphone for gunshot detection and process the sound server-side?) and in the former case I'm pretty sure taps on a keyboard are not registered as a mouse movement in JavaScript.
- shakna 7y ago
  > or because of a physical disability? Because the latter case seems exceptional enough that I'm not sure how that would legally work There have been a number of accessibility-based lawsuits recently. Generally speaking, yes, you absolutely have to allow for them to use an alternative system without locking them out. Because if your particular methodology breaks things for a people group that way, all kinds of discrimination laws become a hammer that someone can toss your way.
  - lucb1e 7y ago

throwaway284629 7y ago

mouse movements will contain personally identifiable information if the user has any kind of writing to text system turned on. You definitely can't rule it out. (not a lawyer) I think what stripe is doing is illegal

three_seagrass 7y ago
Writing-to-text tools are technographic data, not really personally identifiable information (PII), and not run in-browser. When used with other technographic data it can be used to fingerprint a user, but without any PII, you don't know who that user is.
- throwaway284629 7y ago
  if they write their SSN in the tool and it gets recorded in the mouse movements, how is that not PII?

lucb1e 7y ago

> Mouse movements are not a first or last name, physical or email address, [or one of a dozen other obvious examples] You misunderstand what personally identifiable information is. Each individual letter of my name is also not identifiable, the letters of the alphabet are not PII, but when stored in in the same database row, the separate letters do form PII no matter that you stored them separately or even hashed or encrypted them. My phone number is also not something that just anyone could trace to my name, but since my carrier stores my personal data together with the number (not to mention the CIOT database where law enforcement can look it up at will), there exists a way to link the number to my person, making it PII. Everything about me is PII, unless you make it no longer about me. Mouse movements may not be PII if you don't link it to a session ID, but then it would be useless in fraud detection because you don't know whose transaction you should be blocking or allowing since it's no longer traceable to a person. Another example[1] mentioned on a website that the Dutch DPA links to (from [2]) is location data. Coordinates that point to somewhere in a forest aren't personal data, but if you store them with a user ID... [1] (English) https://www.privacy-regulation.eu/en/4.htm https://www.privacy-regulation.eu/en/4.htm [2] (Dutch) https://autoriteitpersoonsgegevens.nl/nl/over-privacy/persoonsgegevens/wat-zijn-persoonsgegevens https://autoriteitpersoonsgegevens.nl/nl/over-privacy/persoo...

Kalium 7y ago
> You misunderstand what personally identifiable information is. Not to belabor a point discussed elsewhere, but those were not arbitrarily chosen types of PII. They are how PII is defined in the specific law that was cited - CalOPPA. The comment to which I responded contains a link. The text of the law contains its definition of PII. Please accept my apologies. I can see I failed to communicate clearly and readers interpreted my statements as broad comment about what is or isn't PII across a union of all potentially relevant laws and jurisdictions. This was in no way, shape, form, or manner my intended meaning. Again, please accept my apologies for failing to be clear. > Mouse movements may not be PII if you don't link it to a session ID, but then it would be useless in fraud detection because you don't know whose transaction you should be blocking or allowing since it's no longer traceable to a person. Maybe it's just me, but I was under the distinction impression that some patterns of input are characteristic of humans and others of inhuman actors. Is it possible that a user could be identifiable as human or inhuman without having to know which specific human an input pattern corresponds to? Have I misunderstood something?

masterfooo 7y ago

Yeah? It is clearly personally identifiable. In fact it is pyschologically identifiable when Stripe can associate that with your name, credit card, Ip address, time of the purchase, the vendor, type of the item, how you get to the store, the items you are paying for, how much time you spent on the item or the store, which links you clicked, the browser you are using, the device you are on, your location etc. Do you want me to list all the possibilities they are recording?. You are out of touch with reality here.

wpearse 7y ago

Counter-point: if your business is selling digital or physical product into New Zealand the NZ tax department requires you to collect two different types of data for the transaction that prove the customer is located in NZ. This can include IP address, phone number, address. So, in some instances, Stripe is legally required to collect some of this data.

sib 7y ago
How does an IP address (in a world with VPN) or a phone number (which is likely to be mobile and could be located anywhere in the world) "prove that the customer is located in NZ"?
- deleted 7y ago
  [deleted]