5 ms·

Age verification is already mandated in the EU, and when you provide your credit card details to Google's age verification system for YouTube, they create a pay

Age verification is already mandated in the EU, and when you provide your credit card details to Google's age verification system for YouTube, they create a payments profile for you without consent. The Google account is set up for purchasing services across all Google properties, without needing to provide further payment details. Google is exploiting the requirement for age verification to set up Google accounts for future purchases. https://news.ycombinator.com/item?id=30699957 https://news.ycombinator.com/item?id=30699957

jmole 5y ago
Or, they’re using the only consumer-focused credit card verification system they have (google pay), and “prevent users from using their credit cards” was never on the roadmap…
- MereInterest 5y ago
  Suppose I asked you if I could borrow your car to get groceries. A week later, I take your car again and go for a road trip. You would be justified in being mad at me, because (1) the consent didn't cover the use and (2) the initial consent was for a limited time. Google has an obligation to verify age. Google also has an obligation to limit tracking of personal information to usages that have been consented to. Neither of these obligations negate the other, and if Google never put it onto their feature roadmap, that just means that Google has been negligent in fulfilling their obligations.
MereInterest 5y ago
Isn't that a pretty straightforward violation of the GDPR? Consent to track somebody's personal information requires the data subject to be informed as to the use of the information, and personal information may not be used outside of the usages that were consented to.
- srcreigh 5y ago
  The consent Google requests could be very broad. I wonder does GDPR specify different categories of consent which must be specifically and separately requested?
  - dessant 5y ago
    They did not ask for consent to set up a payments profile during age verification. Though what you're describing would also be illegal. GDPR does not allow requesting consent for such broad data processing just to fulfill a legal requirement to verify the user's age, and then denying access to the service if the user understandably refuses to give consent.
- justinclift 5y ago
  There's "the law", and there's "what big corporations will attempt to get away with anyway". Because whatever happens in court (if it gets that far), they'll have years of appeals to go, and that'll be some future Google employee's problem not the current people.
  - IMTDb 5y ago
    And there is "the law" and "the other law", often times the two being incompatible, so you're kinda left in the middle trying to kinda please both sides. Like when governments agencies ask to both "disable all tracking of what their employees do on the platform", to ensure private data and GDPR like stuff are ok. They also ask to specifically "enable full logging of all access to their data" for security reasons. So: "sed -i 's/tracker/logger/g' codebase" and everyone is perfectly happy.
sreevisakh 5y ago
Google's use of payment profiles is much more nefarious and exploitative. I recently moved from one country to another. There are a lot of apps that provide local services - like banking and public transport information. I wasn't able to install any of them. Why? My original profile is from the country of my previous residence, where I originally bought my phone. None of those apps should be geographically restricted in the first place - but they are, for some unexplained reason. I have found apps that are geographically restricted even without the knowledge of the developer. So then, how do you prove that you are in a different country? Easy, right? There are multiple sources of information that can prove your location - GPS, mobile service provider information, IP geo-location, Wifi SSID databases... . But no - none of that is enough. You have to add a local payment method! And coincidentally none of the payment methods other than credit card information works - not even the one provided by mobile service provider. So, you are forced to register your credit card information to prove your location. Now that your have proved your location and installed the essential apps you need, may be it's time to delete the credit card information. What if you accidentally subscribe to some service you didn't want? After all, you aren't subscribed to any service or bought anything with the newly entered card. So it should be easy to delete it, right? NO! You are not allowed to delete your only registered payment method! [1] Now it's open forever as a payment method for online services or Google pay. Google's tactics here are sleazy, underhanded and manipulative. And what of the complaints they receive about it? See for yourself - discussion locked and disabled! I don't know at what point their behavior is declared illegal and anti-social. [1] https://support.google.com/googleplay/thread/10797082?hl=en&msgid=25915147 https://support.google.com/googleplay/thread/10797082?hl=en&...
- b112 5y ago
  Interesting about the non delete. In Canada at least, through Visa and Mastercard, your expiry date is automatically updated with various people. This means that never expire, may be just that. https://www.bngpayments.net/automatically-update-expired-cards-and-reduce-failed-payment-methods/ https://www.bngpayments.net/automatically-update-expired-car...
- easrng 5y ago
  You could get a prepaid card and switch to that as your primary payment method. FWIW, I've removed all payment methods from my account before and it worked though I had to disable some unused Google Cloud projects I think.
markdown 5y ago
> they create a payments profile for you without consent. And? I create a "profile" in my mind of every new human I interact with, and every human I read about or hear about even without interacting with. It's a basic human function. When I gain a new business client, I create a profile of them too. This might start with a phone number, but over time, expand to include an email address, knowledge about their location, work hours, bank of choice, etc. Most businesses do this and always have. Consent isn't required for this.
- mkl 5y ago
  Storing my credit card details permanently should require separate consent. Even if a credit card is used to verify my age, once they've seen it one time, they should delete it unless I tell them to store it - it's not like I'm going to get younger or anything.
- BiteCode_dev 5y ago
  It is with a business in Europe, and rightly so. Corporations may be legally people, but they are not individuals. They are not human. And we should not treat them as such.
BiteCode_dev 5y ago
They do also other things like that: - logging to gmail on a non logged in android ? This logs the entire phone to the accounts - chrome and online google services account are intertwined

jmole 5y ago

Or, they’re using the only consumer-focused credit card verification system they have (google pay), and “prevent users from using their credit cards” was never on the roadmap…

MereInterest 5y ago
Suppose I asked you if I could borrow your car to get groceries. A week later, I take your car again and go for a road trip. You would be justified in being mad at me, because (1) the consent didn't cover the use and (2) the initial consent was for a limited time. Google has an obligation to verify age. Google also has an obligation to limit tracking of personal information to usages that have been consented to. Neither of these obligations negate the other, and if Google never put it onto their feature roadmap, that just means that Google has been negligent in fulfilling their obligations.

MereInterest 5y ago

Isn't that a pretty straightforward violation of the GDPR? Consent to track somebody's personal information requires the data subject to be informed as to the use of the information, and personal information may not be used outside of the usages that were consented to.

srcreigh 5y ago
The consent Google requests could be very broad. I wonder does GDPR specify different categories of consent which must be specifically and separately requested?
- dessant 5y ago
  They did not ask for consent to set up a payments profile during age verification. Though what you're describing would also be illegal. GDPR does not allow requesting consent for such broad data processing just to fulfill a legal requirement to verify the user's age, and then denying access to the service if the user understandably refuses to give consent.
justinclift 5y ago
There's "the law", and there's "what big corporations will attempt to get away with anyway". Because whatever happens in court (if it gets that far), they'll have years of appeals to go, and that'll be some future Google employee's problem not the current people.
- IMTDb 5y ago
  And there is "the law" and "the other law", often times the two being incompatible, so you're kinda left in the middle trying to kinda please both sides. Like when governments agencies ask to both "disable all tracking of what their employees do on the platform", to ensure private data and GDPR like stuff are ok. They also ask to specifically "enable full logging of all access to their data" for security reasons. So: "sed -i 's/tracker/logger/g' codebase" and everyone is perfectly happy.

sreevisakh 5y ago

Google's use of payment profiles is much more nefarious and exploitative. I recently moved from one country to another. There are a lot of apps that provide local services - like banking and public transport information. I wasn't able to install any of them. Why? My original profile is from the country of my previous residence, where I originally bought my phone. None of those apps should be geographically restricted in the first place - but they are, for some unexplained reason. I have found apps that are geographically restricted even without the knowledge of the developer. So then, how do you prove that you are in a different country? Easy, right? There are multiple sources of information that can prove your location - GPS, mobile service provider information, IP geo-location, Wifi SSID databases... . But no - none of that is enough. You have to add a local payment method! And coincidentally none of the payment methods other than credit card information works - not even the one provided by mobile service provider. So, you are forced to register your credit card information to prove your location. Now that your have proved your location and installed the essential apps you need, may be it's time to delete the credit card information. What if you accidentally subscribe to some service you didn't want? After all, you aren't subscribed to any service or bought anything with the newly entered card. So it should be easy to delete it, right? NO! You are not allowed to delete your only registered payment method! [1] Now it's open forever as a payment method for online services or Google pay. Google's tactics here are sleazy, underhanded and manipulative. And what of the complaints they receive about it? See for yourself - discussion locked and disabled! I don't know at what point their behavior is declared illegal and anti-social. [1] https://support.google.com/googleplay/thread/10797082?hl=en&msgid=25915147 https://support.google.com/googleplay/thread/10797082?hl=en&...

b112 5y ago
Interesting about the non delete. In Canada at least, through Visa and Mastercard, your expiry date is automatically updated with various people. This means that never expire, may be just that. https://www.bngpayments.net/automatically-update-expired-cards-and-reduce-failed-payment-methods/ https://www.bngpayments.net/automatically-update-expired-car...
easrng 5y ago
You could get a prepaid card and switch to that as your primary payment method. FWIW, I've removed all payment methods from my account before and it worked though I had to disable some unused Google Cloud projects I think.

markdown 5y ago

> they create a payments profile for you without consent. And? I create a "profile" in my mind of every new human I interact with, and every human I read about or hear about even without interacting with. It's a basic human function. When I gain a new business client, I create a profile of them too. This might start with a phone number, but over time, expand to include an email address, knowledge about their location, work hours, bank of choice, etc. Most businesses do this and always have. Consent isn't required for this.

mkl 5y ago
Storing my credit card details permanently should require separate consent. Even if a credit card is used to verify my age, once they've seen it one time, they should delete it unless I tell them to store it - it's not like I'm going to get younger or anything.
BiteCode_dev 5y ago
It is with a business in Europe, and rightly so. Corporations may be legally people, but they are not individuals. They are not human. And we should not treat them as such.

BiteCode_dev 5y ago

They do also other things like that: - logging to gmail on a non logged in android ? This logs the entire phone to the accounts - chrome and online google services account are intertwined