7 ms·

It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Servic

by Sujan 5y ago

It's not very often that each and every point in an article just feels "fabricated" or over the top. It starts with finding the page: Amazon -> Customer Service -> Search for "personal data" -> Search result #1 is "Request Your Personal Information" which nicely explains what to do and links directly to that page. The need to verify or activate a data request via clicking a link? Of course required so some third party can not just request your data to your inbox (and process it along the way) without you actually wanting to do that. All the mentions that most of the data is available in your Amazon account? Well, what many people are looking for (order history etc) is and even nicely formatted, searchable and cross linked to make it much more convenient. Clicking "Remove address" only removes it from the list of addresses? Of course, addresses you ordered to in the past can not be deleted as they have to legally be stored together with other order information. And the list goes on and on. I get that it is scary that a big company keeps all the data you gave to them. And it is also unfortunate for you that it is not their business goal to make it instant and pretty for you to look at all the data. But there is no reason for them to do that. If you don't want Amazon to have your data, don't user Amazon. When you use Amazon, the way you can get a lot of data from them is actually pretty good (also compared to other companies which pretent search history does not exist and so on). (And bye to some Hacker News points. This will get nicely downvoted I suspect.)

jen20 5y ago
> But there is no reason for them to do that. If that is not their business goal, perhaps the GDPR needs to be strengthened and strongly enforced until it is.
- Sujan 5y ago
  That is certainly a political decision that can be made, I agree and would actually be happy about that. If that happens, I am sure Amazon will invest the time and money to comply with that. At the same time it will put many smaller business out of business though, as they do not have the resources to do that. Even the current state of having to fulfill data requests is quite a problem for mayn of them.
  - GekkePrutser 5y ago
    Those smaller businesses will just use a standard webshop package that will incorporate this feature because most of their customers will want it.. The same way these companies use stuff like Magento or PrestaShop instead of rolling their own.
    - janpio 5y ago
      Exactly. But that will something additional they will have to buy (and install, and maintain) if GDPR would include to "make it instant and pretty for you to look at all the data.". Because that is what the parent discussion was about.
      - GekkePrutser 5y ago
        Hmm I doubt it really. I think most webshops will just include this feature.
  - jen20 5y ago
    > they do not have the resources to do that. Good - the aim is for them to not store personal data in the first place, much less build business models that rely upon it. Rather than allowing the population to take on the negative externality of surveillance capitalism, it is absolutely right that the burden must fall on those creating the problem. I don't see this as any different to the complain that small restaurants cannot afford to pay their workers - if they can't afford to comply, they can't afford to be in business at all. It's simply a margin problem.
    - mindslight 5y ago
      You're giving the argument too much credit. It's more akin to a large restaurant arguing that small restaurants could be put out of business by health inspections, so maybe we should hold off on the idea. Rather, keeping a clean kitchen is something they all should be doing anyway from the get go. Any pain for Amazon in Amazon's process is entirely Amazon's fault. If systems are built with the requirement of letting users export their data, then the additional effort to do so is trivial. This argument about the GDPR essentially boils down to technical debt from companies that played fast and loose with personal information, and we shouldn't entertain it.
onphonenow 5y ago
Agreed, I have successfully downloaded my order history from the beginning of my account, very interesting to look through. Though I'm not sure why I was buying solaris books in 1999 :) Others like enders game I still remember.
lelandfe 5y ago
> each and every point in an article just feels "fabricated" or over the top. What I thought were valid points from the article: - Unclear data: "cryptic strings of numbers like '26,444,740,832,600,000” for various search queries." This is easily the worst offender IMO. - A wait time of 19 days - Separating the download into 74 buttons
- xhkkffbf 5y ago
  Yup. I agree. The wait time doesn't make sense. They should be able to spin up extra servers from the spot market in seconds. Even if they're using Glacier, that should only be a few hours. I wonder if they execute the 74 data queries in serial to drag it out. And the multiple downloads is just bogus. That being said, I agree with the general point that the article is a bit overly dramatic. Amazon does a pretty good job with the request. It just takes too long.
  - encoderer 5y ago
    I helped build a system for privacy compliance at a large non-faang tech company. Honestly 19 days seems crazy but this is what we dealt with: It’s 2018 and you have to bolt this mass export/delete on every stateful service in your company. Many of these are “critical” services that are not actively worked on and have a very limited maintenance budget. That is, some team with a lot of existing responsibilities absorbed it along the way and they have no bandwidth for it. So in some cases their mechanisms for retrieval/deletion were pretty egregious and so we agreed on a rate limit and we would queue these requests up and handle all of the paperwork. You get 30 days to comply and if you need another 30 all you have to do is send an update within the first 30. So, quite possibly, they have a rate limit and a queue on at least a handful of backend services and it truly truly does not matter as long as the queue is under 60 days.
  - blip54321 5y ago
    I've worked at an organization with a similar timeframe for some types of data requests (B2B, not GDPR-style ones). There were many parts of the organization which were mismanaged, but that wasn't one of them. That type of data request ("get all my data") involved walking through all the data we had. It wasn't indexed in a way which made it easy to grab. This was an expensive batched job we ran monthly. We spun up a cluster of cloud machines. A map-reduce style operation would organize the data by customer. We'd ship it off to all the customers who requested it that month. Adding appropriate indexes or similar would have been man-years of engineering work. This involved, for example, walking through server logs line-by-line and seeing which ones were associated with which customer. There wasn't a compelling business case to do that. For normal operations, once a month was fine. If a customer had a particular need,, we could hypothetically do a one-off request out-of-line, but customers used the data for types of analytics where a one-month delay wasn't an issue. I know of other pipelines with similar delays, for example, due to lack of automation. A person runs a task once a month, and automation would cost more than a person. I won't chalk this up to dark patterns, so much as speeding things up having zero business value to Amazon. I just walked through the process, and at least the first two steps seemed very normal. Amazon sometimes does outrageous things, but here, I saw nothing to get outraged about.
naoqj 5y ago
>I get that it is scary that a big company keeps all the data you gave to them. Situation in 2022: it is scary that someone has something I willingly gave them.
- jjulius 5y ago
  Define "willing" in this context, though. You, myself and most people on HN have a really good idea of what data we willingly give Amazon, while the average person does not. Is it really an accurate statement that people willingly give them their data when they don't actually know what they're giving?
  - naoqj 5y ago
    What data does Amazon have that you haven't given them?
    - jjulius 5y ago
      You're misunderstanding. I will rephrase: You said that everyone "willingly" gives Amazon their data. The average person does not know what kind of data Amazon collects on them, therefore I am positing that it's not fair to say that they are willingly giving it over.
      - naoqj 5y ago
        Do you think that if you asked random people something like... "Do you think that Amazon stores a list of the items that you have bought from them and the addresses where they sent them" ...the majority would say no?
        jjulius 5y ago
        And if you asked them to tell you every other bit of data Amazon collects on them, do you think they would be able to tell you what all of that is? Because common knowledge within the tech community - and as evidenced in the article we are discussing - make very clear that that's not the only data they gather on you.
msrenee 5y ago
That search you suggested doesn't appear to exist in the app. You mind telling me how to access this data through the app if it's so easy?
- Sujan 5y ago
  For me (amazon.de, EN language setting): Open app -> "More" burger menu botton right (three horizontal lines stacked on top of each other) -> Scroll down to "Customer service" -> Scroll down to search feature -> "Personal Information" -> #1. I think this is really just a webview to the same part of the website with a different design. Takes a bit more tapping and scrolling than clicking on desktop, but that is more he fault of the smaller screen and how apps work I would guess.
  - msrenee 5y ago
    Ah, it was only like 5 options deep and then it gave me a chat "assistant" which I used to search the term "my data" which gave me the link and the drop down box mentioned in the article to scroll to the bottom of to request my data. Which sent an email to my husband's email address that I need to open to confirm the request. Super easy. Not hidden at all.
dylan604 5y ago
>The need to verify or activate a data request via clicking a link? Of course required so some third party can not just request your data to your inbox (and process it along the way) without you actually wanting to do that. You mean like some data hoarding company that offers free email that scans all of your messages to provide better "sorting", provide quickly accessible Tracking buttons, or similar features? Would something like that be considered doing evil? >(And bye to some Hacker News points. This will get nicely downvoted I suspect.) meh. The loss of 4 points is nothing when making valid points
latexr 5y ago
> And bye to some Hacker News points. The lowest score you can get on a comment is -4 (https://github.com/minimaxir/hacker-news-undocumented#downvoting-comments https://github.com/minimaxir/hacker-news-undocumented#downvo...). > This will get nicely downvoted I suspect. Complaining about downvotes before they happen is more likely to get you downvotes than anything else you wrote in that post.
- Sujan 5y ago
  Oh, I did not know that. Thanks. A bit less "aversion" then for the future. My last sentence was triggered by having written a comment on another comment first, which insantly went to -3 (but later kinda recovered), so I almost didn't write this one, just not to have to get the negative feeling. It's a nice Sunday after all.
  - inopinatus 5y ago
    Don't sweat it. None of us will lay upon our death-beds wishing we had scored more points in an internet popularity contest. Sometimes a downvote is because you made a salient and equitable point that threatened someone's cookie jar, an angry conservative enraged that someone expressed a progressive view (and vice versa), some humourless bastard who failed or declined to recognise what you thought to be in obvious jest, or a narcissistic asshole incensed that you dared observe their poor behaviour. These you may consider to be upvotes in disguise. Notwithstanding all this, I suspect you will also discover there's a strong current of support for those surgically dismantling yellow journalism.
PragmaticPulp 5y ago
> Clicking "Remove address" only removes it from the list of addresses? Of course, addresses you ordered to in the past can not be deleted as they have to legally be stored together with other order information. I agree. The author set out with an agenda and spun every step of the process in the most negative way they could come up with. There are some legitimate complaints (wait time, for example) but it’s hard to take these articles seriously when it’s clear that the author started with a conclusion and tried to work backward to build a story around it. Sadly, these articles get a lot of clicks and shares because “your data” has become a nebulous scare phrase in journalism and Amazon is a popular company to hate right now. That said, I bet if any one of our own employers was subjected to the same treatment by the same author with the same agenda, we wouldn’t come out much better. If someone wants to smear a company, they will. Data export can be very confusing for end users, especially when they discover things like their shipping record with old addresses isn’t deleted when they remove the address from their address book. The old shipping records are necessary for everything from customer support to warrant claims to fraud detection to recall notices to regulatory compliance. Trying to shame Amazon for literally just keeping shipping records is bananas.
deleted 5y ago
[deleted]

by Sujan 5y ago

jen20 5y ago

> But there is no reason for them to do that. If that is not their business goal, perhaps the GDPR needs to be strengthened and strongly enforced until it is.

Sujan 5y ago
That is certainly a political decision that can be made, I agree and would actually be happy about that. If that happens, I am sure Amazon will invest the time and money to comply with that. At the same time it will put many smaller business out of business though, as they do not have the resources to do that. Even the current state of having to fulfill data requests is quite a problem for mayn of them.
- GekkePrutser 5y ago
  Those smaller businesses will just use a standard webshop package that will incorporate this feature because most of their customers will want it.. The same way these companies use stuff like Magento or PrestaShop instead of rolling their own.
  - janpio 5y ago
    Exactly. But that will something additional they will have to buy (and install, and maintain) if GDPR would include to "make it instant and pretty for you to look at all the data.". Because that is what the parent discussion was about.
    - GekkePrutser 5y ago
      Hmm I doubt it really. I think most webshops will just include this feature.
- jen20 5y ago
  > they do not have the resources to do that. Good - the aim is for them to not store personal data in the first place, much less build business models that rely upon it. Rather than allowing the population to take on the negative externality of surveillance capitalism, it is absolutely right that the burden must fall on those creating the problem. I don't see this as any different to the complain that small restaurants cannot afford to pay their workers - if they can't afford to comply, they can't afford to be in business at all. It's simply a margin problem.
  - mindslight 5y ago
    You're giving the argument too much credit. It's more akin to a large restaurant arguing that small restaurants could be put out of business by health inspections, so maybe we should hold off on the idea. Rather, keeping a clean kitchen is something they all should be doing anyway from the get go. Any pain for Amazon in Amazon's process is entirely Amazon's fault. If systems are built with the requirement of letting users export their data, then the additional effort to do so is trivial. This argument about the GDPR essentially boils down to technical debt from companies that played fast and loose with personal information, and we shouldn't entertain it.

onphonenow 5y ago

Agreed, I have successfully downloaded my order history from the beginning of my account, very interesting to look through. Though I'm not sure why I was buying solaris books in 1999 :) Others like enders game I still remember.

lelandfe 5y ago

> each and every point in an article just feels "fabricated" or over the top. What I thought were valid points from the article: - Unclear data: "cryptic strings of numbers like '26,444,740,832,600,000” for various search queries." This is easily the worst offender IMO. - A wait time of 19 days - Separating the download into 74 buttons

xhkkffbf 5y ago
Yup. I agree. The wait time doesn't make sense. They should be able to spin up extra servers from the spot market in seconds. Even if they're using Glacier, that should only be a few hours. I wonder if they execute the 74 data queries in serial to drag it out. And the multiple downloads is just bogus. That being said, I agree with the general point that the article is a bit overly dramatic. Amazon does a pretty good job with the request. It just takes too long.
- encoderer 5y ago
  I helped build a system for privacy compliance at a large non-faang tech company. Honestly 19 days seems crazy but this is what we dealt with: It’s 2018 and you have to bolt this mass export/delete on every stateful service in your company. Many of these are “critical” services that are not actively worked on and have a very limited maintenance budget. That is, some team with a lot of existing responsibilities absorbed it along the way and they have no bandwidth for it. So in some cases their mechanisms for retrieval/deletion were pretty egregious and so we agreed on a rate limit and we would queue these requests up and handle all of the paperwork. You get 30 days to comply and if you need another 30 all you have to do is send an update within the first 30. So, quite possibly, they have a rate limit and a queue on at least a handful of backend services and it truly truly does not matter as long as the queue is under 60 days.
- blip54321 5y ago
  I've worked at an organization with a similar timeframe for some types of data requests (B2B, not GDPR-style ones). There were many parts of the organization which were mismanaged, but that wasn't one of them. That type of data request ("get all my data") involved walking through all the data we had. It wasn't indexed in a way which made it easy to grab. This was an expensive batched job we ran monthly. We spun up a cluster of cloud machines. A map-reduce style operation would organize the data by customer. We'd ship it off to all the customers who requested it that month. Adding appropriate indexes or similar would have been man-years of engineering work. This involved, for example, walking through server logs line-by-line and seeing which ones were associated with which customer. There wasn't a compelling business case to do that. For normal operations, once a month was fine. If a customer had a particular need,, we could hypothetically do a one-off request out-of-line, but customers used the data for types of analytics where a one-month delay wasn't an issue. I know of other pipelines with similar delays, for example, due to lack of automation. A person runs a task once a month, and automation would cost more than a person. I won't chalk this up to dark patterns, so much as speeding things up having zero business value to Amazon. I just walked through the process, and at least the first two steps seemed very normal. Amazon sometimes does outrageous things, but here, I saw nothing to get outraged about.

naoqj 5y ago

>I get that it is scary that a big company keeps all the data you gave to them. Situation in 2022: it is scary that someone has something I willingly gave them.

jjulius 5y ago
Define "willing" in this context, though. You, myself and most people on HN have a really good idea of what data we willingly give Amazon, while the average person does not. Is it really an accurate statement that people willingly give them their data when they don't actually know what they're giving?
- naoqj 5y ago
  What data does Amazon have that you haven't given them?
  - jjulius 5y ago
    You're misunderstanding. I will rephrase: You said that everyone "willingly" gives Amazon their data. The average person does not know what kind of data Amazon collects on them, therefore I am positing that it's not fair to say that they are willingly giving it over.
    - naoqj 5y ago
      Do you think that if you asked random people something like... "Do you think that Amazon stores a list of the items that you have bought from them and the addresses where they sent them" ...the majority would say no?
      - jjulius 5y ago
        And if you asked them to tell you every other bit of data Amazon collects on them, do you think they would be able to tell you what all of that is? Because common knowledge within the tech community - and as evidenced in the article we are discussing - make very clear that that's not the only data they gather on you.

msrenee 5y ago

That search you suggested doesn't appear to exist in the app. You mind telling me how to access this data through the app if it's so easy?

Sujan 5y ago
For me (amazon.de, EN language setting): Open app -> "More" burger menu botton right (three horizontal lines stacked on top of each other) -> Scroll down to "Customer service" -> Scroll down to search feature -> "Personal Information" -> #1. I think this is really just a webview to the same part of the website with a different design. Takes a bit more tapping and scrolling than clicking on desktop, but that is more he fault of the smaller screen and how apps work I would guess.
- msrenee 5y ago
  Ah, it was only like 5 options deep and then it gave me a chat "assistant" which I used to search the term "my data" which gave me the link and the drop down box mentioned in the article to scroll to the bottom of to request my data. Which sent an email to my husband's email address that I need to open to confirm the request. Super easy. Not hidden at all.

dylan604 5y ago

>The need to verify or activate a data request via clicking a link? Of course required so some third party can not just request your data to your inbox (and process it along the way) without you actually wanting to do that. You mean like some data hoarding company that offers free email that scans all of your messages to provide better "sorting", provide quickly accessible Tracking buttons, or similar features? Would something like that be considered doing evil? >(And bye to some Hacker News points. This will get nicely downvoted I suspect.) meh. The loss of 4 points is nothing when making valid points

latexr 5y ago

> And bye to some Hacker News points. The lowest score you can get on a comment is -4 (https://github.com/minimaxir/hacker-news-undocumented#downvoting-comments https://github.com/minimaxir/hacker-news-undocumented#downvo...). > This will get nicely downvoted I suspect. Complaining about downvotes before they happen is more likely to get you downvotes than anything else you wrote in that post.

Sujan 5y ago
Oh, I did not know that. Thanks. A bit less "aversion" then for the future. My last sentence was triggered by having written a comment on another comment first, which insantly went to -3 (but later kinda recovered), so I almost didn't write this one, just not to have to get the negative feeling. It's a nice Sunday after all.
- inopinatus 5y ago
  Don't sweat it. None of us will lay upon our death-beds wishing we had scored more points in an internet popularity contest. Sometimes a downvote is because you made a salient and equitable point that threatened someone's cookie jar, an angry conservative enraged that someone expressed a progressive view (and vice versa), some humourless bastard who failed or declined to recognise what you thought to be in obvious jest, or a narcissistic asshole incensed that you dared observe their poor behaviour. These you may consider to be upvotes in disguise. Notwithstanding all this, I suspect you will also discover there's a strong current of support for those surgically dismantling yellow journalism.

PragmaticPulp 5y ago

> Clicking "Remove address" only removes it from the list of addresses? Of course, addresses you ordered to in the past can not be deleted as they have to legally be stored together with other order information. I agree. The author set out with an agenda and spun every step of the process in the most negative way they could come up with. There are some legitimate complaints (wait time, for example) but it’s hard to take these articles seriously when it’s clear that the author started with a conclusion and tried to work backward to build a story around it. Sadly, these articles get a lot of clicks and shares because “your data” has become a nebulous scare phrase in journalism and Amazon is a popular company to hate right now. That said, I bet if any one of our own employers was subjected to the same treatment by the same author with the same agenda, we wouldn’t come out much better. If someone wants to smear a company, they will. Data export can be very confusing for end users, especially when they discover things like their shipping record with old addresses isn’t deleted when they remove the address from their address book. The old shipping records are necessary for everything from customer support to warrant claims to fraud detection to recall notices to regulatory compliance. Trying to shame Amazon for literally just keeping shipping records is bananas.

deleted 5y ago

[deleted]