5 ms·

That's still whack-a-mole. Even if you changed the rules to selling user data, these apps would just update it in their TOS that consumers agree to without rea

That's still whack-a-mole. Even if you changed the rules to selling user data, these apps would just update it in their TOS that consumers agree to without reading. Even laws have this problem. There are so many cookie bars on websites that users just click through them anyways.

mr_toad 4y ago
You can’t agree to something illegal. If the law makes it illegal for third parties to use location data then it doesn’t matter what the TOS are.
- l33t2328 4y ago
  You’re saying it should be illegal for you to decide who can do what with your data? If I want google to sell my data in exchange for keeping Youtube free, that’s 100% my prerogative
kennywinker 4y ago
Whack-a-mole by the way the laws are written. You can write laws that aren't whack-a-mole. E.g. "it is illegal to sell or transfer user's data to another company without positive informed consent from the user within 1 month of the transfer" Every time a company wants to sell on your data, they have to email you and ask permission. Not responding to that message isn't consent. Find a loophole in that.
- runnerup 4y ago
  > Find a loophole in that. Enforcement.
- mattnewton 4y ago
  They’ll just come up with some aggregated form of the data they claim doesn’t violate the letter of the law, sell that, and be in business for years before anyone finds out let alone tries to enforce the rules and find out of they are violating it. This would honestly still be a huge improvement imo, as even forcing data brokers to anonymize or aggregate the data, even if it is ultimately not actually providing privacy, is still a recognition of the problem over the current system in most states.
- goodoldneon 4y ago
  They'll put it in an "updated terms of service" dialog. People always just accept updated terms of service just like they always just accept the initial terms of service
  - taneq 4y ago
    Especially if the terms of service are 147 pages of 6pt text containing nothing remotely concerning privacy, with a link buried in there somewhere to their privacy policy that then has some disingenuous weasel wording on page 14 which might imply that the "legitimate reason" they have for scraping your data is to sell it to third parties.
- bushbaba 4y ago
  Company A sell data to party B. Party B resells the data to party C, D, F without informing company A. Company A & B are owned by the same conglomerate. Your law as written would only cover company A doing the sale of data to B, but not the downstream intermediaries. Alternatively, company A doesn't sell the raw data, and instead sells reports and anonymized data that can easily be joined with other datasets. As this is not a sale of "user data", but an aggregated, anonymous insight.
  - deleted 4y ago
    [deleted]
  - deleted 4y ago
    [deleted]
  - jen20 4y ago
    “You may not sell the information of any person without explicit written consent for that instance of sale from that person. Aggregation counts as information. Rights are not transferable.” The data industry is full of scum - nothing less than scorched earth in advertisers and brokers is sufficient at this point.
    - orangepurple 4y ago
      I think global GDP would halve if this was implemented as written!
      - labster 4y ago
        And yet nothing of value would be lost.
        JTBooth 4y ago
        This would eliminate, like, caniuse.com, wouldn't it? Information about what browser version is used by 99% of visitors to a website is an aggregate of personal information of users of a website.
- JumpCrisscross 4y ago
  > You can write laws that aren't whack-a-mole. E.g. "it is illegal to sell or transfer user's data to another company without positive informed consent from the user within 1 month of the transfer" The problem is people are stupid and uninformed about giving consent. You're the one trying to loophole around that. If you actually want to regulate this the way you describe, you have to do it by removing peoples' right to give certain consents. For example, nobody may give consent for more than 6 months for the use or transfer of their data. This is a big deal! You're removing a free mode of contracting. But if you think about it, we do it all the time. That it has a higher burden of proceeding around new technologies is a large reason why American (where we are careful about rulemaking) and Chinese (no rule of law) tech companies are ascendant. But at a certain point, the usual rulemaking frameworks may need to be applied.
  - ABCLAW 4y ago
    >The problem is people are stupid and uninformed about giving consent. You're the one trying to loophole around that. Not really. People have a limited amount of time to deal with issues and aren't trained legally. This doesn't make them stupid. Their inability to suss out all possible downsides of a set of EULAs across various products for a service they're looking for isn't stupidity; it's just an inherently complex space that requires a lot of time and specialist knowledge. This is one of the main ideas behind consumer law; certain contracts are inherently slanted towards those who draft the contract, therefore we remove some of their freedom to abuse consumers by placing limits on the clauses we're willing to enforce. That lack of willingness to place restraints on these types of freedom has less to do with the inherent difficulty of restraining freedom of contract and has more to do with the fact that the harm is distributed diffusely amongst a massive swath of consumers, vs felt acutely by specific data aggregators so one side advocates far more for their position - even if that position is antisocial in nature.
    - mr-wendel 4y ago
      I think good arguments often have to begin with an assertion that "we aren't as dumb as we tend to think" and introduce color that gives the average person the benefit of the doubt. This post does that nicely. > "Their inability to suss out all possible downsides of a set of EULAs..." This is the part I quibble with, however. This assumes folks even read legal-speak. Privacy laws have undermined this by forcing more text and more "I see, I agree, go away" links/checkboxes/buttons in front of people. The problem isn't the EULAs, the problem is that no sane person can (or should) keep up with it. Yes, sometimes people can be surprising. My wife has an awesome t-shirt from MailChimp from a not-so-hidden "if you read this, you get a free shirt!" clause she found in their legal stuff. But relative to the amount of cheap "consent" given, this is a huge outlier. That said, I also have to give kudos to some of the lawyers I've worked with in the GDPR/CCPA/etc era. At least at the point of purchase, there was no better corporate consumer advocate of "boil it down to two or three crystal clear sentences and link to the details, which must cut to the chase" to be found.
- m463 4y ago
  The loophole is regulatory capture. The laws are written strongly, then watered down by self-interested companies throwing money at the legislative pipeline. I don't know the answer to this, but it would probably be a crisis of some sort, like cambridge analytica. It's sort of amazing how far out of hand things have gotten, with phones, cars, televisions, and more collecting data and matching it with your "dossier(s) in the cloud"
- tintor 4y ago
  user's data and any information derived from that data (ie. aggregating, or training a model on it)

mr_toad 4y ago

You can’t agree to something illegal. If the law makes it illegal for third parties to use location data then it doesn’t matter what the TOS are.

l33t2328 4y ago
You’re saying it should be illegal for you to decide who can do what with your data? If I want google to sell my data in exchange for keeping Youtube free, that’s 100% my prerogative

kennywinker 4y ago

Whack-a-mole by the way the laws are written. You can write laws that aren't whack-a-mole. E.g. "it is illegal to sell or transfer user's data to another company without positive informed consent from the user within 1 month of the transfer" Every time a company wants to sell on your data, they have to email you and ask permission. Not responding to that message isn't consent. Find a loophole in that.

runnerup 4y ago
> Find a loophole in that. Enforcement.
mattnewton 4y ago
They’ll just come up with some aggregated form of the data they claim doesn’t violate the letter of the law, sell that, and be in business for years before anyone finds out let alone tries to enforce the rules and find out of they are violating it. This would honestly still be a huge improvement imo, as even forcing data brokers to anonymize or aggregate the data, even if it is ultimately not actually providing privacy, is still a recognition of the problem over the current system in most states.
goodoldneon 4y ago
They'll put it in an "updated terms of service" dialog. People always just accept updated terms of service just like they always just accept the initial terms of service
- taneq 4y ago
  Especially if the terms of service are 147 pages of 6pt text containing nothing remotely concerning privacy, with a link buried in there somewhere to their privacy policy that then has some disingenuous weasel wording on page 14 which might imply that the "legitimate reason" they have for scraping your data is to sell it to third parties.
bushbaba 4y ago
Company A sell data to party B. Party B resells the data to party C, D, F without informing company A. Company A & B are owned by the same conglomerate. Your law as written would only cover company A doing the sale of data to B, but not the downstream intermediaries. Alternatively, company A doesn't sell the raw data, and instead sells reports and anonymized data that can easily be joined with other datasets. As this is not a sale of "user data", but an aggregated, anonymous insight.
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- jen20 4y ago
  “You may not sell the information of any person without explicit written consent for that instance of sale from that person. Aggregation counts as information. Rights are not transferable.” The data industry is full of scum - nothing less than scorched earth in advertisers and brokers is sufficient at this point.
  - orangepurple 4y ago
    I think global GDP would halve if this was implemented as written!
    - labster 4y ago
      And yet nothing of value would be lost.
      - JTBooth 4y ago
        This would eliminate, like, caniuse.com, wouldn't it? Information about what browser version is used by 99% of visitors to a website is an aggregate of personal information of users of a website.
JumpCrisscross 4y ago
> You can write laws that aren't whack-a-mole. E.g. "it is illegal to sell or transfer user's data to another company without positive informed consent from the user within 1 month of the transfer" The problem is people are stupid and uninformed about giving consent. You're the one trying to loophole around that. If you actually want to regulate this the way you describe, you have to do it by removing peoples' right to give certain consents. For example, nobody may give consent for more than 6 months for the use or transfer of their data. This is a big deal! You're removing a free mode of contracting. But if you think about it, we do it all the time. That it has a higher burden of proceeding around new technologies is a large reason why American (where we are careful about rulemaking) and Chinese (no rule of law) tech companies are ascendant. But at a certain point, the usual rulemaking frameworks may need to be applied.
- ABCLAW 4y ago
  >The problem is people are stupid and uninformed about giving consent. You're the one trying to loophole around that. Not really. People have a limited amount of time to deal with issues and aren't trained legally. This doesn't make them stupid. Their inability to suss out all possible downsides of a set of EULAs across various products for a service they're looking for isn't stupidity; it's just an inherently complex space that requires a lot of time and specialist knowledge. This is one of the main ideas behind consumer law; certain contracts are inherently slanted towards those who draft the contract, therefore we remove some of their freedom to abuse consumers by placing limits on the clauses we're willing to enforce. That lack of willingness to place restraints on these types of freedom has less to do with the inherent difficulty of restraining freedom of contract and has more to do with the fact that the harm is distributed diffusely amongst a massive swath of consumers, vs felt acutely by specific data aggregators so one side advocates far more for their position - even if that position is antisocial in nature.
  - mr-wendel 4y ago
    I think good arguments often have to begin with an assertion that "we aren't as dumb as we tend to think" and introduce color that gives the average person the benefit of the doubt. This post does that nicely. > "Their inability to suss out all possible downsides of a set of EULAs..." This is the part I quibble with, however. This assumes folks even read legal-speak. Privacy laws have undermined this by forcing more text and more "I see, I agree, go away" links/checkboxes/buttons in front of people. The problem isn't the EULAs, the problem is that no sane person can (or should) keep up with it. Yes, sometimes people can be surprising. My wife has an awesome t-shirt from MailChimp from a not-so-hidden "if you read this, you get a free shirt!" clause she found in their legal stuff. But relative to the amount of cheap "consent" given, this is a huge outlier. That said, I also have to give kudos to some of the lawyers I've worked with in the GDPR/CCPA/etc era. At least at the point of purchase, there was no better corporate consumer advocate of "boil it down to two or three crystal clear sentences and link to the details, which must cut to the chase" to be found.
m463 4y ago
The loophole is regulatory capture. The laws are written strongly, then watered down by self-interested companies throwing money at the legislative pipeline. I don't know the answer to this, but it would probably be a crisis of some sort, like cambridge analytica. It's sort of amazing how far out of hand things have gotten, with phones, cars, televisions, and more collecting data and matching it with your "dossier(s) in the cloud"
tintor 4y ago
user's data and any information derived from that data (ie. aggregating, or training a model on it)