8 ms·
Ask Microsoft: Are you using our personal data to train AI?
- Takennickname 3y agoNo one from the US is going to see this.
- deleted 3y ago[deleted]
- gremlinsinc 3y agoI'm in Utah, I saw it.
- pbhjpbhj 3y agoPeople work for MS in Europe. There might be separate questions for different regions too?
- diarrhea 3y agoIf we need to ask, don't we know the answer?
- fxtentacle 3y agoIf nine experts in privacy can't understand what Microsoft does with your data, then in my opinion a court should step in and declare it void so that Microsoft isn't allowed to use any private data until they get their act together. If it's so vague that it becomes meaningless that should default to granting no rights. Otherwise, why not publish your all-rights-granting privacy policy in Klingonian in a locked drawer in a toilet basement? ;)
- pbhjpbhj 3y agoIt sounds like I might be OOTL, has there been recent legal action relevant to this?
- Cthulhu_ 3y ago> then in my opinion a court should step in and declare it void so that Microsoft isn't allowed to use any private data until they get their act together. I hear what you're driving at, but "a court" cannot be both prosecutor and judge at the same time. This page is about that, possibly starting a civil suit to have a judge look at this and act accordingly.
- j245 3y agoThe true failure is government. Mozilla shouldn’t have to lead this. The prosecutor should be the regulator.
- tmpX7dMeXU 3y agoAmerica reaps what America sows.
- FridgeSeal 3y agoWouldn’t have too much of an issue with this if it was confined to America, but unfortunately it’s not. So basically “the rest of us suffer what America sows”
- boredumb 3y ago
- hsoovp 3y agoAh yes, Mozilla, the most respectful company when it comes to personal data.
- dudus 3y agoWhile we are talking about it... can we make ToS ilegal? Why do we have to abide by rules while browsing the web? Why do businesses fear litigation so much, they hire lawyers to write and maintain a huge document nobody can ever read or understand? This is failure from governments that can't set basic rules for human interaction. All this
- Cthulhu_ 3y ago> Why do we have to abide by rules while browsing the web? Are you serious?
- beebeepka 3y ago> While we are talking about it... can we make ToS ilegal? What does that even mean? Laws trump Terms of service/agreements and contracts of any kind. Do they not?
- ropintus 3y agoI think he meant that instead of each company creating their own ToS, the government should set the standard or limitations on what a company can do. > Laws trump Terms of service/agreements and contracts of any kind. Web is not regulated by the government.
- beebeepka 3y ago"The government"? Which one? Some governments do regulate certain aspects of the web directly. All companies have to do is abide the local rules set by regulations, if such exist. And some very much do. Maybe not in your jurisdiction? I think you two have things backwards
- ropintus 3y ago> All companies have to do is abide the local rules set by regulations The point being that there are not enough regulations. One feature that I wish exist is the option to completely erase your account on a particular website along with the data they have collected from you (there can a waiting time of few months before they erase it from their servers). This feature can only be bought out by government regulation because most websites don't have the incentive.
- Liquix 3y agoHow does M$'s legal team accomplish such a feat? Are there layers of linguistic abstraction built up such that only a sufficiently large team (Microsoft, grand jury) has the bandwidth to extract any meaning? Red herrings with gotchas hidden in seemingly innocuous places? Do they just talk in circles and never give an exact answer?
- lucasRW 3y agoPast a certain number of millions of dollars, a team of lawyer is effectively a legal red team who is tasked with finding bypasses (and will find them) around the restrictions in place.
- nottheengineer 3y agoMaybe governments should hire actual red teams to look for those loopholes.
- happymellon 3y agoOr pass the rules that state that if there is no expectation that a layman could understand it, you can't enforce a contract against them.
- no-reply 3y agoI think the the 10th amendment, would be a better template to start with.
- happymellon 3y agoIm not sure what you mean. I wasn't stating that it had to be a federal law.
- reaperducer 3y agoHow does M$'s legal team accomplish such a feat? Who's going to stop them?
- ceva 3y agoOf course, it is going to use it, else you won't be able to use any of their products ... the sad world we are living in
- skilled 3y agoSamsung's ToS, > The Sites may allow you to share things like comments, photos, messages, or documents with us or with other users. When you share content, you continue to own the intellectual property rights to your content and you are free to share the content with anyone else wherever you want. However, to use your content on our Sites, you need to grant us a license for any content that you create or upload using our Sites. When you upload, transmit, create, post, display or otherwise provide any information, materials, documents, media files or other content on or through our Sites (“User Content”) you grant us an irrevocable, unlimited, worldwide, royalty-free, and non-exclusive license to copy, reproduce, adapt, modify, edit, distribute, translate, publish, publicly perform and publicly display the User Content (“User Content License”), to the full extent allowed by Applicable Law. It's my understanding that "Sites" is all Samsung products as it is vaguely referenced in the ToS itself. https://www.samsung.com/us/common/legal/ https://www.samsung.com/us/common/legal/
- deleted 3y ago[deleted]
- SushiHippie 3y ago> These Terms of Use (“Terms”) apply to your use of this website, any associated mobile sites, services, applications, or platforms (“Sites”). Correct But this is only for the US, for example the German TOS is very short and does not state that and is only for the Website and Remote Services. I think that each app (or at least some subgroups of products) has/have its on TOS EDIT: Nevermind, I found the "real" TOS ("AGB") for germany https://terms.account.samsung.com/contents/legal/deu/deu/general.html https://terms.account.samsung.com/contents/legal/deu/deu/gen... It also states the same And these are the services that the TOS ("AGB") cover: https://terms.account.samsung.com/contents/legal/deu/deu/associated_services.html https://terms.account.samsung.com/contents/legal/deu/deu/ass...
- heisenbit 3y agoThe problem is that in order to do anything even slightly meaningful like displaying profile pictures you need to grant the right to store and process. Since it is hard to keep track of distributed data at scale and some data being quoted by other users you need these rights indefinitely. The problem is of course the generalization of data in conjunction with generalized rights gives away de-facto everything. On the other hand narrower general terms risk creating liabilities for companies. I don‘t think building rules based on low level technical functions for a portfolio of high level applications is feasible. Honest actors in their natural interest to self protect have created a legal framework which allows bad behavior by bad actors (or their future bad selves). Not sure how a future framework could look like but the evolution of RBAC may give some clues. Data probably needs to be labeled. Processing needs to be tied to intent. Acknowledging that rules for larger datasets must exist and need to differ by size.
- ldjb 3y agoFor reference, here is the text of Microsoft's upcoming Services Agreement: https://www.microsoft.com/en-us/servicesagreement/upcoming.aspx https://www.microsoft.com/en-us/servicesagreement/upcoming.a... And here is their summary of what has changed: https://www.microsoft.com/en-us/servicesagreement/upcoming-updates https://www.microsoft.com/en-us/servicesagreement/upcoming-u...
- layer8 3y agoIt still contains the sentence “to improve Microsoft products and services, you grant to Microsoft a worldwide and royalty-free intellectual property license to use Your Content.” The only explicit limitation is asserted with respect to targeted advertising: “We do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files, to target advertising to you.” The Summary of Changes doesn’t mention any changes to the Privacy Statement, which in turn doesn’t seem to exclude training AI models on user data.
- tinus_hn 3y agoTraining a Microsoft AI could quite literally be considered ‘improving Microsoft products and services’.
- layer8 3y agoExactly.
- mannykannot 3y agoPrecisely - and there are at least two problems (for the end user) here: Firstly, the subordinate clause ("to improve Microsoft products and services...") does not impose any constraint on what is actually being granted here ("you grant to Microsoft a worldwide and royalty-free intellectual property license to use Your Content") - the end user is granting nothing less than they would be if the subordinate clause were not there. Secondly, there is no suggestion that the "improvements" will benefit the end user. It is, of course, entirely possible that the user's content could be used to benefit other users of Microsoft's products and services in a way that is detrimental to the owner/provider of that content. If the subordinate clause has any purpose other than to suggest to the end user that Microsoft is imposing a benign and reasonable demand here, I do not see it.
- Silhouette 3y agoThis has been my objection to Microsoft's maze-like privacy policies for a long time. I once asked - on another forum and before the recent "AI" coding assistants were widely available - whether Microsoft's privacy policy allowed them to upload and do things with your own code if you used VS Code with telemetry enabled. At the time I was downvoted to invisibility and told I was being silly. But not one person showed me anywhere in Microsoft's terms or privacy policy wording that limited the scope of the data processing clearly and transparently to exclude that kind of thing. Today there's a bit of an obsession with training ML models using any large data set available and perhaps my caution from yesteryear wouldn't look so silly to the critics now.
- dspillett 3y ago> But not one person showed me anywhere in Microsoft's terms or privacy policy wording that limited These policies don't exist to tell you what they are limiting themselves to. These documents exist as a defence to use against you (because you agreed to the policy by continuing to use their services) if you try to stop them doing something. Unless for some reason there is commercial or legal advantage in saying “we will not to X”, a large company will never knowingly impose such limits on itself.
- Silhouette 3y agoFortunately since I'm in the UK the legal position is rather more enlightened. The default is that any processing of personal data is not allowed and they have to justify it and explain their justification. Of course even if they flagrantly ignore the rules and carry on while treating any fines as a cost of doing business - which is hardly unusual in GDPR world for certain big tech companies - there is only so much you can do as one individual and you still need the regulators to step in and enforce the rules with meaningful sanctions.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- edblock 3y agoCould this also affect the self hosted ChatGPT in Azure? Trying to convince everyone to host a model themselves so they can use that data...
- Aachen 3y ago> We had four lawyers, three privacy experts, and two campaigners look at Microsoft's new Service Agreement, which will go into effect on 30 September, and none of our experts could tell if Microsoft [will use your data] to train its AI models. * in the USA, I assume? With GDPR, if it's not a defined goal then the answer is no. In the USA, I hear things of some states having a similar law now but as a blanket statement without defined region (not even country) I'm not surprised if you can't give a definitive "no".
- dna_polymerase 3y agoI think what these types of contracts show is that companies at Microsoft's level don't give a sh*t about national or over-regional regulation. They will use your data, and while you're busy reading 100s of pages of mumbo-jumbo they already have their models about you in place and sell access to it on a PPC basis. And this is especially true with GDPR. Google's revenues are still growing, the advertising companies are fine, we all just have to click a few more cookie banners nowadays.
- 5636588 3y agoDefeatism and cynicism are simply excuses for complacency. If you think companies like Microsoft are exploiting your data, don't just whine about it; take action. Your passivity won't stop them; stricter regulations and public pressure will. Just the other day, Microsoft decided to decouple Teams from the Office Suite in an attempt to preempt a potential antitrust penalty from the European Union. It's just one example of how a regulatory body can influence how companies conduct their business.
- c4mpute 3y agoOn the one hand, yes, in that one example it worked. After quite a while, during which the competition already suffered massively. On the other hand, triple nope. E.g. the council of German GDPR enforcers declared most of Windows and Microsoft Office unfit for use in public offices and companies. https://www.wbs.legal/it-und-internet-recht/datenschutzrecht/microsoft-365-dsgvo-konformer-einsatz-moeglich-57217/ https://www.wbs.legal/it-und-internet-recht/datenschutzrecht... or https://datenschutzbeauftragter-dsgvo.com/dsgvo-teil-2-microsoft-office-365-nicht-dgsvo-konform-fuer-schulen/ https://datenschutzbeauftragter-dsgvo.com/dsgvo-teil-2-micro... But nobody cares, everyone just ignores those kinds of decisions and continues to not get fined because as especially the second link shows, "its complicated". Nobody even knows which agreements with Microsoft are actually valid for which license, software and situation. At the same time, for all the office drones, Microsoft software is just "the standard" and nobody even considers switching. It is just a complete refusal to get compliant by all the public offices, let alone private companies.
- dspillett 3y agoIf they don't explicitly say in the ToS that they aren't going to use it in any particular way, then you can be sure that they are if there is potential for commercial gain. Even if they do explicitly say that they aren't going to use it, I'm going to be sceptical. There will be a nice pile of caveats and exclusions within the legalese, and if not they might just use it anyway and hope they can afford to ride out any resulting legal action if people notice.
- nottheengineer 3y agoThe fact that phones eavesdrop on conversations and turn those into relevant ads within minutes is reason enough for me to believe that they will use the data regardless of what their privacy policy says.
- deleted 3y ago[deleted]
- 1vuio0pswjnm7 3y ago"130 products" Does that include LinkedIn. What stops LinkedIn from sharing data with Microsoft.
- Alifatisk 3y agoLinkedIn is owned by M$, you draw the conclusion.
- Rastonbury 3y agoNothing at all, it's a MS product and straight up integrated with their CRM
- layer8 3y agoIncidentally: https://www.howtogeek.com/816348/did-you-know-shiftctrlaltwinl-opens-linkedin-on-windows/ https://www.howtogeek.com/816348/did-you-know-shiftctrlaltwi...
- charcircuit 3y ago>and none of our experts could tell if Microsoft plans on using your personal data to train its AI models This means nothing. You don't know if someone is going to do something unless they say they are going to do it. No one knows if Bethesda is going to take down every video of Starfield on Youtube tomorrow that is monetized with ads. Sure you can speculate what someone will do, but you will never know for sure.
- zoobab 3y agoSo they will add a clause in their contract.
- dm319 3y agoSo much of modern technology is a trojan horse these days. This is basically the enshittification of cloud services. Just a few years ago people would say you were being a little paranoid if you were worried about your data passing through company's servers unencrypted, but here we are now. If companies do start training models on what people consider to be private documents, then the issues we already have with AI taking the jobs and purposes of humans is going to become significantly worse. Scientists working on papers will essentially not be able to trust that their work won't get out before they have published it. A competing research team, asking prompts in the right way, could chance upon a reply that gives them a clue as to what the other team have found or are doing. The same goes for competing companies and engineering teams. Or authors writing the next book in a series. Other people using that trained data could produce a cheap rip-off of that next paper, patent, book using AI. And that will completely demotivate humans to actually do stuff. Because what's the point? No one will pay you for it, and a poor quality second rate product is obtainable much cheaper. At that point I think we'll discover what the real limitations of AI are, as we, as a society, have to get used to using it over humans. And I somehow doubt we will be better off.
- deleted 3y ago[deleted]
- nonrandomstring 3y ago> Scientists working on papers will essentially not be able to trust that their work won't get out before they have published it. For a long time already there's been a possibility for your work to "get out" (patented etc) before you've even finished working on it. How did Google (and other big-tech entities) get to be the most powerful bodies on Earth? When Google positioned themselves as "the search engine" they obtained more than a little digital privilege. The ability to observe everything someone is searching, over a long time period, is also the ability to anticipate their moves and intentions. That's put competitors and researchers at a huge disadvantage. Researchers and competitors signal their intentions, perhaps quite unknowingly, long before they even have a clear idea of what they're doing themselves. Of course AI only exacerbates this a million-fold. And surely what I'm saying is a decade behind the curve for anyone who is paying attention to the world. If you have a business in tech, and are therefore a direct competitor of at least one major big-tech entity, you should not be using their services. Instead think about on-prem and local compute solutions for your most sensitive work, and relay all your search out via Tor hidden services or other mixnets for maximum diffusion .
- chepy 3y agoHow can we define "personal" data? Is data from public LinkedIn accounts considered personal? However, I believe that our Office 365 personal data should be prohibited from being used to train AI, as it is sensitive information.
- orwin 3y agoThe easy solution would be that everything created by IA (code, books, letters, art) should be licensed creative common (or something more akin to AGPL). Idc if you use my code to write your own, but you have to share it too.
- say_it_as_it_is 3y agoWould Microsoft really risk training data by government administration? It generates billions in revenue from government accounts and the vast industry supporting government that is compelled to use Microsoft products.
- layer8 3y agoI’m sure they have different ToS for government contracts, like they do for enterprise customers.
- Lio 3y agoBased on previous legal battles at Microsoft, yes they would. Microsoft chance their arm on anything they think they can get away with. They think they are too big to fail
- NhanH 3y agoThe market thinks they are too big to fail as well. For a while they had better credit rating than the US government.
- K0balt 3y agoIf it does not specifically exclude that use, then you can be assured that eventually that data will be used in training if it’s useful. If not now, then eventually. That goes for every company warehousing data on the planet. This should be everyone’s base assumption, and should be basically accurate unless laws are put in place, but even then jurisdictional bypass may make them irrelevant for historical data and will only weakly protect new data. Welcome to the new oil.
- nologic01 3y agoThe regulatory architecture of "big tech" is an unmitigated disaster. You can't have two entities effectively control every touching point with the digital domain for a major fraction of the planet. There is absolutely no reason to trust that they will not abuse this position in opaque and impossible to trace ways. These are trillion-dollar powered for-profit entities, with armies of lawyers and lobbyists that can intimidate medium sized countries. They will exploit every weakness of incompetent, confused and captured regulatory/political systems. Because that's what they are legally obliged to do for their shareholders. And these shareholders care zilch if this duopolistic - fingers in all honeypots - design undermines our entire digital future. They just want some tech "winners" in their portfolios. The longer nothing serious is done the harder it becomes to do anything.
- justinclift 3y ago> they are legally obliged to do for their shareholders Isn't that an "old wives tale" that doesn't have any basis in reality?
- nologic01 3y agoAlas it does. Think, e.g. about the backlash against asset managers for pursuing sustainability agendas. Closer to the topic, think also about the "furore" and supposed panic at Google that they are not capitalizing (literally) on their AI leadership.
- justinclift 3y ago> pursuing sustainability agendas My impression is that the "sustainability agendas" these asset managers were pursuing turned out to be er... mostly bullshit. Along the lines of companies "green washing" stuff that was not in fact green. Also stuff marketed as "socially progressive" as a sales tactic.
- nologic01 3y agoIt just goes to show that if you want real change you need to get really serious about it. As in: change the regulatory and legal framework. Self-regulation doesn't work. You just get an army of consultants, rating agencies and other intermediaries providing "assurance" for-profit, never biting the hand that feeds them. PS. For the record and while tangential to the digital monopoly discussion, it is still a good thing that we got the ESG and greenwashing debacle. Just a few years ago nobody but the perennial "tree huggers" was even talking about sustainability. Now it is a much more broad based discussion although obviously it has not landed anywhere yet. I wish people would also take regulation of the digital sphere more seriously as it is the backbone on which we will solve all these other problems.
- dagaci 3y agoThis is the most Kafkaesque thread i've ever seen on Hacker News. Microsoft definitly uses analytics if that counts as personal data - https://www.microsoft.com/insidetrack/blog/microsoft-uses-analytics-and-data-science-to-enhance-the-user-experience https://www.microsoft.com/insidetrack/blog/microsoft-uses-an... Is Microsoft reading your Gmail account, Word documents or Porn activities and feeding them to OpenAI? Not according to terms and conditions https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy https://learn.microsoft.com/en-us/legal/cognitive-services/o... Is Microsoft generally doing generally unknown uknowns. Yes.
- ChatGTP 3y agoCan’t we just ask ChatGPT-4 for a summary since it’s passed the Bar exam ?
- Am4TIfIsER0ppos 3y agoIf a corporation has your data you can be damn sure they are mining it for all it is worth which includes feeding into AI learning these days. They work for the governments helping to surveil us. We "voluntarily" tell google, microsoft, apple, facebook everything that we would object telling to big brother. Boy do I have news for you!
- acqbu 3y agoOfficial answer: no. Right answer: yes, of course!
- spacecadet 3y agoYes, yes they are, and will. If we think some giant corpo has our best interest in mind and has corporate governance all buttoned up, HA capital H A.
- boredumb 3y agoHonest question I have. I've worked in advertising and the laws around PII are interesting. In California there are the CCPA laws that require them to allow a form to submit and have my PII removed after 90? days. What happens if these people train a model on a cali residents PII, having a request come in, 3 months later someone asks it about you and it spits out the PII that was "removed"? I'm assuming it's a matter of this going to court to be decided but I'd be curious if any californian legal nerds have some reasons why no one has started trying to target these things for settlements if nothing else?
- deleted 3y ago[deleted]
- j16sdiz 3y ago> What happens if these people train a model on a cali residents PII.. They would just deny it. Or claims impossible to recover from the trained model. I know no CA laws, but lots of similar privacy law, when asked to be "removed", allow exception for aggregated data.
- sbszllr 3y agoI don’t know CCPA laws that well, but I do the EU ones. As it stands “the right to erasure / to be forgotten” is extremely vague on this, and there doesn’t seem to be a wide precedent. In general the law is applicable to raw data records and not to aggregate data/metrics, neither to models. However, models in this context refers to one particular ruling w.r.t. to insurance or credit scoring industry (don’t remember exactly which one). I want to point out that the model doesn’t need to “spit out” removed data. It can be a classifier, or regression model, and not a generative model, and ideally, it would not be trained on your data. Worth noting that from the technical standpoint, it’s difficult too. Say, a model costs X-large amount of dollars. Normally, I would retrain it e.g. every 6 months. But now I have erasure requests coming in on a regular basis —- retraining often to comply with those is too expensive. There’s a line of research on “machine unlearning” on how to do it efficiently but it’s quite underwhelming so far.
- pixl97 3y agoWhy are you assuming they have your PII in it in the first place and that the identifying part would not be stripped? If the personal part is gone, I'm not sure you have any claim.
- vorticalbox 3y agoAll this privacy noise feels a lot like Whataboutism. Firefox has telemetry and studies enabled by default. Alps while mozzilla call out x, y, z for the same thing.
- executesorder66 3y agoWhere are all the assholes who say things like: "I'm loving the new Microsoft", "Microsoft is not the evil company it was back in the 90's", etc. I'd love you hear how you justify this.
- teddyh 3y agoLately, they tend to gather in threads about Github.
- CatWChainsaw 3y agoThey're a little busy trying to shred their membership card of the Leopards Eating People's Faces Party.
- treprinum 3y agoI bet Adobe is doing the same as well.
- I_am_tiberius 3y agoThank you Mozilla.
- Delphiza 3y agoThere is a difference between personal data and personally identifiable data. In many ways it is unavoidable to use personal data. Predictive text uses personal data (they 'learn' from everyone) - is the sentence and paragraph personal? Search engines record what you have typed in - do you classify your search query as 'personal'? I can copy paste the first comment from this thread - is it personal data. I may be flat out wrong, and shouldn't type anything into a web page ever. Those four lawyers and three privacy experts didn't seem to come to a conclusion on what personal data is. Does big tech feed data created by people into 'AI' tools? Yes. Does little tech? Yes. I'm okay to join Mozilla with my pitchfork if I know what it is about. I would like to have people that are clear about how they are looking after my interests, rather than just getting the mob riled up. Use of data, any data, is subject to an agreement. Go on and read the 'legal' that you have agreed to using Hacker News - they have a whole section on how they use personal information. Do we get our pitchforks out for HN, or are they cool?
- la64710 3y agoIt’s Microsoft that for years tried to kill Linux and still sharpens the knife.
- Delphiza 3y agoSo it's just a grudge against Microsoft then? That's not something I'll sign up for, thanks. You either believe in the concepts of not using personal data - for everyone - or you're selling something.
- microflash 3y agoThe fact that they turn on photo scanning on the photos uploaded on OneDrive tells me everything.
- ahupp 3y agoWhich of these things is "training AI"? * an abuse detection system is trained on user behavior and data to flag bad actors for human review * When I perform a web search the ranking function is trained all user behavior * The email composer will suggest completions based on my own typing history * a public chat interface to an LLM is trained on my private emails "training AI" is an implementation detail that probably doesn't belong in a privacy policy most of the time. Would be nice if Mozilla was more explicit about the behavior they are concerned with.
- amai 3y agoHas nobody put MS Service agreement into ChatGPT and asked for an answer?
- bzmrgonz 3y agoOf course they are, why do you think ms office practically begs you to save your documents on onedrive?? The save to onedrive is by default!!
- deleted 3y ago[deleted]
- likenesstheft 3y agoTime to cancel my subscription to Microsoft’s online products. Never buying another Windows machine again. Apple or Linux only from here in out. Apple’s software and/or LibreOffice are more than enough.
- hulitu 3y ago> Ask Microsoft: Are you using our personal data to train AI? According to Microsoft: "Your privacy is very important for us". So the answer is yes.