8 ms·

At the very least, an action which is effectively instantaneous should never be opt out. That is, if they can flip a switch and scan millions of blogs in a few

At the very least, an action which is effectively instantaneous should never be opt out. That is, if they can flip a switch and scan millions of blogs in a few hours, or days, or even weeks, you need to be able to opt out before that happens. It shouldn't be a race between you and the website to see if you can find the opt out toggle before you lose control of your property. A lesser example of this is when you sign up for a website, and are immediately opted in to their newsletter and various other spam email lists. The opt-in happened in ~1ms, but even if you opt out immediately after your first login, you'll still get added to their list by default.

bradleyankrom 3y ago
I've always been amused by the fact that they'll newsletter and product sales bomb me within a minute of signing up for their service, but removing me from their lists may take up to 5-7 business days.
- karaterobot 3y ago
  It made more sense when I understood that saying it may take up to 10 business days to opt me out was a statement recognizing the legal requirements rather than the technical requirements. I'm sure some companies just wait exactly 9 days, 23 hours, 59 minutes and 59 seconds to instantaneously opt me out. Malicious compliance, or as we used to call it, passive-aggressiveness.
nonrandomstring 3y ago
We need a legally enforcible mechanism to make anyone think twice before using data without consent. This must have the effect with AI training models, that if a persons data has been incorporated without consent, or they legally revoke assumed consent, the data must be removed. At present, AFAICS that would mean voiding an entire model. That would be expensive and so be a stiff deterrent against abuse. Copyright has failed. But there are sutely other tricks to play.
- pacmanincarnate 3y ago
  Why do you believe training an AI model shouldn’t be considered fair use, especially when they are predominantly trained on publicly available information? It’s a completely transformative work where the model contains no part of the original data.
- arkh 3y ago
  Some kind of Regulation of Data to Protect it. And maybe make it General? https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ > The data subject must also be informed about his or her right to withdraw consent anytime. The withdrawal must be as easy as giving consent. > Last but not least, consent must be unambiguous, which means it requires either a statement or a clear affirmative act. Consent cannot be implied and must always be given through an opt-in, a declaration or an active motion, so that there is no misunderstanding that the data subject has consented to the particular processing. https://gdpr-info.eu/issues/fines-penalties/ https://gdpr-info.eu/issues/fines-penalties/ > For especially severe violations, listed in Art. 83(5) GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher. But even the catalogue of less severe violations in Art. 83(4) GDPR sets forth fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover of the preceding fiscal year, whichever is higher.
  - nonrandomstring 3y ago
    This would never work! Seriously though, the hole I am trying to plug here is remedy. Where is the individual remedy against someone who takes my data for their own profit? Sure I can get an official body to act for me, impose fines etc. But if, at near zero cost, I can force them to delete it - no exceptions - that's a powerful response. I'm probably mistaken but right now I don't see that to hand despite the fancy wording about data "belonging to the subject".
    - salawat 3y ago
      The issue is that every business operator relying on this overnight would have to shift massive amounts of capital into their legal departments to create a remediation pipeline, fundamentally shift their architecture to include permission first targeting of training information, and most importantly, the Courts would be instantly swamped with just cases dealing with this kind of case for years while lobbying would go on for years to cripple any such remedy establishment. In short, what you propose is the abolishment of the click through EULA, and a return to exercise of contract law as originally intended. This kills the tech enabled business sector, because they'd essentially have to de-scale or die under an avalanche of judicial remediation. Which I want, to be quite frank. It'd be awesome.
JohnFen 3y ago
> A lesser example of this is when you sign up for a website This is one of the big reasons why I do not create accounts or sign up for things online if I can possibly avoid it.
bdw5204 3y ago
If you shop in a chain store, they generally ask for your email and phone number usually in exchange for discounts. Giving them this information opts you into their email and sometimes text spam lists meaning several messages a day, some of which might include relevant information about a sale or discount you're interested in. The end result is that people stop looking at their email because it's mostly marketing spam and they miss genuinely important emails.

bradleyankrom 3y ago

I've always been amused by the fact that they'll newsletter and product sales bomb me within a minute of signing up for their service, but removing me from their lists may take up to 5-7 business days.

karaterobot 3y ago
It made more sense when I understood that saying it may take up to 10 business days to opt me out was a statement recognizing the legal requirements rather than the technical requirements. I'm sure some companies just wait exactly 9 days, 23 hours, 59 minutes and 59 seconds to instantaneously opt me out. Malicious compliance, or as we used to call it, passive-aggressiveness.

nonrandomstring 3y ago

We need a legally enforcible mechanism to make anyone think twice before using data without consent. This must have the effect with AI training models, that if a persons data has been incorporated without consent, or they legally revoke assumed consent, the data must be removed. At present, AFAICS that would mean voiding an entire model. That would be expensive and so be a stiff deterrent against abuse. Copyright has failed. But there are sutely other tricks to play.

pacmanincarnate 3y ago
Why do you believe training an AI model shouldn’t be considered fair use, especially when they are predominantly trained on publicly available information? It’s a completely transformative work where the model contains no part of the original data.
arkh 3y ago
Some kind of Regulation of Data to Protect it. And maybe make it General? https://gdpr-info.eu/issues/consent/ https://gdpr-info.eu/issues/consent/ > The data subject must also be informed about his or her right to withdraw consent anytime. The withdrawal must be as easy as giving consent. > Last but not least, consent must be unambiguous, which means it requires either a statement or a clear affirmative act. Consent cannot be implied and must always be given through an opt-in, a declaration or an active motion, so that there is no misunderstanding that the data subject has consented to the particular processing. https://gdpr-info.eu/issues/fines-penalties/ https://gdpr-info.eu/issues/fines-penalties/ > For especially severe violations, listed in Art. 83(5) GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher. But even the catalogue of less severe violations in Art. 83(4) GDPR sets forth fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover of the preceding fiscal year, whichever is higher.
- nonrandomstring 3y ago
  This would never work! Seriously though, the hole I am trying to plug here is remedy. Where is the individual remedy against someone who takes my data for their own profit? Sure I can get an official body to act for me, impose fines etc. But if, at near zero cost, I can force them to delete it - no exceptions - that's a powerful response. I'm probably mistaken but right now I don't see that to hand despite the fancy wording about data "belonging to the subject".
  - salawat 3y ago
    The issue is that every business operator relying on this overnight would have to shift massive amounts of capital into their legal departments to create a remediation pipeline, fundamentally shift their architecture to include permission first targeting of training information, and most importantly, the Courts would be instantly swamped with just cases dealing with this kind of case for years while lobbying would go on for years to cripple any such remedy establishment. In short, what you propose is the abolishment of the click through EULA, and a return to exercise of contract law as originally intended. This kills the tech enabled business sector, because they'd essentially have to de-scale or die under an avalanche of judicial remediation. Which I want, to be quite frank. It'd be awesome.

JohnFen 3y ago

> A lesser example of this is when you sign up for a website This is one of the big reasons why I do not create accounts or sign up for things online if I can possibly avoid it.

bdw5204 3y ago

If you shop in a chain store, they generally ask for your email and phone number usually in exchange for discounts. Giving them this information opts you into their email and sometimes text spam lists meaning several messages a day, some of which might include relevant information about a sale or discount you're interested in. The end result is that people stop looking at their email because it's mostly marketing spam and they miss genuinely important emails.