17 ms·
Docusign just admitted that they use customer data to train AI
- jcoder 3y agoWhy a xitter post of a screenshot with no link when the full article is public? https://support.docusign.com/s/document-item?language=en_US&bundleId=fzd1707173174972&topicId=uss1707173279973.html&_LANG=enus https://support.docusign.com/s/document-item?language=en_US&...
- silok 3y agoAlso because xitter provides a broader discussion platform and reach compared to only HN (even though I highly appreciate the HN content). But yeah, the xitter post should preferably also contain that url to the source.
- NewJazz 3y agoBecause that article is published by docusign and they could change it.
- DistractionRect 3y agoIn that case a link to an archived copy is preferable to a screenshot of the partial document hosted by Twitter.
- fddrdplktrew 3y agoAn archive link should be added as a comment automatically for all posts... in some cases it would even allow you to bypass paywalls...
- ehPReth 3y agohttps://web.archive.org https://web.archive.org (take a screenshot option if you have a login and it's JS madness WBM can't handle), https://archive.ph https://archive.ph, etc (hopefully captured more than one if possible) - random screenshots are proof of absolutely nothing. (here's one for the page above: https://archive.is/e6K4K https://archive.is/e6K4K)
- ankit219 3y agoBecause twitter downranks any tweet with link, so now users put a pic/screenshot in first tweet with the link in the next tweet.
- magnusss 3y agoWhy does docusign need such sophisticated and powerful AI models, to the point that they’re willing to risk their customers’ ire by training on their data (yes I know, even though it’s anonymized per “industry best practices”)? Are they in some additional line of business besides making it possible to sign a contract electronically?
- initplus 3y agoThe obvious angle is AI contract generation. Docusign are uniquely positioned to build up a real training set of contracts.
- SteveNuts 3y agoGoing to be absolutely wild the first time it spits out a specific enough paragraph to identify the company whose data was used to train the model.
- haydenchambers 3y ago[dead]
- anon373839 3y agoOr spits out the terms of someone's confidential settlement agreement.
- ironmagma 3y agoIf they're uniquely positioned to do it, it probably doesn't need to be done. Who is going to usurp them if they don't?
- adamisom 3y agoI find this comment interesting in the context of having read a lot of brain-dead takes on "capitalism", some of which it liken it to feudalism. I find it interesting because it shows how different those two are. Under feudal zero-sum world your question would make complete sense, but under a capitalist positive-sum world, it seems to me the answer is just "a lot of profit would be left on the table" (ie positive-sum mutual-benefit transactions), which explains why docusign would do it.
- chris_wot 3y ago"Will my data be used for AI model training and improvement? If you have given contractual consent, we may use your data to train DocuSign's in-house, proprietary AI models. Your data will be anonymized and de-identified before model training." This seems to be opt-in? Am I missing something?
- KennyBlanken 3y ago"Contractual consent" != "opt in." That just means you clicked "I agree" at the end of 10 pages of legalese.
- buzer 3y agoDoesn't "contractual consent" simply mean that it was part of the contract, likely adhesion one? In their privacy policy (https://www.docusign.com/privacy https://www.docusign.com/privacy) they say their lawful basis is "Consent (where required under applicable law)" which certainly sounds like if applicable law doesn't require it they would be use it without consent.
- neilv 3y agoDoes "contractual consent" necessarily mean conscious opt-in? I'd suspect it can mean some some clause buried in contract document. Also, it's some party's interpretation of that clause, not what some other party understood it to mean. However, in this particular case, maybe most relevant is that I'd assume Docusign is facing a lot of corporate lawyers among its customers. So I'd guess the company can't get away with behaving like a stereotypical sketchy startup, towards its customers, and I'm sure Docusign has legal advisors who would tell them that if they ever needed to be told.
- szundi 3y agoProbably it is in the terms and conditions, so =yes
- shortsunblack 3y agoThere is no such thing as "contractual consent". Consent under GDPR cannot be "contractually" given as part of a blanket clause in a contract. It requires criterion like informed, easily retractable, uncoerced, etc. GDPR also has the concept of a "contractual necessity". A legal basis where data must be processed for the performance of a contrast. So say, you buy a t-shirt from an American online store and they need to process your shipping address. That's contractual necessity. They seem to be mixing the two into "contractual consent", as if you are able to consent in a contract. Under GDPR, you can't! In no other contexts can there be a more legible interpretation.
- SoftTalker 3y agoI think you can pretty much assume that all data in SaaS products is mined for commercial purposes and soon will be used in AI training if it isn't already, consent or lack thereof notwithstanding. They'll just do it, the temptation is too large and the task is too easy. If you want your data to be private, encrypt it or better yet keep it in house.
- gorbachev 3y agoThe problem with your suggestion is that this is so ubiquitous you can not avoid it, unless you go live as a hermit in a cave.
- phendrenad2 3y agoTime for another California legislation. Let's put a "Don't train AI models on my personal information" link at the bottom of websites.
- szundi 3y agoOr other dropdowns for gdpr popups
- troupo 3y agoGDPR explicitly states "opt out must be as easy as opt-in". Unfortunately enforcement has been asleep at the wheel.
- arcanemachiner 3y agoI propose a useless header to send with browser requests as a toothless opt-out mechanism.
- siggalucci 3y agoDocwesign
- cm2012 3y ago[flagged]
- Razengan 3y ago> I have lots of experience with digital advertising Yeah, you wouldn't. Meanwhile I have ever yet to see any ad that actually made me buy something because of the ad. The whole advertising industry seems like a racket, at best a case of the Emperor With No Clothes, and a front for spyware at worst.
- YPPH 3y ago>I have ever yet to see any ad that actually made me buy something because of the ad That's a somewhat superficial understanding of how advertising works. Sure, Barry might see an ad for McDonald's and go out and buy a Big Mac, but a lot of the work is subliminal.
- KennyBlanken 3y agoThe goal of the advertising industry is mostly to get their brand into your brain for when they do become relevant because you remember or recognize them.
- smt88 3y agoThe literally millions of people who have sensitive information in DocuSign, including things like: - salaries - proprietary business information - divorce agreements - non-disclosure agreements Do you think people don't put private information into contracts?
- bastawhiz 3y agoYou're in digital advertising. How would you feel if they did a poor job of de-identifying one of your contracts (maybe because the client's company name is also a common noun) and their AI regurgitated some private business dealings word for word to one of your competitors? Yeah, it would suck.
- Sohcahtoa82 3y agoDo you actually think this is a non-issue? Or do you think just knee-jerk dismissal of anything related to AI makes you look cool or edgy?
- szundi 3y agoI’ll love how all those incompetent lawyers’s work will go and train the supposedly super AI and somehow it will spit out lawyery bs
- digitcatphd 3y agoWhy is everyone so concerned about AI training on their data in the first place? Has anyone really pondered the consequences or are we just repeating the concerns of others without thinking for ourselves again? What are real actual consequences? Especially if I’m a small company? Except of course it repeating or regurgitating your content, which is a valid concern.
- robjan 3y agoYou already stated the problem in your last sentence. There's also the risk that the model could end up with your / your customers' PII in it which could lead to serious consequences.
- quantified 3y agoRepeating or regurgitating your content. To anyone, somewhere. You got it. Think about it from the perspective of creatives and professionals who deal in words.
- sys_64738 3y ago> Why is everyone so concerned about AI training on their data in the first place? Unless I give my consent unhindered then my data is my data and cannot be used for any purpose at all unless I approve. This also means you cannot make blanket statements in Terms of use saying I grant you permission to use my data. I don't.
- Sohcahtoa82 3y ago> Except of course it repeating or regurgitating your content, which is a valid concern. That is exactly it. LLMs are nothing more than engines that predict the next token based on a mind-boggling large set of statistics of what tokens follow what. They're essentially Markov Chains on a massive dose of steroids. If the training data includes one document that includes password rules like "The password shall be at least 12 characters long. The password shall include [...]", and then you have another document that includes a line of "The password is fdFjkkl1@!#", then if you ask the LLM to generate a document that includes password rules, there's a chance it may output "The password is fdFjkkl1@!#" in that document, because it knows that "is fdFjkkl1@!#" sometimes comes after "The password".
- bastawhiz 3y agoRepeat after me: There's no sure-fire way to automatically anonymize arbitrary customer data. There's no sure-fire way to automatically anonymize arbitrary customer data. There's no sure-fire way to automatically anonymize arbitrary customer data. You can't anonymize it by hand. You can't anonymize it by machine. If you're taking blobs of customer data and dumping it into a machine, customer data can come out of the machine. Neither humans nor machines are error-free. If you believe DocuSign is going to do a perfect job, I've got a bridge to sell you.
- coding123 3y agoMeh, so it puts Robert Picardo Stewart somewhere.
- bastawhiz 3y agoOr it puts your name and the name of one of your confidential clients in someone else's contract. Or it oopsies your name and salary into a job offer for someone else. Or it sees the name of your ex wife and hallucinates details about your assets based on your previous divorce papers and she sues you. I can come up with these all day.
- wmidwestranger 3y agoAI as the system copying notes for the test from another system. Nothing in there is anywhere near impossible unless the system doesn't have the data.
- xeyownt 3y agoAnd? If reliability is zero, so is the risk.
- bastawhiz 3y agoJust because my ex wife might incorrectly sue me doesn't mean it's not an incredible pain in the ass. Just because someone incorrectly got a contract that hilariously includes all the private details of my employment doesn't mean I won't be royally pissed. The risk is "I don't fucking want this to happen". So no, it's not zero.
- refulgentis 3y agoThe headline seems far out of step with the content: they use OpenAI/MS for chat AI, and they use the standard paid API that doesn't retain data. Beyond that "If you have given contractual consent, we may use your data to train DocuSign's in-house, proprietary AI models." -- I'm open to hearing that "contractual consents" actually means "literally all of you mwahahaha", but that's not borne out by the content.
- wodenokoto 3y agoI don't really see how this admits they are training AI on user data (edit: user documents, which I feel is what is implied. User app usage is probably placed in training data). They are processing data with AI, both off-the-shelf models and own models, sure. This is no different from any "old school" ML fraud detection, customer journey analysis, etc., etc.
- cmurf 3y agoAlternatives to DocuSign that aren’t doing this? How would we know?
- jenadine 3y agohttps://www.docuseal.co/ https://www.docuseal.co/ You can self-host
- xyst 3y agoFeds asleep at the wheel, again. US government sold out to private companies.
- simlevesque 3y agoIt's by design. That's how the US works. We the corporations.
- gorbachev 3y agoThe way to fight this is to inform the legal counsel at a Really-Big-Company (or alteratively a Really-Litigious-Company) that uses DocuSign. There's absolutely no way they would approve using a platform like this for anything that has even a slight chance of divulging confidential or sensitive information to DocuSign, either about the company, its employees or customers.
- jaystraw 3y agoA few years ago, my band was putting our manager on our LLC account. The credit union, then Alaska USA but now Global , sent us all docusign links to add her. She had moved out of state, but either way I think they would've done it that way. Even skimming the EULA there was no way I was gonna esign through their service. This confused the bank, and it was honestly a bit of a pain in the ass with some emailing back and forth. But they got me the forms and I signed analog, and it went through eventually. Just sent them my I Told Ya So heh
- Smoosh 3y agoYes, but they already have a copy of your contract/document, yes? By which I mean to point out the problem that the people signing the contract/document aren’t the ones choosing the signing service company.
- Lockal 3y agoSo... What? They must provide up-to-date mechanisms to stop malicious actors and find anomalies to protect against cyber-attacks. Fake signatures? Cropped photo submitted multiple times under different names? Photoshopped materials? AI-generated materials? How do you detect this without training on real data?
- whatindaheck 3y agoThis is especially concerning because many businesses use Docusign for job paperwork. If you want/need a job and they use Docusign there’s no getting around this. If you need to eat you’re forced to sign away your data to train AI.
- m2mdas2 3y agoIf they have admitted to do this then it's reasonable that they have done other vile things with these super sensitive informations. Don't ask for proof, ask yourself.
- __loam 3y agoWhen I worked at a company that built software for lawyers, this was one thing I remember having multiple discussions with different people including the CEO as something that would be monumentally stupid for us to do.
- tzm 3y agoDocusign response: > Thank you for the feedback. We are updating our AI FAQ to be more clear: We only collect data for training from customers who have given explicit contractual consent as part of their participation in AI Extension for CLM, AI Labs and select beta programs using AI. When we train models using customer data to improve the accuracy of our AI features, we only use data from customers who have given consent, and that is de-identified and anonymized before training occurs. https://x.com/DocuSign/status/1763647141875192065?s=20 https://x.com/DocuSign/status/1763647141875192065?s=20