5 ms·

The core issue is transparency. I don't want to see a 'privacy policy', I want to see who a company has sold/given my information to and what limitations that s

The core issue is transparency. I don't want to see a 'privacy policy', I want to see who a company has sold/given my information to and what limitations that sale has. The concept is simple. If you collect anything about me and allow some other entity access, you tell me about it/make it easy for me to see -and- block. Most of this abuse of personal data would go away if people knew it was going on.

m463 3y ago
I read somewhere if you call up a towing company, the wireless carrier will provide them your location. they don't even say "your call^H^H^H^Hlocation will be recorded for quality purposes"
sofixa 3y ago
> Most of this abuse of personal data would go away if people knew it was going on. GDPR proves this wrong. Most people click OK/accept even in front of relatively clear information (to be fair sometimes the options are "accept for you to be tracked and shared with 'our partners' or pay a subscription/fee", which is an easy choice for many.
- spinningD20 3y ago
  Yet if the business model / customer's _existing_ service agreement is changed, the temperature of the water that the frog is in just went up a little bit, so folks continue using it, which is what often happens as well. "well, I'm not sure if they're going to start collecting or using my data, because I don't actually really KNOW that or the extent of everything, just an email from them with a vague update to an equally vague privacy policy that I apparently implicitly agree to if I don't discontinue using their service." Just like a manufacturer/seller on say, amazon shouldn't be able to revise their product with cheaper quality under the same model number (and yet it happens all the time), changes to the agreement of a service should be treated as a new service. Whatever the solution, it should be a big enough deal that it cannot be implicitly agreed to, and clear enough language (maybe vetted by a third party review of the agreement) to communicate to all users, what is at stake and how, to which third parties, etc.
- 38 3y ago
  This is misleading. The OK is almost universally made easier to click through dark patterns, with the "reject" being hidden or taking more clicks
  - cogman10 3y ago
    Yup. At least 2 clicks and you have to process what you are clicking to understand. I've seen more than a few sites where it's "Ok" then "Customize" followed by a bunch of checkboxes to disable cookies while the "accept all button" is where typically "OK" would be and the "reject all" is often labeled something else that isn't clear. This is also not often remembered on future visits so you end up doing this dance every time you visit that site.
  - ikiris 3y ago
    And those are illegal under gdpr, and enforcement is slow but happening. Whats your point?
- hocuspocus 3y ago
  In this very case, the GDPR is scary enough that European carriers make sure to anonymize and aggregate analytics they sell to third parties. Even if you click OK, a data leak would be pretty harmless and wouldn't identify you personally.
  - sroussey 3y ago
    Location data that includes your home in the suburbs is pretty identifiable.
    - hocuspocus 3y ago
      Carrier position accuracy is pretty shit in low density areas, you aggregate (e.g. per H3 tile), apply scaling (no operator has 100% market share) and K-anonymity.
- onli 3y ago
  Many people click no whenever there is not a manipulated choice. See https://www.cnil.fr/en/evolution-practices-web-regarding-cookies-cnil-evaluates-impact-its-action-plan-0 https://www.cnil.fr/en/evolution-practices-web-regarding-coo... "Most" may be correct, but given how annoying those banners are I would not read too much into that.
- keybored 3y ago
  When presented with 50 prompts throughout the day, 95% of which makes clicking OK easier than clicking decline, most people (allegedly) click OK. What an easy choice to be nagged at every new website.
techdmn 3y ago
AND if people had viable alternatives. (Sorry, I see now that you mentioned blocking, which would also work.)
idatum 3y ago
Everything should be opt-in. Burden should be on them, something like, "We want to share your data and if you agree here are the benefits to you."
- krustyburger 3y ago
  [flagged]
- ethbr1 3y ago
  That's something I think the EU got right -- being hard-nosed about true tracking consent requiring a user to receive the same outcome regardless of their choice. Anything shy is begging companies to dark-engineer patterns around obtaining it.
  - nox101 3y ago
    The EU didn't get this right - or else they aren't enforcing it. I'm in the EU right now and the crap I see is a popup "We respect your privacy. Us and 352 (not an exaggeration!) of our partners are collecting data on you. Approve or Details?" Pick details and you can spend your time going through the partners https://pasteboard.co/rrL2bpmiE6Zq.png https://pasteboard.co/rrL2bpmiE6Zq.png And most you can't reject Even more hilarious. pageboard itself said 847 partners! https://pasteboard.co/XQHhPzTw42Pv.png https://pasteboard.co/XQHhPzTw42Pv.png
    - immibis 3y ago
      This is mostly unenforced, as it WAS ruled that it must be as easy to reject as to accept. However, they're going after "consent to ads or buy a subscription" which I thought was a pretty fair compromise business model.
      - Maarten88 3y ago
        I'm generally okay with Ads, that is fair. But I'm not okay with tracking, consolidating data about me from different sources, analyzing it and selling that. It is too hard to understand how that may impact me and others.
barbariangrunge 3y ago
The core issue isn’t transparency. It’s surveillance and powerlessness
gmd63 3y ago
I would extend this to include companies like Facebook that study your data to derive deeper insights about you. I want to be entitled to every conclusion they reach about me from my own data, so I can correct whatever assumptions they have about me and possibly learn more about myself.
theptip 3y ago
Transparency is good, but I think it’s also important to impose contractual liability and fines too. GDPR has a good model here; a data processor must list all of their sub-processors, AND have contracts with each that let them enforce transitively your data deletion rights. This guards against the case where a processor transparently updates their ToS to share your data with someone you do not consent to.
ranger_danger 3y ago
> I want to see They can still just lie though.
throw10920 3y ago
> I want to see who a company has sold/given my information to and what limitations that sale has To expand on this more - I feel like laws requiring companies to keep a "custody chain" of personal data at every transfer step would be relatively un-controversial. Sure, I'd rather do away with personal data being able to be bought and sold entirely, but an easy first step is "massive fines for any company that doesn't carefully track exactly which entity touched the user's data".
cameldrv 3y ago
I just don't want 'em to do it. I expect companies I have a paying business relationship with to not report on my private comings and goings, especially not to bounty hunters and other shady characters. Back in the day if you did something like this, you would be run out of town on a rail, but unfortunately we've allowed mobile phone companies and a lot of others to get such a large national market share that there is no recourse.

m463 3y ago

I read somewhere if you call up a towing company, the wireless carrier will provide them your location. they don't even say "your call^H^H^H^Hlocation will be recorded for quality purposes"

sofixa 3y ago

> Most of this abuse of personal data would go away if people knew it was going on. GDPR proves this wrong. Most people click OK/accept even in front of relatively clear information (to be fair sometimes the options are "accept for you to be tracked and shared with 'our partners' or pay a subscription/fee", which is an easy choice for many.

spinningD20 3y ago
Yet if the business model / customer's _existing_ service agreement is changed, the temperature of the water that the frog is in just went up a little bit, so folks continue using it, which is what often happens as well. "well, I'm not sure if they're going to start collecting or using my data, because I don't actually really KNOW that or the extent of everything, just an email from them with a vague update to an equally vague privacy policy that I apparently implicitly agree to if I don't discontinue using their service." Just like a manufacturer/seller on say, amazon shouldn't be able to revise their product with cheaper quality under the same model number (and yet it happens all the time), changes to the agreement of a service should be treated as a new service. Whatever the solution, it should be a big enough deal that it cannot be implicitly agreed to, and clear enough language (maybe vetted by a third party review of the agreement) to communicate to all users, what is at stake and how, to which third parties, etc.
38 3y ago
This is misleading. The OK is almost universally made easier to click through dark patterns, with the "reject" being hidden or taking more clicks
- cogman10 3y ago
  Yup. At least 2 clicks and you have to process what you are clicking to understand. I've seen more than a few sites where it's "Ok" then "Customize" followed by a bunch of checkboxes to disable cookies while the "accept all button" is where typically "OK" would be and the "reject all" is often labeled something else that isn't clear. This is also not often remembered on future visits so you end up doing this dance every time you visit that site.
- ikiris 3y ago
  And those are illegal under gdpr, and enforcement is slow but happening. Whats your point?
hocuspocus 3y ago
In this very case, the GDPR is scary enough that European carriers make sure to anonymize and aggregate analytics they sell to third parties. Even if you click OK, a data leak would be pretty harmless and wouldn't identify you personally.
- sroussey 3y ago
  Location data that includes your home in the suburbs is pretty identifiable.
  - hocuspocus 3y ago
    Carrier position accuracy is pretty shit in low density areas, you aggregate (e.g. per H3 tile), apply scaling (no operator has 100% market share) and K-anonymity.
onli 3y ago
Many people click no whenever there is not a manipulated choice. See https://www.cnil.fr/en/evolution-practices-web-regarding-cookies-cnil-evaluates-impact-its-action-plan-0 https://www.cnil.fr/en/evolution-practices-web-regarding-coo... "Most" may be correct, but given how annoying those banners are I would not read too much into that.
keybored 3y ago
When presented with 50 prompts throughout the day, 95% of which makes clicking OK easier than clicking decline, most people (allegedly) click OK. What an easy choice to be nagged at every new website.

techdmn 3y ago

AND if people had viable alternatives. (Sorry, I see now that you mentioned blocking, which would also work.)

idatum 3y ago

Everything should be opt-in. Burden should be on them, something like, "We want to share your data and if you agree here are the benefits to you."

krustyburger 3y ago
[flagged]
ethbr1 3y ago
That's something I think the EU got right -- being hard-nosed about true tracking consent requiring a user to receive the same outcome regardless of their choice. Anything shy is begging companies to dark-engineer patterns around obtaining it.
- nox101 3y ago
  The EU didn't get this right - or else they aren't enforcing it. I'm in the EU right now and the crap I see is a popup "We respect your privacy. Us and 352 (not an exaggeration!) of our partners are collecting data on you. Approve or Details?" Pick details and you can spend your time going through the partners https://pasteboard.co/rrL2bpmiE6Zq.png https://pasteboard.co/rrL2bpmiE6Zq.png And most you can't reject Even more hilarious. pageboard itself said 847 partners! https://pasteboard.co/XQHhPzTw42Pv.png https://pasteboard.co/XQHhPzTw42Pv.png
  - immibis 3y ago
    This is mostly unenforced, as it WAS ruled that it must be as easy to reject as to accept. However, they're going after "consent to ads or buy a subscription" which I thought was a pretty fair compromise business model.
    - Maarten88 3y ago
      I'm generally okay with Ads, that is fair. But I'm not okay with tracking, consolidating data about me from different sources, analyzing it and selling that. It is too hard to understand how that may impact me and others.

barbariangrunge 3y ago

The core issue isn’t transparency. It’s surveillance and powerlessness

gmd63 3y ago

I would extend this to include companies like Facebook that study your data to derive deeper insights about you. I want to be entitled to every conclusion they reach about me from my own data, so I can correct whatever assumptions they have about me and possibly learn more about myself.

theptip 3y ago

Transparency is good, but I think it’s also important to impose contractual liability and fines too. GDPR has a good model here; a data processor must list all of their sub-processors, AND have contracts with each that let them enforce transitively your data deletion rights. This guards against the case where a processor transparently updates their ToS to share your data with someone you do not consent to.

ranger_danger 3y ago

> I want to see They can still just lie though.

throw10920 3y ago

> I want to see who a company has sold/given my information to and what limitations that sale has To expand on this more - I feel like laws requiring companies to keep a "custody chain" of personal data at every transfer step would be relatively un-controversial. Sure, I'd rather do away with personal data being able to be bought and sold entirely, but an easy first step is "massive fines for any company that doesn't carefully track exactly which entity touched the user's data".

cameldrv 3y ago

I just don't want 'em to do it. I expect companies I have a paying business relationship with to not report on my private comings and goings, especially not to bounty hunters and other shady characters. Back in the day if you did something like this, you would be run out of town on a rail, but unfortunately we've allowed mobile phone companies and a lot of others to get such a large national market share that there is no recourse.