3 ms·

I think that in Europe, that will soon be prohibited without declaration and explicit consent.

Mindwipe 2y ago
Under the DMA's requirements to protect children I think it will be basically mandatory to do this. In the UK it already is under the Online Safety Bill.
duxup 2y ago
If you suspected you had underage users using your service illicitly. Could you not use such methods to find them? I wonder at what point analytics, queries, or ML to determine age gets in the way of actually keeping them from getting into things they shouldn't... Under age users aren't going to just tell you their age honestly, so you'd have to use some method to derive their age.
- littlestymaar 2y ago
  > If you suspected you had underage users using your service illicitly. Could you not use such methods to find them? You could use something like that and it would be counted as “legitimate interest” under GDPR, but: - you wouldn't need (and then would be forbidden) to do segmentation between more categories than “too young”/“old enough”. This is not what they are doing here. - you'd still need to tell the users that you're doing it, and provide a way for the users to modify that data upon request > Under age users aren't going to just tell you their age honestly, so you'd have to use some method to derive their age. You don't have a legitimate interest of knowing their age, only for knowing if they are underage or not.
handity 2y ago
If that's true, it's pretty ridiculous. I wish legislation would get at the core issue, which is not processing, but that collection happens at all. Normalizing surveillance, but asking companies to please not do anything with that data for minors, is such a far cry from what we deserve.
- msm_ 2y ago
  But Discord must store the messages, to make searching possible. And I assume the model works based on the writing style, topics discussed, etc. What would you propose, automatically remove all messages after a few weeks? Even then Discord technically can process the messages and build the same model. So yeah, in this case the processing is the problem since I don't want Discord to know my gender and age (unless I explicitly tell it).
  - shrimp_emoji 2y ago
    > What would you propose, automatically remove all messages after a few weeks? This but unironically. If people or bots or the NSA want to keep records, let them scrape and cache 'em. I actually think it should all be P2P, but that would kill the thin shell of a business model that exists.
    - littlestymaar 2y ago
      I would hate such a model, having persistent history is one of the killer feature of Discord vs, say, IRC.
      - olyjohn 2y ago
        I dunno, the search on Discord is trash. The one time I thought it would be useful to go back and find something, it was completely incapable.
        zubairshaik 2y ago
        This is not my experience, I use the search heavily and find it an invaluable tool to prevent asking repetitive questions.
  - mrngm 2y ago
    At least under GDPR, collecting personal data is already considered processing. Processing is only allowed under specific conditions and purpose. It would be perfectly fine if Discord stored messages from users (for brevity, assuming that's personal data), made it searchable and available as long as the user exists on the platform, provided that they specify this as the purpose of processing, and the user explicitly gave informed consent. Should Discord want to perform any other processing besides that designated purpose, they would (again) have to receive the user's explicit, informed consent. Otherwise, it's simply not allowed. No need to remove messages in such a case. Of course, technically they could process that data for a different purpose than specified, but that's illegal and may eventually result in a fine that can be based on a percentage of total global revenue. Not profit or loss, revenue. Then suddenly it becomes a really interesting business decision to do other than defined things with the data at hand. (and something something purpose limitation, data minimization etc.)

Under the DMA's requirements to protect children I think it will be basically mandatory to do this. In the UK it already is under the Online Safety Bill.

duxup 2y ago

If you suspected you had underage users using your service illicitly. Could you not use such methods to find them? I wonder at what point analytics, queries, or ML to determine age gets in the way of actually keeping them from getting into things they shouldn't... Under age users aren't going to just tell you their age honestly, so you'd have to use some method to derive their age.

littlestymaar 2y ago
> If you suspected you had underage users using your service illicitly. Could you not use such methods to find them? You could use something like that and it would be counted as “legitimate interest” under GDPR, but: - you wouldn't need (and then would be forbidden) to do segmentation between more categories than “too young”/“old enough”. This is not what they are doing here. - you'd still need to tell the users that you're doing it, and provide a way for the users to modify that data upon request > Under age users aren't going to just tell you their age honestly, so you'd have to use some method to derive their age. You don't have a legitimate interest of knowing their age, only for knowing if they are underage or not.

handity 2y ago

If that's true, it's pretty ridiculous. I wish legislation would get at the core issue, which is not processing, but that collection happens at all. Normalizing surveillance, but asking companies to please not do anything with that data for minors, is such a far cry from what we deserve.

msm_ 2y ago
But Discord must store the messages, to make searching possible. And I assume the model works based on the writing style, topics discussed, etc. What would you propose, automatically remove all messages after a few weeks? Even then Discord technically can process the messages and build the same model. So yeah, in this case the processing is the problem since I don't want Discord to know my gender and age (unless I explicitly tell it).
- shrimp_emoji 2y ago
  > What would you propose, automatically remove all messages after a few weeks? This but unironically. If people or bots or the NSA want to keep records, let them scrape and cache 'em. I actually think it should all be P2P, but that would kill the thin shell of a business model that exists.
  - littlestymaar 2y ago
    I would hate such a model, having persistent history is one of the killer feature of Discord vs, say, IRC.
    - olyjohn 2y ago
      I dunno, the search on Discord is trash. The one time I thought it would be useful to go back and find something, it was completely incapable.
      - zubairshaik 2y ago
        This is not my experience, I use the search heavily and find it an invaluable tool to prevent asking repetitive questions.
- mrngm 2y ago
  At least under GDPR, collecting personal data is already considered processing. Processing is only allowed under specific conditions and purpose. It would be perfectly fine if Discord stored messages from users (for brevity, assuming that's personal data), made it searchable and available as long as the user exists on the platform, provided that they specify this as the purpose of processing, and the user explicitly gave informed consent. Should Discord want to perform any other processing besides that designated purpose, they would (again) have to receive the user's explicit, informed consent. Otherwise, it's simply not allowed. No need to remove messages in such a case. Of course, technically they could process that data for a different purpose than specified, but that's illegal and may eventually result in a fine that can be based on a percentage of total global revenue. Not profit or loss, revenue. Then suddenly it becomes a really interesting business decision to do other than defined things with the data at hand. (and something something purpose limitation, data minimization etc.)