6 ms·

> My anonymous source claimed that way back in 2005, Google wanted the full clickstream of billions of Internet users, and with Chrome, they’ve now got it. The

> My anonymous source claimed that way back in 2005, Google wanted the full clickstream of billions of Internet users, and with Chrome, they’ve now got it. The API documents suggest Google calculates several types of metrics that can be called using Chrome views related to both individual pages and entire domains. What answer do the engineers at google working on this have for this violation of privacy?

bdlowery 2y ago
How is it a violation of privacy. Did you read the terms of service?
- y42 2y ago
  A tos announcement is not an explicit consent. I doubt that this will help in court, even pre-GDPR.
  - HelloNurse 2y ago
    Further, a TOS announcement can be easily construed as an admission of intent to fuck users.
- precompute 2y ago
  It's a privacy violation regardless of the ToS.
- 9dev 2y ago
  See, that’s the nice thing about the GDPR: You cannot hide unexpected hostile stuff in the ToS anymore. If you don’t tell me what you do with my data in a way that is obvious, easy to understand, and most importantly easy to disable, it’s illegal.
danpalmer 2y ago
Personal (not work related opinion): This basically can’t happen with things like DMA and GDPR. DMA in particular means you can’t share data across “products” without explicit consent. So you could for example collect websites that don’t work for the purposes of improving Chrome, but not then share that with the Ads/Search orgs for personalisation or targeting, as far as I understand the legislation. Personal opinion about work at Google (still not googles opinion) I’m consistently impressed with how seriously this stuff is taken and the amount of work that goes into making sure that things like this sharing can’t happen accidentally, and that user choice is respected. The engineers on the ground are absolutely making sure this all works, and most of us care deeply about user privacy. I have personally worked both on implementing new features that significantly push forward privacy, and on implementing privacy controls for regulatory purposes.
- BrenBarn 2y ago
  The thing is that preventing "sharing" isn't sufficient. People who are concerned about privacy don't want any such data collected or stored in the first place, ever. The implicit "sharing" of my data with Google (or whatever company) is a problem in itself. Regardless of how "seriously" Google (or whatever company) takes it, for a lot of the data I don't want them to ever have it in the first place.
  - danpalmer 2y ago
    This is a fair position to take, but assuming good faith all round, one that I think will typically be a minority. If you ask a user if they're willing to share crash reports only to improve the reliability of the software, I'd bet most people would be ok with this. In fact it's sufficiently reasonable that I believe GDPR allows this to be opt-out, something I broadly agree with. I do think opt-outs should be available, I do think there should be configuration available for those who do not wish to share anything, but if the laws are being met, in the right spirit, then I would hope it would provide little actual benefit.
    - deleted 2y ago
      [deleted]
    - thaumasiotes 2y ago
      That analogy doesn't seem like a match. If you ask a user if they're willing to share every action they ever take "only to improve the reliability of the software", a lot of them are going to say "wait, why would you even need that?" If I'm letting you scrape crash dumps and my browser happens to crash in the request where I send my credit card information to xhamster, that's one thing. Odds are that's never happened to anyone. It's another thing for you to guarantee that you're planning to record that information.
    - throwaway743 2y ago
      > If you ask a user if they're willing to share crash reports only to improve the reliability of the software, I'd bet most people would be ok with this. You do realize the majority of people are completely oblivious as to why privacy matters as it relates to their data collection. It's not that they're willing to do anything. It's that they're passive/apathetic when faced with vague prompts telling them about a matter they don't have insight on, after being bombarded by terms of service agreements, cookie pop ups, etc for years and years. > This is a fair position to take, but assuming good faith all round, one that I think will typically be a minority. If they were aware of privacy implications / exactly what's being collected on them and how that data is being used, then it's safe to say that they'd be the majority. Can't blame them for not taking the time to read into the matter either, as most outside of tech are wrapped up with a million other hostilities in their daily lives. Defend it all you want, but it's just one more unethical thing screwing people over.
deleted 2y ago
[deleted]
raxxorraxor 2y ago
That would be money. If someone has another excuse, they are naive or lying to themselves. It certainly is not "to improve the net or advertising" - that would be the lying part. Google has done some good for the net, but the scales of their contributions slowly but steadily move to the negative side.
- azemetre 2y ago
  Reminds me of the studies they’ve done on cognitive dissonance/lying. Basically if you believe lies you tell yourself, they tend to turn into truths in your mind over time. Even if you were doing it “ironically.”
marcinzm 2y ago
> What answer do the engineers at google working on this have for this violation of privacy? The same answer you probably have for the millions of questions about what the things you do that some other people find offensive to their personal views and beliefs.
GuB-42 2y ago
I am not an engineer at Google but this is I would say if I was. We don't know who you are, you are just a number in a database, and we don't even know what number, we just get the total number of visits for each website, not who visited it. It is like counting cars on a highway, not following your car. Plus, it serves the useful purpose of providing you with better search results, the terms and conditions allow it, and it can be disabled.
- voltaireodactyl 2y ago
  The obvious response being that counting cars on the highway is a necessary first step on the road to identifying and then tracking their movements. Similar to how insurance companies have offered voluntary, “anonymized” data dongles for discounts that are now being used (or at least revealed to be used) to collect data most often used to reject claims.
  - Ferret7446 2y ago
    Agriculture is a necessary first step toward a dystopian society, so clearly we should ban agriculture. The logic does not follow. "A is required for B, B is bad, so A is bad" is not logically valid.
    - voltaireodactyl 2y ago
      I absolutely agree — my statement was merely one of fact; to get to point B, one must first achieve point A. Much like inventing the wheel (positive) is a necessary precursor to both ambulances/fire fighting (also positive), as well as DUIs (less positive). The larger point being simply that I find it somewhat disingenuous for those of us who consider it our job to think through problems from many angles to pretend we’re somehow unable to imagine the potential unfortunate consequences arising from our work, given the existing Powers That Be (meaning both entities and trends).
- lolinder 2y ago
  > we don't even know what number, we just get the total number of visits for each website, not who visited it This is not what a clickstream is. A clickstream requires that the sequence of clicks be preserved, and preserving that sequence undermines anonymity.

bdlowery 2y ago

How is it a violation of privacy. Did you read the terms of service?

y42 2y ago
A tos announcement is not an explicit consent. I doubt that this will help in court, even pre-GDPR.
- HelloNurse 2y ago
  Further, a TOS announcement can be easily construed as an admission of intent to fuck users.
precompute 2y ago
It's a privacy violation regardless of the ToS.
9dev 2y ago
See, that’s the nice thing about the GDPR: You cannot hide unexpected hostile stuff in the ToS anymore. If you don’t tell me what you do with my data in a way that is obvious, easy to understand, and most importantly easy to disable, it’s illegal.

danpalmer 2y ago

Personal (not work related opinion): This basically can’t happen with things like DMA and GDPR. DMA in particular means you can’t share data across “products” without explicit consent. So you could for example collect websites that don’t work for the purposes of improving Chrome, but not then share that with the Ads/Search orgs for personalisation or targeting, as far as I understand the legislation. Personal opinion about work at Google (still not googles opinion) I’m consistently impressed with how seriously this stuff is taken and the amount of work that goes into making sure that things like this sharing can’t happen accidentally, and that user choice is respected. The engineers on the ground are absolutely making sure this all works, and most of us care deeply about user privacy. I have personally worked both on implementing new features that significantly push forward privacy, and on implementing privacy controls for regulatory purposes.

BrenBarn 2y ago
The thing is that preventing "sharing" isn't sufficient. People who are concerned about privacy don't want any such data collected or stored in the first place, ever. The implicit "sharing" of my data with Google (or whatever company) is a problem in itself. Regardless of how "seriously" Google (or whatever company) takes it, for a lot of the data I don't want them to ever have it in the first place.
- danpalmer 2y ago
  This is a fair position to take, but assuming good faith all round, one that I think will typically be a minority. If you ask a user if they're willing to share crash reports only to improve the reliability of the software, I'd bet most people would be ok with this. In fact it's sufficiently reasonable that I believe GDPR allows this to be opt-out, something I broadly agree with. I do think opt-outs should be available, I do think there should be configuration available for those who do not wish to share anything, but if the laws are being met, in the right spirit, then I would hope it would provide little actual benefit.
  - deleted 2y ago
    [deleted]
  - thaumasiotes 2y ago
    That analogy doesn't seem like a match. If you ask a user if they're willing to share every action they ever take "only to improve the reliability of the software", a lot of them are going to say "wait, why would you even need that?" If I'm letting you scrape crash dumps and my browser happens to crash in the request where I send my credit card information to xhamster, that's one thing. Odds are that's never happened to anyone. It's another thing for you to guarantee that you're planning to record that information.
  - throwaway743 2y ago
    > If you ask a user if they're willing to share crash reports only to improve the reliability of the software, I'd bet most people would be ok with this. You do realize the majority of people are completely oblivious as to why privacy matters as it relates to their data collection. It's not that they're willing to do anything. It's that they're passive/apathetic when faced with vague prompts telling them about a matter they don't have insight on, after being bombarded by terms of service agreements, cookie pop ups, etc for years and years. > This is a fair position to take, but assuming good faith all round, one that I think will typically be a minority. If they were aware of privacy implications / exactly what's being collected on them and how that data is being used, then it's safe to say that they'd be the majority. Can't blame them for not taking the time to read into the matter either, as most outside of tech are wrapped up with a million other hostilities in their daily lives. Defend it all you want, but it's just one more unethical thing screwing people over.

deleted 2y ago

[deleted]

raxxorraxor 2y ago

That would be money. If someone has another excuse, they are naive or lying to themselves. It certainly is not "to improve the net or advertising" - that would be the lying part. Google has done some good for the net, but the scales of their contributions slowly but steadily move to the negative side.

azemetre 2y ago
Reminds me of the studies they’ve done on cognitive dissonance/lying. Basically if you believe lies you tell yourself, they tend to turn into truths in your mind over time. Even if you were doing it “ironically.”

marcinzm 2y ago

> What answer do the engineers at google working on this have for this violation of privacy? The same answer you probably have for the millions of questions about what the things you do that some other people find offensive to their personal views and beliefs.

GuB-42 2y ago

I am not an engineer at Google but this is I would say if I was. We don't know who you are, you are just a number in a database, and we don't even know what number, we just get the total number of visits for each website, not who visited it. It is like counting cars on a highway, not following your car. Plus, it serves the useful purpose of providing you with better search results, the terms and conditions allow it, and it can be disabled.

voltaireodactyl 2y ago
The obvious response being that counting cars on the highway is a necessary first step on the road to identifying and then tracking their movements. Similar to how insurance companies have offered voluntary, “anonymized” data dongles for discounts that are now being used (or at least revealed to be used) to collect data most often used to reject claims.
- Ferret7446 2y ago
  Agriculture is a necessary first step toward a dystopian society, so clearly we should ban agriculture. The logic does not follow. "A is required for B, B is bad, so A is bad" is not logically valid.
  - voltaireodactyl 2y ago
    I absolutely agree — my statement was merely one of fact; to get to point B, one must first achieve point A. Much like inventing the wheel (positive) is a necessary precursor to both ambulances/fire fighting (also positive), as well as DUIs (less positive). The larger point being simply that I find it somewhat disingenuous for those of us who consider it our job to think through problems from many angles to pretend we’re somehow unable to imagine the potential unfortunate consequences arising from our work, given the existing Powers That Be (meaning both entities and trends).
lolinder 2y ago
> we don't even know what number, we just get the total number of visits for each website, not who visited it This is not what a clickstream is. A clickstream requires that the sequence of clicks be preserved, and preserving that sequence undermines anonymity.