3 ms·

After reading the article it seems to be on the right track. Banning markets for user data seems like a great first step.

abeppu 2y ago
Is banning "sale" the right way to frame this though? What is a "sale"? E.g. I know that zoos aren't supposed to buy or sell animals -- but they do exchange them. And certainly among tech companies, "data partnerships" are already common, where company A gives data to company B and B does something for A distinct from just paying them. I think we need to expand regulations around consent of data subjects. Today we sometimes argue over whether a data subject has meaningfully given consent for a specific use of their data for something other than the core product that generated it. Once that consent is given, maybe the data subject has some right to be forgotten in principle, but understanding how their data is actually being used in order to withdraw consent is really hard and messy. What if every use of a customer's data which is presented back to them (e.g. from a marketing email from a firm you've never directly interacted with to targeted ad you see in an app or on web page) has to give you a link a report showing what data sources contributed to it, and which parties controlled it, along with "revoke consent" links?
- jampekka 2y ago
  In EU under the GDPR we have the "consent" thing. It has failed miserably because of bad enforcement and corporate shenanigans. Per polling around 3% of people want to give a consent for adtech tracking but majority click a consent button against their consent. There's also a right to get the data they have on you and to who it was sold and to revoke the "consent". It's practically useless because of how it gets maliciously implemented.
  - abeppu 2y ago
    Right, so you're not aware of all the data controllers that have your data to whom you should send a request to delete your data, so currently it's impractical to exercise your rights. But presumably you're aware when you're shown an ad ... so requiring the application which uses the data to present info about the data provenance and controllers would give data subjects a better opportunity to withdraw consent from those uses. But I suppose you might not know if your data was used against you in the form of not offering you a better loan rate which your neighbor was offered, for example.
    - jampekka 2y ago
      I have no idea who has my data and how it's used. And how they made it work is that every single site has these nags, and if you once make the mistake of "consenting" to any of them (which is inevitable with all the dark patterns), your data gets sold to all corners of the adtech. I use adblock religiously, so luckily buying my data is mostly waste of money to them. There's an obvious existing solution to this: do not track headers. But they didn't want it that way because it wouldn't have left enough loopholes to keep people giving their data against their consent.

abeppu 2y ago

Is banning "sale" the right way to frame this though? What is a "sale"? E.g. I know that zoos aren't supposed to buy or sell animals -- but they do exchange them. And certainly among tech companies, "data partnerships" are already common, where company A gives data to company B and B does something for A distinct from just paying them. I think we need to expand regulations around consent of data subjects. Today we sometimes argue over whether a data subject has meaningfully given consent for a specific use of their data for something other than the core product that generated it. Once that consent is given, maybe the data subject has some right to be forgotten in principle, but understanding how their data is actually being used in order to withdraw consent is really hard and messy. What if every use of a customer's data which is presented back to them (e.g. from a marketing email from a firm you've never directly interacted with to targeted ad you see in an app or on web page) has to give you a link a report showing what data sources contributed to it, and which parties controlled it, along with "revoke consent" links?

jampekka 2y ago
In EU under the GDPR we have the "consent" thing. It has failed miserably because of bad enforcement and corporate shenanigans. Per polling around 3% of people want to give a consent for adtech tracking but majority click a consent button against their consent. There's also a right to get the data they have on you and to who it was sold and to revoke the "consent". It's practically useless because of how it gets maliciously implemented.
- abeppu 2y ago
  Right, so you're not aware of all the data controllers that have your data to whom you should send a request to delete your data, so currently it's impractical to exercise your rights. But presumably you're aware when you're shown an ad ... so requiring the application which uses the data to present info about the data provenance and controllers would give data subjects a better opportunity to withdraw consent from those uses. But I suppose you might not know if your data was used against you in the form of not offering you a better loan rate which your neighbor was offered, for example.
  - jampekka 2y ago
    I have no idea who has my data and how it's used. And how they made it work is that every single site has these nags, and if you once make the mistake of "consenting" to any of them (which is inevitable with all the dark patterns), your data gets sold to all corners of the adtech. I use adblock religiously, so luckily buying my data is mostly waste of money to them. There's an obvious existing solution to this: do not track headers. But they didn't want it that way because it wouldn't have left enough loopholes to keep people giving their data against their consent.