15 ms·
USPS shared customer postal addresses with Meta, LinkedIn and Snap
- ysacfanboi 2y agoThis perhaps explains why I couldn't successfully submit the change of address forms while my ad and tracker blocker was on. Why is this legal?
- jondwillis 2y agoBecause we have failed to adapt our laws sufficiently to keep up with modern networked computing realities. And it is more profitable in the short term (the short term is ending, right about now, in my opinion) to continue to not update our laws. We are going to start to see productivity drop at some point (now) from all of the corruption and inefficiencies that are stacking up to pay for said short-term profits.
- djbusby 2y agoLots of places have the ad/tracker code in paths that can't handle the error correctly. Like, they always think the object they need is there (window.google.tag or whatever). We need to educate the Journeymen in the game to use try/catch and other methods so the hot-path don't die. Not sure about the illegal part but, for sure a failure in test cases.
- bredren 2y agoReally, you don’t want to fill out a permanent change of address form with the USPS. They sell that information. Or license it. Or whatever they call it when they are holding booths at advertising and marketing trade shows. You want to fill out a temporary change of address, renew it the one allowable time and then ghost USPS. By then you should have updated your personal and business contact info with any group you care about. USPS is one of the largest distributors of spam in the United States.
- ranger_danger 2y agoFriendly reminder that FedEx (and probably others) use onboard Flock cameras, who sells the video feeds to law enforcement without probable cause.
- samatman 2y agoThat which takes place in public has never been, and will never be, subject to 4th Amendment protections. Otherwise the police would need probable cause, and therefore a warrant, to look at you while walking down the street.
- ranger_danger 2y agoAnd FedEx delivers on private property 90% of the time, all day every day. This includes car license plates which they actively scan for, meaning your physical location is now being tracked and sold. Cameras always running.
- ranger_danger 2y agoClearly it is a contested issue even within the court system, there have been verdicts made that go both ways on the same issue and many lawyers are noticing that your position is not shared by everyone in charge, and I do not think any of us are in a position to make such unfalsifiable claims. https://www.aclu.org/news/privacy-technology/warrantless-pole-camera-surveillance-by-police-is-dangerous-the-supreme-court-can-stop-it https://www.aclu.org/news/privacy-technology/warrantless-pol... https://news.bloomberglaw.com/us-law-week/police-turn-on-hidden-cameras-turn-off-fourth-amendment https://news.bloomberglaw.com/us-law-week/police-turn-on-hid... >the court determined that no “search” had occurred prior to the entry in Tuggle’s home, so the Fourth Amendment did not apply. To reach this conclusion, the court had to set aside the dictionary and replace the normal meaning of “search” with a fuzzy definition that different courts interpret in different ways at different times.
- samatman 2y agoBoth of these cases were decided against the defendant, and more to the point, both of these cases concern the police setting up a camera specifically pointed at the front of someone's home. That is quite literally on the dividing line between public and private space. I can easily imagine later courts ruling that the combination of specific intention on the part of the police, and the limitless nature of this surveillance, makes it different in kind from the classic stakeout (which does not require a warrant, and never has), and that therefore that in particular requires a warrant to be obtained. I don't think that will happen, but it's imaginable. You're talking about a truck driving around with a camera, and sharing that data on request with law enforcement. That's a completely different thing, and it isn't an edge case at all. That is, and will be, not subject to 4th Amendment protection. On the contrary, Fields v. City of Philadelphia supports a 1st Amendment right to film in public, in that case, the conduct of the police. But the principle generalizes. Furthermore, as an example, let's say that a repairman enters a home, and sees what he or she reasonably believes to be a brick of heroin on a desk. Later, the police, having staked out this home, ask that repairman if they happened to see something suspicious. The repairman tells the police about the brick, they get a warrant, and enter the home. All of this is completely legal. So there's just no world in which a FedEx truck, or any truck, filming the public space in the ordinary course of doing what it does (delivering packages in this case), where the police later ask for and obtain that record, is going to be subject to 4th Amendment restrictions. It is simply, on many levels, not how things work.
- nullc 2y agoGovernment sites shouldn't load any third party content.
- xeromal 2y agoI assume they are because they're broke
- financetechbro 2y agoGovernment agencies are not meant to be profitable
- toomuchtodo 2y agoTell that to the people who keep getting elected. Takes time to repair poor decisions resulting from electorate whims. https://www.govexec.com/management/2024/04/senators-call-postal-board-abandon-dejoys-usps-reforms/396048/ https://www.govexec.com/management/2024/04/senators-call-pos... https://fortune.com/2024/04/10/usps-dejoy-price-hikes-customer-dissatisfaction/ https://fortune.com/2024/04/10/usps-dejoy-price-hikes-custom... | https://archive.is/b03We https://archive.is/b03We
- xeromal 2y agoYup, it's hard to fault the postal service when the game is rigged against them from congress.
- galaxyLogic 2y agoRight. And they are meant (?) to be transparent. Only individual's information must be kept private.
- AceJohnny2 2y agoUselessly tied up budget and so many strings attached is functionally identical to broke. I have a friend who works at USGS in California, the folks who track (among other things) volcanic and tectonic activity on the west side of the US (that includes Yellowstone). For their field trips, they have a daily stipend for food & lodging of ~$100 IIRC. If you know the cost of lodging, you can understand how that's a ridiculously small amount.
- digging 2y agoTracking pixels are just insane. I can't imagine a non-regulatory/legislative solution when the biggest companies on the planet will pay you money just to put a script on your page. How does that get outcompeted? Someone richer pays you to not sell out your users? Just ban this shit.
- throwaway3306a 2y agoHow does the law differentiate that from jQuery on a CDN? The CDN is also doing some amount of tracking, and some of it is simply technically necessary. Google is actually using the Google Fonts service to track traffic.
- mdavidn 2y agoA CDN delivering something like jQuery will not receive cookies nor query parameters and will return a very generous max-age, allowing the browser to reuse the resource for any number of pages or sites without contacting the CDN again. The value of CDNs like this has diminished greatly with the advent of HTTP/2 and HTTP/3.
- hunter2_ 2y agoBut it could start delivering not-jQuery at some point. Far-fetched on the surface, but it's exactly what occurred with polyfill.io recently: https://blog.qualys.com/vulnerabilities-threat-research/2024/06/28/polyfill-io-supply-chain-attack https://blog.qualys.com/vulnerabilities-threat-research/2024... https://news.ycombinator.com/item?id=40791829 https://news.ycombinator.com/item?id=40791829
- mdavidn 2y agoThis is true, but there is a mitigation available: The site can require the resource to match a specified cryptographic hash before running. This did not work with polyfill.io because that CDN would dynamically return different resources based on the user agent. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- alsetmusic 2y ago> When reached for comment, Facebook spokesperson Emil Vazquez provided a statement: “We’ve been clear in our policies that advertisers should not send sensitive information about people through our Business Tools. Doing so is against our policies, and we educate advertisers on properly setting up Business Tools to prevent this from occurring. […] Seems pretty convenient to blame the people using the tool. > Our system is designed to filter out potentially sensitive data it is able to detect.” And just how much attention is spent making that work well? Or is that really just an afterthought with no ongoing improvements so that they can say they tried?
- zelphirkalt 2y agoI mean, filtering messages that contain _addresses_ ... That must be an almost impossible task to do for machines of a multi billion dollar company!
- tqi 2y agoIs it also Apple's fault when people send inappropriate messages via imessage?
- deleted 2y ago[deleted]
- cute_boi 2y ago> We’ve been clear in our policies that advertisers should not send sensitive information about people through our Business Tools. Doing so is against our policies, and we educate advertisers on properly setting up Business Tools to prevent this from occurring. Our system is designed to filter out potentially sensitive data it is able to detect. Please stop denying the fact that you could have disabled usps when they sent the sensitive data. But why would facebook/meta do it when they need so data. And, why is USPS even using meta etc..
- deleted 2y ago[deleted]
- moomoo11 2y agoI hate using usps address change because they always leak my address. I didn’t do it once when I had a short stint and that addrsss isn’t leaked…
- tbyehl 2y agoThey don't leak your address, they sell it. https://postalpro.usps.com/mailing-and-shipping-services/NCOALink https://postalpro.usps.com/mailing-and-shipping-services/NCO...
- richwater 2y agoYet another reason I wouldn't care if the USPS shut down for good. Between delivering spam mail and selling my addresses, they provide net-negative value to my life.
- steego 2y agoHow about you vote for politicians that pass laws to protect your privacy and minimize junk mail instead? I personally use the USPS quite a bit to ship things and I prefer to use them over FedEx or UPS any chance I get.
- cqqxo4zV46cp 2y agoWho said that they don’t? One person voting for a politician doesn’t change governmental policy JUST for them. How unnecessarily condescending.
- uoaei 2y ago"instead" is the operative word here. It's commentary on priorities and reactionary attitudes. Please don't inflame the conversation with more combative language.
- deleted 2y ago[deleted]
- pushcx 2y agoIt makes sense that USPS considers it a bug to freely give away the data that it sells: https://postalpro.usps.com/mailing-and-shipping-services/NCOALink https://postalpro.usps.com/mailing-and-shipping-services/NCO...
- deleted 2y ago[deleted]
- troupo 2y agoOn top of all this people keep uncritically posting news like "Meta will not provide AI models to EU due to regulatory uncertainty" Shit like this is the only "uncertainty"
- xyst 2y agoOnly need to sign up for informed delivery via website, then the service sends e-mail and/or texts. Have rarely needed to use their site directly. Still it’s a major oversight on their part. I wonder if the tracking pixel is loaded as part of “social login” or “social media integration”. Yet another reason I don’t use that shit, and heavily block them across all sites.
- sphars 2y agoCan anyone confirm if there are tracking pixels or similar on the emails themselves? I too never visit the website, I just look at the emails.
- spike021 2y agoSome of the email themselves have ads too. For instance the latest one for me has a Chase banking ad.
- zzyzxd 2y agoUSPS Informed Delivery emails have tracking pixels. But all the mail scans are just attachments to the emails. You can configure email client to not load any remote content and the they will still get rendered pretty nicely. I was pretty surprised to see those attachments in the first place, because some of the scans were quite large (a few hundreds KBs).
- xyst 2y agoI can't say for sure, but haven't worried about it since I opted to _not_ load remote content in e-mail messages.
- markus_zhang 2y agoPAY ME!!!
- KennyBlanken 2y agoWait until you hear that the USPS scans the front and back of every piece of mail that passes through its high-speed scanners, stores it for an unknown period of time, and makes those records available to law enforcement. Those images are part of their 'informed delivery' service which you can sign up for. I've noticed on a number of occasions that the contents of the envelope were noticeable without enhancement and legible with simple contrast/level adjustment.
- kyleee 2y agoAnother example of dragnet spying. People are too stressed to care
- jeffbee 2y agoNo they just don't care. The kind of privacy maximalism found on HN appeals to one in a million. It is not a mainstream issue at all.
- hunter2_ 2y ago> the contents of the envelope were noticeable I've seen that as well, but I place the blame on the sender for using an envelope that isn't fully opaque.
- SoftTalker 2y agoOr they scan using UV or other frequencies so that even if the envelope is visibly opaque it’s not opaque to their scanner. Sometimes their post processing slips up and reveals that their scanner can see thru the envelope.
- uoaei 2y agoIt's pretty hard to believe they don't also regularly use endoscopes on random or suspicious packages when there's a little space to insert one.
- davchana 2y agoThere are whole discussions on various forums and subreddit about image background, fonts of address, sending addresses of USCIS letters to immigrants applicants, to know or guess whats the content of the letter, due to anxiety and curiosity of can't wait until you actually open the letter, that if this letter is a routine acknowledgement, or interview request, or request for proof, or approval or something. Most of the time if the address section shows a part of green statue of Liberty, its a good news.
- vzaliva 2y agoClickbait title: USPS did not share anything intentionally. They negligently allowed tracking pixels from certain companies on their Informed Delivery page. Of course, it's terrible from a privacy point of view, but let's be honest and call things as they are.
- rahimnathwani 2y agoHow can a tracking pixel cause a customers postal address to be sent to Meta?
- slotrans 2y ago1. customer enters their address in form fields 2. those form field values are templated into a GET request to the Meta tracking pixel (or POST request to the /events endpoint, or ...) 3. profit they've made it very easy https://developers.facebook.com/docs/meta-pixel/implementation/conversion-tracking/ https://developers.facebook.com/docs/meta-pixel/implementati...
- slotrans 2y agoit could have been much worse, I have seen passwords leaked this way ("seen" meaning "I worked at a company where this happened and read the code with my own eyes" not just "I read it in the newspaper")
- rahimnathwani 2y agoOK, based on your link the answer to my question seems to be: it's not a tracking pixel, but the "Meta Pixel", which the documentation describes as "a snippet of JavaScript code".
- jameshart 2y agoWelcome to the wonderful world of affiliate marketing, adtech, and tag management. In that world, third party ‘tags’ that are included in a page are generally referred to as ‘pixels’. Sometimes they are single pixel img tags. Frequently they are scripts. But the industry calls them ‘pixels’ anyway. It is, surprisingly, not a terribly honest industry.
- ta988 2y agoNow go ask your bank that does the same... And your local government, and your dentist appointment tracking system and...
- XCSme 2y agoI am happy that my building has this pick-up box system: https://www.my-pup.com https://www.my-pup.com When you order, you enter their own address and name, so neither the delivery company, nor the web shop, have your details.
- grendelt 2y agoAnother reminder we still don't have an overarching, comprehensive data privacy law for US citizens ala GDPR.
- whalesalad 2y agoThis is what happens when Trump "drains the swamp" and appoints dipshit leaders to critical infrastructure.
- deleted 2y ago[deleted]
- AustinDizzy 2y agoThis just highlights the pervasive privacy issues in adtech. Many platforms today even support server-side events tracking which bypasses client-side detection & prevention like an adblocker would do to a tracking pixel. The true scope is alarming: way beyond clicks and views, they track events like "MakeAnAppointment", "AddPaymentInfo", "LoanApplication", etc. This is the real reason why TikTok is a national security risk. Their ad platform, widely used by Shopify, Adobe, Segment, WooCommerce, etc., collects intimate data on non-TikTok users: prescriptions, medical appointments, loan applications, credit card details. Millions who'll never use TikTok, Facebook, etc. are still subject to this data collection in the name of "converting users to customers". https://abs.codes/blog/2024/03/tiktoks-all-seeing-eye-surveillance-beyond-its-users/ https://abs.codes/blog/2024/03/tiktoks-all-seeing-eye-survei... At the policy level, we urgently need a national data privacy act to address these types of systemic issues. At the technology level, things like zero-knowledge advertising could mitigate a lot of the user privacy risk.
- carom 2y agoTangentially related, the government publishing my address whatsoever really upsets me. Voter records, property records, the DMV, and the USPS all in some way publish or sell citizens' addresses to private companies. I do not know why this is legal. I do not want anyone outside of the government knowing my address.
- russianbandit 2y agoTBH I don’t even want the government knowing my address.
- smcin 2y agoSure, but the USPS is not a government-owned corporation (like Amtrak), it was made an "independent agency" of the US executive branch back in July 1971, over half a century ago; under Nixon [0]. The head of the USPS (Postmaster General, currently Trump appointee Louis DeJoy) reports to the Board of Governors [1] (9 governors + PG + Deputy PG) who are nominated by the President; the PG can be removed by an absolute majority of the board. The USPS is overseen by the Office of Inspector General (USPS-OIG), current head Tammy Hull [2] and has a "hotline" (actually a web form) for reporting complaints [3] which fall under its focus areas, which includes fraud, computer crime and employee misconduct. Seems like one place to start. For previous 2022 discussion of controversies involving Postmaster General DeJoy and what it would take to remove the PG, see [4]. The PG has no term limit but most recent PGs averaged ~5 years. Historically it wasn't seen as a partisan appointment and wasn't replaced when an incoming President changed to the other party. [0]: https://en.wikipedia.org/wiki/United_States_Post_Office_Department https://en.wikipedia.org/wiki/United_States_Post_Office_Depa... [1]: https://about.usps.com/who/leadership/board-governors/ https://about.usps.com/who/leadership/board-governors/ [2]: https://www.uspsoig.gov/ https://www.uspsoig.gov/ [3]: https://www.uspsoig.gov/hotline https://www.uspsoig.gov/hotline [4]: "Can Biden fire US Postmaster General Louis DeJoy?" https://www.federaltimes.com/federal-oversight/2022/08/24/can-biden-fire-us-postmaster-general-louis-dejoy/ https://www.federaltimes.com/federal-oversight/2022/08/24/ca...
- falqun 2y ago"oh sorry, the computers at fault here, cant do nothing about it" - god I hate that line of reasoning. Its your system, so its your responsibility.
- smolder 2y agoThis may sound hyperbolic but I think the US is a failed state. Humanity is facing a mess because the hegemony is falling apart in the hands of extremely incompetent leadership. Generations of nepo-babies have led to incompetency. In very simple terms: today's rich are stupid.
- kvetching 2y agoPeople would be horrified if they knew the extent to which basically every corporation shares data with everyone else for "business intelligence"
- surfingdino 2y agoFor all this spying the quality of products and services is going down, so what's the point?
- deleted 2y ago[deleted]
- soygem 2y agoTAD, Total Advertiser Death.
- BobbyTables2 2y agoI don’t get it. Thought tracking pixels were just for unsophisticated websites and those who wanted to track people across different sites. USPS has an authenticated page where they know their customers. Why wouldn’t they just analyze THEIR OWN logs instead of relying on third-party advertising companies? Was this really an accident?
- wlonkly 2y agoPixels aren't pixels, oddly enough, it's marketing jargon for cross-site tracking, which way back when was accomplished by pixels. So even relatively sophisticated analytics platforms are still "pixels". I don't like it either. The USPS wants to know which of their ad campaigns is successful, and want to be able to target advertising, so they embed their advertising platforms' Javascript in their site. That part seems reasonable for a government agency that's required to self-fund. The problem is either that the tracking was on pages that shouldn't have had it, or that it wasn't restricted in what it could send to the analytics platforms.