3 ms·
> ...they will gladly make it look like it's more complicated and insurmountable than it really is There are non-malicious explanations for the same pattern of
by sangnoir 2y ago
> ...they will gladly make it look like it's more complicated and insurmountable than it really is
There are non-malicious explanations for the same pattern of behavior at large organizations - the motivation (malice or not-malice) that seems correct is a Rorschach test.
If I accidentally log IP addresses for EU users that opted out on some throw-away experimental page on my site, Brussels would never find out. If Google does it, it not only has to report the incident, but will most likely be fined. In order to avoid this outcome, they have internal review processes which makes ot "complicated and insurmountable", because how do you justify investing many hours of dozens of lawyers and technical reviewers time for a frivolous, niche AI demo?
- Asraelite 2y ago> If I accidentally log IP addresses for EU users that opted out If opting out is a possibility, then it's not essential data. If it's not essential data, what legitimate reason would you have to collect it in the first place?
- sangnoir 2y agoData safety is a not a binary thing (essential = okay to keep, non-essential = not okay). Instead , it is a context-sensitive, layered, multi-axis concern. IP addresses, for instance, are PII that are essential for network routing, but that doesn't mean address+based ad retargeting is fair game. Accidentally logging data that's essential but was supposed to be ephemeral would turn it "not-ephemeral" and make it possible to cross-reference with other information in privacy-defeating ways. As I said, it was a privacy-focused product, and using data that is meant for one thing (e.g. abuse detection and prevention) for some other out-of-spec use - even accidentally - is a big no-no.