4 ms·

IMO we should ban gathering this data without a warrant or specific contractual agreement between the device owner and entity aggregating the data. As much as c

by ch4s3 6mo ago

IMO we should ban gathering this data without a warrant or specific contractual agreement between the device owner and entity aggregating the data. As much as congress loves to claim the interstate commerce theory of everything, this seems like a slam dunk.

Dwedit 6mo ago
Contractual agreement? Nobody reads things like EULAs or terms of service. It's probably in there already.
- rubyfan 6mo ago
  Right, privacy terms are written to be vague and permissive. Even if you read them you can’t usually understand how the data will be used or opt out.
- toofy 6mo ago
  if it were up to me i’d require a hand signed contract that explicitly, up front and in plain english gives permission and is not transferable to any “partners”.
- ch4s3 6mo ago
  I should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.
  - ryandrake 6mo ago
    There is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.
    - pocksuppet 6mo ago
      Then it's not a valid contract and therefore does not absolve them of criminal liability for stalking you.
      - kube-system 6mo ago
        Contracts of adhesion can be valid contracts. The ability to negotiate or equal bargaining power is not a required element of a contract. Furthermore, you cannot contract away criminal liability if any exists.
        lukeschlather 6mo ago
        Even attempting to use a contract of adhesion to justify selling GPS location data to a third party should be a criminal act.
        kube-system 6mo ago
        Yes, the US is in desperate need of better privacy laws.
      - celeritascelery 6mo ago
        You click on “accept terms and conditions” which means you agree to the contact.
    - ch4s3 6mo ago
      You can't just bury literally anything in an EULA. There's a fair amount of case law establishing that EULAs clauses that are surprising or illegal aren't enforceable.
      - pwg 6mo ago
        That fact does not change the point of the individual to which you replied. Regardless of whether the clauses in the EULA are 100% legal, some mixture or 100% illegal, the entire EULA is a "one sided rule-book dictated completely by one side". You, the person held to the EULA's rules, do not get to negotiate on the individual points. You simply have a "take it or go away" set of options.
- teeray 6mo ago
  Instead of “I accept”, you’re given a quiz
rubyfan 6mo ago
I think we should make this type of tracking opt-out by default. We should also ban the sale of its use to third parties and its use for purposes other than the specific functionality which required it to be enabled in the first place.
- gruez 6mo ago
  >I think we should make this type of tracking opt-out by default That's opt-in, not opt-out. https://en.wiktionary.org/wiki/opt-out https://en.wiktionary.org/wiki/opt-out
  - nickburns 6mo ago
    GP states correctly that they believe the default 'choice' of a user should be 'opting-out' of location tracking.
    - rcxdude 6mo ago
      This is utterly confusing the use of the terms. Opting is making a choice. The default isn't a choice. Opting by default makes no sense.
      - rubyfan 6mo ago
        Yeah it is. What I mean is the default is you have not opted in. You must choose to opt in for this type of tracking. It should be a choice that doesn’t preclude you from using a service if you don’t allow tracking.
        quantum_magpie 6mo ago
        You are describing opt-in policies — you’re out by default and you have to opt-in to be tracked.
    - deleted 6mo ago
      [deleted]
troupo 6mo ago
> IMO we should ban gathering this data without GDPR tried. And the narrative around GDPR was deliberately completely derailed by adtech. Lack of enforcement didn't help either
- ch4s3 6mo ago
  GDPR like all EU regulation is needlessly complicated and aimed at a compliance model that seems designed for SAP.
  - troupo 6mo ago
    You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats on gullibly believing the ad tech narrative.
    - ryandrake 6mo ago
      The "GDPR is complicated" meme has been circulating among software developers since probably before it was even written. It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it!
      - pocksuppet 6mo ago
        Same with the California age input box.
        lukeschlather 6mo ago
        The problem with the age input box is that we don't have the GDPR. We're mandating that people give accurate age information to advertisers, and it's legal for advertisers to sell detailed dossiers on people including their age and target advertising using the age. This is why Meta wrote the age input box legislation, they want to make everyone legally required to provide Meta with their age.
wakawaka28 6mo ago
Every EULA already covers this basically. The real problems are: people agree to it, and the government can do an end-run around the constitution by simply purchasing data or hiring contractors.
philipnee 6mo ago
companies don't buy anymore, they just take it. think about Claude, every time you use it, you are literally give away your code, your data, and even your personal information.

by ch4s3 6mo ago

Dwedit 6mo ago

Contractual agreement? Nobody reads things like EULAs or terms of service. It's probably in there already.

rubyfan 6mo ago
Right, privacy terms are written to be vague and permissive. Even if you read them you can’t usually understand how the data will be used or opt out.
toofy 6mo ago
if it were up to me i’d require a hand signed contract that explicitly, up front and in plain english gives permission and is not transferable to any “partners”.
ch4s3 6mo ago
I should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.
- ryandrake 6mo ago
  There is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.
  - pocksuppet 6mo ago
    Then it's not a valid contract and therefore does not absolve them of criminal liability for stalking you.
    - kube-system 6mo ago
      Contracts of adhesion can be valid contracts. The ability to negotiate or equal bargaining power is not a required element of a contract. Furthermore, you cannot contract away criminal liability if any exists.
      - lukeschlather 6mo ago
        Even attempting to use a contract of adhesion to justify selling GPS location data to a third party should be a criminal act.
        kube-system 6mo ago
        Yes, the US is in desperate need of better privacy laws.
    - celeritascelery 6mo ago
      You click on “accept terms and conditions” which means you agree to the contact.
  - ch4s3 6mo ago
    You can't just bury literally anything in an EULA. There's a fair amount of case law establishing that EULAs clauses that are surprising or illegal aren't enforceable.
    - pwg 6mo ago
      That fact does not change the point of the individual to which you replied. Regardless of whether the clauses in the EULA are 100% legal, some mixture or 100% illegal, the entire EULA is a "one sided rule-book dictated completely by one side". You, the person held to the EULA's rules, do not get to negotiate on the individual points. You simply have a "take it or go away" set of options.
teeray 6mo ago
Instead of “I accept”, you’re given a quiz

rubyfan 6mo ago

I think we should make this type of tracking opt-out by default. We should also ban the sale of its use to third parties and its use for purposes other than the specific functionality which required it to be enabled in the first place.

gruez 6mo ago
>I think we should make this type of tracking opt-out by default That's opt-in, not opt-out. https://en.wiktionary.org/wiki/opt-out https://en.wiktionary.org/wiki/opt-out
- nickburns 6mo ago
  GP states correctly that they believe the default 'choice' of a user should be 'opting-out' of location tracking.
  - rcxdude 6mo ago
    This is utterly confusing the use of the terms. Opting is making a choice. The default isn't a choice. Opting by default makes no sense.
    - rubyfan 6mo ago
      Yeah it is. What I mean is the default is you have not opted in. You must choose to opt in for this type of tracking. It should be a choice that doesn’t preclude you from using a service if you don’t allow tracking.
      - quantum_magpie 6mo ago
        You are describing opt-in policies — you’re out by default and you have to opt-in to be tracked.
  - deleted 6mo ago
    [deleted]

troupo 6mo ago

> IMO we should ban gathering this data without GDPR tried. And the narrative around GDPR was deliberately completely derailed by adtech. Lack of enforcement didn't help either

ch4s3 6mo ago
GDPR like all EU regulation is needlessly complicated and aimed at a compliance model that seems designed for SAP.
- troupo 6mo ago
  You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats on gullibly believing the ad tech narrative.
  - ryandrake 6mo ago
    The "GDPR is complicated" meme has been circulating among software developers since probably before it was even written. It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it!
    - pocksuppet 6mo ago
      Same with the California age input box.
      - lukeschlather 6mo ago
        The problem with the age input box is that we don't have the GDPR. We're mandating that people give accurate age information to advertisers, and it's legal for advertisers to sell detailed dossiers on people including their age and target advertising using the age. This is why Meta wrote the age input box legislation, they want to make everyone legally required to provide Meta with their age.

wakawaka28 6mo ago

Every EULA already covers this basically. The real problems are: people agree to it, and the government can do an end-run around the constitution by simply purchasing data or hiring contractors.

philipnee 6mo ago

companies don't buy anymore, they just take it. think about Claude, every time you use it, you are literally give away your code, your data, and even your personal information.