5 ms·
Most companies would bury this change in a deceptively boring T&Cs update, but we value transparency, so here's what you need to know in an internet-friendly nu
by sixtyj 5mo ago
Most companies would bury this change in a deceptively boring T&Cs update, but we value transparency, so here's what you need to know in an internet-friendly numbered list:
Users on our EU cloud instance are opted out by default
So too users with agreements that prevent training (e.g. BAA, MSA, or similar)
All other users on our US cloud instance are opted in by default
We will anonymize all data before it's used for training
We will only use data that already exists in your PostHog instance
We will do all the model training ourselves, which means...
We won't sell or send your data to third-party model providers
You can opt out at any time via your org settings in PostHog (admin access required)
Training won't start until June 29, so there's plenty of time to decide
- GuinansEyebrows 5mo ago> All other users on our US cloud instance are opted in by default This is slimy.
- xnorswap 5mo agoIt's slimy because your government allows it, this doesn't have to be the case. 1. Lobby your representatives to improve your data protection laws, even if you think it's pointless to do so 2. Stop attacking EU data protection laws, even if they inconvenience you As can be seen from this announcement, data protection laws do make a difference.
- GuinansEyebrows 5mo agoyes, of course!
- mrweasel 5mo agoNot really, it's slimy because it should be obvious that it's the morally wrong thing to do. There's no tangible benefit to the users, only risk. The fact that they only opt-out EU users, because regulation forces them, tells you all you need to know about the moral compass of PostHog. This shouldn't even require regulation, but apparently expecting companies to act morally is a bloody pipe dream. Profit over morals and concerns for your costumers, apparently.
- ryanmcbride 5mo agoI don't want to support a company that's going to do everything they can possibly legally get away with, I want to support companies that do the right thing where they can.
- osigurdson 5mo agoWhat concrete difference is being made here? If a site is hosted in the US but accessible by EU citizens AND using a PostHog US server isn't the data still being used for training? Legitimate question, I am not trying to prove a point.
- mark242 5mo agoIf "we will opt everyone in because otherwise we won't get enough data because we know users won't opt in" is your business model, maybe it's time for a rethink.
- rottencupcakes 5mo agoDefaults matter. Opt-in vs opt-out organ donorship has a large impact. Most people on any web app won’t stray from the defaults.
- philipwhiuk 5mo agoAgain, this is because it's uninformed. Consent matters.
- cjonas 5mo agoyea except one is a "dark pattern" to exploit customers for corporate profit while the other is to benefit society.
- mmh0000 5mo agoWhich we probably need to consider changing now that some truly bizarre and evil shit is being done on donor organs: https://news.ycombinator.com/item?id=48212992 https://news.ycombinator.com/item?id=48212992
- abustamam 5mo agoOff topic but I'm curious what's evil about that article. Bizarre, sure, but evil? They took a brain (an organ) from a dead person who had previously given consent to use their organs for that purpose.
- mmh0000 5mo agoI think most people, and definitely myself, when they sign up to be an organ donor, they think of the liver, kidney, and heart. Things that will help other people. Not the brain, the center of conscience, being kept in some sort of horror-movie half-alive state. I do not think we understand consciousness enough to rule out what those brains are experiencing.
- kelsey98765431 5mo agoCant wait to see posthog crash and burn, i have hated their service for years now.
- johnsillings 5mo agowhy?
- jasonmp85 5mo ago[dead]
- vovavili 5mo agoBizarre take.
- rafael-lua 5mo agoCalm down, GA4/Amplitude/Mixpanel.
- hilariously 5mo agoThere is no such thing as opt in by default - and burning that amount of customer goodwill because you want something instead of say, giving a discount to people who are willing to do it is a choice for people who have a lot more market share and their customers would have more trouble leaving.
- infecto 5mo ago> Most companies would bury this change in a deceptively boring T&Cs update, but we value transparency, so here's what you need to know in an internet-friendly numbered list: This feels like a really bad defense. It’s great you provide transparency but I don’t want my analytics system writing my code. There are already so many other first movers that are better that I would rather connect to your analytics.
- ryanmcbride 5mo agoHey man, respectfully, opt-in by default is not opt-in. That's opt-out, and it's scummy. I feel like you either know that already, or should, but either way I won't be using your product anymore. Just pulled it out of the projects I'm personally in charge of and in the future I'm going to recommend against using it both internally and for clients. Legitimately disappointed.
- teraflop 5mo ago> All other users on our US cloud instance are opted in by default Cool, cool. Glad to see that you are the arbiter of what your users have "opted" to do, and their input isn't required. While we're at it, I'm going to "volunteer" your time to rebuild my patio this weekend. You don't need to worry about volunteering, I've done it for you.
- trollbridge 5mo agoIf you send a postcard by Friday 5:00 PM, you can opt out of helping me with my patio. This is a one time offer; if you don’t, you have to help me every weekend for forever.
- buzer 5mo ago> We will anonymize all data before it's used for training Anonymize by what definition? GDPR? Do note that this very high bar. > All other users on our US cloud instance are opted in by default Including end users in the EU? You should remember that you are obtained the personal data directly from data subject meaning Article 13 obligations apply. Article 13 omissions cannot be cured retroactively. Can you show all of your customers have provided sufficient Article 13 notice to cover this processing? And do note that you are almost definitely within the scope of 3(2)(b).
- _heimdall 5mo ago> We will do all the model training ourselves That's actually an interesting note. So you all will be managing the training runs on hardware you own or rent and manage?
- tartieret 5mo agoThere is definitely some confusion on the EU part. I am a European citizen, but some of my activity data on some of the sites I host is logged in US Posthog, which means Posthog is subject to the GDPR, even if the data is US hosted!
- osigurdson 5mo agoI think it would be better if there was an EU browser that provided a warning if accessing sites outside of the EU. If an origin site is in the EU then it could be subject to EU regulations.
- sammy0910 5mo agoas a user i dont like it, and am disappointed. it will take a bit of time to transition our systems off of posthog, but we will need to. if you are looking at your metrics, I want to be clear that this transition will not happen overnight, but it _will_ happen for this reason, so just be aware that your short-term metrics won't tell the full story
- shafyy 5mo ago> Users on our EU cloud instance are opted out by default > All other users on our US cloud instance are opted in by default Perfectly demonstrating that we need regulation to protect the general public, most companies will not do the right thing but the thing that benefits them first and foremost.