7 ms·

The fact that Jawbone has this information on their users (yes, I know they say it's aggregated and "anonymised" data) is pretty scary to me. In my opinion, thi

by antr 12y ago

The fact that Jawbone has this information on their users (yes, I know they say it's aggregated and "anonymised" data) is pretty scary to me. In my opinion, this data should only be visible to each user, and no one else. I really doubt Jawbone users are aware that their UP devices are sending data to third-parties... it feels like 21st century shackles.

BillFranklin 12y ago
Total privacy invasion.
ClassicFarris 12y ago
At first I thought something along these lines, then I remembered: 1. Google has "trends" when things happen, and "Earthquake" was most certainly googled near/at the time it happened. 2. The phone company has records, which many people texted/called near/at the time it happened. 3. 911 has records and calls were made near/at the time it happened. and so on… So there are private entities and government that have data around the event that can correlate behavior and situations, so it shouldn't seem scary to me… it's just should I have better access to the data? And if I do, what can I tell from the correlation?
- jsprogrammer 12y ago
  I think it also has to do with what content is being recorded. Intimate sleep data is a bit different than knowing I called 911 for an emergency situation.
  - dohertyjf 12y ago
    Are you saying that the sleep data is more personal than calling 911? I have to question that, because you could call 911 for all sorts of private situations that you wouldn't want publicly known. So no, it's not really different.
    - gknoy 12y ago
      Especially in this case. Saying something like, "I couldn't go back to sleep after that earthquake woke me up" is the kind of thing many people would share on twitter, facebook, or around the water cooler with coworkers.
  - baddox 12y ago
    It's subjective. I would consider a call I made to 911 to be a lot more personally sensitive than my sleep patterns.
Goopplesoft 12y ago
The UP bands data processing happens server sided and is indicated by the UI. Was there an indication here that a third party was involved (the post indicates its their internal data team)? Otherwise I think everyone has generally accepted internal company use of data (critical part of growth) let alone when its aggregate and anonymous.
lfx 12y ago
Quote from [1] Jawbone Privacy page: "We may share your Information with third parties to provide services on our behalf such as to process payments, or to store information collected through our site, app, and services." Does this statement allows them to use users data for this purpose? [1] https://jawbone.com/legal/privacy https://jawbone.com/legal/privacy
- thaumasiotes 12y ago
  Well, we the general web audience aren't providing any services to UP wearers on behalf of Jawbone, and they're not giving us the data to store (that is, they're not asking us to store it), so that quote doesn't allow such a sharing of an UP wearer's data. However, they might be willing to argue that sharing aggregated data isn't the same thing as sharing your personal data; it wouldn't be a totally ridiculous idea.
- josephlord 12y ago
  The Use of Information section includes press releases although it is not counted in the sharing section. I also see no commitment to anonymising the data. Jawbone uses your information to provide and deliver products and services you request; personalize your experience and customize content, marketing, and recommendations; respond to requests that you make, provide you with customer service, send you press releases, general informative announcements, and promotional information about us or our products, or to aid us in serving you better; and protect, investigate, and deter against fraudulent, unauthorized, or illegal activity.
projectmayhem 12y ago
As an UP user, I think Jawbone make it pretty obvious when using their app that you're sending data up to a server, and as others have pointed out, the EULA explains that this data can be used elsewhere.
TomAnthony 12y ago
I'm a Jawbone UP user and I have absolutely no problem with this anonymised data being used like this. It can make not only the product better but could also lead to useful research around sleep and health. If I want out then Jawbone has a handy 'remove all my data' option. People share all sorts of data in all sorts of places (as others have pointed out in this thread), and it is their own responsibility to read the T&Cs of those services. I agree that data privacy is important for those who want theirs protected. But in this instance, people have chosen to wear their UP and have T&Cs which notify them of the usage. If they later change their mind then they have the option to have their data removed. I can't see how any of that equates to 'shackles', but agree from some POVs it could be considered 'scary'.
- amirmc 12y ago
  > "... it is their own responsibility to read the T&Cs of those services." While some people may believe/feel this is reasonable, it has rapidly become impractical. Have you read the T&CS for all the services you use? Any idea how many pages of text that comes to? Did you also know that the reading level of most T&Cs requires college-level education (just to comprehend)? My point is that it is already impractical (& will become more so) to suggest that T&Cs can make people aware of anything.
  - reitanqild 12y ago
    I used to read them, then sift through them. Then I gave up. My defence would go along the lines of: you don't seriously think that any end user would read that, would you? (Exceptions for APIs etc.) Same goes for legal disclaimers in email footers, cookie warnings, warning stickers etc. Why are we allowing this to happen? (My solution: "Yes, you can sue them because the coffee was hot (etc) and there was no sticker on it, you just have to be prepared to give up your voting rights and your drivers license in the progress. Continue Yes/No?")
    - acangiano 12y ago
      As an aside, the "coffee was hot" lawsuit wasn't as frivolous as people make it sound. See Liebeck v. McDonald's Restaurants for details.
maxerickson 12y ago
You don't need a sleep monitor to function in the 21st century. If you try to take a Jawbone off, I believe it will take a few seconds. I dislike these data collection and analysis as a service gadgets enough that I'm not using any of them, but I think you could be a little more considered in your criticism of them.
joshdance 12y ago
How are they not aware the data is sent to 3rd parties? Isn't that a key feature of the device?
diminoten 12y ago
Oh, come on. I'm getting a little sick of how far the pendulum has swung in this privacy conversation. I get the desire for privacy, but if every time people have data about them used we get this complaint, no one's going to listen when there's a real violation of privacy.
drzaiusapelord 12y ago
Comments like these make me think that the pro-privacy crowd is officially a cult. I just don't see the argument about anonymized data that you can opt-out of being such a threat to the end user. I love these types of analysis, especially the ones about dating from OK Cupid. Tivo used to reveal all sorts of interesting things about viewership that was very enlightening. I'd hate to lose this data just because a minority think its a threat to their civil rights. There's a reason why no one outside of reddit and HN knows what the EFF is or cares about their mission. It doesn't fit in with most people's politics. I really think the privacy advocates are holding us back at this point. They refuse to make reasonable concessions and while they think they're fighting the good fight, they've just marginalized themselves to the point where only a tiny extremist minority is engaged because moderate voices are shouted down as "selling out to the man" or the NSA or whoever the villain of the day is. Its also sad to see a arguably progressive community like HN fall for this stuff. Not only are we doing this stuff all the time, the current fad of health devices, smart watches, etc are going to make this a lot more common. We're like cavemen throwing spears at an enemy with machine guns. Its a fight we've long lost. I think its better for us to focus on privacy issues that are legitimately victimizing instead of railing against anything and everything that kinda sorta rubs us the wrong way. If anything, the cult of privacy is hurting us because its created a "boy who cried wolf" situation which is now a political liability. How am I supposed to tell Joe Midwest Voter that X is harmful when he keeps hearing about how tracking cookies or Tivo stats or iPhone policies are harmful and didn't give two shits about those either.
- Retric 12y ago
  There is no such thing as completely anonymized data. And in this case there releasing information without the consent of their users. Sure, you might think that it's reasonable in this case but the important thing is users are not making that decision. So, as long as companies feel they can do anything they feel like with the data your only option is to completely opt out. Which means companies have no reason not to release your data as everyone assumes they will anyway.
  - mgob 12y ago
    This isn't a question I have an answer to, but isn't it likely that users relinquish their right to data privacy when they sign a privacy policy and/or terms of use?
wdr1 12y ago
To me, there's a world of difference between sharing my personal commute between home & work, and using my drive to show traffic patterns.
declan 12y ago
I look forward to NSA serving an FAA 702 order on Jawbone to track a non-U.S. user. It would require that Jawbone perform a live intercept so FedGov agents can plant physical bugs or insert TURBINE-derived malware or attach a keystroke logger. The order would use existing legal authority to compel Jawbone to provide real-time data on the user’s precise geographical location and whether he or she is awake. Obviously if the target is at home and awake, the Feds would abort the black bag job. The Google Play store listing shows that the Up app wants access to precise (GPS) and approximate (network) location, so the lat/long available for NSA perusal with compulsory process is likely pretty detailed. And the marketing literature on the Jawbone site uses “always-connected” and “real-time” language, which is perfect if you're in the real-time surveillance business. The non-U.S. user targeted by FedGov may think he’s escaping surveillance because he’s using only local phone providers and local email providers. He’d be wrong; Jawbone is based in SF and subject to U.S. law… Another interesting use would be tracking physical movements of non-U.S. users and correlating them to see who’s meeting with whom; does Jawbone force SSL for its API usage? (The API web page only says “communication should be done over a secure channel,” not “must.”) I’m joking above, of course, and I have no reason to believe the NSA has done this for a non-U.S. citizen or the FBI has for domestic surveillance. My point is to suggest that folks here at startups think in advance about how to respond to legal process, how to encrypt data in transit, and how to store user data in a way that minimizes your legal exposure and protects your users’ privacy. Better to think about this early vs. after you get an early morning knock on the door with a very serious plainclothes guy with a badge serving you with some very serious papers demanding info. That happened to me in a different context years ago, but that’s a story for another time.
kevincrane 12y ago
First off, I have a Jawbone UP24 and love it. You know how they got that sleep data? I pushed the "start sleep" and "stop sleep" buttons, then they gave me an awesome visualization of how I slept last night. You know what you'd do if you didn't want them to have that data? Don't push those buttons.
unicornporn 12y ago
Does anyone know if there's a device like this that DOES NOT require uploading all collected data to "the cloud" in order to analyze what I've collected? It's pretty obvious that this could be done on client side without needing an internet connection. Or do all of these companies sacrifice usability and privacy in order to make more money?

by antr 12y ago

BillFranklin 12y ago

Total privacy invasion.

ClassicFarris 12y ago

At first I thought something along these lines, then I remembered: 1. Google has "trends" when things happen, and "Earthquake" was most certainly googled near/at the time it happened. 2. The phone company has records, which many people texted/called near/at the time it happened. 3. 911 has records and calls were made near/at the time it happened. and so on… So there are private entities and government that have data around the event that can correlate behavior and situations, so it shouldn't seem scary to me… it's just should I have better access to the data? And if I do, what can I tell from the correlation?

jsprogrammer 12y ago
I think it also has to do with what content is being recorded. Intimate sleep data is a bit different than knowing I called 911 for an emergency situation.
- dohertyjf 12y ago
  Are you saying that the sleep data is more personal than calling 911? I have to question that, because you could call 911 for all sorts of private situations that you wouldn't want publicly known. So no, it's not really different.
  - gknoy 12y ago
    Especially in this case. Saying something like, "I couldn't go back to sleep after that earthquake woke me up" is the kind of thing many people would share on twitter, facebook, or around the water cooler with coworkers.
- baddox 12y ago
  It's subjective. I would consider a call I made to 911 to be a lot more personally sensitive than my sleep patterns.

Goopplesoft 12y ago

The UP bands data processing happens server sided and is indicated by the UI. Was there an indication here that a third party was involved (the post indicates its their internal data team)? Otherwise I think everyone has generally accepted internal company use of data (critical part of growth) let alone when its aggregate and anonymous.

lfx 12y ago

Quote from [1] Jawbone Privacy page: "We may share your Information with third parties to provide services on our behalf such as to process payments, or to store information collected through our site, app, and services." Does this statement allows them to use users data for this purpose? [1] https://jawbone.com/legal/privacy https://jawbone.com/legal/privacy

thaumasiotes 12y ago
Well, we the general web audience aren't providing any services to UP wearers on behalf of Jawbone, and they're not giving us the data to store (that is, they're not asking us to store it), so that quote doesn't allow such a sharing of an UP wearer's data. However, they might be willing to argue that sharing aggregated data isn't the same thing as sharing your personal data; it wouldn't be a totally ridiculous idea.
josephlord 12y ago
The Use of Information section includes press releases although it is not counted in the sharing section. I also see no commitment to anonymising the data. Jawbone uses your information to provide and deliver products and services you request; personalize your experience and customize content, marketing, and recommendations; respond to requests that you make, provide you with customer service, send you press releases, general informative announcements, and promotional information about us or our products, or to aid us in serving you better; and protect, investigate, and deter against fraudulent, unauthorized, or illegal activity.

projectmayhem 12y ago

As an UP user, I think Jawbone make it pretty obvious when using their app that you're sending data up to a server, and as others have pointed out, the EULA explains that this data can be used elsewhere.

TomAnthony 12y ago

I'm a Jawbone UP user and I have absolutely no problem with this anonymised data being used like this. It can make not only the product better but could also lead to useful research around sleep and health. If I want out then Jawbone has a handy 'remove all my data' option. People share all sorts of data in all sorts of places (as others have pointed out in this thread), and it is their own responsibility to read the T&Cs of those services. I agree that data privacy is important for those who want theirs protected. But in this instance, people have chosen to wear their UP and have T&Cs which notify them of the usage. If they later change their mind then they have the option to have their data removed. I can't see how any of that equates to 'shackles', but agree from some POVs it could be considered 'scary'.

amirmc 12y ago
> "... it is their own responsibility to read the T&Cs of those services." While some people may believe/feel this is reasonable, it has rapidly become impractical. Have you read the T&CS for all the services you use? Any idea how many pages of text that comes to? Did you also know that the reading level of most T&Cs requires college-level education (just to comprehend)? My point is that it is already impractical (& will become more so) to suggest that T&Cs can make people aware of anything.
- reitanqild 12y ago
  I used to read them, then sift through them. Then I gave up. My defence would go along the lines of: you don't seriously think that any end user would read that, would you? (Exceptions for APIs etc.) Same goes for legal disclaimers in email footers, cookie warnings, warning stickers etc. Why are we allowing this to happen? (My solution: "Yes, you can sue them because the coffee was hot (etc) and there was no sticker on it, you just have to be prepared to give up your voting rights and your drivers license in the progress. Continue Yes/No?")
  - acangiano 12y ago
    As an aside, the "coffee was hot" lawsuit wasn't as frivolous as people make it sound. See Liebeck v. McDonald's Restaurants for details.

maxerickson 12y ago

You don't need a sleep monitor to function in the 21st century. If you try to take a Jawbone off, I believe it will take a few seconds. I dislike these data collection and analysis as a service gadgets enough that I'm not using any of them, but I think you could be a little more considered in your criticism of them.

joshdance 12y ago

How are they not aware the data is sent to 3rd parties? Isn't that a key feature of the device?

diminoten 12y ago

Oh, come on. I'm getting a little sick of how far the pendulum has swung in this privacy conversation. I get the desire for privacy, but if every time people have data about them used we get this complaint, no one's going to listen when there's a real violation of privacy.

drzaiusapelord 12y ago

Comments like these make me think that the pro-privacy crowd is officially a cult. I just don't see the argument about anonymized data that you can opt-out of being such a threat to the end user. I love these types of analysis, especially the ones about dating from OK Cupid. Tivo used to reveal all sorts of interesting things about viewership that was very enlightening. I'd hate to lose this data just because a minority think its a threat to their civil rights. There's a reason why no one outside of reddit and HN knows what the EFF is or cares about their mission. It doesn't fit in with most people's politics. I really think the privacy advocates are holding us back at this point. They refuse to make reasonable concessions and while they think they're fighting the good fight, they've just marginalized themselves to the point where only a tiny extremist minority is engaged because moderate voices are shouted down as "selling out to the man" or the NSA or whoever the villain of the day is. Its also sad to see a arguably progressive community like HN fall for this stuff. Not only are we doing this stuff all the time, the current fad of health devices, smart watches, etc are going to make this a lot more common. We're like cavemen throwing spears at an enemy with machine guns. Its a fight we've long lost. I think its better for us to focus on privacy issues that are legitimately victimizing instead of railing against anything and everything that kinda sorta rubs us the wrong way. If anything, the cult of privacy is hurting us because its created a "boy who cried wolf" situation which is now a political liability. How am I supposed to tell Joe Midwest Voter that X is harmful when he keeps hearing about how tracking cookies or Tivo stats or iPhone policies are harmful and didn't give two shits about those either.

Retric 12y ago
There is no such thing as completely anonymized data. And in this case there releasing information without the consent of their users. Sure, you might think that it's reasonable in this case but the important thing is users are not making that decision. So, as long as companies feel they can do anything they feel like with the data your only option is to completely opt out. Which means companies have no reason not to release your data as everyone assumes they will anyway.
- mgob 12y ago
  This isn't a question I have an answer to, but isn't it likely that users relinquish their right to data privacy when they sign a privacy policy and/or terms of use?

wdr1 12y ago

To me, there's a world of difference between sharing my personal commute between home & work, and using my drive to show traffic patterns.

declan 12y ago

I look forward to NSA serving an FAA 702 order on Jawbone to track a non-U.S. user. It would require that Jawbone perform a live intercept so FedGov agents can plant physical bugs or insert TURBINE-derived malware or attach a keystroke logger. The order would use existing legal authority to compel Jawbone to provide real-time data on the user’s precise geographical location and whether he or she is awake. Obviously if the target is at home and awake, the Feds would abort the black bag job. The Google Play store listing shows that the Up app wants access to precise (GPS) and approximate (network) location, so the lat/long available for NSA perusal with compulsory process is likely pretty detailed. And the marketing literature on the Jawbone site uses “always-connected” and “real-time” language, which is perfect if you're in the real-time surveillance business. The non-U.S. user targeted by FedGov may think he’s escaping surveillance because he’s using only local phone providers and local email providers. He’d be wrong; Jawbone is based in SF and subject to U.S. law… Another interesting use would be tracking physical movements of non-U.S. users and correlating them to see who’s meeting with whom; does Jawbone force SSL for its API usage? (The API web page only says “communication should be done over a secure channel,” not “must.”) I’m joking above, of course, and I have no reason to believe the NSA has done this for a non-U.S. citizen or the FBI has for domestic surveillance. My point is to suggest that folks here at startups think in advance about how to respond to legal process, how to encrypt data in transit, and how to store user data in a way that minimizes your legal exposure and protects your users’ privacy. Better to think about this early vs. after you get an early morning knock on the door with a very serious plainclothes guy with a badge serving you with some very serious papers demanding info. That happened to me in a different context years ago, but that’s a story for another time.

kevincrane 12y ago

First off, I have a Jawbone UP24 and love it. You know how they got that sleep data? I pushed the "start sleep" and "stop sleep" buttons, then they gave me an awesome visualization of how I slept last night. You know what you'd do if you didn't want them to have that data? Don't push those buttons.

unicornporn 12y ago

Does anyone know if there's a device like this that DOES NOT require uploading all collected data to "the cloud" in order to analyze what I've collected? It's pretty obvious that this could be done on client side without needing an internet connection. Or do all of these companies sacrifice usability and privacy in order to make more money?