Google’s new program to track shoppers sparks a federal privacy complaint
washingtonpost.com
washingtonpost.com
It'd be really nice if we could stop that instead of caring about the particular people they sell it to.
IE It's not "better" when they sell it to someone who isn't Google, and I honestly could't give a crap about the complaint, which mostly deals with antitrust.
Once cash is gone:
1. your purchases will be available to any company willing to pay for it, and
2. Visa will get a de facto "tax" on all transactions (through 1-2% merchant fees)
[0] https://www.wsj.com/articles/visa-takes-war-on-cash-to-resta...
I've seen estimates that the cost of handling cash is actually higher than the interchange fees that Visa charges. This generally counts things like armored truck services, time spent counting cash (probably multiple times), time spent delivering cash, dealing with registers, etc.
Interchange fees for CC are capped at 0.3% and 0.2% for debit in the EU. No 20 cards in every wallet, black pink yellow variations, no "yes VISA but not MasterCard" sillyness. Honestly even the cap of 0.3% is still far too high.
Is there anywhere that is actually a thing? Very rarely I see a place that won’t take Amex, but no visa or mc?
Lots of places won't take AmEx or Discover (some of the highest fees in the business.)
CostCo currently only takes Visa (no MC.) Sam's used to only take Discover. It's rare, but it happens. In this case it's also only for "credit" purchases, "debit" is ok for any card, but the fees are way less for "debit" than "credit".
I know one stopped receiving ten dollar bills.
so while Visa is the threat in the forefront we need to be very wary about any attempt to push towards a cash less society until privacy is guaranteed from even government agencies
Anyone against government access to this stuff ought to be for strict limits/prohibitions on its collection by any entity. It's toxic and should be eliminated.
Do you have any anecdotes or links where data collectors exchanged favor with ABCs for legal violations?
Certainly easier, but it wouldn't stop trading (IIRC, there are already cases of, e.g., swapping stolen goods for drugs).
Won't stop people trying to get rid of cash though :/
In the days when we had interest rates it was possible to make money on transactions by taking the money one day and paying the invoice on the next day. Overnight the money would earn interest. This would be profit to cover the transaction. So a bank could make money moving cheques around for people, taking two weeks to clear back in the days when everything was manual.
So with electronic payment there is no human inspecting signatures and doing data entry. So why the merchant fees?
In a free market a competitor that just makes money on interest should be winning here.
You could have a non-profit do the interchange, like the Interac network in Canada, but that would be difficult to coordinate without consolidating all the banks. (Canada has, like, only half a dozen.)
SEPA?
Convenience. Handling cash is risky and expensive. You have to pay someone to count it, take it to the bank, where it has to be counted again, etc. That is time that has a cost. There is risk of loss or theft. That can be insured but there is a cost for that too. If you have to have an armored courier transport it, that has a cost.
Bottom line, the merchant fees are probably not much more than, and in some cases less than the costs of handling cash.
If a payment app really takes off in the Western world, wouldn't that be a very big risk for Visa and Mastercard?
[0] https://www.nytimes.com/2017/07/16/business/china-cash-smart...
I would give up my purchasing history to everyone in the world if it meant I could use a single card to actually pay for 80% of things on a day-to-day basis. Cash sucks.
I'm currently in Croatia, where it seems only restaurants and some grocery stores frequently take cards; I paid for an invoice at a local bank (Raiffeisenbank) yesterday that only took cash, which I thought was hilariously ironic.
For what it's worth, my stay in Iceland (3 months) was absolutely fantastic when it came to taking card payments.
On the other hand, the Netherlands (Amsterdam, 3 months) often only took Maestro-only (or sometimes Visa-only) in the cases where vendors even took cards.
Likewise in England (Sheffield, 3 months) many vendors only took cash, and were mightily confused by American cards (especially one requiring pin + signature).
I also had a brief stay in Italy (Naples, 1 week) where I found one restaurant that took any kind of card; everywhere else was cash-only.
This has been my experience. I didn't realize how commonplace card transactions actually were in America until I realized how rare they were in the places I've lived since.
I hate paying with cash because it's several extra mental steps to withdraw $X / maintain $X on hand / track expenditures / count up payments + check change / etc. It's so much easier and faster to use a card, so I hope Visa (or whomever, I don't have a preference as long as it's a card) lobbies for more widespread acceptance worldwide.
If that requires killing off cash, I wouldn't have a problem with that!
Do you remember where? I live in Sheffield, and I'm having a hard time thinking of anywhere I would have an issue paying by card.
Many parts of Europe have payment systems that are independent of VISA and MasterCard, but provide similar (but safer and more convenient) functionality, including the German-speaking countries.
If you want official statements from me, go elsewhere.
If you want HN to be a place of real discussion and debate, it's stupid to try to tie people to their companies. I think very different from my company on quite a lot of issues, and i happily point that at too.
To your point, however, I didn't hand wave away anything. I said the real issue is "people can get this data". Are you really so naive as to believe this isn't being done by every damn company that can get the data? Saying the real issue is that "Google" got this data, is, IMHO, missing the boat. I don't want Facebook to have it eithre! So to me, like I said, i don't give a shit about that part. You are more than welcome to have a different opinion!
I also worked in DC long enough that a random PR release by an organization devoted to lobbying on certain issues just doesn't bug me or make me care. Quite literally. So I said that.
They are more than welcome to file whatever complaints they want, and i hope they get some sort of response.
While i tend to disagree strongly with his views, i'm much more in favor of folks like ocdtrekkie filing complaints with whatever specific feelings they have on an issue, because at least i don't believe that's being driven by PR
(I know it may be shocking to learn that,in attempts to get funding, etc, non-profits do large coordinated PR campaigns the same way politicians submit bills they know will never pass so they can go home and talk abut it at a stump speech. Much like everyone else, they must stay relevant to be useful.).
I don't think it's so much about thing people to their companies but more about being transparent so people can form their own opinions. If people just accuse you of hiding that information it details the conversation anyway.
Just my opinion. I also work for Google and am pretty sure they also recommend being transparent when commenting on things related to the company although I admit it's been a while since I read the guidelines.
I'm very strongly against disclaimers for my personal opinions on random discussion forums , and will continue not to do so right up until i'm forced to (at which point, i'll probably just stop contributing). When I write or post articles in a public news setting or something, or get paid to write them, i'll be happy to.
When i'm just writing crap on HN, sorry, but no.
"presumably people will be worried you have an ulterior motive in trying to get people to think of Google in a positive light."
Which, again, should and does contribute literally nothing to a real discussion, much in the same way knowing a guy owns a 50 million dollar house does not make their opinions or viewpoints, or arguments, less valid on NIMBYism. Engage on the merits.
"but more about being transparent so people can form their own opinions".
People should not form opinions based on who other people work for, when they aren't speaking for their companies. This is precisely a type of bias we should be seeking to prevent. It adds no value to an intellectual discussion. It just gives a mechanism for smug self satisfaction by saying "hey, i don't have to care if he has a good point, he works for X so i can just pretend it's not a real argument"
"I also work for Google and am pretty sure they also recommend being transparent when commenting on things related to the company although I admit it's been a while since I read the guidelines.'
I'm very very very familiar with the guidelines google issues.
The irony is that by not disclosing the company you work for, you actually make it worse. If you disclose any conflicts of interest, then people will be less likely to accuse you of having an ulterior motive. I suppose it's a philosophical choice of living like how you want the world to be or how it is now and who am I to tell you how to live your life!
If he put "I work at Google", on every post that touches Google then we might as well go back to having signatures on every post like a web-forum.
While I agree that because of Google's intimate symbiosis with internet, it's nice to have transparency from employees when they protect Google, I don't think the Original Comment was protecting Google.
They were arguing that instead of being upset that Google can now get your data, in addition to [$OTHERCORP, ...], privacy advocates should be upset that any corp is getting the data.
Indeed when I said defending I didn't mean they were saying Google is right but rather moving the discussion away from having bad PR for Google, which is like defending the name of the company (even if it's justified). I admit that my vocabulary is rather limited so perhaps that is not the right word to use but hopefully you get my point.
When the company is Google (or of a similar scale) -- and that company claims to care about privacy (but sometimes engages in practices that suggest otherwise) -- then clearly that association is quite relevant. (Its not a huge oversight, but really, if you had put a standard disclaimer at the end of your comment it would have come off a lot more nicely).
But calling people "stupid" for pointing out that this association matters (when it obviously does) is just... "Google-y", I guess.
You have not given any reason the association actually matters here[1], nor engaged the argument on the merits Instead, you did precisely what i said would happen - character assassination for no reason. You also assert i called people stupid, which is also clearly false, I instead expressed that the notion that tying people to their companies would do anything useful is stupid.
[[1] It doesn't. You can engage the arguments on the merits whether it had my name or anyone else's. In fact, you'll see i didn't even express an argument past "it sucks they can sell info", and that i didn't give a shit about the complaint itself because it suggests that it's okay to sell it to certain people, when i feel it's not okay to sell it to anyone. I haven't actually seen anyone cogently disagree with this, and it's 100000000% irrelevant to where i work.
It obviously is, because these other someones don't have the same amount of information on you. It seems not unlikely to me (and probably others) that your difficulty in appreciating this point is employment related, even if you are arguing in good faith and are not consciously aware of it.
I don't disagree with you that the correct fix is to prohibit the sale of this information in general.
Sorry, but saying "it's stupid to do X" really is basically the same as saying... "people who do X are stupid". Or at least "they are, in that context, being stupid".
Either way, you said what you said -- and presumably you meant what you said -- so there's no point in trying to wiggle away from it.
You might think you are completely objective and unbiased, as do most others, and maybe you are. But, most people are fooling themselves a little. Nobody will admit to themselves, let alone others, that they work for someone evil.
So really, if you want a place of real discussion and debate, it's important to tie people to their companies in cases where they are participating in discussions about these companies.
No, they aren't, and it's horrendously biased to say that.
"So really, if you want a place of real discussion and debate, it's important to tie people to their companies in cases where they are participating in discussions about these companies. " No, it isn't, precisely because your premise is wrong. It's not just wrong, it's startlingly bad to me.
If your default position is "people's opinions are less valuable because they work for X", you really aren't going to do a good job of seeing multiple perspectives.
But given what you've written here, maybe you don't want to?
That doesn't even make sense. The op made no argument for or against google in any of this thread, and has only tried to clarify that. Defending yourself against the Google hating bandwagon is clueless hole digging? Did you even read any of the op's comments?
People are less objective about an entity who is paying them. There is nothing controversial about this. I'm surprised someone like you would even convince themselves otherwise.
>a random PR release by an organization devoted to lobbying on certain issues just doesn't bug me or make me care.
How ironic that you are trying to diminish this article by calling it a "random PR release" by a "lobbying organization".
Perhaps someone who didn't work at Google might call them a "privacy watchdog" looking out for consumers.
>just doesn't bug me or make me care.
Well, you cared enough to comment.
Arguably, DannyBee is correct that the real issue is that credit card companies are allowed to sell this data at all. But perhaps the danger of this practice is especially highlighted by the fact that Google is now one of the buyers.
Perhaps HN should implement some kind of badget/sigfile/etc extension for this purpose.
But I'll also note that in my response, I didn't comment on whether or not what Google was going is a good thing, or even going about it in the right way, I merely commented that the information being speculated on is inaccurate and that there was a crypto-conference presentation that gave some details of what Google is doing that contradict what some of the commenters imply.
I actually understand the skepticism and I think it is related to the secrecy of the mechanism and if a peer reviewed paper were published, it might do much more to alleviate fears.
HN seems kind of hesitant to add additional profile tools beyond the usual. I'm not sure if that's part of it's charm or a detriment. I think having a sig line on every comment might be tedious, and FWIW, I don't think it should be obligatory to attach your employer to every comment on every post on HN. There's a lot that's simply not remotely relevant.
I think people should disclose they work for a company they are defending the position of online. But I don't see a way to force that issue in an environment that permits anon accounts.
I am not my company, and a lot of people elsewhere aren't either. I don't think who we work for is really relevant at all unless they are trying to make offical statements.
Either engage on the merits or don't. "Ignore this guy, he works for X" is not a useful line of argumentation.
The only thing putting company names next to things would create, IMHO, is an echo chamber.
(This is very different than journalists being paid to write specific articles or funded to do specific research, or even people paid quite specifically to astroturf)
If we believe it's some magical generalized conflict of interest, why stop at company names.
In any article about NIMBYism, should we require people post whjether they rent/own/own a home > 2 million/whatever. etc
IMHO it's completely irrelevant to the merits of their argument. The merits don't change one way or the other. It seems the only usefulness would be able to filter/confirm biases. At that point, why bother having a discussion.
Therefore, the participation of employees adds a lean in their favor, and disclosure, if it doesn't neutralize it, at least flags it so people are aware.
Mind you, knowing you're a Googler, I did upvote your original comment, because I thought it was accurate and had value. And I do see the concern about people being dismissive of others based on their employers, particularly in comments not directly related to the topic being discussed. (Imagine trying to comment here with "Uber, Inc." after your name.)
You are wrong on both points, FWIW :) But it's definitely true at other companies.
" And I do see the concern about people being dismissive of others based on their employers, particularly in comments not directly related to the topic being discussed."
Given another person just literally said to me "the opinion is less valuable because you work for X", i'm much more worried about this attitude than i am the one where people are biased towards their companies.
Most people in tech are not true believers. Most probably like their companies. But that doesn't mean they agree with what their companies do all the time. Especially in a company the size of, say, Google, it's pretty, IMHO, silly to think that among 150k of those people, there is no dissent, or not even a lot of dissent, all the time.
Perhaps this offers the opportunity for a product, in the short term: Is anyone offering credit cards which promise not to sell your purchase history? I'd be game for that.
It looks to me like a form of homomorphic encryption where both the aggregate consumer transactions (people bought X at merchant M), and the aggregate Google ad information (people saw ad for X at merchant M) are encrypted and the set intersection is computed on the ciphertext revealing only the aggregate number of purchases, not the individuals.
Now granted, there could be a security hole in this scheme as with any crypto-protocol, so it does need peer review, but the design, as stated in that YouTube presentation, is not to reveal to Google personal purchasing information, nor reveal to merchants, personal profile information. No personal financial data or purchasing information is supposedly transmitted.
The problem with this kind of technology is that it is really difficult to explain to the public, and easily demagogued.
I do not know of any work in homomorphic encryption that claims to provide privacy guarantees in the face of side-channels from other sources (in this case, the side-channels could be phone location information for brick-and-mortar purchases, or web browsing activity timestamps for online purchases). It's not surprising that such work is hard to find, since merely computing correct query results breaks most reasonably privacy guarantees.
Also, the field of homomorphic encryption encourages people to use horrible cipher-modes like code-book, so guilt-by-association makes me highly suspicious of stuff in that space: https://en.m.wikipedia.org/wiki/Block_cipher_mode_of_operati...
The closest thing I know of that is workable is differential privacy, which (in laymans terms) introduces enough noise to make sure that overly-specific queries return random (but representative) garbage. Apple says they use differential privacy to train models on data that's stored on iPhones without actually giving themselves access to that data. Cool stuff.
I guess this complaint from this article is asking the FTC to get more information on this process, or get Google to explain how it works, or something.
Upvote for the explanation.
I've worked on a similar problem, and some very large retailers we worked with wanted to measure ROAS. They turned off all adspend in a certain large metropolitan area, while we turned on in that area. Measuring the sales lift/drop, gave an idea of the platform's effectiveness.
Any other demographic data point could also be used, not just geo. You don't necessarily need to link people directly.
It's better in the sense that those companies can probably do much less with purchase histories than Google as they have less total information on me (whereas Google has email, web history, photos, etc. if I allow them).
Do you have evidence of this?
https://www.forbes.com/forbes/welcome/?toURL=https://www.for...
http://www.thesimpledollar.com/how-credit-card-companies-mak...
https://www.creditfirm.net/blogs/mastercard-to-begin-selling...
http://www.businessinsider.com/credit-cards-sell-purchase-da...
Tragedy of the commons. At this point in time, any and all forms of data collection have become common. When I visit a website, I expect them to collect everything about me - my IP, my mouse movements, what I clicked, how long I took to click it. Just a matter of time, that they start tracking audio and visual cues as well. It's unthinkable today but we will get there. It will enter slowly in the form of alexa and google home. then a browser plugin. Then a browser integration. Then a web api. And to cap it all, everyone will claim how it's made their life better.
Commons are properties without private owners. The tragedy is that because no one individual owns it, the people that use it use it without care to its maintenance believing that it is not their responsibility.
start tracking audio and visual cues as well
(If you do mean mic/camera, sites can't access those without prompting the browser to show a permissions dialog and you clicking "ok".)
You don't think it actually _will_ make some people's lives better? Do you think those people are being tricked into thinking their life is being improved? Or do you just think the downsides just outweigh those improvements?
But I'm weird, I don't think advertising is inherently evil or annoying.
You can't really say Google is perfectly secure and will never ever ever be hacked and leak your data either. Maybe it will never happen, maybe it will.
Therefore I believe I should have the right to say "hey, I don't want this private corporation to have my credit info".
I suppose some people might feel weird letting strangers or anyone know what they buy, but that's an argument for the ability to opt-out, not for filing a complaint with an agency or starting a lawsuit.
The problem at hand is that Google and others are scooping up everyone's data. A change in the way these companies decide to use that data can have an effect on everyone's lives, but without anything like a Congressional Budget Office or public debate to gauge whether the benefits of those changes outweigh the costs for the people who are affected.
Edit: Hrmf, never mind. Egg on my face.
Well, not with Eich. I don't think there was another short-term Mozilla CEO ousted among public controversy.
ISTR participation in Gor fandom being brought up alongside sexual harassment/abuse claims for a prominent community figure (maybe Jacob Applebaum? I thought it was him, but I don't see that element mentioned in any of the articles on him, so it may have been someone else) but I don't remember that or consensual BDSM related activity being the central concern in any ouster.
EDIT: As a sibling comment suggest, the Gor issue was with Larry Garfield.
Geico began offering policies to the general public in 1974, so this is historical trivia now.
I do recall that they offered a rather significant military discount when I was a soldier. I have wonder if that discount was backed by actuarial data. I would rather expect members of the military to be higher risk than civilians or civil servants.
The region where I live is heavy in the defense industry. There are lots and lots of veterans here. Federal Acquisition Regulations give preference to veteran-owned small businesses and also to service-disabled veteran-owned small businesses. Despite that, in a town with lots of defense and lots of veterans, there aren’t a whole lot of VOSBs.
A few years ago, the dad of a schoolmate of my son’s retired as an Army Lieutenant Colonel. Even though he as a Ranger performed parachute jumps with weapon in hand into hostile territory, he had lived in post housing all his adult life and had never had a mortgage before. The civilian world and business customs were all foreign to him despite his having interacted closely with the contracting industry for years.
We get used to what we’re exposed to. After being told for years and years to jump out of perfectly good aircraft to go blow up this-or-that target, it becomes not quite so scary. Drop the typical cake eating civilian in that world, and he’s likely wetting his pants. Drop G.I. Joe in the new world of corporate finance, contract vehicles, teaming agreements, and business development, and it can be unsettling too.
Also, not to nitpick, but coffee is not linked to increased risk of heart problems, that's a myth.
"I'm sorry sir, our system says your wealth rating is 600, our discounts only apply to people with 400 or lower."
Note I am not saying there are not annoying advertisements, but that's an issue of implementation, not the concept of targeted advertising. If anything, Google would know I will never click on an annoying ad if they "invaded my privacy" more than they do now.
That's the benefit to you. The other is that the business model supports the Google services you use.
The perfunctory question is: what are the costs to you and everyone else?
The question that piques my interest: why do you assume there aren't costs, or that the costs are negligible? Why does your belief that an institution isn't evil or annoying mean you only do the first half of a cost/benefit analysis?
Or...I haven't seen any evidence there is a noticeable cost to me as a person?
Not that it's not a valid complaint, just interesting
Auto companies have used Polk vehicle registration data and data aggregators to match a vehicle purchase to the user's online ad clicks. They compare how showing ads for certain models influences your car purchase (ex. Honda CRV) from your initial search (best family sedan) and demographic info (FB data indicates you are an avid runner, 2 kids, 1 dog, etc..). Retailers employ a similar model for basket size.
There are partners like Oracle Data Cloud, Nielsen Catalina Solutions, Neustar and LiveRamp (ex. IdentityLink http://identity.liveramp.com) that provide similar data for O2O measurement.
My guess is somehow I have given the credit card companies permission to sell it, but it feels like my entire purchase history attached to my personally-identifiable info enough to tie it to a Google account really shouldn't be legal to sell.
As a note, filing privacy complaints with the Federal Trade Commission is surprisingly intuitive, and I highly recommend people familiarize themselves with the system and use it liberally.
Opt-out (I believe) happens at the credit-card level, per [0][1].
[0] https://www.engadget.com/2017/05/23/google-track-shopping-tr...
[1] https://www.consumer.ftc.gov/articles/0222-privacy-choices-y...
Publishers in general have very little visibility into user behavior, since they rely on third-party tracking tools and third-party ad engines.
Prime members also get a free six-month trial period, followed by a discount on a subscription -- $3.99 / month [0], as opposed to the standard $10 / 4 weeks (or $99/year) [1].
[0] https://www.amazon.com/dp/B072MHQFJ1 [1] https://subscribe.washingtonpost.com/
I don't think personalized ads would be nearly as obnoxious if I knew that the ad matches my browsing history but has nothing to do what name shows up on my passport.
Most of what people seem to take issue with is their personal identity in addition to the tracking.
The tracking for the purposes of relevant ads would be identical from the perspective of the advertiser (efficient/profitable) but much more private for the user.
After reading the initial article in May, I called American Express and they swore up and own they don't sell my purchased data. I don't see how you get above 70% without data from American Express.
So who's lying?
https://wallethub.com/edu/market-share-by-credit-card-networ...
Either way, 100% - 23% = 77% which is > than 70% so the point stands. Visa + Mastercard alone are over 70% using the purchase volume numbers
I'd also wonder about how the numbers are computed - you can get incomplete records on a high percentage of consumers without the AmEx data as (people with AmEx) and (people with other card(s)) aren't disjoint sets.