My opinion is still that those terms of services are silly. If I ever do start my own business, one of the things on the checklist is to have a minimal, if any, terms of service, because nobody wants to waste time reading them, and 99% of what is in ToSes is in the law anyway. Except, of course, data collection beyond functional requirements. That would be a good thing to hide in long ToSes.
My take away is that you can tell users exactly what you're doing and they'll still be outraged. So don't do creepy stuff.
Ask for permission at 3am on Sunday. People will press Allow just to get done whatever they thought they were doing, and forget they ever pressed it.
Indeed. :\
> The iOS security model would have served you better; Facebook could never accidentally forget you’d said no.
Interesting, so you mean this is the case even if I uninstall and reinstall the app? What if I wipe the OS and reinstall (as "cleanly" as is possible)?
If you say no, facebook can't access the data. Facebook can't conveniently forget that you said no and access the data anyway - if you say no at the system prompt, the OS won't give the app access to that data in the first place.
The system isn't perfect - it turns out my mum wasn't getting chat notifications on her iphone because she doesn't know what notifications are and she's been saying no to the prompts. But I find it somewhat refreshing to see beginner users erring on the side of saying no, rather than always saying yes to every random prompt the computer spits out. Fail-private is better than fail-public.
Also note that Android's new security model (version 6+?) is pretty similar to what you described, but yes, I do believe this incident occurred on an older version.
This is why encryption on our phones is so important. I want my phone knowing all sorts of "creepy" things about me (medical records, etc) so that it can be more useful. What I don't want is that information anywhere except under my immediate control.
Storing encrypted in the cloud is OK as well, I suppose, as long as the encryption key is only available to me.
I did not see in the screenshot an OS permission prompt, so if the app had the access locally a bug in the settings could have reset/flip the options and upload the data anyway, like how Windows forgets about your privacy settings on updates.
For example, I assume all warranty disclaimers include "not even the implied warranty of merchantability or fitness for a particular purpose" because somewhere, in a legal dispute, "no warranty" was not enough.
How about a law that requires the party presenting legal paperwork to show that the recipient could have read the document. Use an algorithmic method to estimate the reading time, take off ~33% to account for variance in reading ability, and declare that the minimum time that must be spent with the document.
If you cannot show that e.g. someone clicked "I Agree" at lest 5 minutes (or whatever) after they received the ToS text, then the court will assume prima facie that the have not read the ToS and are not responsible for anything in it. The friction this would add to the checkout/signup process grows with the document size, creating an incentive to write short and simple ToS.
How about present your TOS in a form that is understandable by the average user in a span of 2 minutes? Without being a lawyer...(and I doubt you have 2 minutes at all)
Don't do creepy things should be a different law
Other people's lawyers are the worst.
Big firms acting for small clients generally doesn't work out so well for the small client.