Maine passes bill to prevent ISPs from selling browsing data without consent

It is section 4

nice word of the day usage ;)

Without reading the bill, not necessarily.

It's entirely feasible to have two classes of customers, right? One that agreed to the provision, and one that didn't. One that gets a 500GB data cap, and one that gets 150GB, say.

Just because you serve a customer doesn't mean you must serve them equally. Afterall, technically, they are serving the customer, right?

> The bill prohibits a provider

Nobody cares, what provider does. What matters is whether or not you sign a damn consent form.

Suppose, that there is a popular mobile App, written by Zhang Li Ltd. The App allows you to buy travel tickets, receive discounts in local stores and upload contents of your address book to it's servers. After a while you notice, that everyone uses it. Your local store no longer sells large amounts of grocery unless you make a reservation from The App. All train tickets must be booked by using The App. A bunch of local utilities stopped accepting payments unless you send them via The App. The thing is just so convenient!

One day you notice, that The App requires you to sign some "consent form" in order to use it's advanced features. A month later it threatens to delete your account if you don't "consent" (of course, it won't say so directly — "our ML algo detected, that you are Russian hacker! plz confirm your identity! account secuuuurity!" — that's how it will roll). The App is absolutely not connected to your ISP — it's authors just want to buy the data, that's all!

Reminds you of anything?

And spying on people used to be illegal as well.

Now it is going to become legal in Maine — as long as you are an ISP.

I wonder if they will make you sign a release when you sign up for a service. So you will need to consent to use the ISP.

I don't think their consent is an outlier. Most users are somewhat ok with selling their data in exchange for free services. I mean I use Gmail, Google Search, Google Maps, etc. etc. knowing they hoover up my data because, in the end, I value the ability to have these services for free more than I care about Google's ability to collect useful statistics about me/its users.

Saying "I think everyone who disagrees with me is an outlier" is not a particularly helpful way to further a discussion.

Would you care to present evidence?

For clarity, I do not share the opinion that I stated, only recognized that people do have it.

I'm not too sure how one user consenting to the data sharing guidelines should affect your experience. Elaborate?

Has this worked out in practice, say with cookie warnings? Or do most of us click Accept and move on?

> And even the good actors

This sounds like snark, but I don't intend it that way. I genuinely want to know.

Who are the good actors? I really can't see any.

Could you provide some examples of the kinds of regulations that you believe are required?

Right? This is always the false dichotomy that gets put to us. "Either accept the ads or pay me 5 bucks a month"

5 bucks a month??!?! You were making 5 bucks a month off JUST ME WITH ADS?!!!!

But it's not that at all. It's simply that credit cards are so heinously inefficient and unreliable and costly to manage that they need to charge that amount of money to not lose money on average. Dealing with fraud and charge backs and the cut the banks take and the cost per transaction. It's just how terrible of a payment system credit cards really are.

If we were getting charged the actual price of the product, most people would happily pay! Load your browser up with 20 bucks and you'll have unobstructed internet for months.

I think this goal is pretty much what Brave is going for, they get a lot of criticism for their implementation here. Of course I'm not shocked, this is a hard problem, and the demand for the solution is irrationally low.

"I will gladly pay my proportion of what's necessary to keep the service running in order to avoid the "you're not the customer, you're the product" mentality."

Since both are complementary and independent revenue streams, why do you assume that you paying cash for something does not mean you will be monetized in other ways as well?

Legislating such a micropayments system would centralize the monetization of internet services in a way unprecedented since the advent of the internet. If you're worried a lack of Net Neutrality would suppress free speech, this would strangle it.

You'd create two internets: a bourgeoisie sphere of corporate sites with enough influence to be included in the micropayment system, and the unwashed masses, the sites deemed unworthy of monetization, forced to survive on crippled ad market. The handful of large corporate microtransaction payment processors would get to pick and choose who gets to be on the "good internet" without any oversight.

Not micropayments. Macropayments.

Tiered to nominal standards of use.

Centrally collected over a large set of services.

With an open and public process of service determination and interest advocacy.

With a disinterested-party dispute resolution process.

Predicated on ability to pay.

Taxes.

Please correct me if I'm wrong, but you're saying your only issue here is consent? Surely you could just not use the sites and services that evade your consent then?

I'm sympathetic to the fact that "don't use services that track you" is easier said than done, but all the same, you do have that option.

You haven't convinced me that the data they collect can harm you as an individual. How is your life actually negatively impacted? How is this a more rational concern than conspiracy theorists thinking the government is monitoring their private phone calls?

and of course they never propose any "perfect" solution that they'd actually support.

This isn't "progress", it's the silicon valley oligopoly on traffic data trying to maintain its position through legislation. If we're going to hold as a societal standard that it's okay for companies to sell traffic data, then more competition is better. The more centralized the control, the easier it is for the companies in power to exploit the general public.

Industry groups in favorable contexts would say this is fine, then for the "didn't go far enough" part they just lobby some changes in definitions next year, another change in scope the year after that, etc. Pretty soon it's exactly what they wanted and nobody's the wiser.

May as well forbid it outright at that point.

(They should. Everybody deserves protection from this, even the people who don't understand the threat it poses. The uninformed, ignorant or naive all deserve protection, since preying on ignorance or naivety is generally considered abhorrent by anybody who's not totally morally defective.)

You are opted-out of them sharing by default. It allows you to opt-in to share

According to the bill text someone else linked (https://news.ycombinator.com/item?id=20062182) it’s out-in, requiring “express, affirmative consent” which should also rule out burying it in a footnote of the fine print.

> Which isn't necessarily bad

One positive is that it changes the criteria of success in the market from "who can provide quality internet at a low price, and mine and sell the most data" to simply "who can provide quality internet at the lowest price".

When new companies enter the internet market (if such a thing still happens?) they will be asking "how can we provide good internet?" instead of "how can we mine more data from our users?"

> The only alternative seems to be a hike in rates for everybody.

My naive understanding of the market is that the market doesn't work this way -- you charge what the market will bear. How much a product costs to make has nothing to do with how much you should charge for it; you charge what people will pay you.

So if the market is already buying a product at a given price point, and you find a way to save some money or make some extra money on the side, you shouldn't lower your prices in response unless a competitor forces you to -- and the ISP market has notoriously low competition. You happily take the extra margin and move on with your life.

In the same way, if a margin on a product goes down, but the market still refuses to pay more for it, you shouldn't necessarily expect prices to rise. Sometimes products just have different percentage margins.

In other words, if a company like Apple has good data that people are perfectly willing to buy iPhones at $1200, and they figure out a manufacturing trick that allows them to save $100 on each iPhone they build, they're not just going to drop the price to $1100. Similarly, if Apple has good data that people are only willing to buy iPhones at $1200 (and presumably they do, or else they would charge more), then a buyback or warranty program that loses them $100 per iPhone isn't necessarily going to mean a price increase.

Of course, economic majors are welcome to correct me if I'm oversimplifying this.

This is not a competitive business. It’s just monopoly companies grabbing what they can. They don’t need to sell data, they just do because they can. Nobody weeps for the poor ISPs, ultimately perhaps the owner will get a slightly less tall stack of money each year.

They consider you read emails after a set period of time, regardless of you (do/did/have) actually read. It works like that in Europe not the least.

> “But the TOS and EULA were on display…”

> “On display? I eventually had to go down to the cellar to find them.”

> “That’s the display department.”

> “With a flashlight.”

> “Ah, well, the lights had probably gone.”

> “So had the stairs.”

> “But look, you found the TOS and EULA, didn’t you?”

> “Yes,” said Arthur, “yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying ‘Beware of the Leopard.”

100% seconding your observation; I've been arguing something similar myself for a while too. That's why I'm totally serious when I say, ban the shit out of the advertising industry. Burn it to the ground, with legislative fire. Half of this crap comes from advertisers and ad-supported sites (the other probably mostly from airlines).

This won't solve everything, but would be a nice start. There will always be scoundrels, but the current market dynamics seems to be pretty good at making manipulative and dishonest behaviour successful. We need to work on corrections that would promote honest businesses instead.

As a secondary avenue, I wish we could somehow have a cultural shift. "Dark patterns" isn't a new phenomenon; its very name has been a commonly-known term for years now. And yet, instead of avoiding them, most successful companies seem to look at them as sources of inspiration. Hell, they're becoming a part of "UX standard practice" these days.

ISPs use a variety of techniques, such as deep packet inspection.

Many ISP support centers use commercial software [1] to display a detailed analysis of website usage whenever a customer calls in for support.

This includes the top websites visited, how much data was transferred for each site (yes, including those of a more salacious nature), the number and type of devices inside a home, nearby Wi-Fi networks, etc. [1]

This information can then be queried and used used for marketing purposes at the subscriber level (or to individuals within a dwelling).

[1] https://www.calix.com/content/calix/en/site-prod/library-htm...

[2] https://www.calix.com/compass/access-analyze.html

[3] https://www.calix.com/compass/consumer-connect-plus.html

I wasn't responsible for the data intake, but I know that the data was extensive, and always included time on page, full URL, other request information (often post stuff).

I know that HTTPS provided a technical hurdle that our company and data providers worked around after about 6 months.

My guess is that some MITM-type collection? Some data providers gave us IPs and some just gave us some Tokenized ID. I don't know if ISPs provided IPs, but probably not.

Note that we did lots of data linking. Let's say an ISP provided us your age, URL, and Timestamp. We would link that into another data provider that provided past purchases, URL, and Timestamp (shopping toolbar/plugins do this) to get a bigger picture of who you are.

They're tracking the TLS ones too. DNS & Server Name Indication reveals which site you're going to. DPI means they're watching the content of the HTTP pages you go to as well.

It would depend on what is included in the data and what other data is available for reference. You can have medical data that tracks all of the symptoms reported by a patient without prompt ("What brings you in?"), symptoms reported by a patient with prompt ("Can you describe the pain? Where is it located?"), and the diagnosis by the doctor. It tells you nothing about the patient nor the doctor, but it still provides useful information.

No, I'm not saying that.

It is possible, for instance, to collect individual data, tally up certain characteristics in the aggregate, then discard the individual data points and only keep the aggregate statistics.

With certain narrow exceptions, though, no data about me personally should be collected without my explicit permission regardless.

The site guidelines are here https://news.ycombinator.com/newsguidelines.html

Jokes aren't explicitly against the guidelines either, but I think the site likes to emphasize high quality content that will not alienate people who don't understand obscure references.

...so it was happening before 2018. And therefore has nothing to do with that bill because it was never law?

If FAANG business depends on data which should be private then FAANG should be out of business.

I worked at Amazon, which has a ton of data about your shopping habits that allow them to make targeted decisions on a customer's behalf. You know what? The vast majority of that data (at the time) came from observing customer behavior on properties owned by Amazon.

In my mind, that's perfectly reasonable - what I do within the boundaries of their business is our shared interaction and we both have the opportunity to make decisions based on those interactions. The major exception for Amazon is affiliate links, which, for the business i was in, weren't used as data sources.

Apple is not significantly different. Between Apple and me, who else knows our business and what does Apple know about me outside of my interactions with them (maybe more now with Apple Pay).

For the most part, Netflix is the same. Sure they know what I watch, but why does that matter if they're only using it to improve their own business and make programming choices?

Google and Facebook, on the other hand, blanket the internet with tracking beacons, read my email, keep shadow profiles (I don't have a facebook account, never have had one, but I'm sure they know more about me than I'd like), eavesdrop on conversations (I suppose Amazon is in that business now, too), track locations, steal contact data, trick people training their ML algos, etc. As is said, "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.", FB and Google have far more than that and a single bad actor with access to that data could make life extremely difficult for just about anyone in the world.

Yeah, good. I value my privacy far more than somebody's profit.

"Businesses rely on being shitty so we can't outlaw being shitty or they might have to find a way to operate without being shitty, or else stop operating" isn't really convincing me.

AAN actually sell stuff other than hyper-targeted ads. F and G (and AAN) still can sell ads, just less targeted ones. They would suffer a bit (or a bit more), but not outright be forced out of business. And same goes for most if not all other FAANG-tier companies not explicitly included in that acronym.

As for the "improving service" angle, e.g. Netflix could ask if it's OK to collect history to improve/personalize recommendations.

And a lot of "improvements" and metrics do not really need detailed data collection per person anyway. Collecting anonymous data in broader groupings is often quite fine. E.g. "Strange Things is really popular our total-views counter says ergo order a new season". There is no need for Netflix to know exactly who specifically watched the show to make such a decision.

Businesses relying on collecting data without explicit permission should go out of business.

This is absolutely false.

This isn't true of Facebook. This isn't true of Apple. This isn't true of Amazon. This isn't true of Netflix. Google... likely they would be wounded, but it definitely wouldn't make them go out of businesses.

Only if they fail to adapt. And if they can't adapt, then good riddance. The history books are littered with examples of huge corporations that failed to adapt then died. FAANG isn't special.

I don't understand comments like this. I see this sentiment adopted, and echoed by so many really smart people who should know better. They talk about FAANG like they're essential services, like the food supply, or water. Almost as if it's not a real option for ANY business to fail or be overtaken by a competitor. Regardless of their current size and scope, if they all disappeared over the course of a month, do you honestly think nothing would rise up to take their places almost immediately? I mean, I would definitely move a product or two to market and attempt fill some of the demand left in their wake. Wouldn't you?

That analogy is completely arbitrary though, and only drawn to serve tech companies' interests. Because Facebook and Google are platforms, not end destinations in themselves.

In your analogy, perhaps the ISPs are the highways, and tech companies are the neighborhood streets, but they're both roads. Because you're not trying to get to Facebook, you're trying to get to your grandma's photo album, that unfortunately you can only get to through Facebook.