Hacker News Reader

Comment by aeternum | Hacker News Reader

I don't think lawmakers have thought through the ramifications. Here are a few:

Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization?

What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be banned as well? Many companies, including Google would have to significantly change their pricing model if so.. yet that is apparently illegal.

View on HN

European here, I can help:

Yes a click counts as personal data if you can reference it back to a real person. Aggregated clicks probably wouldn't.

Selling ads based on personal data is selling your personal data. The personal data provides the value to the transaction.

Yes lots of companies may need new business models, but for the most part what I've seen is dark patterns, non compliance or wriggling to avoid any real change.

In Europe at least, it's back to the regulators to make a move.

It's interesting to know what those terms mean in Europe's GDPR, but I'm not sure that will affect their interpretation in the U.S. court system.

> but for the most part what I've seen is dark patterns, non compliance or wriggling to avoid any real change.

I fully expect this part to be just as relevant over here

> Aggregated clicks probably wouldn't.

> Selling ads based on personal data is selling your personal data. The personal data provides the value to the transaction.

What about selling ads based on aggregated data? e.g. put users into buckets, then sell ads for those buckets.

> Way too hard to enforce, the definition of 'customer data'

HIPPA manages with "Patient data". The standard techniques include non-reversible addressing of users. Patient N has an internal number and an external number. Without having Patient N's internal record in hand, you can't correlate it back to that user, which is particularly useful in a legal defense.

I think of customer data as any data that has been created/logged/stored based on some action I took (logging into website, clicking a button, visiting a website, opening an app, etc.) that can be tied back to me, my friends/family/community, my devices, my ip addresses, my locations, etc. in any way shape or form.

> Will that be banned as well?

I sure hope so.

> Many companies, including Google would have to significantly change their pricing model if so

Good. It would be even better if they have to change their business model.

Are you willing to pay to use a search engine? How much?

Those aren't the only two options. Duckduckgo shows you ads based on your search terms.

Depends on the search engine, of course, but I am not opposed to the notion.

That said, I am also not arguing against advertising as a funding model. I'm arguing against business models that rely on invading people's privacy.

I don't understand this mentality. If someone is fine giving a company some information, and the company uses that to give them a better product, where is the harm? And what right do you have to stop those two parties from voluntarily exchanging goods and services?

If I am voluntarily giving information to a company, and have been completely informed of all the purposes that it will be put to (especially which companies it may be transmitted to), then I have no problem with it at all, personally. And I particularly would not be inclined to say that others can't decide this for themselves.

The problem is the rampant data collection that is engaged in without my permission and/or knowledge, and that companies often forward that data to others.

Targeted/behavioral advertising in particular has monetized that abuse. I would be thrilled if that business model dies an agonizing death.

The amount of abuse on that score has been so extreme, and going on for so long, that strong legislation is clearly the only remaining option to at least stem the worst of it.

>If I am voluntarily giving information to a company, and have been completely informed of all the purposes that it will be put to (especially which companies it may be transmitted to), then I have no problem with it at all, personally. And I particularly would not be inclined to say that others can't decide this for themselves.

I fully agree, but it seems like under this legislation it becomes illegal to conduct a business in this manner. If I am fine with trading a certain set of my data for access to a service, I should be able to do so (if the service provides that option, obviously).

Nope, not illegal:

> Businesses can, however, offer “financial incentives” for being allowed to collect data.

The change is from opt-out to opt-in.

OK so if I understand you, you are worried that companies are collecting data on people and then using that data to give them more personalized ads. These ads may convince people to buy or do things that they otherwise wouldn't. It's not just that people would buy Chevys instead of Fords. They could be convinced to vote differently and support harmful policies.

I hope that's an accurate summary of your view.

I have a few points.

First, I don't think targeted advertising is much more effective than your typical magazine ad, TV commercial, radio ad, or movie trailer. In all of those cases, the advertisers know the demographics of who is consuming that media and can target pretty effectively. And if targeting was far more effective than old school ads, advertisers would pay significantly more for targeted ads, but they don't seem to. CPC for Facebook and Twitter is about the same (~50 cents), despite one allowing for much more fine-grained targeting. And I doubt LinkedIn does better targeting than Facebook, but LinkedIn's CPC is 10x higher.

Second, is this an instrumental value or a terminal value for you? eg: If all advertising were banned (or at least heavily taxed), would you no longer want a ban on companies storing customers information? If so, I'd like to hear why.

Third, what if we could pass laws that caused the benefits of targeted ads to outweigh the downsides? For example: We could ban targeting for politics. Then people could still get ads for more things they want, such as some software that would help them or some new barbershop that opened near them. That seems like a win-win to me.

Lastly, whenever I see an argument between to sides, I pay attention to emotions. In my experience, the less emotional side tends to be the more correct one. If a side mostly engages using disgust, anger, and catastrophizing, I get very suspicious. If I had to pick the more emotional side in this thread, it would definitely be the side that accuses the other of, "violating basic human decency", of being "horribly unethical", and doing "stupid privacy violating shit". On the other side, pretty much everyone against this law seems to think it's mistaken, not evil.

> I hope that's an accurate summary of your view.

It's not, really.

I object to data about me or my use of my machines being collected without my permission at all. Past that, I object to it being shared with others. What it's used for is beside the point.

Marketing companies come into it simply because they are the most egregious bad actors when it comes to those two points.

I'm sorry I misunderstood you.

> I object to data about me or my use of my machines being collected without my permission at all. Past that, I object to it being shared with others. What it's used for is beside the point.

What can I engage with here? I'm trying to figure out what bad consequences you're worried about, but you seem to have a terminal value that companies shouldn't be allowed to keep information you sent them.

Let's try another tactic: What do you think of casinos that share surveillance photos of card sharps with other casinos? Or wifi hotspots at coffee shops that keep logs of mac addresses to limit abuse? Or news sites that limit non-paying visitors to 3 articles per month? Your statement seems to be so absolute that it forbids all of these legitimate uses.

Yes, in the interests of brevity, I've omitted a lot of nuance. Let me try to add some of that back in.

I do not object to data collection that is technically necessary to provide services. For instance, I don't object to web server logs.

I also don't generally object to sites using data I have willingly provided for their own purposes, as long as they aren't doing things like sharing it with other entities or combining it with data about me that they have obtained with other entities (unless I have given consent, of course). So I have no problem with your wifi hotspot or paywall examples.

Anything beyond that -- which would include your casino example -- requires my express consent. I do think that casinos violate this principle, because they do not inform me of their surveillance before I set foot on their properties. If they did, though, then I would not object.

The essential principle that I operate under is that of informed consent. It's really that simple. Having a relationship with a specific entity carries with it a certain amount of implied consent (web server logs are an example of this) -- but even that data should remain private between me and that entity. Any sharing of it with others requires my express permission. "Sharing with others" includes indirect mechanisms such as using that data to match me with advertisers, even if the raw data itself is not transmitted to others.

> companies often forward that data to others

Why not just outlaw that?

That should be part of it. Another part should be that the data can't be collected without my permission in the first place.

Reply on news.ycombinator.com