Hacker News Reader

Comment by darawk | Hacker News Reader

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

This is something I object to. It's just fundamentally stupid and doesn't make sense. The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free.

EDIT: I'll also add that it strongly favors incumbent tech companies, by explicitly carving out "selling to third parties" as a disfavored tactic. Google can monetize your data internally. Your average startup may not be able to. Specifically carving out "selling to third parties" favors large, incumbent players over small startups. But then, regulation always does.

View on HN

You just have to change the onboarding process to include a fee, and offer an incentive/rebate of the subscription price to match the cost to basically make it free. That way if they decide to change their mind and not give their data, you're still in the clear by removing the incentive and either charge their payment method or disable their service until they do (or reenable data sharing).

That way it feels more transparent to the end-user, and they have to make the conscious choice of either giving a bit of their data in exchance of a free service or be prepared to pay to keep their data private.

I wonder if that will have unintended consequences.

It might inadvertently assign a price to the data collected.

It also shows a direct discrimination against poor and/or young people who might not afford the service.

You need parental permission to collect data from young people in the US anyway (see COPPA). But an age gate and asking for a credit card number are very different levels of sign up friction for a young person to try to get around.

There is already a price in the data collected (for FB i think $120 / year). I think making it public is a good thing. I think the law will also force facebook to offer ad free subscription plans, something people have been asking for. My bet is nobody is going to use them though.

I didn't believe that number but it seems like it's true if you restrict it to just north america monthly active users: https://thespring.io/investing/facebook-makes-more-revenue-p...

Average revenue per user is around $25 for global users.

This brings up a related issue that not all users are equal. Even in non-data mining business models, you still have some segment of the users subsidizing another.

>It also shows a direct discrimination against poor and/or young people who might not afford the service.

As opposed to what, treating everybody badly? McDonalds discriminates between people who can afford a Big Mac and people who can't, and that's not a problem.

The internet is not the same as a food place. People expect and have gotten used to services for free. If you put a price tag on a software library, you obviously discriminate against students and poor people.

Actually, it kinda is the same.

If you don't have the money to buy a big mac, you either eat a cheeseburger on the dollar menu or go home and cook a burger yourself.

If you don't have the money for the software library, you either choose a lesser library, or go write your own.

A larger problem however is many are considering the internet a fundamental human right, which it isn't. Might be nice to have, but a fundamental right it is not.

Poor people can get other services at a discount, for instance electricity, internet or cable service.

For a short time AT&T GigaFiber was charging $30/month to opt out of surveillance and I thought they can't possibly be selling my data for that much. I wonder if this new law will also lead to some unrealistically high prices.

> You just have to change the onboarding process to include a fee, and offer an incentive/rebate of the subscription price to match the cost to basically make it free. That way if they decide to change their mind and not give their data, you're still in the clear by removing the incentive and either charge their payment method or disable their service until they do (or reenable data sharing).

The problem is that then you cannot effectively offer a service level that is ad based. Say I want to offer some web services. I provide a free tier with ads (information gathering and selling) and a payed tier with no ads. This law says that I cannot charge more for the non-ads version. OK, so then I make both cost the same, either free or some fixed cost. If they are both free, what stops everyone from just using the non-ads version, it's free too. If both aren't free and cost money, what is the point of even providing the ad version, since people can pay the same and get the no-ads version. Not to mention, everyone that is fine giving their information in order to receive the service for "free" is now not able to do that.

You can still have ads you just can’t sell the users data to get them. Which means you either have to target ads yourself or you have to use non targeted ads. So you can still have an ad supported free level.

Exactly - you can still have an ad supported model all you want, you just can't be lazy about it anymore. You'll either have to tell the ad network yourself what your audience attributes are and likely take a hit on CPC because of less targeting data, or you'll have to do what people used to do (and some still do) and manually choose the ads you want to run.

It's not the end of the world, it's the end of some business models.

>You just have to change the onboarding process to include a fee, and offer an incentive/rebate of the subscription price to match the cost to basically make it free. That way if they decide to change their mind and not give their data, you're still in the clear by removing the incentive and either charge their payment method or disable their service until they do.

What's the practical difference between these two scenarios?

1) I offer a free service if you let me collect your data, but charge you $3/mo if you refuse to let me collect it.

2) I offer a $3/mo service, but give you $3/mo back if you let me collect your data.

Option #1 is explicitly illegal under the new California law. If option #2 is legal, then what is the law supposed to ban?

One difference, it seems, is that under the proposed law you couldn’t advertise your $3 service as “free”, maybe?

Either way though, I’d be happy if it were just required that there BE an opt out even with a price tag. Google can then finally tell me how much money they want for their services.

The second one has a much higher barrier for users, as they now need to hand over their credit card information.

Only if that's how you design your onboarding flow. It's for your company's convenience to do it that way, though, not necessarily the user's.

The difference is mostly to do with user experience. It also has to do with the requirements of how you bill the customer. It means you can't give them a "free" sign up and then charge them a fee after the click the data selling opt out button.

What's meant by saying you can offer incentives is that you must present all information at the same time and that users are considered as opt-out by default.

Basically, the user must go through a sign up page that has a box that says "You may sell my data in exchange for a $3 discount" and it cannot be selected by default. You also cannot have a sign up page that has a box that must be selected to opt-out whether the box is selected by default or not.

The no-relatiation clause also has addition requirements that are not related to money. For example, you cannot refuse to allow a user to access your site because they didn't allow their data to be sold. You also couldn't impose access limitations like slowing the rate of page response or increasing the number of advertisements on the page or send spam only to users that opt-out.

The difference isn't really about charging a fee to users that won't let you sell their data. It's more about not allowing websites to harass users with increased advertising on behalf of whoever they wanted to sell your data to. It's only illegal for them to sell the data, internal use is still legal, so they're preventing a loopholes.

At least in America we already restrict certain types of transactions, e.g. selling illegal and/or restricted drugs is itself generally illegal IIRC. Similarly I'm pretty sure slavery is illegal even if it's entered into voluntarily (please correct me if I'm wrong there, I'm not speaking from specific knowledge).

We impose these restrictions for the good of the public. If we decide that exchanging personal data for goods and services should be illegal under certain conditions, I don't see why that's any different than the precedents I mentioned.

There's significant pushback against the restricted drugs thing, so that might not be the best comparison.

I mean, I'd push back against some of it myself, but how many people are arguing that e.g. methamphetamine and fentanyl should be freely available?

Of course, it's all up for debate. I used it as an example because it's the status quo, so it's a good refutation of the statement that this new law is "crazy" in the sense of it being radical and unprecedented.

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

> - Businesses can, however, offer “financial incentives” for being allowed to collect data.

This just means your service always costs money, but you can refund the full amount for allowing you to collect data.

Is there a difference between offering, say, $12 monthly opt-out & $10 plan for opt-in vs flat $12 with a $2 discount to opt-in?

Yeah, the latter seems like it would involve more bureaucracy than the former. I don't want to sound fatalistic, but I cannot shake off the feeling that it was almost definitely intended.

Yep, people are generally lazy. Having something be two steps instead of one make a big difference on your overall conversion rate.

Given how hidden opt-out settings tend to be, yes. If the user has to opt in explicitly, it’s much less likely they’ll consent unintentionally.

In practice it will be a dull button saying “$12 plan” and a bright shiny button saying “$2 DISCOUNT” with everything else in fine print.

Probably. Loss aversion may make the user more likely want to recover $2 rather than pay $2 to upgrade to tracking-free versions.

https://en.m.wikipedia.org/wiki/Loss_aversion

Exactly. And i think it 's better UI overall: You default to no ads , but when it comes payment time, you present the ad opt-in to the users. My bet is 99.99% of users will choose free with ads. This also crosses a psychological barrier to disable their ad blocker.

I think the intention is to decrease the opacity of 'free' services, with the awareness that most people using most free services don't or can't know what happens with it and what is collected. Money is not personal data, likewise almost anything else is not personal data, and there should be more legal protections in llace imo to protect a naive person's ability to limit the propagation of it, or hold companies accountable. If most people knew how any givem system worked, then software engineers wouldn't make as much. It's not a clear cut transaction when the cost is "any amount of data we can collect about you and sell to anyone for any price in exchange for this specific service we provide amd cam take away at any moment". That's a bullshit transaction.

> The entire premise of free exchange is that I give you my services in exchange for something of value of yours.

Not if the thing I value is my personal data. Because I, as a typical short sighted consumer, will consistently underestimate the value of my data, as well as how my data affects those around me (extreme case: my data is my social graph, which you can use to reconstruct the social graph of my acquaintances).

If I don't know the actual value of what I am giving up, I am naturally going to get swindled.

You used the first person pronoun a lot there. Do you yourself actually feel that you are short-sighted and that you consistently underestimate the value of your data? Or are you putting yourself in the place of a hypothetical other person?

Hypothetical. The post I replied to used "I" and "you", so I used "you" and "I". That said, I genuinely don't know how much my data is worth…

I ask because people are often very quick to suppose that they are part of the educated elite but other people need them to protect them from their own bad choices.

Do you, for example, not use Google because you are concerned they are getting too good a deal from you? Duck Duck Go exists.

I use DuckDuckGo, and only fairly rarely fall back to Google. My Gmail account is dormant, I set up my own mail server. But I still have an Android phone…

In the case of data, is it always yours to give? Is the fact that I am friends with Friendo my data or Friendo’s? Both? Neither? Collectively both? Taken further is my contact info about Friendo mine to give? Is the photo with Friendo’s face that I took of a group of us at a bar my data to give?

If Friendo doesn’t have the same relationship I have with Tech.co, how is Friendo benefitting? Where is the exchange there?

I think you've missed the point. This does not make it illegal to collect or even sell user data, it makes it illegal to do so without consent.

Any concern regarding whether consent is likely to be withheld really just points out how stupid a company's business model is. Incumbent vs. Startup is also a false premise because Facebook is an incumbent that relies on selling user data. They do make some money from purely internal advertising, but in total Facebook only makes less than $5 per user when selling data, and that's lifetime, not per year. So the only way to make real profits from selling data is if you sell millions of people's data. Their internal data use however, is just for add targeting which they make more money from each year. This internal use makes more per user and is therefore a more viable strategy for a small company than selling data.

There are already regulations that make it impossible to sell user data that would be valuable that apply to more than just internet collected information. So, any data selling strategy a startup or incumbent company might have will either not earn significant profits or is very likely already illegal.

In any case, advertising revenue rarely ever covers a company's expenses. If a company is only staying afloat because of selling data, then that company is achieving a very poor return on investment and is wasting the time of everyone involved. Either they need better business processes, strategies or they're not offering something of sufficient value to be worth the time put into the business.

I think the legislative motivation is a belief that people do not (and perhaps cannot) understand the potential cost of consenting to data sharing. Without that understanding, can you really have a meaningful consent?

In this view, a company offering a discount in exchange for sharing is inherently deceptive.

> The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free.

The service isn't free. The exchange just isn't money. When money is involved a price is put forth. It's an agreed to and published exchange mechanism. When it's data on someone the price isn't shared. It's kept secret. There's always a price. It's just not always money or public. This will make more information public.

I wonder if this will start to change how business operate. Right now they are skewed against consumers towards businesses. I wonder if consumer protections, like this, will cause businesses to re-evaluate business models.

This explains it, I think that California took same diction.

Giovanni Buttarelli, European Data Protection Supervisor “There might well be a market for personal data, just like there is, tragically, a market for live human organs, but that does not mean that we can or should give that market the blessing of legislation.”

Privacy is fundamental human right that you cant trade for. Same as you cant sign a lawfull contract that you want to be someones slave, even if you want to.

Data mining as a business model is fine, as long as the customer is making an informed decision, there are equally good alternatives out there which you can pay for in other means, and you're not drawn to a particular service because of network effects or platform lock-in.

However, customers aren't well informed, and if they were, they wouldn't use these services. Currently customers are getting scammed for their data. This is why we need regulation.

It's not a requirement that services be provided for free. It's an acknowledgment that, if services can't be provided without violating basic human decency, they should not be provided at all.

> The entire premise of free exchange is that I give you my services in exchange for something of value of yours.

The problem is that these companies advertise their products as "free," which means something very different. And they usually don't mention at all that they're collecting shit tons of personal data. It's taking advantage of people's ignorance, and it's practically fraud, IMO.

Every other business tells the customer up front what the price is, and maybe it's time tech companies started doing the same.

Without telling users what data they collect, how much they collect, how they use it, and who they give it to, there's no way for users to make an informed decision.

> It's just fundamentally stupid and doesn't make sense. > I give you my services in exchange for something of value of yours.

I never explicitly stated that I'd serve these companies by giving my data. Services cannot be assumed, why do you think there are such long Terms of Service. We as users should also have Terms of Service then.

Charging different customers a different price for the same product is illegal under US law, and California laws don’t change that.

EDIT: Several comments below point out the innumerable businesses operating in such a way as to make mine an impossible claim.

Enumerating the established methods to avoid meeting the legal parameters of price discrimination is not the same as price discrimination being legal.

My bar for following just laws is higher than the minimum required to avoid being prosecuted. I’m sure experts can help work around any future privacy laws too, so why even worry?

Surveillance already creates a different product one can charge more for, though your lawyer might advise you call it “personalization” in memos.

This is suprising to me. I assume it is much more nuanced than that? How does insurance work then? Isn't insurance fundimentally the same plan with different prices for different groups depending on assessed risk?

That's not generally true. Businesses are free to vary their pricing provided they aren't violating some other law in doing so (e.g. laws prohibiting discrimination based on race or sex or laws requiring common carriers or utilities to charge prices set on a tariff).

How do car dealerships do it then?

Because when you buy a car you aren't usually buying "a [year] [make] [model] [with these features]". You're buying "that specific car with that unique identifier"

The correct answer is “it’s not the law”. Or at least the way the OP described it.

https://www.ftc.gov/tips-advice/competition-guidance/guide-a...

Really? So all it takes to work around this supposed law is to give your products unique identifiers?

I have a coupon code that says otherwise.

Not even remotely true unless you're selling to the government. The GSA does get a bit testy if they think you're cutting someone else a better deal.

Charging different customers a different price for the same product is illegal under US law

Demonstrably untrue.

It is illegal to charge a different price based on a protected class like race or gender. But travel sites, for example, are notorious for charging different people different prices based on their GeoIP, whether they're on mobile or desktop, or Windows vs Macintosh.

"Demonstrably untrue."

Robinson-Patman Act says "Please read me, and understand me and the Clayton Anti-Trust Act which I amend."

> that is not the same as price discrimination being legal

From refurb's link below:

"Price discriminations are generally lawful"

See https://www.ftc.gov/tips-advice/competition-guidance/guide-a...

You’ll love their take on net neutrality.

"EDIT: Several comments below point out the innumerable businesses operating in such a way as to make mine an impossible claim."

They have no clue about the Robinson-Patman Act amendments to the Clayton Act.

Airplane tickets. Car rental rates. Hotel rates. Buying a car. Loans: if I want to borrow $100k for 10 years, I will pay a different price than my next door neighbor asking for the same terms.

Agree entirely. This part is overreach as it’s now forcing a company to provide a service for which they receive no compensation. That’s too far.

I honestly don't see how it's doing that. The legislation doesn't even make an ad-based revenue model illegal.

They're not being forced to continue offering any services.

> Making it illegal to withhold services if you don't give up your data is crazy.

Maybe you can show me generic ads based on your content instead of targeting them based on where I've been on vacation last month, etc.

Or simply stop building businesses based on people data. Sell something people want to pay for. Humankind has been able to do that for thousands of years, did we forget how to do it?

Your quoted statement conflicts with the following: > Businesses can, however, offer “financial incentives” for being allowed to collect data.

Couldn't a financial incentive be charging more?

except, the full sentence in the bill reads:

> including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services, except if the difference is reasonably related to value provided by the consumer’s dat

Doesnt that second part cancel the first part? Businesses can also pay money for data ... so facebook can switch to subsciption only, but pay its users with virtual coins for viewing ads

> except if the difference is reasonably related to value provided by the consumer’s data

I think it means that if you opt out of data collection, then things like personalized recommendations will no longer work, which makes the services worse. That is a part of the service directly related to the data.

>so facebook can switch to subsciption only

sure, if it wanted to fall out of the fortune 500.

If Facebook can't convince its users that its service is worth paying an average of $2.5 per year for, I don't think it really deserves to remain in the Fortune 500.

Where does $2.5/year come from? Other comments in this discussion have suggested that it would be more like $120/year in the US, or $25/year for a global average

$2.5/year from each of their monthly active users would be sufficient to keep Facebook in the Fortune 500. (As referenced in the post I was replying to.)

(Tangentially, they would have to cut costs to remain profitable, but I figure it should be possible for 6k employees to maintain a set of services that people are willing to pay $2.5/year for.)

I interpret the purpose of that item combined with the subsequent one is to ensure that they can't force you to sell yourself but can offer you the option and leave the decision with you.

> The only reason those services are being provided at all is to get that data.

If people don't find your product valuable enough to pay for, then your company should go out of business.

Companies have been exploiting people's privacy behind their back, and now that they've been called on it they're throwing a tantrum.

> The entire premise of free exchange is that I give you my services in exchange for something of value of yours.

"Something" doesn't mean "anything". You can't offer your services in exchange for e.g. my body parts. Why are we willing to ban that but not our data?

> The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free.

Well, no — they could charge money for them. But even this is a false dilemma; surely we can come up with at least one business model other than "charge directly for our service" and "surveil our users".

There's also the dilemma that if you pay for something with a credit card, you have to identify yourself.

Only as an artifact of how laws currently work, not a necessary aspect of how transactions have to work.

We could definitely have a system where eg all CC processing must be done through a firewalled system such that the business only ever learns that the payment was successful (unless there is a dispute).

Edit: Europe tries to approximate this with the GDPR system of “you can only use information for the purposes for which it was collected” but that doesn’t stop them from seeing your identity like I described.

Not if you use Apple Pay though no?

Why would Apple not be selling your data the same as everyone else?

Will credit card companies fall under this law so I can opt out of them selling my purchase history?

>You can't offer your services in exchange for e.g. my body parts. Why are we willing to ban that but not our data?

Is this a real question?

Because there's a large number of us who want to pay with that data and don't think it's as damaging as cutting off our arms. It is true that there are things we are not allowed to freely exchange: kidneys, livers, most parts of our body. It is true that there are things we are allowed to relatively freely exchange: money, possessions, plasma, blood, and currently data.

Lots of us feel that the data thing should be allowed. That's all.

Is this anecdotal or do you have empirical evidence?

No this is one of the most verified facts. The privacy agreements of gmail, facebook and what not, serve like a poll for this: if you use the service you agree to this. Majority of people use Gmail, Facebook, etc. So this is not anecdotal. On the other hand the desire to "protect" privacy at the expense of free services is based on anecdotal data at best.

> The privacy agreements of gmail, facebook and what not, serve like a poll for this

I don't think they do, given that most people don't read them, and a large percentage of them are written so it's very hard to tell what they are really saying unless you're a lawyer.

That nobody gives a damn and doesn’t even read it kinda proves the point, no?

No, because it presupposes that people understand what they might be implicitly allowing by not reading them. Without first knowing whether or not people understand the extent of surveillance that is possible and the possible consequences we can not know what it means that people ignore the privacy agreements.

It's possible people genuinely don't care. It's also possible they don't understand the implications, and/or that they trust these companies more than they ought to.

No. Not reading it is not equivalent to "not giving a damn".

First, having to read a long block of legalese on every visit to a website (which would be necessary because those privacy polices can change without notice at any time) is unsupportable. If people actually did that, it would render the web completely unusable. The average normal person can't be blamed for saying "screw that", nor can their attitude about privacy really be inferred from it.

Second, even for those of us who are more concerned than the average person about these issues, reading privacy policies is a pointless waste of time. Once you have a lawyer interpret them for you, it turns out that the vast majority of them say the same thing -- they are reserving the right to do anything they want with my data. That means that I can safely predict what privacy policies say, so there's no need to read them.

If it is a fact then show me the proof.

Just because people use a service doesn’t mean they have read the terms and conditions. Therefore, your anecdote is just that.

Using the service is generally an acceptance and agreement to the terms of service.

A similar analogy is that I may not want to read my credit card bill, that doesn't eliminate the responsibility I have to pay it. Or, I may not want to read my visa card notice they send informing of a change in the APR or other conditions for service. however, my continued use of the card is the standard way one accepts new or changed TOS.

Maintaining ignorance doesn't excuse the actions.

Your argument implies that Google is acting in the limits of the current law.

Not really relevant to a change in the law.

No one's performed a proper survey AFAIK, but the GDPR opt-out rate is very very low, which provides weak evidence. This is not evidence of numbers, but I have an existence proof in that I also personally know a lot of people who know and insist on not opting out.

> GDPR opt-out rate is very very low,

Then again GDPR requires opt-in, but most sites ignore that and many make the opt out extremely time consuming.

Your proof is that you “personally know a lot of people who know and insist on not opting out”? That’s anecdotal evidence at best (aka not proof).

This is a confusing interpretation of what I said:

> This is not evidence of numbers, but I have an existence proof in that I also personally know a lot of people who know and insist on not opting out.

Most people I know would interpret that as "I know I'm not the only one because". After all, I specifically say "not evidence of numbers" and I also specifically say "existence proof". I find your response baffling.

At best this proves that this law is harmless.

I don't think the law is harmful. I'm considering the absence of opt-outs and the general prevalence of opt-ins evidence of people not being eager to opt-out.

> Because there's a large number of us who want to pay with that data

Okay, cool, don't opt out then. I on the other hand would prefer to see ads based on the content I'm viewing for which no other data from me needs to be passed around.

Yeah, and those parts of CCPA I support. I also support the data deletion stuff. Everyone should be able to revoke consent at any time. What I object to is the "you must continue to provide service after opt-out". I think you should be able to say what you're willing to accept and get appropriate service.

In fact, ideally, the User Agent would advertise our privileges. Like a DNT option and websites would respond with a paywall or something instead and be expected (by law) to respect the DNT. Then, on first load, browsers could say, "Do you wish to allow tracking?" and warn about the added paywall cost vs. the tracking cost.

> What I object to is the "you must continue to provide service after opt-out".

Well, I quite like that part. It pushes content providers to look for surveillance free business models, such as content based ads that aren't personalized. Why should selling your data vs. paywall be the only options? To protect Google's ad cartel?

Well, then, I suppose that's where our disagreement lies. I would prefer to minimize regulation controlling people so long as harm is not being done (hence I'm pro-CCPA in the ways it protects people from being harmed and disagree with it where does not actively protect from harm) and you have a different bar.

> I would prefer to minimize regulation controlling people

That seems like a weird spin. Businesses are being regulated here, not individuals. I don't see how the law would control me.

Okay, I'm happy to rewrite that whichever way you like, but I believe businesses are just groups of people. If you wish, consider that 'prefer to minimize regulation binding units of people or groups of people acting in concert'. I'm also content with it just being 'prefer to minimize regulation binding businesses or people so long as no active harm yada yada'.

I would submit that mass surveillance is doing harm, see Cambridge Analytica and other recent scandals.

Those were non-consensual, so yes, I'm on board with not allowing them.

The core disagreement is that I might want to pay with data only for services to me, and this new standard practically mandates that free riders are allowed.

> this new standard practically mandates that free riders are allowed.

It doesn't. That's merely one way how businesses could comply with the law, the other option would be to look for better business models as I said in the comment you replied to.

> "Something" doesn't mean "anything". You can't offer your services in exchange for e.g. my body parts. Why are we willing to ban that but not our data?

Because if you were to run a survey over the general population the large majority is fine not having to pay for gmail, google search, maps and other "free" services while some data may be collected doing so while a much smaller percentage thinks it's OK to sell their organs for that?

I think you’re missing the point.

At least I know where my data is. Have you ever read a GDPR popup partner list? Do the people you mention understand how gmail business model works?

"Have you ever read a BGP table"? Arguing that there are too many people in ad exchanges is a very weak argument. This is the internet, which enables global scale exchanges of all kinds of things. GDPR is a law designed for the 1800s

The partner list is not there for informing users, it is there for accountability in case the decide to silently add new partners.

This is your opinion, unless you actually did a survey of violating a citizens privacy by big tech. Have you?

Presumably you have? Do share!

No need! I’m not presenting a hypothetical survey’s results without evidence. The person I was responding to is, unless they actually have such a survey. I asked for it and no one answered. Therefore, until there is a time with supporting evidence, we can’t even qualify the opinion as a theory, let alone a fact.

General population is simply not aware of how much surveillance is involved and how much of their private information said companies collect, use or sell to 3rd parties. Many are happy to get "free" service in exchange for "some data", but most people people would be very much against someone data mining their health or pregnancy status, using some sophisticated algorithm to selling something harmful to their kids or messing with their mood when they're in depression to maximize profits.

Most people don't understand the risks and how badly mass surveillance done by Google / Facebook / etc can be abused. So akin to situation with tobacco industry someone have to educate them about this.

> Most people don't understand the risks and how badly mass surveillance done by Google / Facebook / etc can be abused.

This is totally dodging the issue.

Would they pay instead of allowing that collection?

Given the choice of "pay for this service", "stop using this service", "give up your data", even with a full understanding of the risks and the extent of this data, the general public has shown time and time again they will take the last option.

People do not like to pay for things.

I see way too many arguments about privacy that doesn't seem to grasp that the core of today's tech industry is built around this fact.

People will pay 5$ for 50 cents of coffee beans and enough sugar to drown a fly a day, but they will never pay 5$ a month to access nearly the entirety of mankind's collective knowledge at their fingertips in milliseconds in the form of a search index spending millions of dollars a year to index it all.

> People will pay 5$ for 50 cents of coffee beans and enough sugar to drown a fly a day, but they will never pay 5$ a month to access nearly the entirety of mankind's collective knowledge at their fingertips in milliseconds

I pay a lot more than $5/month for Internet service.

Would you pay $5 on top of that ISP charge to Google, so that your search experience is ad-free? Would you pay $5 for fastmail.com's standard plan over gmail?

$5 for a tracking free Google, including no Google ads on any site? Maybe. But then it would be $5 to any other tracking network and there will probably be some other tracking with no opt out. I'll be still running adblockers and privacy extensions, so paying is pointless.

Ha, case in point. A technical person talking themselves out of a hypothetical situation where they pay, now imagine everyone else.

The point is that I wouldn't be paying for a search service, I would be paying for not to be tracked, which is something I don't want to happen. It's so similar to paying for insurance against fires (think of gangster movies.) I don't like it.

I in fact do pay for fastmail.

You and the vast minority of internet users.

Agreed.

I recall people were talking about turning back to piracy in response to the fragmentation of streaming services.

Disney plus will cost around 7 dollars a month, Netflix costs 13, HBO costs 15. This is about 23, 45, and 50 cents per day respectively.

Yet this change was enough to cause some people to angrily proclaim that they'll go back to illegally downloading movies and tv shows.

Agree about the overall point, but this example is unfortunate: complaints about fragmentation are not only about money: crappy apps, less convenience, lack of availability (outside US), etc.

I'd think single source vs fleet of disparate services is a bigger concern. If I have to track and maintain 10 subscription services to get the stuff I want, I'd rather just pirate it, the inconvenience factor is too high otherwise.

Look at music, this seems solved there.

If Spotify was $50 or $75 a month a lot more people would not be paying and do things illegally. Can’t blame just fragmentation.

One option I also think we are forgetting, Services like ProtonMail and Tutanota. Both are private and encrypted, both are free (with an option to pay for more services). These services are out there, but general knowledge of them is not so high. I believe more users would switch to them if they knew about them. My own parents came to me asking if there was something they could do after being creeped out/scared by big techs privacy invasive tracking and stalking. They weren't aware of the availability of other services and yet they went looking when it got bad enough. How much sooner for others if they were aware of these alternative services? We could all argue back and forth about both sides, but I believe that both sides would be truly surprised about what would actually happen.

edit: typos

I agree and this seems to be the main problem: we are losing privacy today but we will suffer most of the consequences tomorrow. So most of us are not aware of the real cost we're paying and unable to make an informed decision.

Welcome to democracy, where an individual with zero understanding of an issue can vote on it and is legally entitled to have their opinion taken seriously.

Just for context: do you have any alternatives?

It really does feel like there should be some kind of aptitude test involved in getting a vote, doesn't it?

We need to require at least some minimal standard. A common-sense starting point would be literacy...

Yes, I think about this often and it appears to be a bug in the democracy system but any attempt to tie voting rights to knowledge seems to create even more bugs.

This is a strawman, you can still monetize without detailed user information, even still with ads.

> Because if you were to run a survey over the general population the large majority is fine not having to pay for gmail, google search, maps and other "free" services while some data may be collected doing so

How is this an argument against the law? It doesn't make it illegal to share data but requires that users can opt out. If said large majority is fine with surveillance, I guess Silicon Valley can relax.

He's saying being able to "opt out" is absurd. It's equivalent to getting the product for free in most cases.

"Hey, I want to use your free service but I want to go ahead and opt out of the part that enables it to be free" You don't see a problem with that?

It would be like if there were a restaurant that gave free food in exchange for filling out surveys (data collection). So you eat the free meal and then "opt out" of doing the survey.

The idea that free is only possible by trading data is absurd. E.g. Google search and maps can provide sponsored results without knowing everything about you. News sites can have ads related to their content and general target audience.

> You don't see a problem with that?

in this case, NOPE

Opt out is a problem anyway, GDPR is better in that it requires information up front, opt in.

I strongly suspect that if you asked people 50 years ago whether it was ok for companies to eg. track everywhere most people go, I think the vast majority would have said no. Google et al. just started spying on everyone without any serious debate over whether it was right. Then once people caught on, they either had to stop caring about privacy, or they had be Richard Stallman and eschew pretty much all mainstream computing technology.

If someone went back in time to tell people that this new internet thing was going to lead to the US having more surveillance than East Germany or the Soviet Union, there would have been laws passed and systems designed from the start to prevent it from happening. The fact that it didn't happen this way, and our culture's privacy norms have been destroyed as a consequence, is more reason to act to prevent further damage, not a reason to just give up.

I understand the requirements to clearly disclose, so that a user can make an informed decision, but deciding for the user is hubris.

> I strongly suspect that if you asked people 50 years ago whether it was ok for companies to eg. track everywhere most people go, I think the vast majority would have said no. Google et al. just started spying on everyone without any serious debate over whether it was right. Then once people caught on, they either had to stop caring about privacy, or they had be Richard Stallman and eschew pretty much all mainstream computing technology.

Sure, but if you had phrased the question more fairly and said "Should it be ok for a company to give you free services in exchange for tracking everywhere you go?" I think almost everyone would have said yes.

> If someone went back in time to tell people that this new internet thing was going to lead to the US having more surveillance than East Germany or the Soviet Union, there would have been laws passed and systems designed from the start to prevent it from happening. The fact that it didn't happen this way, and our culture's privacy norms have been destroyed as a consequence, is more reason to act to prevent further damage, not a reason to just give up.

My intuition here is the same as yours. That this is a bad thing. That privacy matters in an intrinsic sense, not an operational sense. But i'm not so sure that's really true anymore. The privacy ship has sailed off into the sunset for a while now, and at least to me, the harms don't seem that substantial. All that data is mostly used to give me ads that are more targeted to what I might want to see anyway. There certainly could be lurking latent risks about, but it's a little hard to see exactly what they are.

> Sure, but if you had phrased the question more fairly and said "Should it be ok for a company to give you free services in exchange for tracking everywhere you go?" I think almost everyone would have said yes.

Then you should add shadow profiling, data banks linking together data of dozens of different companies, politically targeted advertisement that pretends to be from human users.

Yes the free market is nice and all, still the internet is a hell of a creepy place. It is undeniable that the reason this was allowed (comparing to direct mail advertisement for example) is that it was always believed to be impossible.

That's nonsense.

Nobody can make an informed decision because nobody knows exactly what data Google collects or exactly how it's used.

And unless you've actually run a survey you can't even speculate about whether people are okay with it or not. If your claim was true, why would this law even exist? You're okay with it, but privacy is a highly personal issue.

> if you were to run a survey over the general population the large majority is fine not having to pay for gmail, google search, maps and other "free" services while some data may be collected doing so

This is simply not true. When informed about it, a clear majority of people would prefer not to be surveilled, and are uncomfortable with unknown third parties having profiles on them, ads following them around the internet, etc.

The fact that these people continue to use these services anyway (even after being informed) is not a sign that they are 'fine' with it. It is because they have no choice. Even as an engineer, I've found it unfeasibly difficult to avoid being surveilled while continuing to live a normal life. For most people it's a non-starter. They have no choice.

Freedom to choose is essential to a free market. Regulation, done well, can increase market freedom.

> Well, no — they could charge money for them. But even this is a false dilemma; surely we can come up with at least one business model other than "charge directly for our service" and "surveil our users".

No need to come up with something new, we had content based ads long before Google and Facebook took over.

Good laws put bad people out of business. I don't see the issue here.

The reason there are so many wonderful services available for free is because they make money selling your data. If the service is free, the product is you.

For many, many people, that is _fine_.

The real issue I see here is how this law is written and how we're interpreting it. If the law makes it so that people who want to opt out of free internet services because of privacy concerns are free to do so, then we're all good. If the law is written such that people who want to avail themselves of free services in exchange for their data are no longer able to do so because that business model is broken, then I see a lot of problems.

The problem is these services are scams. If people understood what they were doing they wouldn't trade their data for $5/month.

If your business can't survive by charging a fair price for the service it provides without stealing data, then it shouldn't exist.

> For many, many people, that is _fine_.

I would argue this isn't the case. For many people it is out of sight and out of mind. They don't realize what's happening.

I came to this conclusion after talking with people about it. Numerous people didn't believe it. I had to show people documents and articles for them to believe me. Most of the people I've spoken with do not like this behavior and would rather not use a service or pay for it if they had known.

The average person is unaware. That does not make it ok.

I like that the webshit data robbers downvote me for saying what they're doing is evil, yet if I showed any particular one what kind of information I have access to about them, just as a random private citizen interested in these things, they'd freak out and call me a creep. It's a shame what money does to people.

> yet if I showed any particular one what kind of information I have access to about them

This is where the line is drawn for most - if people from Facebook, Amazon or Google look at information other than machines. Totally fine if it's just a computer with a strong law like GDPR safeguarding it.

People are looking.

Not that I'm doubting you, but could you please provide sources?

I will not. This is both common knowledge and common sense.

You can easily find articles about sufficiently low-level drones getting fired from Facebook for snooping if this is an authentic query.

If you have trusted friends in tech, you can ask them even better.

Maybe. I'm just saying this is where expectations lie - including my own. Maybe I'm naive, I don't know.

From my conversations with Googlers at least, it does seem they're extremely careful about insider threats.

Is what people say is what people actually going to do ?

> The average person is unaware. That does not make it ok.

Any actual data other than anecdotes?

This statement is too broad brush for me to actually understand where you're coming from. Let's try a few variations of the theme and see if we can suss out why we perceive this so differently. If none of these touch on your perspective, I'd appreciate it if you could propose some of your own.

Please note that these are deliberately constructed as strawmen; I am not advocating for them or saying you do.

1/ Would you approve of a law which forbade companies (perhaps outside of eg healthcare or finance) from collecting or storing PII?

2/ Would you approve of a law which forbade a company which bought or sold PII (perhaps with the above exemptions) from doing any other kind of business?

3/ Would you approve of a law which required companies to explicitly price and purchase PII from consumers?

4/ Would you approve of a law holding employees or executives criminally responsible for data breaches?

5/ Would you approve of a law standardizing the requirements for anonymizing data?

6/ Would you approve of a law banning online advertising?

7/ Would you approve of a law which placed the same requirements on any company which stored PII as are currently imposed on credit agencies?

These all sound fine, except I don't know that credit agencies are held to high standards.

Ok, maybe I'm asking questions too close to my own viewpoint. Let me ask some follow-up questions that are a bit further out.

Would you approve of a law which forbade advertising of any sort?

Would you approve of a law which required service providers to offer their service for free?

Would you approve of a law which forbade service providers from offering their service for free?

Would you approve of a law banning the sale of digital goods or rights to digital goods?

Would you approve of a law banning subscriptions or recurring payments?

Would you approve of a law forbidding the use of cameras in public places?

Would you approve of a law forbidding companies from having more than $X in revenue, for some X?

> Would you approve of a law which forbade advertising of any sort?

No. People are entitled to speech.

> Would you approve of a law which required service providers to offer their service for free?

No. Making money is Virtuous and Good. Acquiring money by theft, deceit, etc is not.

> Would you approve of a law which forbade service providers from offering their service for free?

No. Charity is fine. In the cases people are actually paying with their data and the "free" is just legal trickery then yes. You already can't pay people in blood. Data is just as important.

> Would you approve of a law banning the sale of digital goods or rights to digital goods?

No. However, DRM should be illegal.

> Would you approve of a law banning subscriptions or recurring payments?

No. The only issue here is predatory sign-ons.

> Would you approve of a law forbidding the use of cameras in public places?

This one is difficult. At any earlier time, no.

> Would you approve of a law forbidding companies from having more than $X in revenue, for some X?

No, I wouldn't bother.

Ok, so you would forbid online advertising, but not advertising overall. What would you allow/ban and why (assuming that viewpoint is germane to this conversation)?

I'm not sure what you mean by "at any earlier time". Can you clarify?

You mention predatory sign-ons. In this context it seems you view the data-for-service trade as predatory. Do you think it would remain predatory if it were explicitly priced-- eg, if Google offered you a $5 credit on a $5 service for use of your data?

Would you approve of a law explicitly allowing blood-for-service or similar?

> > Would you approve of a law forbidding the use of cameras in public places?

> This one is difficult. At any earlier time, no.

I suspect the best solution here is laws around how the data from public cameras is stored and processed. Cameras that store a temporary loop of data, delete it after a day or two, and don't upload that data to the cloud are one thing. Cameras that upload every image to the cloud for permanent storage where face recognition software is used to track you movement around the city or your emotional state throughout the day are a different beast.

Surveillance cameras could really use a PCI-type compliance regime. Data must be stored encrypted at rest, intranets must be segregated from the broader web, etc. It isn't perfect but it's better than nothing.

Reply on news.ycombinator.com