Hacker News Reader

Comment by Ansil849 | Hacker News Reader

> Somehow Chrome autopopulating credit card fields got transformed into me having a Google Pay account.

If you give a company your information in one department, another department will invariably use it. See also: Facebook using the phone number you put in for 2FA for targeted marketing [1].

[1] https://techcrunch.com/2018/09/27/yes-facebook-is-using-your...

> The old "don't be evil" Google wouldn't have done this.

What's the "old" Google? You mean like Google Latitude, circa 2009? [2] [3]

[2] https://www.computerworld.com/article/2530951/privacy-group-...

[3] https://www.nytimes.com/2011/03/22/technology/22privacy.html

View on HN

Chrome card autofill was always stored via a separate Google API, which is why you need to input the CVV to autofill the card number and can't just pull it from your local sync database file. You've always had a ""Google Pay"" profile, it's just now in a dedicated screen.

It's worth noting that this is exactly what GDPR is meant to stop. Specifically, if they take your data they need consent and they need to be upfront about what they're going to use that data for. So if they say "Hey, would you like us to store this data for auto-complete" and then take it and use it to create a google pay account, then they don't have consent and can be fined.

Corporations treat fines as cost of doing business. In order to actually be effective, there need to be mandatory minimum prison terms for C-level staff who greenlit a particular program.

The maximum GDPR fine is 4% of previous years revenue, or in the case of google $3Bn.

This has never been applied and will never be - GDPR enforcement is a joke.

The combined amount of fines across all companies over the GDPR's entire 4-year lifespan is just 1Bn.

there's a transition period. We can't start enforcement with the maximum available penalties.

If the lower don't suffice, we will get closer & closer to the maximum.

The transition period is getting a bit long now and companies are still making billions on violating the GDPR.

The maximum is 4% or €20M whichever is HIGHER.

So, for a one-person startup, €20M means game over.

https://danuker.go.ro/gdpranoia.html#fines

I wouldn't be surprised if that "or" clause was added specifically to kill one person post box companies that only exist to carry the risk. Big Tech is very good at throwing empty shell companies at problems that involve paying money, like taxes.

I do agree that there needs to be more personal accountability, although I think the bigger issue here should be people in the finance world. Some of the fines have been quite large and do serve as a deterrent. H&M was fined 35 million EUR, which is a sizeable number even for a firm their size.

The total amount of all GDPR fines ever (all 907 of them) is ~€1.5 billion [1]. Google's revenue for 2021 alone, was €230 billion [2].

Fines may deter small and medium-sized corporations, but not large ones. Therefore something else might. Like prison.

[1] https://www.privacyaffairs.com/gdpr-fines/

[2] https://www.statista.com/statistics/507742/alphabet-annual-g...

How about making fines commensurate with company revenue?

That and a wildly escalating pay scale for reoffenders.

Depends. If you make the fines company-changing, then they can work.

I'm also all for throwing C levels in jail ALONG WITH the board as well. They want to benefit and sign off on choices of the company? They can also hold said responsibility on illegal stuff.

Or, just a lot bigger fines would probably work.

Someone will quickly point out that this is exactly the advantage American startups have over European ones.

lol the old Google and it's mission statement i wonder if it ever followed that vs. it was all PR that many fell under it's spell. I surely did then I was invited to demo my invention/tech to Google ATAP and whoa it was a huge spit in my face type experience and similar to this MIT student's experience https://news.ycombinator.com/item?id=18566929. Hers was worse as they blatantly patented her work after her interview without her knowledge and consent. Yet they got caught.

I am avid DDG user and advocate ever since realizing wow Google stomps on all the dreamers it inspired.

Goodness gracious, "I demo'd my work to $BIGCO and they stole it". Imagine my surprise. This has been going on since the start of the PC era. I don't condone it in any way, but trusting $BIGCO is like trusting the mafia; don't do it, or have a private army (lawyers, gunmen, doesn't matter).

lol i went out there with a provisional patent filed which is a waste of money you later learn cause you need a similar warchest to your opponent.

My point is Google's motto/PR was "Don't Be Evil," and that was just a ruse and her experience helps prove that as well prompts users to be disenchanted by them who also were sold and bought that same crap.

Further I am more then happy to tell my story and more importantly her story with evidence to warn those who have Google's stars in their eyes to demand millions before taking a meeting!

Google Latitude was an opt-in service.

> Google Latitude was an opt-in service.

Ostensibly, so is Google Pay. And yet here we are. See also, from the third link in my previous post:

> And the privacy watchdog said users of Latitude were not informed that Google tracked their movements to enhance its database of Wi-Fi information.

Except Google never automatically opted users into Google Latitude, so it is not at all comparable to what pg says happened with Google Pay.

> And the privacy watchdog said users of Latitude were not informed that Google tracked their movements to enhance its database of Wi-Fi information

This looks like they are confusing two different things (Latitude and Location Services, though maybe Latitude required Location Services to be enabled). Are iOS users warned that getting their location on iOS at all is used to enhance Apple's database of Wi-Fi information? The difference is that on Android, this is opt out with an explicit prompt at device setup, and on iOS, you can't even opt out. Which is more evil? https://news.ycombinator.com/item?id=21708157

> This looks like they are confusing two different things (Latitude and Location Services, though maybe Latitude required Location Services to be enabled).

The Google Latitude case also resulted in an actual fine levied. Your stance is that this fine was all because the regulatory body "was confused"?

No, you're confused about that because your article mixed up Street View and Latitude claims. The fine for Latitude was for processing location data collected from French users in France, which requires filing with the French government, not for any nonconsensual data collection. https://larevue.squirepattonboggs.com/google-street-view-and...

> not for any nonconsensual data collection.

It was absolutely for nonconsensual data collection. From the very link that you provided:

> The CNIL held that since it was carried out without the knowledge of the data subjects, the collection of data using the “Google Cars” or the mobile phones of “Google Latitude” users was carried out unfairly and therefore in breach of article 6.1° of the French data protection law.

And if you read the article, the complaint is that Latitude used the data illegally collected from "Google Cars" to perform its service, which it considered an unfair advantage. Latitude itself did not collect any data without user consent.

> In order to implement this service, the company used the same vehicles used for “Google Street View” – the “Google Cars”, equipped with 360° cameras and sensors to enable different types of data to be collected.

If there were any nonconsensual data collection in Latitude, you would expect to see other fines or Google changing the service. Neither happened. On the other hand, there were other fines for Wi-Fi data collection from the Street View cars, and Google did make fixes to it in response.

I am not sure why you continue to misrepresent this case. Using Google Car data was only one of the privacy violations, the other was mobile phone data.

I will post the quotation one more time:

Notice the whole "or the mobile phones" section, which comes after the Google Cars section which you are pretending is the only pertinent section?

And I am not sure why you keep pretending there was any nonconsensual data collection from the phone, quoting the article author's poor wording instead of the actual claims brought against Google. The article specifically describes which data was nonconsensually obtained by the cars. Can you tell me which data was nonconsensually obtained from phones? Look at the numbered claims.

Edit: I can't respond because you've made this thread too long. Once again, reread the numbered claims that CNIL brought against Google. None of your quotes are supported by the claims. (Technically, you're misinterpreting the first quote in your comment below, which is about data collected for Latitude, not data collected by Latitude. To avoid making mistakes of interpreting the author's interpretation, simply read the numbered claims.)

> Can you tell me which data was nonconsensually obtained from phones?

This is clearly explained, multiple times, in the article that you yourself linked to:

> This time, the CNIL decision, dated 17 March 2011, concerns data collected for the implementation of the “Google Latitude” service, which enables geolocation of users that have a Google account and a “smartphone”.

> The users’ phones themselves since they are used for the purposes of geolocation.

If you are claiming that no phone data was collected, then how do you explain this quotation which I have now quoted three times:

>>> The CNIL held that since it was carried out without the knowledge of the data subjects, the collection of data using the “Google Cars” or the mobile phones of “Google Latitude” users was carried out unfairly and therefore in breach of article 6.1° of the French data protection law.

Although you might not like it, the use of your location to improve the database of access points on iOS is carefully anonymized and thus practically harmless and not evil. It’s comparable to Google using your location to build its traffic information if you navigate using Google Maps. If they did it anonymously which I haven’t investigated but doubt.

Google also claims to do it anonymously. The only difference is that Android lets you opt out, so a wiretap order to Google can't get your location.

I have not seen any cases where this has happened which suggests that either the data is available more easily somewhere else or isn’t available at Apple or Google.

Reply on news.ycombinator.com