Permission Slip: App to take back control of your data | Hacker News Reader

Permission Slip: App to take back control of your data

digital-lab.consumerreports.org

82 pointstony10145 comments

https://www.consumerreports.org/cro/2015/01/user-agreement/i...

> By transmitting any Communication to the Site, you grant CR an irrevocable, non-exclusive, worldwide, perpetual, unrestricted, royalty-free license (with the right to sublicense) to use, reproduce, distribute, publicly display, publicly perform, modify, edit, create derivative works from, incorporate into one or more compilations and reproduce and distribute such compilations, and otherwise exploit such Communications, together with any personal information transmitted with your Communications (such as name, user name and photograph), in all formats and in all media now known or later developed.

> You acknowledge and agree that any Communications made to or by means of any Site Tool are public and you have no expectation of privacy in any such Communication. No confidential, fiduciary, contractually implied or other relationship is created between you and CR by reason of your transmitting a Communication to any Site Tool.

There has to be a narrower way to draw up this agreement.

This means (a) their comment pages can incorporate your comments and mini bio to show on their comment pages, and (b) the Internet is not private.

They have bad lawyers and bad Chief Legal Officer for allowing this boilerplate in an agreement for an app like this, but these two clauses are less nefarious than they sound.

Technically your writings are copyright by you, so this pairing lets them do whatever with your comments, and display them to others without you coming after them for something.

> Chief Legal Officer

Since around 2008 I notice everyone is an officer. There was a specific meaning of officer, and now it is big-shot-ism.

I'm imagining within any group of legal experts there's disagreement on how to approach risk/liability and manage it, if it is unavoidable. You need a dictator :)

The parent is probably right: Not a nefarious agreement, but it is some kind of irony that the service exists to help expunge your digital existence in many places and they have you agreeing to use your commentary (satisfaction?) as a means to market themselves.

If you were so happy with their service, I wish you could submit testimony in an explicit area of their site. I left an earlier comment and erased it: I'm not a fan of "implicit" we-can-use-anything-you-do agreements. I wish it were more transactional. That's why this service could be fantastic: It's alienating and exhausting to live in the digital public where every influencer/company wants to use your existence for monetary gain.

This could do with being moved to plain English.

The landing page tells me nothing useful about this app. So, I'm not inclined to trust it at all, because anyone can claim they are "Powered by Consumer Reports", and without any evidence to back that up, it's just an empty claim.

Can someone please explain to me why I'm wrong?

Refer to https://digital-lab.consumerreports.org/2022/11/16/introduci...

Okay. That link explains a little bit. Enough that I'd be willing to check it out now, in comparison to other tools like DeleteMe.

But it would have been nice to see that same information on the landing page for the software. Or at least have that link included in the original post here on HN.

Well that was a fast fail. I decided to try to have them request that Home Depot stop selling my data, and then the program seems to have hung on a blank page.

I hope the problem is that their servers are overloaded due to "HN Hug-o-Death", and not something else.

There are a lot more words there, but no more explanation of what it is.

Ok, we've changed to that from https://www.permissionslipcr.com/ above.

For that matter, could this have been done as a website rather than a mobile app?

Agreed. A web site would have been a much better solution that would have better served their members.

Besides the press/announcement post, if you opened the App Store link you’d have seen the publisher is Consumer Reports, with one of the other apps being the official CR app.

If they're going to have a web landing page at all, then it needs to tell you more than just giving you a link to the App Store and nothing else. At that point, it's just a pure waste of time. They shouldn't have bothered to build a web page at all, if that's what they were going to do with it.

It said quite a bit besides the links on the page.

I saw very little text. I saw some graphics where someone clearly spent some time to make some small sprites move around a bit to catch your eye, and links to open the App Store, and that's it.

If they're showing real text explanation of what the app is and what it does and why you might want to trust CR to allow them to do that for you, then they certainly didn't show any part of that on the web page I saw.

The web page I saw was basically useless. They would have been better off just making it a redirect to the actual App Store page.

I doubt you’d have been happy with anything they could have said. I tried downloading the app just now, and it didn’t do anything that surprised me based on what the landing page had described (with words in addition to images.) This isn’t a service I need, but the basic functionality and relationship to Consumer Reports was successfully communicated.

Including the text of the press release from CR, or even just a link to that press release would have been enough to at least get me to try the app.

But their landing page as I saw it was basically useless.

So, you're not the author are you? If so, then why would you hide your identity here?

No, and I’ve no relation to Consumer Reports. I’m not surprised you went for some weird attack there, sadly, after trying to find something wrong with a bog standard app explanation page.

But there was no explanation actually shown there. So there is no valid claim of a standard app explanation page.

Perhaps you saw a different page than I did, but there was nothing on the page that I saw that explained anything about the app itself or what it was supposed to do.

And there's nothing strange about asking someone if they happen to be the author when they are acting like a shill. When I am presented with a spade, I tend to call it a spade.

To be clear, here's a screenshot of the page I saw: https://imgur.com/a/pV4PdSv

What on this page do you find useful? What does this page look like on your device?

What do you see as the ideal response to your comment?

Do you feel that what you’ve said has been in service of soliciting that response?

I looked at the website for this app and got an idea of what it’s meant to do. I don’t think I’m particularly smart and found this to be along the lines of any other SaaS app marketing site.

If your gripe is that “anyone can claim that they’re powered by consumer reports”, are you also the sort of person to verify the claim yourself instead of outsourcing that to Hacker News? As made evident by another replier, more information was easily findable.

The link that was provided to the CR press release was a suitable response. That was enough to tell me that this thing probably actually is associated with CR, where I've been a member for over thirty years.

I still find it ironic that I learn about this thing here as opposed to official CR channels to their membership, but whatever.

Now, as it turns out, the product may well actually be associated with CR, but it's still a fail. At least for now, because they give me nothing beyond a blank page when I select the option to have them tell Home Depot not to sell my data.

I probably won't delete it yet, because I want to see where this product goes. And I want to see what it can do for me that DeleteMe (and other similar tools) cannot. But as of today, it's like the announcement of Twitter, and then getting nothing but a fail whale when I go there.

To be clear, here's a screenshot of the page I saw, which has virtually no useful and verifiable information on it: https://imgur.com/a/pV4PdSv

> With a tap, you can tell a company to stop selling your data or to delete your data entirely.

Will they listen or just laugh it off? Besides, making it the individual's job to run around and tell everyone to delete their data is the worst possible way. And who has data on you without your knowledge? How about not collecting all that data in the first place?

Edit for clarification: I'm not criticizing CR, they're doing what they can under the circumstances.

Don’t let the perfect be the event of the good. CR can’t make companies not collect data to begin with. That requires legislation. With this app, they are doing what they _can_ do.

I agree, and I wasn't blaming CR. I thought it would be obvious that it's legislation that is lacking.

If they are under reach GDPR they have to if you tell them. No idea whether separate company pretending to be a proxy of you would be listened to

From their FAQ:

“Permission Slip helps you exercise your right to privacy under the California Consumer Privacy Act (CCPA) by acting as your ‘authorized agent’ and sending data requests to companies for you.”

https://www.permissionslipcr.com/faq.php

The California Attorney General is monitoring companies’ compliance with authorized agent requests:

“The sweep also focuses on businesses that failed to process consumer requests submitted via an authorized agent, as required by the CCPA. Requests submitted by authorized agents include those sent by Permission Slip, a mobile application developed by Consumer Reports that allows consumers to send requests to opt-out and delete their personal information.”

https://oag.ca.gov/news/press-releases/ahead-data-privacy-da...

There is also simpleoptout for the more lo-fi approach.

https://simpleoptout.com/

Why is this an app? It sounds like a nice service but I don't know why I need to install software on my phone and interact with a small touch screen in order to use it.

Anyone else put off by the privacy policy? It’s essentially the equivalent to what most companies do that they are “helping” with. I get that some data retention is required for offering this service, but I am not sure why they would need to retain data if my account is deleted. At least they are up front about it (assuming you are they type to read privacy policies).

Here's something I never see discussed. Assessing one's credit worthiness is naturally a data business. So, unlike for ads where companies knowing more about you has no upside, when it comes to credit the situation isn't as black and white. There's an actual trade-off. I DO want companies knowing how much I make because that's beneficial for me.

In EU your rating will only get lower if you actually don't pay for loans. I don't need to use credit card and pay it off regularly to get low mortgage.

Bank ask about job and income information (for bigger stuff like mortgage) when you get the mortgage, not keep a file with your entire life's of financial information.

Ok for mortgage but I had in mind getting better credit cards in order to get rewards. I do want to give these companies what they want so I can get better rewards.

I'm not saying the trade-off is worth it for everyone, I'm just saying there's a trade-off, unlike in advertising.

Downloaded!

Funny, I suggested building an app exactly like this a month ago. In unusual HN fashion, I was immediately shot down as “that would never work” [1]. I feel vindicated that Consumer Reports built this :p.

[1] https://news.ycombinator.com/item?id=34194778

“YC et al would never fund this! You’d barely even become a billionaire.” Is how I read those responses when they come from Hacker News.

I stopped using consumer reports online because they LOST their independence.

Their website connected very intimately with the sales channels and they made their money from referrals.

This reminds me of apple touting privacy, while simultaneously tracking all your activity with little or no recourse.

It’s like how VPN providers say to use them to protect yourself from your ISP. Don’t get me wrong, Comcast has its many many issues, but I still trust them more than I would most VPNs. I guess it’s easier to create anonymity with VPNs, but still, most people just think they have a VPN so they’re good.

In contrast, I would trust almost any VPN provider far more than I do Comcast or any other major ISP that I know of. AT&T has already had major litigation against them for their activities with deep packet inspection, injecting their own ads, and blocking or traffic shaping other sites on the Internet that compete with services that AT&T wants to sell you instead (like Netflix). And Comcast is far worse in this space than AT&T.

The word "trust" is pretty meaningless in a void--if you can't answer "trust to do what?" I think you're missing some nuance to the concept.

For example, I trust my parents to do what they think is best for me, because I have decades of experience showing that is genuinely their goal. But would I trust my father to perform open-heart surgery on me? Absolutely not! The man doesn't have a medical degree of any kind.

With corporations, my trust is largely based on their incentives.

I trust Comcast not to sell my credit card data to Nigerian scammers, because they're clearly making more money by being a cable provider than they would by being a credit card data darknet wholesaler, and selling my credit card data to Nigerian scammers would put their more profitable business at risk.

VPNs... might sell my credit card data to Nigerian scammers, because their profit margins aren't as high and their reputations are already not great.

I don't trust Comcast not to report my metadata to the NSA or to reject MPAA requests for torrent data, because they already did both those things and have incentives to continue.

I trust VPNs to request MPAA requests for torrent data, because as soon as that became known it would hurt their business model. I don't trust VPNs not to report my metadata to the NSA because acting as a honey trap for the NSA could be pretty profitable and probably wouldn't become public, so it wouldn't hurt their business model.

This particular situation feels sufficiently far from the original point that I’d say it isn’t that fair a comparison.

> connected very intimately

Do you mean hyperlinks?

They're not hiding anything: https://www.consumerreports.org/cro/about-us/our-partners/co...

I used to subscribe to the physical magazine and I thought they had much higher standards.

They accepted no advertising in their magazine. They bought cars independently, and tested them as customers.

I think their "adaptation" to the internet might have been necessary to survive, but I believe it made them less objective.

Reply on news.ycombinator.com