Red flags in the Threads privacy policy
qz.com
qz.com
Meta's Twitter rival launched in over 100 countries today—but not in the EU
Anything more is simply detail - if a major launch of this sort of service omits the EU we immediately know exactly why.
Errg: sorry folks. I miss read the thread and thought the "such as" was responding to the comment next to it about the design flaw of not being able to delete personal data.
- Enforcement records from illegal content / violating content
- Local data cache for offline mode in mobile apps
I'm not saying all of these apply to "Threads". But there are tons of edge cases to consider that need code changes t o behave as expected.
There's really no complexity there. The right to be forgotten doesn't superseed other laws, and it is required by law in most countries, that transaction data be stored for 5 years plus running year, so in case you request to be forgotten, that can only happen once the mandatory data retainment has expired, which can easily be handled by a "transaction date", and simply run a batch job that matches each user to their transactions (and desire to be forgotten), and once transaction are expired and the user has requested to be forgotten, you simply delete.
> Local data cache for offline mode in mobile apps
The right to be forgotten has a "grace period", so set your cache expiration to less than that amount of time and you're pretty much home safe, or better yet, don't cache GDPR sensitive data and you can pretty much cache for as long as you like.
Data protection laws like the GDPR might take the position that you should minimise the collection and use of personal data. Many of us might even agree with that position in principle. It can still be complicated to work out what "minimal" actually means if you did have good reasons to collect the personal data in the first place and you might still need to keep the data or some part of it for those purposes or to comply with other laws or regulations.
Also, some of these are pure theoretical in the EU. You're not even allowed to photocopy an ID in Germany; age verification is a checkmark someone sets upon verifying the ID is valid and then (metaphorically) handing it back, not a copy of a legal document that you probably don't want deduplicated to random S3 buckets held by all the companies you do business with. They're not exactly resistant to replay attacks, after all.
My point is that knowing which personal data you need to redact and under which circumstances is not always easy. Before you can build a system that does something you first need to identify exactly what something is required.
This kind of wilfully ignorant argument is extremely tedious and indicative of the fact that you do not understand the actual construction of the GDPR, or choose to misrepresent it.
Let’s put this nonsense to bed once and for all by quoting the Irish summary [1] of articles 17 and 19:
> You have the right to have your data erased, without undue delay, by the data controller, if one of the following grounds applies:
> - Where your personal data are no longer necessary in relation to the purpose for which it was collected or processed.
> - Where you withdraw your consent to the processing and there is no other lawful basis for processing the data.
Information pertinent to tax records is not collected on the basis of consent, and nor is anything else legally required.
Now please, just stop.
[1]: https://www.dataprotection.ie/en/individuals/know-your-right...
This is HN. Please don't post comments with that sort of hostile tone here. Assuming ignorance and/or bad faith does not further constructive or interesting discussion.
The GDPR is extremely easy to understand. It's not always trivial to comply with, because we all know that enterprises are held together with instant glue, a networking VM in a basement nobody has logged in to for 10 years, at least 3 layers of management between a DPO and feature teams and one all-knowing employee everyone hopes will never leave or take too much vacation because things will slowly crumble in their absence. It's pretty hard to be absolutely compliant in that environment. But if you're a startup, or even solo? You can absolutely design your app to not have these issues in the first place.
I respectfully disagree. And I write that not only as a very experienced developer but also as a director who has been legally responsible for GDPR compliance in more than one relatively small organisation.
The GDPR in its official format in English is 88 printed pages. It contains 173 introductory paragraphs followed by 99 specific Articles some of which span multiple pages by themselves. As is customary for legislation made at EU level a lot of the provisions are written more as statements of intent with considerable ambiguity about concrete implementation that is left to regulators or courts to clarify.
The specific legal basis of "legitimate interests" and the overarching obligations to collect and process data only where it is reasonably necessary are good examples of this openness to interpretation. And yet much of the data processing that most of us would probably agree is reasonable relies on the legitimate interests basis for its lawfulness. Several enforcement actions by regulators have already been brought against data controllers who apparently believed they were acting in compliance but were still found to be infringing the general principles around necessity and proportionality.
I contend that any legal document running to nearly 100 printed pages of densely printed text cannot credibly be described as "easy to understand". Indeed I must have read hundreds more pages of analysis and discussion by legal scholars, professional data protection officers and other experts and there have been plenty of disagreements over interpretation or sometimes outright contradictions between those papers.
Of course the only things that actually matter are the actions of the regulators or other official bodies that interpret the regulations and potentially sanction those who infringe them in specific cases. That means we also have to consider the stated opinions and actions to date of all the different national regulatory authorities and the outcomes of the cases that have been formally considered and resolved so far. And once again it is clear that even among the national regulators who are responsible for the interpretation and implementation of the rules there can be considerable disagreements about how the rules should be interpreted and sometimes which cases should be brought at all.
Now I don't necessarily disagree with some of those outcomes but I do think that if a data controller honestly believed their prohibited actions were in compliance and was subsequently penalised and required to make changes then evidently there is a problem with how accessible/understandable the rules are and those rules demonstrably failed to prevent the unwanted behaviours in those cases until the regulators did take action.
Most enforcement is directed towards total disregard of the GDPR. Data that hasn't been properly deleted after requests, requests that go unanswered, and entities like Meta who think their legitimate interest towers over protected categories of information (i.e. allowing microtargeting based on health). Companies also get away with a lot of easy to see violations (i.e. I've complained about Microsoft doing dark patterns to obscure whether agreeing to data collection is a requirement for a service to work).
Usually you'll be fine if you understand the basic framework and intent.
And I'm not sure how you get to 88 pages. It comes out to 68 pages with very generous margins and a line-height of 22pt on A4 for me.[1] (also, all EU law, including translated judgements, is canonical in all member state languages, FYI)
[1]: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
I agree this is true. And at least here in the UK the regulators appear to be acting in good faith and according to the spirit of the law. However I don't like the principle that not enforcing a bad rule somehow makes it better.
If something doesn't need to be enforced then it doesn't need to be a rule at all. Then it can't be selectively and possibly punitively enforced against someone the authorities take a dislike to or simply because of a bureaucratic mistake caused by incompetence rather than malice.
Moreover having rules that are rarely enforced effectively penalises those who do make a good faith effort to comply but probably would not have suffered any ill effects if they had not done so. They're being penalised by paying extra compliance costs for trying to do "the right thing" and that doesn't seem like a good idea to me. In a business context it is literally giving a direct financial advantage to competitors who bend or outright ignore the rules and get away with it.
And I'm not sure how you get to 88 pages.
Official PDF:
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...
Also, legal texts are the always longer than a conceptual tl;dr of them. Covering for all eventualities. It's not a flaw of the legislation itself that some boilerplate is required. Also, a lot of it is contextually relevant (e.g. there's entire sections for regulating specific industries).
Your average contract contains the same boilerplate by percentage.
Twenty-eight independent data regulators on a complain-investigate model. I’ve seen folks bury early-stage competitors with regulatory inundation as an effective, if unethical, strategy. Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads.
For non-EU-based business: Appoint a representative in the EU. The DPA of that representative's country is responsible for you.
So where do the other 20+ DPAs come in? They might be responsible for your customers - in which case, they'll contact your DPA and sort it out among themselves. You still won't have to become an expert in the nuances of Bulgarian, Swedish and Portuguese privacy law.
No, they won’t. They’ll help you coördinate. You won’t have to become an expert in other bodies of law, but you will need to responsive to them, which is time consuming, distracting and—if you’re running a real business—expensive.
I’ve seen this deployed to remarkable efficacy, with asymmetry in defence:deployment cost in excess of 10:1.
Note that Musk has zero need to tell anyone to do this. Some fans will do so on their own initiative and that will suffice.
Even with the best of intentions, these laws can be labyrinthian and ambiguous, and therefore expensive to (try to) observe. And there is still always the risk that you are found guilty of something. For a small or medium business, you are likely to be far enough out of the radar to avoid issues. But as a large company you may easily end up in legal crosshairs, costing millions or billions of euros, even if you ultimately prevail. And if you lose…
Seriously though, GDPR compliance isn’t that hard. You just have to get out of the habit of collecting everything.
Unless compiling data on your users and selling it is your entire business plan.
One of the issue I see it that many companies have been lured into this impression that they need to track everything, in great detail, but it doesn't actually provide that much value. I blame the snake oil sales people in the advertising/remarketing/up-selling/cross-selling business.
I recommend to simply get rid of any tracking. If you want user feedback, ask them or do tests. It’s cheaper and more effective.
Any commercial organisation is going to have customers and therefore customer details and payments data.
Any commercial site needs to record enough logs to investigate events like outages or security threats.
Any site that isn't purely informational and read-only probably works with user-provided data in some way.
People keep writing about GDPR and similar laws as if they only apply to data-harvesting analytics plugins on ad-ridden content farms but the same laws apply to everyone else as well. For many it will be reasonable and indeed necessary to process personal data in order to do whatever the site or app does.
Necessary for the performance of a contract or to comply with legal obligations.
> Any commercial site needs to record enough logs to investigate events like outages or security threats.
Legitimate interest, and possibly legal compliance if the nature of your site means you have a legal duty to collect those logs or that they could help in the course of an investigation.
> Any site that isn't purely informational and read-only probably works with user-provided data in some way.
If it's a UGC-based website, then collecting some data is necessary as part of the provision of a service or legitimate interest for fraud/spam prevention.
Every single point you mentioned would explicitly be allowed under the GDPR with either compliance with legal obligations, necessity for the performance of a contract or legitimate interest, no consent required even.
On numerous occasions in GDPR-related discussions I have seen people seriously questioning whether you can keep a basic server log with IP addresses in it of the kind that every web server has generated by default for decades. Often there are suggestions that such logs must be automatically deleted after a short period or the IP addresses masked in order to be compliant. And yet having records of which addresses were doing what on your site can be useful information for security and fraud prevention purposes months or even years after the records were originally created. So who is right? GDPR doesn't actually say and as far as I'm aware neither have any of the relevant data protection authorities yet so if you're running a site with these security concerns but also making an honest attempt to be compliant then you literally have no way to know how far you're allowed to go without crossing a line and upsetting a regulator.
That's just one everyday example that would probably apply to millions of different websites and that has been discussed many times but still with no clear answer. There are many more areas of ambiguity that even a well-intentioned organisation can easily run into. Backups and archives. Soft deletes when a user asks to delete something but you know for a fact that many users subsequently contact your support staff saying they've made a mistake and asking to restore the data. It's a long list with few clear answers.
Any modern western jurisdiction has practically indecipherable layers of legal complexity affecting nearly every facet of life.
As a tech manager for an EU company, I can honestly say that it isn’t that hard to be GDPR compliant.
Even when I worked for a company that did need to collect customer information, we pretty well understood what we could and couldn’t do under GDPR.
This whole “GDPR is dangerous” meme needs to die because businesses aren’t being dragged in court over trivial things because of it. The only people moaning are those who were abusing peoples data to begin with. And those are exactly the types of companies this law is protecting people from.
It's pretty easy for a business to be GDPR compliant unless their business model or processes in some way involve collecting and processing or selling personal data of their users. Before GDPR a lot of businesses used this as a nice little second income stream, or just grew used to being able to freely analyze every aspect of their users private data that they could get a hold of. Suddenly they can't do this anymore, and what's actually difficult is not being compliant with GDPR, it's reconciling their business to a new way of working where they have to be considerate of their user's right to privacy.
For example, you have a deeply entrenched analytics system that you base a lot of your decisions on. Suddenly you have to basically gut it, or even throw it out entirely. No matter that's there's plenty of GDPR compliant systems to replace it, they don't feel as effective and it's easy to see why a business would make these changes begrudgingly and with a lot of complaining about how unfair it all is.
Good.
It’s also worth noting that you can still using customer data for analytics under GDPR. GDPR doesn’t prevent legitimate analytics from happening. It just gives consumers power to be excluded from analytics and to force companies to be transparent about their usage of personal data.
> This whole “GDPR is dangerous” meme needs to die because businesses aren’t being dragged in court over trivial things because of it.
Ah, yes, the one weird trick of GDPR "compliance" by being a smaller, less appealing target to the enforcers.
The "GDPR is dangerous" meme needs to stay alive because it's massively ambiguous and different country's interpretations vary wildly. The types of companies the law is "protecting people from" are non-European ones. It's just economic protectionism in the guise of privacy.
But to be clear, the GDPR is not about protectionism. If it feels that way then perhaps you need to have a hard look at whether the bigger problem is the companies that you feel are being persecuted by GDPR and whether the countries they originate should have done more to regulate them to begin with.
For example, which of the following statements are true according to the ECJ's interpretation?
American companies cannot run datacenters in Europe, because the CLOUD act might compel them to give up data to American authorities.
Canadian companies cannot run datacenters in Europe, because Canada might pass legislation that compels companies to give up data to Canadian authorities.
American citizens cannot work at datacenters in Europe, because they're subject to U.S. law, and the U.S. might pass legislation to compel them to steal data.
Germany cannot host datacenters, because they lack an independent nuclear triad, meaning that they're subject to U.S. invasion to seize the datacenters.
So am I but unfortunately the topic itself is highly nuanced. If it were that easy to say this type of usage is ok but this type isn’t then we would have been able to put better technological measures in place to keep our data safe.
And let’s be honest, GDPR is hardly an outlier. Most laws end up being nuanced when it comes to cutting edge technology. Whether it is intellectual property laws, computer misuse laws, etc. The only difference here is that innocent people aren’t being harmed by GDPR.
So if you’re going to complain about vague laws harming people, then GDPR is the literal last one you should be concerned about at this point in time.
The only reason people moan about GDPR is because entities like Facebook have brainwashed you into believing it’s bad. They say it’s “anti-business”, “harms innocent companies”, etc. but it’s all BS. And I say this as someone who has had to work inside the GDPR every day since it’s inception.
Now if you want to moan about innocent people being arrested in America for “hacking” because they send bug bounties, or even just click “view source” in Chrome…then I’m all ears. Or complain about how IP laws are being abused to hoard monopolies on obvious ideas. Or about how companies are sucking up other peoples copyrighted content for free to train proprietary GAN. Or about the abuses of DMCA.
The thing is, companies don’t to moan about those things because those abuses empower them. Whereas GDPR levels the playing field. So despite the fact that GDPR has never once been abused and the others frequently are, GDPR is the law that everyone gets pissy about.
Privacy laws aren't new, they existed before the GDPR. But they were fractured and not up-to-par with the new digital reality of large scale collection of personal data. These laws are geared exactly against the very business model of Google and Meta: offer free services, be first to market and become a gatekeeper, collect user data as broadly as possible, sell business intelligence and marketing services to actual paying customers.
When Meta states that it can't release Threads due to "unknown legal liabilities" that's a round-about way of admitting that their business model doesn't entirely square with European laws, such as they are.
Finally, as far as size in terms of user base, revenue and expenses go, the likes of Meta, Google and Twitter are very much a league of their own. Given their business model and its profitability, it's inevitable that their goals and motives are at odds with the interests and legal rights of citizens.
We've had no more than two disputes since the GDPR was passed and they both ended up with a simple "Please remove their data and make sure that X services are deactivated too when the user fills their consent form".
No scary lawyers or multimillionaire suits. I guess that part is reserved for those that consciously decide to ignore the rules.
Are you referring to gdpr? If so, that is such a clear set of documents (especially article 15) i would ask you to take a re-read.
That companies like Facebook push fancy theories of what is and isn't legitimate interest is not the fault of the law. People will always try to push the limits to see what they can get away with, esp. when there is money to be made. That doesn't mean it will fly - like Facebook has just discovered (and others before them).
Law cannot enumerate every single possible existing and future use case. It outlines the intent - and if there is a grey area somewhere, it will be ultimately tested and decided in court.
That's how it has always worked.
That's just not realistic, esp. not when technology is involved which evolves at light speed compared to the comparably glacial tempo of regulatory and legal world.
E.g. GDPR has been proposed in 2012, adopted in 2016 and fully in power since 2018. I.e. the entire process took over 6 years!
Where was e.g. Facebook or Amazon in 2012 and where is it today? What about siphoning of (also personal) data by various AI training systems - is that covered by GDPR too or not as they are not really "stored" in the resulting models? Not something one could ask the legislators in 2012 to anticipate, really.
E.g. Recital 47 on Overriding legitimate interest:
"The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."
I.e. Facebook is entitled to use your data for their own direct marketing (e.g. sending you leaflets, sale offers or telemarketing) to you according to this. We can guess how did this provision get there (likely the lobbying has been fierce).
Or Article 22 on automated processing/profiling:
"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."
Full text of the directive is here: https://gdpr.eu/article-1-subject-matter-and-objectives-over...
A lot of people make all sorts of comments on GDPR (and other regulation) but it is unfortunate that very few have actually *read* what they are commenting on.
And post Brexit they'll ignore all the CJEU case law about how blatantly companies have been building GDPR since the start.
This is very speculative. My guess is that changes will be made, but they'll be incremental and some effort will be made to ensure broad alignment with eu GDPR so we don't have another SCC-syle mess (where some major EU to USA data transfers were determined to be illegal.)
[1] https://uk.practicallaw.thomsonreuters.com/w-026-8528?contex...
[2] https://www.gov.uk/government/consultations/data-a-new-direc...
*I get a GDPR-looking privacy popup on Threads in the UK so I'm inclined to agree
Not threads.net
I guess the app works? But why not the website too? (Or does the website also do nothing in the US?)
it's right there: "Meta"
Whoever thought something good and user-first would come out of this wannabe Twitter killer is completely naive.
I expect that federation won't last and there's 2 things that can happen, either Meta decides it's not worth it, or they will find a way to draw out most of federated users and then deal a killing blow to the fediverse.
I was skeptical about being against Meta's Twitter being federated, but now I am totally in favor of it being banned by most instances.
Also, interesting to see a big international company actually back up their "we just won't do europe then"
that's the most interesting things to me. Whether:
1- Threads is dead in the water
2- They figure it out and makes the EU happy
3- EU is irrelevant enough to be ignored
2- still looks like the most likely 1- would be very embarrassing and 3- would be, indeed, an "interesting" development.
The way I see it is a mix of all of that, but number 3 is the biggest.
Twitter is not big here. There’s people who use it, sure, but there’s a reason you don’t see that many EU issue trending on Twitter. Here’s an example out of the top of my head: France is rioting and it barely registered on Twitter.
The biggest European market for Twitter is the UK and it has 19M users, the second biggest is France with 9.5M [1]
The only time I see EU events surging on Twitter is during continental sporting events like Champions League, or Eurovision.
Twitter is just that that big around here.
Instagram on the other hand, I don’t know anyone without an IG account - so that might muddy the waters on this dynamic.
This however is just my personal experience.
[1] https://www.oberlo.com/statistics/number-of-twitter-users-by...
Your point is well taken, and if anything that's a significant understatement. This is one of the most significant protests (or nearly civil war) to occur in France since the Revolution.
> and it barely registered on Twitter.
Indeed. I saw videos of what was happening in Wuhan in late 2019, but tbh it was mostly linked by comments on (where else) HN, so I may not have discovered it via Twitter's own tools.
As someone from Europe who isn't French. It's just another France rioting story. It might be big in France but for the rest of us, it's just looks like another France rioting story which they were doing for the past few months.
It's not just that it's barely registering on Twitter, it's barely registering anywhere because lots of us are just so used to France rioting that it's not really news. It's like mass shootings in the US. I think there was a new one over 4th July holiday period but I am not 100% sure because we're so numb to mass shootings out of the US. They need to do something super wtf like have the police stand outside a classroom while a school shooter is shooting children for us to register.
Essentially it's like how the average protest with minorities is treated vs Jan 6....
The former the cops toss tear gas, kettle them and beat them with baton and "rubber" bullets while the latter theres cops literally moving the barricades aside and escorting the rioters around....
Even that unfortunate incident when they killed the teen was very much reactionary, as people have been throwing Molotov cocktails etc at them for weeks now.
Honestly, i do understand the perspective of the rioters. Not having a chance to improve your life would make me violent too, i think... But framing the police as racists acting out is misguided considering that most of the issues are social in nature and not caused by the police.
And this might be too nitpicky for such an emotional topic, but the term racism gets thrown around way too much. I think it's more akin to classism, as it seems like you're still gonna get discriminated against if you originate from the poor areas, no matter what the color of your skin is.
Because of thier racism and prejudices they are too quick to use force, tear gas and other "compliance methods" against those they deem undesirable, while they consistently avoid use of such methods at all when they self identify with the protesting group.
That's what's being referred to
It's not overt kkk or Nazi shit, it's the subtle underlying racism that makes them shoot tear gas on the first day into a group of entirely peaceful people, which then result in the escalation to this extreme violence we now see.
It's a well established fact that the police are the source of escalation in many cases, choosing to attack the whole instead of seeking to address the problematic few.
The cops even send in fake protesters to engage in violence so they can then attack the protest. It was caught in Quebec on video, so I highly doubt it doesn't also happen in France where tensions and racism are far more significant. (See agent provocateur)
I don't believe Facebook, Instagram, Tik Tok or Twitter were net gains for people. I don't see how Threads might be.
I do honestly believe that if all these services disappeared overnight we would live in a better world. I legit just don't want Threads to enter the EU, ever.
There are products that can't be sold on the EU because of health concerns. Threads is no different.
I'm pretty sure they'll launch in the EU eventually.
2) Even if it were true, we are not CEO of a multi-billion corporation.
They're likely not launching in EU because EU requires user data be stored in EU, and their current launch stack is hosted elsewhere, look at this datacenter map of Meta:
https://datacenters.atmeta.com/
They're mostly in the US, and most outside the EU. Given the record timeline from concept to launch for this app, it's normal they can't whip up a datacenter from nothing overnight.
I kinda assume that Meta could do this if they wanted. Their Instagram and Facebook comments are legal and available in the EU no problem.
- Yes Instagram and Facebook are legal and available in EU (as I noted), but there's one data center in Ireland and one in Denmark as far as I see, and given the massive influx of users to Threads, they probably have no extra capacity on these two datacenters to cover all of EU with a new app, not right now at least. Compare with SEVENTEEN datacenters in the US.
- "Full datacenter" doesn't mean much. When we say "a datacenter" it doesn't mean a building of specific size and capacity. They likely collocate some servers in other people's data centers (in fact many of those are like that).
- IRC and ICQ still require a network of servers. IRC is a protocol that barely changes so you don't need as much centralization as with a product of rapid iteration and innovation as modern social networks. But you still must be quite familiar with IRC splits and lag, which comes with such architecture. If a social network broke as often as IRC did, people would simply not use it, modern audience have higher expectations. Resilience requires redundancy and more resource-intensive architectures.
- Modern social networks have way more people on, than IRC ever did. At the peak of IRC use, around 2004-2005 all networks, all servers, total, had about 10 million users. Today they're just about 350k. Compare with Threads, which gained 30 million+ users in ONE DAY. More users mean you need more servers and beefier servers, and more serious architecture (as things don't scale linearly by magic beyond a threshold).
- IRC has no content to host at all. How'd you publish a photo to the world on IRC? You can't. Or even text? I guess everyone has to be in the channel, or know where to find some logs? ICQ is also mostly peer to peer. If you lose your copy of the chat logs, that's it. At least how it was in the 90s when it was popular and I used it (I hear it's still popular in Russia or something? Dunno). So you can't compare social media with a peer-to-peer ephemeral messaging protocol. The peer-to-peer messaging protocol is a tiny part of what Twitter and Threads do.
- I haven't even mentioned algorithmic timelines and the like, which make the task even more complicated, nothing like IRC.
And then to pay for all these costs of hosting and algorithmic distribution, backup and so on, you need to collect said user data, profile ads, run the ad network UI and so on. That also adds to the cost and resource use of running this service.
We can probably discuss "is all this needed, can't we go back to something like IRC"? And I think about this a lot. The modern social media design is not the best way to do it, it's not the final way. But Meta wanted to clone Twitter, not IRC, and this comes with the cost & system requirements of running something like Twitter.
At some point it was definitely more than 95% of websites being shady with their cookie coercion banners.
That is why it is important to have sandboxes and/or laws that are based on size, number of consumers, etc. one thing is to ask for a full GDPR compliance to a bank and much different is for small companies.
In the EU, it's basically expected that the courts will apply the law on a case-by-case basis, which opens the door to inconsistent application of the law and ultimately to selective prosecution.
In the case of Meta, it definitely seems inconsistently applied (even though I hate Meta and would never trust them again). They simply choose the seemingly worst offender (Meta) and try to kick it out of the EU, while leaving alone the actual worst offender (ByteDance). Prosecution becomes a case of politics rather than justice.
Yeah, because implementing compliance features takes time and they likely opted to launch early instead.
Personally, I think the US should also have much stronger laws that safeguard the data of their people.
Not that they’re perfect - plenty of insane rulings coming out of there too like Frances microphone one
There is a serious lesson for startups though, if you actively start collecting data, you will, if you survive long enough, begin to have to declare what data you have when you "grow up". For example, if you do anything with photos, you will have to ask for permissions to process location data. even if you throw it away, it still counts as processing. Taken in the wrong light, or explained badly, this will tarnish your brand.
Rant time
Twitter can infer (if they hadn't have sacked all their data scientist people) your sexual preferences, location, and employer.
Google already knows your employer, especially if your work uses any google service. they also know everything you look at, type and interact with on the web. If you have an android phone, then your every move is logged, not only that but shared with your phone manufacturer as well.
Apple hoovers everything you do. I know they say its all for a "magical" experience. But they will and do monetise it. Anyone who says differently is in denial.
let us not talk to deeply about tiktok.
Is threads actually setting out to hoover that data? I doubt it. Have some people filled in their facebook profile with gender, preference, employer, house location and significant spouse(s)? you betcha.
> Scary people hoovering up data - they will and do monetise it
> Is threads (Facebook) actually setting out to hoover that data? I doubt it
So Facebook is the noble player; Twitter, Google, Apple, TikTok the bad guys ... Mark Zuckerberg isnt going to buy you a horse for your efforts.
"they trust me, dumb fucks"
> This level of scrutiny is really excellent. Now we need to apply it to other companies working in the same space.
Facebook is and should be held in the same esteem as those lot. I was talking about threads specifically.
Sure, facebook the app is all up in your junk. But the apple label about "it stealing your health data" is nonsense[1]. Why isn't there a permissions dialogue asking me to share my health data, like fitness apps? Does apple specifically allow Facebook apps to get at my health data unannounced? what about apple pay, is that leaking to facebook as well?
None of the FAANG companies are reliable narrators. Regardless of how good their PR is.
Sure facebook will rat you out to the police, They don't spend anywhere near enough time or money doing actual proper moderation. They also totally suck at making new products (threads is the first new product with any success since messenger, and that sucks donkeycocks.) are they "nobel heros" fuck no. They are just trendy whipping sticks.
[1] https://www.mirror.co.uk/tech/threads-twitter-rival-warning-...
Check out the App Privacy section yourself: https://apps.apple.com/us/app/threads-an-instagram-app/id644...
> Sure, facebook the app is all up in your junk. But the apple label about "it stealing your health data" is nonsense[1]. Why isn't there a permissions dialogue asking me to share my health data, like fitness apps? Does apple specifically allow Facebook apps to get at my health data unannounced? what about apple pay, is that leaking to facebook as well?
[1] https://apps.apple.com/us/app/threads-an-instagram-app/id644...
As I said earlier, Tech companies are not reliable narrators.
But, to underscore the point, if apple really are letting facebook harvest this data, surely this undermines their "privacy is our magic sauce" shtick? why are they letting them harvest that data? why, as a platform, are they letting them get away with it?
Ideally the US would adopt GDPR like laws at a federal level, however thats not going to happen because there are too many tech billionaires.
If your problem is with ethics, FB isn’t a beacon of good behavior.
If your problem is getting rate-limited or losing your blue checkmark, I guess go wild, but you probably already loved Twitter too much to leave.
I think that statement is being incorrectly reduced/interpreted to 'mind your own business' which would be ironic.
In my defense, I said "we" and not "you" for a reason. Also the point I was attempting to make was less "stop doing that" and more "that way madness lies"
A well-run internet service tries not to keep causing self-inflicted PR disasters. A well-run service is stable, consistently available, doesn't have a large amount of feature churn, and generally has stable leadership making sane decisions about maximising value. None of those things describe Twitter under Musk, but Facebook is a generally well-run company with sound policies and competent leadership.
Just because people here disagree with many of Facebook's decisions doesn't make them any less good. I may think that the focus on VR is a strategic mistake, or that Facebook has a PR problem, but generally they're good stewards of the platform they've created and run it fairly well.
Which is a direct result of Musk deciding to prioritise blue check comments over others. If you're having to pay to have people listen to you then that means you typically don't have something worth saying.
And we see this manifest in many ways e.g. pages of laughing emojis in response to a tweet.
This basically invalidates all of advertising in one stroke.
And then there is the “Play this one stupid game that has everyone hooked!!!” With an unrelated picture. Or “This guy became a millionaire in ONE day!1!” type of advertising.
Of course advertising is not worth it for the target. It's harmful more often than not.
The problem is that there’s so much noise that it fails at that. So I end up not using it when I don’t already know something is going on.
I guess the biggest difference is that Facebook has had almost 10 years to adjust the algorithm towards paid content, and have users becoming accustomed to the system.
That's a lie.
Instead, "Facebook realized that users were growing wary of misleading teaser headlines, and the company recalibrated its algorithm in 2014 and 2015 to downgrade clickbait and focus on new metrics, such as the amount of time a user spent reading a story or watching a video, and incorporating surveys on what content users found most valuable"
For companies that were depending on the organic reach of their clickbaity or low quality posts for their advertising, this had the effect of forcing them to pay to get that same reach. But it wasn't in any way that facebook was prioritizing paid over organic content.
Feel free to provide a source that show a decrease in advertisements on Facebook.
A lot of the prominent accounts seem to be moving. It may be because they want a general public square rather than Elons personal website. It may be because they are worried that the rate limiting etc is going to affect what they do to monitor their reach, understand their audience etc.
Either way I don't think their problems fall into any of the categories you've given exactly, but if the people someone likes to follow on twitter move to threads, the likelihood is that person will move to threads, especially if they are somewhat dissatisfied because the app is becoming weird and stuffed with ads.
FB always had this tendency of rate limiting (showing an annoying sign up modal and then eventually silently failing due to HTTP 429 ajax requests- seemingly IP rate limiting). It also seems to not allow viewing of otherwise public info based on user agent (mobile vs desktop)
The reality is that the privacy policy will almost never be a determining factor in whether somebody will use a service. The Facebook haters on HN were never gonna use a Facebook product anyways, regardless of what the policy said, and the same goes for the people that are happily using threads now. Does the privacy absolutist who refuses to do anything outside of a VM behind Tor exist? Of course, but not in any meaningful amount for it to matter.
The people closely reading terms of services and opting out of arbitration provisions or whatever are wasting their times with busywork. It's doing work that feels meaningful and feels like giving it to the man without actually accomplishing much of anything.
Strava, a social media app for exercise, has selective access to "health" data about exercise stored on the phone, but that's the closest I can think of.
I am completely unfamiliar with what that implies or what access would actually be allowed, but I can see how that would raise concern.
An altruistic guess -- maybe another way for them to achieve geolocation if other methods are hindered?
So what are we really talking about here?
The very first thing in the listing for the app in the AppStore. Why are you so obtuse to this?
https://apps.apple.com/us/app/threads-an-instagram-app/id644...
DATA LINKED TO YOU The following data may be collected and linked to your identity:
Health & Fitness Purchases Financial Info Location Contact Info Contacts User Content Search History Browsing History Identifiers Usage Data Sensitive Info Diagnostics Other Data
Think instead of all the data that all huge number of advertising networks, like the one paying qz.com's bills, that have massive hoards of data about you, without your consent, that gets bought and sold every single day.
This is not a trivial distinction! The health data on an iPhone is secure, and Threads is not getting access to it. What this is talking about is Threads linking up with all the data that all the other advertisers are already doing!
I deleted my Facebook account circa 2012 when I heard what some of their ML engineers were up to at a casual meet up, like geolocation all photos and and doing facial recognition to place which bars everyone had been in over the weekend. Back then, before the deep learning revolution, this was a mind-blowing capability. These days, I have no idea what ad networks are up to but rest assured, by getting all of HN to load the ads that are served from qz.com the advertisers have now gained far more than they did when I installed Threads (because I already have an instagram account and that does all these same things. Five years after deleting my Facebook account I was ready to give in because the rest of the networks had the data anyway).
Because you became weak and caved does not mean the rest of have to give in as well. I have never created an IG account, nor will I be using Threads. I abhor Meta, and will never allow their apps to be installed on my devices. Your cavalier attitude about your data is your business, and my attitude is polar opposite. You coming in and trying to white knight the Threads listing as "nothing to see here, move along" is just this side of being a Meta shill. Some of us still have principles.
If you care about privacy, then you should care about the specifics of how it is being abused so that you can defend against it. So you should care that the health data is not coming fro, your phone, it's coming from the massive databases of information that Facebook/Meta and toooooooons of other companies have on you and sell trade and swap.
If you care only should maligning Threads, then continue to obscure the threat to privacy and how the massive network of advertisers is monetizing your health data against your will. Because bringing up laws about banning apps from taking your health data from your mobile phone, which is what spawned this thread, will only detract from efforts to improve privacy, because it would do nothing to 8pm rove privacy here.
So instead of insulting me and throwing around fake "white knight" allegations, at least try to keep up with the conversation.
I don't even see an option to give it access to health information, which is tightly controlled on iOS.
An incorrect interpretation, sure, but not one you have to be dumb to make.
In this case Facebook appear to have simply ticked every possible box for data collection regardless of whether the app actually does it or not. Note you can't just get health data on iOS without asking, so people would notice if they tried. My guess is that actually figuring out what they do/don't collect was too hard, so they just said yes to everything.
This information is provided by the app developer; in this case Meta are telling Apple they use your health data and Apple is merely showing that information in the App Store.
How so? There is no hidden meaning here; Facebook are simply telling Apple that they will access your health information, and Apple is passing that information along. There’s no misinterpretation. The fact that the app doesn’t currently request this information is immaterial – Facebook are saying they will. The straightforward interpretation of the privacy card is the correct one.
Seriously I could barely even find the claim you speak of, when every other sentence is punctuated by a half-screen advertisement.
Why accept the claims of such obvious click-bait without evidence? There's no reason to believe anything said in the article, particularly when it's claims can easily be checked and shown to be false.
This is data that is linked to you, and the spamminess of the ads on qz.com is likely doing far more invasion of people's privacy than Threads could even dream of.
This comment thread was about Threads taking health data "from your phone," Which is does not do, and which that sceeenshot does not say it does.
This sort of data linking is absolutely pervasive in the web advertising industry, and it is bad. But let's not falsely say it's coming from the store of data on your phone, it's coming from advertising networks like those that pay for qz.com's hosting bills and profits.
If I want to disable all the toggles and have a non-functioning app, I’d be ok with that. At least I could selectively enable the bare minimum and then have a more deliberate decision regarding how much of my privacy I want to give away, rather than what an app developer might be hungry for (and not actually need).
Threads is currently not available in Europe because its privacy policy isn't compliant with EU law, that's literally what the article is about. We're not talking about individual choice here, or absolutists behind Tor. I don't understand what your post has to do with the topic. Clearly we have with privacy legislation at least accomplished that Meta must follow the rules or not operate here.
You're right that individual users agreeing with TOS's is meaningless, but we've been beyond that for years.
I don't think the severity of tracking is important when comparing insta vs threads, just the inertia of an old vs new product.
Now if you are saying there is no willpower to follow through over the long arc aka this fight is over and lost, then I disagree but could be wrong.
Has Meta ever displayed any particular quality regarding content moderation, freedom of speech, privacy, information control, transparency, or mental health? Not implying Twitter is any better, Musk Tweeted, "It is infinitely preferable to be attacked by strangers on Twitter, than to indulge in the false happiness of hide-the-pain Instagram"
What a sad state of affairs when a form of abuse somehow becomes "infinitely preferable" to another; maybe I'm being overly sensitive, or has the social media bubble fallen into pure insanity?
Your quality of life will be better without any of it. Humans were not meant to communicate at that scale.
Just to see what it is like. I will probably not use it, because the lack of proper chronological feed irks me, but as an iOS developer I want to check out new apps all the time to see if they do anything different.
Just look at screenshots or videos of how it works to satisfy your curiosity.
That sounds like it would not hold up in court. It would be as if Threads could be shut down if a single person on the team had once made a Twitter account.
Whether it will hold up in court doesn't really matter if you're dealing with a company that recently had a valuation of greater than $1 trillion who really just wants to make its smaller competitor go away.
The data collected by the Threads app could include your sexual orientation, race and ethnicity, biometric data, trade union membership, pregnancy status, politics, and religious beliefs. This data may potentially be sent to “service providers” and “analytics partners,” which is often code for third-party advertising and marketing firms.
Threads collects data about your employment
Information about your company, your role on your team, your job history, and your performance evaluations may be collected and sent to third parties.
Threads collects data about your body
Details about your health, fitness, and exercise may be hoovered up to be sent to third parties.
Threads collects data about your web activity
Threads may scour your browsing history, web page interactions (including with ads), and the referring web page or source through which you accessed Threads links. This information may be sent to third parties as well.
Threads collects data about your location
Photos, videos, or other recordings of a user’s environment, as well as “IP-address-based location information,” may be collected and sent to third parties.
----
1. How does it access biometric data?
2. How does it access your performance evaluations?
3. How does it access your browsing history?
4. How does it access "photos, videos, or other recordings of a user’s environment"?
If the answer to this is that it extracts information from the things you post, mining the data of your threads over years and extracting a profile, then that isn't that big of a privacy invasion -- especially if you post publicly.
If the answer is that they activate the camera without you knowing, that they bypass security features to access browser history and biometric data, and that they... I don't even know how they'd access performance evaluations, then that's a different question and less of a privacy issue and more of a computer misuse issue.
Does anyone know the answer to this?
Perhaps it's time for phone cameras & microphones to have hardware lights next to them like Macs do.
Unfortunately most people aren't willing to pay for websites and so the only successful model ends up being advertising driven.
- "You cant delete Threads without deleting Instagram altogether": but you can deactivate it. What's the difference, and why do I care? Without including that info, you're useless.
- "Threads collects sensitive personal information about you": How? Inferred from the things I post? Well I'll just not post those things.
- "Threads collects data about your employment": Same.
- "Threads collects data about your body": Same. Alternatively, this could come from the Health API, which I have to provide explicit permission for. Such permission was not even asked for.
- "Threads collects data about your web activity": How? It reads referrer headers. So an issue with my User Agent, if it were configured to do that. Which it isn't.
- "Threads collects data about your location". It may reverse-geocode my IP. Okay. And? Literally any analytics service with a map does the same.
Honestly, I find it far more interesting than the physical fight that Musk and Zuckerberg were talking about.
Other people's threat models are so unimaginable, so inconceivable that the commenter "hates" the "hit pieces" that attempt to inform people of risks, people who may face different threats than the hater.
I hope most folks can step out of their own context occasionally and view our current zietgeist from the perspective of a sex worker, or a journalist, or basically anybody who may have perfectly good reasons for electing to maintain their privacy.
I don't think that's too much to ask.
Threads polls just about every bit of data the operating system stores. E.g., on iOS threads reports that they collect data from the health app (“health and fitness”). If you are using the health app to store information about your health and body, Threads wants to get it straight from that app.
It’s not that it’s collecting data, it’s that it is asking for permission to passively collect data from other apps in the background (without you explicitly allowing it each time).
The actual list of privacy descriptors and what they actually mean can be found here: https://apps.apple.com/story/id1539235847
For example, the description of “Health and fitness” is:
> Health and fitness
> Health
> Health and medical data, including but not limited to information from the Clinical Health Records API, HealthKit API, and Movement Disorder API, or from health-related human subject research or any other health or medical data that you provide.
> Fitness
> Fitness and exercise data.
Which indicates that the app can use HealthKit etc to gather information about your health and medical data and exercise data.
This could come from any number of sources. Running AI to determine race, height, weight, and age from a profile picture for example.
> "Threads collects data about your web activity": How? It reads referrer headers.
Or it fingerprints you and your local network so it can associate browsing outside the app with your threads’ profile to better target ads?
Honestly you seem 20 years behind the times with how invasive tracking and analysis can be.
You actually can't deactivate your Instagram account. The deactivation feature doesn't do anything; they automatically reactivate your account immediately when you try to use it. It's fake.
This has been the case for several years and I can confirm this was still the case as of last week:
https://www.reddit.com/r/Instagram/comments/k0vxzk/my_instag...
There are passive ways of doing this. If you take your phone someplace monday-friday, from 8:30 to 5pm, and you have geo-location turned on, it's a pretty good guess they know where you work, and your working hours, minnimum.
You do not need to explicitly talk about employment info, personal information, or permit health api access on Threads for Meta to infer these things "well enough" for advertising.
The first stock market bubble in 2000 partly burst because investors realized that large user numbers by themselves were worthless.
Then other monetization schemes were discovered ...
You can't just "not post those things". If we are on good terms I can literally just post "Saw you working the bakery this morning, did you skip your morning jog?" and the system already knows where you work and that you are physically active, no input from you required at all.
Facebook already did this with shadow profiles. Facebook has information about me and I have never posted there, I don't even have an account there.
It is a necessary but thankless job to document how they get away with it. My pessimistic take is its not going to move the needle. There is a huge captive audience (the most likely users of threads are existing users of facebook and instagram) that has been socially engineered not to worry about privacy.
Internal cannibalism between surveillance capitalists aside, the true change will only come when authoritative bodies (public sector and other institutions) walk the talk, vocally refuse to use these platforms and throw their weight behind the fediverse.
In the App Store they set the privacy policy to Instagram's;
https://apps.apple.com/us/app/threads-an-instagram-app/id644...
They use Twitter to intimidate others and promote their clique.
I find that the only people worth reading are the independently minded ones who don't care what others think. In the current climate, they are either journalists or independently wealthy.