Hacker News Reader

Comment by cj | Hacker News Reader

I think there needs to be some kind of "responsible and clear disclosure" laws that require companies to very clearly and overtly disclose what data they're collecting and how they're using it.

Some kind of standardized "label" (something like the standardized nutritional facts on food products) that is easy for consumers to read and comprehend, not buried in pages of paperwork, without needing to read a 20 page TOS / Privacy Policy.

The legal problem is everyone is "consenting" to data collection by accepting a TOS which protects companies and makes it "legally acceptable". The real problem that needs solving is consumers are rarely aware of what they're consenting to. Companies might not hoover up and sell as much data if they were required to clearly tell everyone they're doing it.

Basically, let's get rid of this idea that agreeing to a 20 page TOS / Privacy Policy is legally binding when < 1% of people actually read what they're agreeing to.

View on HN

> The real problem that needs solving is consumers are rarely aware of what they're consenting to.

Right, which means consent was never actually given. In order for it to be consent, you have to be fully informed of and understand what you're being asked to consent to, and there has to be a realistic and meaningful way to withhold that consent.

> you have to be fully informed of and understand what you're being asked to consent to

This really makes it seem like only a very limited set of contracts would actually be legal.

To me a big problem we have is that we act as if there is a fair "fight" between a mega corporation with a expensive team of lawyers, expert psychologists, and supercomputers against ... my gandma who googles to get to google. I think we all know that nearly no one reads pretty much anything they sign and if they did it is not clear that they are fully informed, understand, or are not under pressure (clear case might be medical consent forms authorizing something like a emergency surgery. I'd find it impossible to convince me the person signing was well informed and not under duress. I'd rather case like that revolve around expert of doctors determining if an action was reasonable to another doctor rather than have anything to do with a patient or surrogate signing a document. Seems to just waste time).

It really would be great if the crack team of lawyers was required to put terms and conditions into text that is understandable by an average person in a reasonable amount of time.

>This really makes it seem like only a very limited set of contracts would actually be legal.

Correct. There is an abject lack of respect and even basic understanding of consent in society, especially in the business world. It's a massive problem that does not receive anywhere near the attention it deserves.

There's so many adults that were clearly never taught F.R.I.E.S. and it's both depressing and horrifying.

Freely Given

Reversible

Informed

Enthusiastic

Specific

A TOS is absolutely not a contract that people enter into fully aware of the implications.

We should have granular control over the permissions we give companies in how they use data. I don't feel it is enough to require clear disclosure of the ways a company uses data, I think they should require explicit and knowing consent from the user, and the user should have a meaningful way to withhold consent other than to abstain entirely from using any online services.

It is hardly fair or equitable, and surely should not be legal that a company can, without any meaningful way for a user to withhold their consent, declare & demand unlimited control and benefit (of/from the user's data) for any purpose whatsoever, including sharing and selling said data for a profit to data brokers who have no contractual obligation to the user once they obtain the data.

I'm fully with you, but my question is how you actually inform people at the power of their data? I often pressure people into chatting with me through Signal and I'll be honest, there is often a defeatist or lack of knowledge at what this data can be used for even among graduate CS students.

Honestly, I think one of the major issues is that the world is exceptionally complex these days (well, always has been, but surely there's more now). Our entire world runs on specialization but we often act as if one needs to be an expert in nearly every domain. Is not the definition of an expert someone who understands the nuances and complexities of said niche? It would then seem de facto unreasonable for people to have a nuanced understanding of practically any given subject.

Because of this, I want to question the common framing about focusing on informing people. I don't want to stop informing people, to be clear. But I think we should look for solutions that are not reliant upon people being informed, as this is clearly not a scalable nor stable mechanism for creatures with finite ̶t̶a̶p̶e̶ ̶ knowledge and finite time.

The thing is, people don't have the ability to withhold consent. I don't think people would need to be fully informed to realize that withholding consent is better than giving it, if that was actually a viable choice to make.

I mostly trust Mozilla but I still turn off all of their data collection in Firefox. This wasn't always my default but it is now my default in any place where I am given the choice.

It really is difficult to understand all of the implications and it's taken me years of experience to realize that I should just default to presuming that data collection is going to be bad for me in the long run. When there is a complex and nuanced situation involving a binary choice then all you really need to know is which of the two choices is generally more likely to be in your best interest, then always choose that one. For data collection the safe bet is always "no"

Yeah that's how I am too, even with Mozilla. For the same reason: default to the most secure option. Everything is so complex that I can't know what my information makes me vulnerable of.

I honestly don’t think this would work. The number of “well why should I care if they have the data” conversations I’ve had is just depressing.

We can't force people to care about privacy. That's not the goal. If someone is clearly informed and they still don't care, that's totally fine. The problem is people aren't being clearly informed.

No, the problem is that they don't really have an alternative. To give none of your information to banks, email providers, ISPs, cell service providers, etc. is to remove yourself from society.

> the problem is that they don't really have an alternative.

In situations where there isn't an alternative, consent is impossible.

Companies, courts, and for the most part the congress, obviously don't seem to care. (In the USA, at least. Europe sort of seems to care but even then I'm not sure the solutions have been adequate / appropriate)

I’m not sure of your personal skills, abilities, and background, so this is more of a general call to action: Why not create an alternative?

I’ve often heard people talk of a lack of alternatives to certain services, so they use them begrudgingly, or boycott them at large personal cost. But it doesn’t have to be this way. There is nothing that I’m aware of that says banks or digital service providers need to collect any more information than is necessary to provide the service they offer. It seems to me that, at least in a this niche community there is a desire for privacy-respecting products and services. A company that oriented itself around meeting that demand would be, I suspect, very lucrative.

>There is nothing that I’m aware of that says banks or digital service providers need to collect any more information than is necessary to provide the service they offer

And what about all the information that is necessary to provide the service they offer, like the real-time location of everyone's cell phone and who calls who when and for how long or all the DNS requests? Sure, a company doesn't have to retain this information and market it for resale, but providing these sorts of services necessarily entails access to a lot of information that most people would consider private, but which the third party doctrine says isn't.

This is the key right here. There should be a clear way to withhold consent because implicit agreement isn't good enough for the kind of data collection and aggregation that is happening.

> If someone is clearly informed and they still don't care, that's totally fine.

Let's be honest here, how many people are "clearly informed?" That's fuzzy definition. I'll give a personal example here[0]. Certainly the implications here are operating through fairly abstract and indirect mechanisms (it's even called "metadata") and most people are not trained to operate within these types of frameworks.

FWIW, no one seems happy with the situation but feel that they have no choice in the matter. It's said that you can choose not to use said service, but often the implication of that means no phone, no internet, no computer (at least non-linux), no bank, etc. There may be a literal choice available, but not a reasonable choice. I think we need to have a clear distinction between these two, because the literal choice is often used to justify something that would have major impacts. I think it is difficult to argue that one could create a reasonable and relatively average modern life with no access to phone, internet, or computer. It also then clearly becomes "well I'm forced to share with x people, so I guess I'll share with y" and often x is "the government" (even if it isn't).

[0] I've on several occasions had conversations with my family where they've been convinced that their phone is listening to every conversation they have (this dates back to 2010 btw but continues today) because they were served ads for something they were talking to about with a friend, in person. They are convinced that is the only way that such an inference could be made rather than through knowledge that the friend made the purchase (recently), that the companies know these two people are standing right next to one another for an extended period of time, and have a decent knowledge of their interests to infer that this product would be likely discussed by these two people. Ironically the recording is more complex, but it appears simpler. Sure, setting is different in 2023+ but we know the compute costs to process every conversation and energy requirements to be always recording and that this would kill phones of the 2010's.

Reply on news.ycombinator.com