Hacker News Reader

Comment by owulveryck | Hacker News Reader

I think that in Europe, that will soon be prohibited without declaration and explicit consent.

If that's true, it's pretty ridiculous. I wish legislation would get at the core issue, which is not processing, but that collection happens at all. Normalizing surveillance, but asking companies to please not do anything with that data for minors, is such a far cry from what we deserve.

But Discord must store the messages, to make searching possible. And I assume the model works based on the writing style, topics discussed, etc. What would you propose, automatically remove all messages after a few weeks? Even then Discord technically can process the messages and build the same model. So yeah, in this case the processing is the problem since I don't want Discord to know my gender and age (unless I explicitly tell it).

> What would you propose, automatically remove all messages after a few weeks?

This but unironically.

If people or bots or the NSA want to keep records, let them scrape and cache 'em.

I actually think it should all be P2P, but that would kill the thin shell of a business model that exists.

I would hate such a model, having persistent history is one of the killer feature of Discord vs, say, IRC.

I dunno, the search on Discord is trash. The one time I thought it would be useful to go back and find something, it was completely incapable.

This is not my experience, I use the search heavily and find it an invaluable tool to prevent asking repetitive questions.

At least under GDPR, collecting personal data is already considered processing. Processing is only allowed under specific conditions and purpose.

It would be perfectly fine if Discord stored messages from users (for brevity, assuming that's personal data), made it searchable and available as long as the user exists on the platform, provided that they specify this as the purpose of processing, and the user explicitly gave informed consent. Should Discord want to perform any other processing besides that designated purpose, they would (again) have to receive the user's explicit, informed consent. Otherwise, it's simply not allowed.

No need to remove messages in such a case. Of course, technically they could process that data for a different purpose than specified, but that's illegal and may eventually result in a fine that can be based on a percentage of total global revenue.

Not profit or loss, revenue. Then suddenly it becomes a really interesting business decision to do other than defined things with the data at hand.

(and something something purpose limitation, data minimization etc.)

If you suspected you had underage users using your service illicitly. Could you not use such methods to find them?

I wonder at what point analytics, queries, or ML to determine age gets in the way of actually keeping them from getting into things they shouldn't...

Under age users aren't going to just tell you their age honestly, so you'd have to use some method to derive their age.

> If you suspected you had underage users using your service illicitly. Could you not use such methods to find them?

You could use something like that and it would be counted as “legitimate interest” under GDPR, but:

- you wouldn't need (and then would be forbidden) to do segmentation between more categories than “too young”/“old enough”. This is not what they are doing here.

- you'd still need to tell the users that you're doing it, and provide a way for the users to modify that data upon request

> Under age users aren't going to just tell you their age honestly, so you'd have to use some method to derive their age.

You don't have a legitimate interest of knowing their age, only for knowing if they are underage or not.

Under the DMA's requirements to protect children I think it will be basically mandatory to do this.

In the UK it already is under the Online Safety Bill.

Reply on news.ycombinator.com