FTC Report Confirms: Commercial Surveillance Is Out of Control
eff.org
eff.org
Creeps me the fuck out, and the owners seem to have no ethical qualms about buying, selling, and using this data.
Humans are kind of smart and resistant to manipulation. Especially the ones with money.
I'm not sure. I think gaming/gambling industry having a concept of "whales" kind of disproves this.
Jury nullification.
Or vote, or whatever the site rules permit, good luck with that.
The latter I absolutely believe. The former I'd file under sci-fi marketing tales that anyone with some amount of knowledge about web technologies wouldn't fall for.
To me, the more interesting and outrageous story is how many aggregators are able to sell garbage data so successfully.
But is Plaid?
And banks do sell account balance data, they also sell credit and debit transaction history
Plaid’s business model is — Company A needs a consumer’s data from Bank B. Plaid takes the consumer’s banking credentials, gets the data, and sells it to Company A.
At no point in this process does Plaid go and sell this data to another unrelated Company C. The lawsuit cited was about Plaid not sufficiently explaining its position between Company A and Bank B to the consumer. It was not about Plaid going and selling the data to the highest bidder.
Any time you hear yourself utter the words "Wouldn't x be f'd if word got out that y"... You need to stop and consider that there is an entire industry around reputation management, and PR crisis management that is leverageable by the deep pocketed in order to keep their name out of news items, and that the favorite acquisition of the absurdly deep pocketed is the media outlet/platform.
Think. The world is full of scummy people looking to make a buck, and a much more pauce number eho worry about doing so honestly. Until you meet one of the rare ones who falls on their sword for their ideals, never assume the guy on the other side of the table is one until proven through deed.
I’m not saying “you should trust Plaid with your data” — absolutely, 100% not that. I imagine that’s how I’m being interpreted, hence all the downvotes.
What I’m saying is that at the present time, it does not seem to me that Plaid would be incentivized to do something that they explicitly say they are not doing. Plaid’s business model is, trust us to get your customers data and deliver it to you, and only you, safely. Selling it to Bob down the street on top of that would threaten their primary business model. And today, that primary business model is doing very well! So why threaten it?
Now, someday in the future, maybe that business model has stagnated, and line still needs to go up, so someone may get greedy and that may change. In fact, this is even likely to happen! But there will be signals that it is coming.
Even re: the issue of misleading users that they are not their bank — after they got slapped down on that one, their strategy changed. There is a new set of regulations around disclosure around these things, and Plaid is pushing them pretty hard. My guess is they had some hand in drafting these regs and are hoping to use a higher regulatory burden to build a moat against competitors.
But honestly, I’m kind of surprised at the lack of nuance in understanding how Plaid works, especially here on HN.
There's hundreds of regulatory actions taken by governments per year. That's "consequence" by definition.
A few food companies have failed due to poor quality control: https://www.thestreet.com/retail/another-popular-ice-cream-b...
In fact, many companies go bankrupt every year: https://en.m.wikipedia.org/wiki/Bankruptcy_in_the_United_Sta...
Or any of those budgeting apps that integrate with your bank account.
For that, this very biased training set. And almost always the independent variables used for modeling are 7-10 standard demographics.
Part of the problem though is that much of this data is persistent, across order-of-human-lifetime.
How often does your employer salary history have to be obtained to be useful? Maybe once every 10 years?
I have zero faith that in jurisdictions without national laws prohibiting it (and laws that prevent usage of extra-national data) that's not happening.
You know how some banks have a service which tells you how you spend your money? With graphs, 20% on power, 15% on food, etc?
That service is provided by a third party, who is given the data anonymized. A unique id number assigned. Yet it's trivial to deanonymize, and that's what happens.
All that is required is one buy with a points card, an airmiles card, and you are forever relinked to your data. It's how points cards make cash on the side, how air miles do. Exact time, date, amount, location of purchase is a great sync method.
If you pay for your phone with any form of traceable payment, they know who you are, your address, etc. From this immense data is gleamed, such as lot value, neighborhood, and so on. Companies can even get current location and geofence you, being alerted if you move in/out of a certain location.
Mobile phone companies sell this data/service via an easy api. Companies relink a phone from the app level via IMEI and number, which is sold to aggregators along with phone data (contacts, etc). The telco api links to real identity.
Once linked, forever linked.
Most people love free apps, and give up messages/sms, contacts, and more to save a dollar on an app. From this immense relationship data is gleamed, including likely employer and social circke.
Even if you are careful with your app permissions, certainly many acquaintances of yours aren't, so you get linked to their social circle, often with contact name/address.
This is just the simple stuff.
Source: I've dealt with these companies.
The spam blocker is pretty powerful though, you aren’t getting past it unless you are in my contacts or have a # flagged as affiliated with a reputable business
All of this information can come only through cooperation between banks, credit reporting companies, utilities etc.
Banks might not be directly selling the transaction history, but they report the customer transaction history to Equifax and similar credit scoring agencies. Equifax certainly does onsell that to shady credit companies, which has happened to me twice with letters in both cases stating in the footprint in a very small font size and in a very pale hue of grey «provided by Equifax».
[edit] also, that just happened to be the first time I’d seen a single session represented that way, rather than aggregates. Again, it wasn’t some brand-new thing then, it’d been around long enough to have multiple companies offering it as a service, not just an internal tool at a couple giants.
Not saying it’s a good thing but assume that most websites are recording your session at this point.
I asked our data team what the fuck they need this level of tracking for, and they said "wasn't us, it was marketing that requested it".
So I ask many of the marketing people, and they just say "oh we thought it could be useful!" Without actually clarifying the "how" or "why".
I removed that shit with a quickness after that, and no one's complained so far (duh)
I love the GDPR if nothing else because it scares the - excuse the vulgarity and ableism - retarded decision makers into not doing idiotic shit like this. For any kind of bullshit like this I just bring up GDPR as a shield these days and none of it goes through
This stuff bugs me so much; it all feels so cargo-culty. Even ignoring privacy, I wonder how much money and computing power is burned on buying and collecting data that nobody needs and that doesn't actually serve any significant business purpose.
22 years old, height proportional to weight, poor decision making skills.
What about your son?
I've seen this offered to young kids paying rent:
"Flex lets you pay rent on a schedule that works better for your monthly budget and frees up your cash flow."
"Help you pay rent on time. Improve your cash flow. Build your credit history."
Finally figured it out a day later when reviewing my hike on the Fitbit app. At the end of my hike I forgot to shutoff route tracking. On my way home, I had stopped by Walmart to grab a few things and while there, looked at their ladders. I could see on the app the path I took through the store, including when I stopped for a few minutes in front of the ladders. That was enough data to trigger ads for ladders for the next couple of days.
We leak data about ourselves constantly without realizing how much we're doing it or where it ends up going. Lots of it is also circumstantial and makes me wonder what erroneous ideas some of these databases might have accumulated over the years and who gets to see that "information". What happens if you walk through a part of town where there's an activist rally for "We Love Kitten Torture" going on? Do you forever get tagged in a bunch of databases as an animal torturer?
integrate something like this with license plate data, property records, person recognition, and realtime location. when a self-driving automobile detects that it's out of control and unable to avoid imminent liability, it can make a cost-benefit analysis of each prospective casualty by querying an API that provides an avoidance score for each consumer and property in the vicinity. based on this score the client automobile will be able to identify a route of least liability. consumers may be encouraged to integrate with these services by assigning unidentified things a score of zero.
You can get a ton from a worknumber query.
Problem is that people share so much that those that do not start to stand out and might get penalized as well.
Other notable examples: the EPA. There was a time when people had to wear gas masks out doors in some cities because the pollution was so bad before regulations and enforcement came into place. Similar stories with CFC emissions.
The development of the Internet has been accelerated under mostly conservative leadership which has been walking back regulations. And while much innovation has happened in that time I think a great deal more could have been achieved if it weren’t focused on this kind of profit-at-all-costs environment it’s been simmering in.
Do you have any examples of similar tangible harm caused by lack of regulation on data collection?
People facing criminal charges for helping people in Texas learn about what options for managing their own reproductive health and bodies.
Is there an actual case where data described in the article was used for anything like what you're suggesting? The actual cases involve people reporting each other (a man reporting a woman he is dating for example).
Sounds to me like blaming the acid rain on the acid detectors
That sounds like a good reason for any women in Texas to avoid dating any men in Texas.
Having worked on this stuff, I can tell you that the data relevant to extremist rabbit holes is not what the FTC is talking about. Facebook learns enough from which posts you click on to know which extremist content to suggest (and then they intentionally do not suggest it)
For identity theft you need things like names, addresses, SSN, W2 income, etc
I'm sick of events like the Boar's Head listeria outbreak killing 10 people happening with regularity now. Last year it was eye drops causing blindness. The companies don't care beyond the lawsuits they'll face, who cares if people die as long as their profits go up?
I'm sick of oil companies lying about the environmental harms they cause. Their profits are going up, so why should they care about climate change or the tainted groundwater their fracking causes?
I'm sick of seeing ads and billboards for corporations everywhere I go. I'm sick of being tracked because corporations can make x% more money with my data than they can without it. Installing uBlock Origin is easy, but we now have facial recognition systems with physical cameras in the real world. Can't do anything about those unless I just never leave my home.
I'm sick of people defending this behavior by asking "what tangible harm have you experienced?". The tangible harm is that I'm fucking tired. I'm tired of living in a society that requires expending so much mental energy just to exist.
I should be able to just trust (within reason, of course) that a $1,000 mattress will work for X years without needing to research whether the company is decent or known to be awful. I should be able to buy chocolate from the grocery store without needing to research whether the corporation (or any of its 24 parents and subsidiaries) used slave labor to produce it. I shouldn't need to worry about bottled water being stolen from aquifers by corporations that will simply move on after destroying the communities that depend on that water.
I vote, because it's all I can do, but that accomplishes nothing because we're stuck in a two-party system that won't let me vote for a candidate far enough left to actually fix things. Instead we continue to maintain the status quo, because corporations have more money and political power than civilians.
I'm well aware that this reads like an overdramatic manifesto. I'm just sick of everything feeling like it's getting worse all the time, and it seems pretty causally linked to the rise of corporations. Is it too much to ask that I be able to live without them invading _every single aspect of my life_? I don't think it is, but I think we're too far gone at this point for it to ever change.
No, it reads like you are reading my mind. Well said, especially the point that this is _every single aspect_ not just an infraction here and there.
100 years ago well before the invention of so-called surveillance capitalism, people were making soft drinks out of radium, and inhaling asbestos.
Many things are better since then. Some new things are probably worse, but every reasonable measure of human welfare suggests we are better off than we were previously.
Something some subset of us are worried about right now, whether it’s WiFi or 5G or Covid vaccines, will turn out to have had horrible consequences and you can’t really fault the rest of us that we didn’t listen to the crazies.
Just embrace panglossian optimism because the alternative is to just be angry and exhausted and indignant all the time and then you’re no fun at parties.
It's hard not to be angry and exhausted when you have to be a chemical engineer just to know what's even safe to eat.
So tired of people making excuses so that some billionaire can buy another yacht. Can we finally actually start investing in people and putting people first instead of corporations.
There’s a spike in teenager suicides, girls in particular. The phenomenon is well researched, it correlates with popularity of social media among teenagers. I believe that’s causation not just correlation, because social media didn’t became popular everywhere at once, they did gradually for different countries/languages, the teenager suicides spike follows.
Restricting data collection will fix that by dismantling the business model. Will be harder for tech companies to convert screen time into profits. Will even flip the motivation developing addictive apps: the more time users will spend there the more bandwidth they consume i.e. profits will turn into costs. Which is good for most people, except employees and stock owners of social media companies.
P.S. Personally, I prefer more radical approach: total ban of advertisements on the internets. Many cities did it for billboards, I don’t see why we shouldn’t do the same online.
I used data and ran experiments to measure and mitigate teen well being and harm at Instagram. I was not on the team responsible for this, but I worked on organic ranking and was responsible for understanding and measuring the impact of these things. I can say with certainty nobody cares more about teen well being than Meta. It's their future, and the success Instagram over Snapchat is essentially completely due to better positive interventions for well being. We measured this carefully with RCTs and had more data than anyone on the planet.
Overall Instagram is net good for the majority of teens across a wide variety of well being metrics, and net negative for a small percentage. Meta spends hundreds of millions trying to fix those latter, rarer cases.
You’re describing the status quo with online ads still legal. Amazon has 37.6% share of e-commerce; small manufacturers can’t compete. Google hosts 79% of videos viewed over the internets, and it abuses small creators really bad, with no ways to appeal or contact humans.
One of the reasons how these corporations became that powerful was unrestricted and legal digital surveillance. Another reason, anti-monopoly regulators asleep at their job allowing big tech companies to easily acquire competitors (e.g. Google was competing with YouTube for a year or so with “Google Video” product, failed, then acquired the competitor).
> net good for the majority of teens across a wide variety of well being metrics, and net negative for a small percentage
Many researchers who don’t work for FB were warning for years. Couple years ago some of that internal research was leaked, here’s a copy-paste “Thirty-two percent of teen girls said that when they felt bad about their bodies, Instagram made them feel worse” https://archive.is/qBpaq#selection-915.1-915.113 I would not call 32% “a small percentage”.
Another thing, “negative for just a small percentage” is a poor defense. Even if it’s indeed tiny, it still doesn’t mean the business model should be legal. Imagine a lottery where 0.1% people win $1M, 1% people win $10k, 10% people win $1k, 89.9% don’t win or lose anything, and 0.01% lose their life – don’t you think a business model like that should be illegal?
I wish the EPA hadn't dropped the ball on noise pollution.
This is to say nothing of the traffic noise or garbage trucks or whatnot--but a building appliance? I thought surely that must be regulated, or at least controllable. It's unreal the lack of attention people pay to it.
https://www.ftc.gov/news-events/news/press-releases/2024/09/...
https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b...
Edit: added link to pdf
Funny how they have advertising cohorts drilled into every niche interest or happening, but they just can't perfect the technology to determine if someone is a child. Very elusive tech they've definitely been working day and night to implement for years.
Almost like they benefit from acting blissfully ignorant.
Oh they do. It's a very valuable demo and doubtlessly they worked day and night for years to perfect it. They want to shape the malleable minds of lifetime consumers. They have, with great success, for nearly a century.
The Biden FTC has been quite aggressive against all sorts of anti-consumer practices throughout the economy which tend to follow these types of reports. I suspect action is coming relatively soon.
The answer is, until you actually do the work you don’t actually know. Scientists and government officials can’t cite common knowledge. And even if you were right about the conclusion, the details matter. The amount matters. The mechanisms matter.
Government officials can cite whatever they want, including stuff they pulled out of their ass, as long as they have the votes.
Put another way, "you can't control what you can't measure" (or in this case, characterize more generally).
What do I expect them to do? Limit super-invasive spying to domestically-controlled companies.
a real solution would be to legally privilege and disqualify classes of personal information from civil and non-violent criminal legal proceedings based on how they were collected, and PII collection sources material to commercial decisions must be disclosed in offers and contracts.
insurers and creditors would actually have to take risk again instead of being rentiers, police are servants and not governors, and the provenance of PII as evidence would have to be proven as from a legal and prescribed source that included explicit consent. there is no stopping the flow of data collection, but we can improve laws to manage it.
Information is power and if insurances and producers know everything about you, you will be squeezed like a poor victim.
On bad days I believe people that overshare information deserve that fate, but there isn't really an argument against just regulating collecting information or make them seriously accountable for this information being leaked with severe financial penalties.
It wouldn't even be hard to regulate. Enforcement wouldn't be easy, but I guess the risk for many companies would just be too high to even try.
Let's not play game to makes states good guys and companies the bad boys.
Now do arms.
It is true that the state should not collect this information either for that matter.
Let's not play games to make companies the innocent bystanders and states the evil antagonist.
Also, you don’t own your data. That idea is itself an absurdity that is already meaningless. Once that is accepted life becomes much simpler. You want stock growth and tech jobs, that’s part of the deal. I didn’t make it and I’m not responsible for it but that’s how it is.
Before that? I don't remember that much from the past few years, but I think a good chunk of federal agencies were kinda in a weird stalemate ( which is kinda what the US is system is built for anyway ).
This FTC has been extremely active and assertive since 2021, for which I'm thankful. People only pay attention in election years.
Any large institution takes some time to change, senate confirmations for the leads of major agencies don’t occur immediately upon swearing in of a new President - it’s often months later. Then, after that occurs, change from the top down occurs.
Additionally for any sufficiently large group of people it takes a long time to get people to take any sort of collective action, let alone an organization with processes, years long funding and contracts already in place. Then there are sometimes/often legal challenges to the awarding of contracts, the issuing of regulations.
How long do you think this study would’ve taken to execute by itself? Okay now how long do you think it would’ve taken to plan the methodology for what they should do to execute. Before that they have to have a proposal of what they would like to study and then get the money approved / allocated to do the previous work I just mentioned, such as a detailed methodology.
Again, this administration has been in charge of the FTC for only 3 ish years and had to probably rebuild it towards focusing on holding businesses to account.
Not quite sure what else you’re expecting, it takes companies as well many months and even years to change focus, or to deliver a robust product. And that’s generally with an agreed upon a singular focus.
Why wouldn't they? A capitalist shareholder system requires that they do exactly this, to whatever extent it does not impact sales.
It's on citizens to demand regulation, and yet in the US, a probable majority of voting citizens don't like regulation, and think that government is too large or too untrustworthy. Combine that with the control that corporations have over our politicians, and further combine that with low public understanding of the issue, and there is nothing realistic that can be done.
So I consider surveillance capitalism to be permanent in the US. Regardless of the fact that most people don't like being spied on and manipulated constantly. Perhaps some really large, really bad event could galvanize the public, but I doubt it.
[1] https://www.washingtonpost.com/outlook/2021/04/26/constituti...
Besides the maximimization of revenue, the profit motive also dictates the reduction of risk. Consider any application for insurance, membership, coverage...
>government surveillance, is trying to lock you up because they have run out of real terrorists to fight
"Government is surveilling/fighting you because who else" is easily applicable to $EvilCorp monopolies, because its tautological.
This simply isn't true. Commercial surveillance is a means and method of inserting itself further into your workflows or lives. Just think of all the health and identity related 'features' being rolled out (and celebrated), and how governments are readily capitulating to them. It isn't far fetched or tinfoil to consider that these commercial entities, at some point in the future, can become the arbiters of decisions that affect you.
This isn't even about commercial vs government surveillance, they are equally dangerous, and of both you should be equally wary; governments are far more careful with actions, even with malicious intent, whereas commercial entities with deep pockets are often abstracted away sufficiently to escape blame or consequences. However, governments that delegate to commercial for decision making means that there is little to no difference in the 'type' of surveillance.
Minimizing your own ecosystem lockin is extremely important.
But it's easy enough to just opt out of all that. I don't use fitness or health wearables. I don't have my DNA or ancestry analyzed. I don't use online/telehealth services. Hell I don't even visit the doctor very often. I don't trust healthcare at all because it's very easy for them to use "scare" marketing to get people to pay for all kinds of stuff that (a) they don't need and (b) has very little real benefit and (c) that in most cases is for conditions that common sense and a little self-discipline can avoid.
You're free to think that doctors and health organizations operate on some higher plane of morality but the truth is they are businesses and need to compete for customers just like any other business does.
I’m glad I’m not the only one who thinks like this.
I mean, I'd rather nobody track anyone but that's no longer a reality, so if we're picking sides here I'm definitely pro-gov't.