We caught companies making it harder to delete your personal data online
themarkup.org
themarkup.org
For example, Amazon eero, the overpriced WiFi router that doesn't even work (without phoning back home and having an app installed on your phone). They had an outage like a year ago, and during said outage, all your existing ad blocking stopped working, too, even if you never rebooted during the outage, and even though said blocking is supposed to be performed locally. I think you can't even get the ad blocking unless you or your ISP pays for the special subscription, either. (I imagine the thing could have removed all local ad blocking settings and lists during the time it couldn't confirm you're still a paying customer because their cloud was down?)
Does anyone know how exactly does Amazon get away with not providing data export for their eero product? I haven't seen a Blink or Ring exports, either. The main Amazon dot com does have the export, which has some extensive data you may not think they do collect, but it doesn't cover eero, Blink or Ring.
I checked eero.com. It seems info about the product other than “it’s a secure WiFi router that doesn’t require users to manage it” is in the videos, if it is on that site at all, but I couldn’t get the videos to play, so I may be wrong, but why would a WiFi router have personal data on the device?
It will have the username and password at your internet provider, but what else does it store?
For ad blocking and network control, it also has "Block & Allow Sites" with the blacklisted and whitelisted domain names, which you may have to use to block ads and also unblock some domains that stop working as a result of bogus entries in the ad block.
All of this information is stored in the cloud, but I found no way to export it in any way. I've actually contacted eero, asking for the export, and they've basically admitted that it's not supported.
So that's all your websites you visit, plus any data transmitted from your phone to computer or google TV or whatever the fuck.
This is evil.
I had to install the drive client on a Windows laptop and download it through that.
I feel like this has been made a shitty experience intentionally.
These days I think of every account as ephemeral, anything I don't have in git on my local machine will disappear one day.
Now we have to have the "delete my data" and "request my data" as part of our main settings list. Result: flooded with requests. People are clicking the buttons just because they are there. For me it's not a big deal, I automate all the requests. But, I still feel like this went too far.
If the user can create and account, they should be able to delete one. One is not harder or further than the other.
We just don't view it that way because we're all parasites who feed off the current status quo.
They were objecting to the idea that putting it behind the "support" button is a violation. If true, that's excessive in terms of mandating accessibility.
No, requiring actual application functionality isn't too far. For God's sake, just make normal software like a normal person. This should all be very intuitive.
Stop trying to game things, stop trying to maximize conversions and other bullshit metrics, stop trying to implement every dark pattern under the sun and just... Be normal. I promise you will comply without even trying.
And, bonus points, your software will be less shit. I know it doesn't feel that way right now, because most software is shit. You shouldn't aspire to be another turd floating around in the cesspool that is the modern web.
Well now we're deep into the realm of assumptions.
They said "behind our Support/Legal button" which to me sounds like it probably loads another normal page.
Though a GDPR request basically is a ticket.
I think this isn't a very charitable opinion of why people click buttons.
> But, I still feel like this went too far.
Why?
The reasons why they click the buttons are utterly irrelevant to anyone except them.
Let them click the buttons. It's their right.
> But, I still feel like this went too far.
Not far enough. I think data should be a massive liability. It should actively cost you lots of money to know any fact at all about any person anywhere on the planet.
In other words, in an ideal world you would be scrambling to press that button on their behalf the second your business with them was concluded. "Can we please forget everything we know about you please?" and only their explicit affirmative consent would allow you to not delete their data.
this will stop being a problem
That's not as bad as I would have expected
I only got really serious about consistently using VPN’s, firewalls, adblockers, and more privacy centered browsers a few years ago. I would say over the last 8 to 12 months I finally started to see it pay off. I still don’t see a lot of ads if ever, and they are wildly off target when I do see them. Using email aliases that I regularly purge has also made a huge difference when it comes to password/info leaks in particular.
Now if I could only get my damn phone number under control… so tired of the endless spam texts
Starting in 2028 CA registered data brokers will have to undergo audits to ensure that they have been complying with deletion requests to the fullest extent of the law. Now, maybe only 20% of actual data brokers are registered in California like they are supposed to be, but it's a start.
Shameless plug: I'm building a platform to help the data brokers actually delete the data they are supposed to, provide full auditing and accounting for that process, and automate privacy request handling: forgetmenaut.com
I might be wrong but if I'm not that's a serious problem for AI companies.
It feels like such a cat and mouse game, that should be easy to automate, that said, I'm not sure it'll be effective.
I'm on the fence about whether that's real value delivered from Incogni, but I do think overall it's working to limit some of the spread of my data.
So since you don't know if they information or not, you should start sending them delete request every second? You know, just in case they got new data since the last request and we know it takes a while to actually process those requests.
The ones that do take the time to reply usually say "We've deleted your personal data now", which is not at all what I want. I want to know what details they have about me, where they obtained it, and why they think spamming me is acceptable.
I've got a folder where I keep printouts of the recent offenders, and once I get a few weeks of holiday I'll start filing small-claims cases against them.
A rare case of doing God's work at a profit!
Be prepared to be disappointed. There is 0 evidence/elements of damage in the eyes of the archaic courts in this case, as you have no evidence of being damaged. You may be annoyed, but you're not at psychical or monetary risk due to the actions of another.
I disagree^ with the above, we live in the future where comm-spam is an inherent risk. However, I lost a small claims case where documented over 5 years Mazda put the wrong oil in my car. I found out after pouring through paperwork and seeing the line items/overcharging (22 instances of this.)
Judge dismissed it due to no "damage." 3rd cylinder died a week later.
I guess it was written for a less technical audience, but it makes it seem like they have JS or 'code' was specifically written to hide these from web crawlers.
It makes more sense, in context, that companies could be unaware. Sure, a 'noindex' doesn't just show up, but how many were old configs disallowing *, and only allowing indexing on a few sites
Edit: I didn't see the screenshot section. Most (of the few I spot-checked) are, in fact, noindex. I stand corrected
You own the data you produce, both intentionally (writing, making videos) and unintentionally ("metadata", logs). You have to explicitly give others permission to use that data for any purpose where money exchanges hands (and many where it does not). You can limit or revoke the permission at any time.
This is already the case. All the contracts and terms of service documents already contain these permission clauses. People don't even read such things.
The funniest contracts are the ones that say "by using this site, you agree to [surveillance capitalism]". People have to navigate the site in order to even read the contract so it's logically equivalent to writing "by reading this contract, you accept it".
People need to start making laws that invalidate these silly documents.
It's the illusion of choice that gives is the veneer of legitimacy.
In every aspect of life in which personal data is indexed/transmitted, the point of origin at least is some place you've explicitly indicated approval of this process. IF you walk into walmart, you are granting them the ability to sell your facial data and card metadata to whoever.
No third party is calling your mobile provider to ask them to leak info. They are PAYING the mobile provider to leak them info that we provided express written consent for them to do so. TO avoid these ToS and binding agreements, you would need to live a disconnected agrarian lifestyle. Literally, can't walk into any corporate store.
yay!
It used to be the case that you exchanged money for a good or service. It was a transaction of 1 thing for 1 thing.
Now you're exchanging your money AND personal information for goods or services (sometimes both mixed in a way that is optimized to get as much money out of you as possible). And because those providing goods or services all have the same incentives, you don't have a free choice to pay a competitor who doesn't use these business practices.
Freedom absolutists (such as ancaps) will claim you can always start a competitor. But that's just not true, these business practices are so advantageous that you either use them too or go out of business.
The real solution is for people to unite and demand change together. And that's what governments are for.
However, I doubt it can be extended to training statistical models. LLMs and other models by their nature strip attribution which ironically happens to be the trick they are trying to use to break pretty much all open source licenses.
What do you get back from giving that?
In fact, while they do have a robots.txt [1], their form [2] isn't actually listed there. Instead, the page itself has a meta tag:
<meta name="robots" content="noindex, nofollow">
(Disclosure: I work on Mozilla Monitor, where we try to help people send these data deletion requests.)
People think they can delete their messages on say, Discord. I tell them it is not deleted, just marked deleted. The data is still there.
Try deleting your account with the delete button. Nothing happens. Everything on the site perfect, just that Delete button is broken (and the request times out).
But wait, you can send a ticket. Get response days later that it is marked as resolved.
You go back to the site ... O, i am still logged in with my old session.
Then you see your email: deleted_2544642405_blabla@gmail.com
So fake "delete" by simply putting a deleted and some timestamp before your email address, while keeping your other data.
O and the Delete button is also not fixed ;)
Companies really only seem to learn with some hefty GDPR fines.