Hacker News Reader

Comment by sixtyj | Hacker News Reader

Most companies would bury this change in a deceptively boring T&Cs update, but we value transparency, so here's what you need to know in an internet-friendly numbered list:

Users on our EU cloud instance are opted out by default

So too users with agreements that prevent training (e.g. BAA, MSA, or similar)

All other users on our US cloud instance are opted in by default

We will anonymize all data before it's used for training

We will only use data that already exists in your PostHog instance

We will do all the model training ourselves, which means...

We won't sell or send your data to third-party model providers

You can opt out at any time via your org settings in PostHog (admin access required)

Training won't start until June 29, so there's plenty of time to decide

View on HN

> All other users on our US cloud instance are opted in by default

Cool, cool. Glad to see that you are the arbiter of what your users have "opted" to do, and their input isn't required.

While we're at it, I'm going to "volunteer" your time to rebuild my patio this weekend. You don't need to worry about volunteering, I've done it for you.

If you send a postcard by Friday 5:00 PM, you can opt out of helping me with my patio. This is a one time offer; if you don’t, you have to help me every weekend for forever.

If "we will opt everyone in because otherwise we won't get enough data because we know users won't opt in" is your business model, maybe it's time for a rethink.

Defaults matter.

Opt-in vs opt-out organ donorship has a large impact.

Most people on any web app won’t stray from the defaults.

Again, this is because it's uninformed.

Consent matters.

yea except one is a "dark pattern" to exploit customers for corporate profit while the other is to benefit society.

Which we probably need to consider changing now that some truly bizarre and evil shit is being done on donor organs:

https://news.ycombinator.com/item?id=48212992

Off topic but I'm curious what's evil about that article. Bizarre, sure, but evil? They took a brain (an organ) from a dead person who had previously given consent to use their organs for that purpose.

I think most people, and definitely myself, when they sign up to be an organ donor, they think of the liver, kidney, and heart. Things that will help other people.

Not the brain, the center of conscience, being kept in some sort of horror-movie half-alive state. I do not think we understand consciousness enough to rule out what those brains are experiencing.

> half-alive state

The brain can't be "half-alive" after you've died.

> I do not think we understand consciousness enough to rule out what those brains are experiencing.

The parent edited their comment, wasn’t there when I replied. But if you believe your organs don’t die when you die, then don’t donate your organs?

Um... I, 220% disagree with that statement. I did edit to fix a spelling mistake, I did not add/remove content...

I wish HN showed the edit history >:(

> if you believe your organs don’t die when you die, then don’t donate your organs?

Because "I" don't know what "I" am.

Am I a brain? Am I a soul? Am I the universe?

I have no idea. Science currently has no idea. Religion is unprovable.

I want to donate my organs. If my death can bring life to others, it would be a truly amazing deed I could do.

On the other hand, if I am just a brain, I do not want to be locked into some sort of drugged, half-conscious state where I can't scream.

That's fair. Personally I wouldn't mind, but when you put it that way it makes sense people would be wary. Kind of reminds me of the series Pantheon, which is amazing but also kinda disturbing for similar reasons.

I sincerely hope this never comes to pass, but you or your loved ones may someday find themselves in the position of wishing more people were opted in for organ donation.

The same cannot be said for some random corporation training AI models off your data to make a buck or two.

I think it might be better to get rid of the organ *donation* system entirely.

Organ transplant surgery costs hundreds of thousands of dollars, yet donors get zilch, which is completely unfair when everyone else in the value chain gets paid.

If instead it was "allow my organs to be sold for my estate" I think the supply of organs would greatly increase, which would be win/win.

there are a number of problems with people selling their organs for profit, it's a perverse incentive — the people in the chain who otherwise get paid don't get paid for the organs, they get paid for the labor of doing their jobs

Organ donation saves lives at no cost to you (because at this point you're dead).

It's unclear if my private data being used for training has a cost to me, but I'm giving posthog money already. They shouldn't double dip.

It's frustrating as we literally just moved to it. Back to Mixpanel?

I'd recommend at least doing a short spike to see if you can build your own in some way. We did that for the purpose of experimentation and now we've built our own metrics platform that we completely own.

this is the business model of all companies training AI, if they had to get permission we wouldn't have frontier LLMs at all

So it's OK to do stuff without permission as long as we get something that makes a lot of people a lot of money?

*"that makes a select few rich people a lot more money?"

It's not OK, but it's a fact.

has it not always been this way?

Two things can be true. A shitty thing can prevail for a long time and still be shitty.

I think it's prevailed for all of human history in this case, so while shitty it appears to be a feature

Agreed but "it's always been shitty" isn't a reason to do nothing about it.

For much of human history slavery was fine too, but thankfully that's been dealt with in many nations. I know some folks argue that capitalism is just the next iteration of slavery but that's different.

not sure why you think stating facts implies nothing should be done about it

slavery is still fine in the US as long as you're incarcerated, and the US still does business with countries that regularly use the old fashioned kind — hell, some people still want to bring chattel slavery back here and still proudly display the confederate flag

these are just very slow things to change... in the timespan of centuries if you're lucky, but in the case of wealth bringing privilege we haven't cracked the issue for thousands of years

> if they had to get permission we wouldn't have frontier LLMs at all

Don't threaten me with a good time.

That would be a good thing TBH.

There is no such thing as opt in by default - and burning that amount of customer goodwill because you want something instead of say, giving a discount to people who are willing to do it is a choice for people who have a lot more market share and their customers would have more trouble leaving.

> Most companies would bury this change in a deceptively boring T&Cs update, but we value transparency, so here's what you need to know in an internet-friendly numbered list:

This feels like a really bad defense. It’s great you provide transparency but I don’t want my analytics system writing my code. There are already so many other first movers that are better that I would rather connect to your analytics.

Hey man, respectfully, opt-in by default is not opt-in. That's opt-out, and it's scummy.

I feel like you either know that already, or should, but either way I won't be using your product anymore. Just pulled it out of the projects I'm personally in charge of and in the future I'm going to recommend against using it both internally and for clients.

Legitimately disappointed.

> We will anonymize all data before it's used for training

Anonymize by what definition? GDPR? Do note that this very high bar.

> All other users on our US cloud instance are opted in by default

Including end users in the EU? You should remember that you are obtained the personal data directly from data subject meaning Article 13 obligations apply. Article 13 omissions cannot be cured retroactively. Can you show all of your customers have provided sufficient Article 13 notice to cover this processing?

And do note that you are almost definitely within the scope of 3(2)(b).

Cant wait to see posthog crash and burn, i have hated their service for years now.

why?

Bizarre take.

Calm down, GA4/Amplitude/Mixpanel.

> Users on our EU cloud instance are opted out by default

> All other users on our US cloud instance are opted in by default

Perfectly demonstrating that we need regulation to protect the general public, most companies will not do the right thing but the thing that benefits them first and foremost.

> All other users on our US cloud instance are opted in by default

This is slimy.

It's slimy because your government allows it, this doesn't have to be the case.

1. Lobby your representatives to improve your data protection laws, even if you think it's pointless to do so

2. Stop attacking EU data protection laws, even if they inconvenience you

As can be seen from this announcement, data protection laws do make a difference.

yes, of course!

Not really, it's slimy because it should be obvious that it's the morally wrong thing to do. There's no tangible benefit to the users, only risk.

The fact that they only opt-out EU users, because regulation forces them, tells you all you need to know about the moral compass of PostHog.

This shouldn't even require regulation, but apparently expecting companies to act morally is a bloody pipe dream. Profit over morals and concerns for your costumers, apparently.

I don't want to support a company that's going to do everything they can possibly legally get away with, I want to support companies that do the right thing where they can.

What concrete difference is being made here? If a site is hosted in the US but accessible by EU citizens AND using a PostHog US server isn't the data still being used for training?

Legitimate question, I am not trying to prove a point.

> We will do all the model training ourselves

That's actually an interesting note. So you all will be managing the training runs on hardware you own or rent and manage?

There is definitely some confusion on the EU part. I am a European citizen, but some of my activity data on some of the sites I host is logged in US Posthog, which means Posthog is subject to the GDPR, even if the data is US hosted!

I think it would be better if there was an EU browser that provided a warning if accessing sites outside of the EU. If an origin site is in the EU then it could be subject to EU regulations.

as a user i dont like it, and am disappointed. it will take a bit of time to transition our systems off of posthog, but we will need to.

if you are looking at your metrics, I want to be clear that this transition will not happen overnight, but it _will_ happen for this reason, so just be aware that your short-term metrics won't tell the full story

Reply on news.ycombinator.com