Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Silicon Valley is terrified of California’s privacy law

techcrunch.com

Post reply on HN
Print view View original

131–140 of 553 posts

Re: Silicon Valley is terrified of California’s privacy law

#131

Post by chooseaname »

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service.

If you're ad dependent, would this basically mean you have to give your service to this user for free after this?

Re: Silicon Valley is terrified of California’s privacy law

#132

Post by bcheung »

nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

Some problematic scenarios:

- How do you identify what is customer data? There may be information stored in logs somewhere. Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal information can manifest in logs. How do you ensure compliance with something when you don't fully understand what can come out of it? Any engineers now must fully understand the consequences of anything they log and design delete mechanisms for it. This extends to any 3rd party software you use that generates logs. You must now fully and deterministically understand your entire system just to comply with this law. Such a request is essentially NP-complete.

- How do you prune said data from logs?

- How do you delete data that are archived in write only media formats and/or that are in cold storage somewhere? You'd have to physically destroy the media and make a copy of everything minus the part you want to exclude. This dramatically increases archive storage complexity and cost.

Re: Silicon Valley is terrified of California’s privacy law

#133

Post by JohnFen »

Steven_Vellon wrote: post #89
mitchdoogle wrote: post #10

Earlier quoted context omitted.

The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

If there was an easily defined definition of "respecting users data" the we wouldn't be in this situation. Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data, but this is often prohibited by law. Plenty of people don't think having a tool to dump user data is necessary to respect user data.

> Plenty of people think putting a clause in the EULA that says user data can be monetized is being respectful of user data

Do they really believe that, though? I always thought they were just thinking it was just legal cover to allow them to do whatever they want with the data. Respect doesn't enter into it.

Re: Silicon Valley is terrified of California’s privacy law

#134

Post by jedberg »

jtchang wrote: post #78
jakelazaroff wrote: post #56

Earlier quoted context omitted.

I am on board with this law, but I’m curious how these two points will shake out: > - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. > - Businesses can, however, offer “financial incentives” for being allowed to collect data. Seems to me that it’s a distinction without a difference. Is there something I’m missing?

It's all about marketing and perception. See how credit card companies set rules regarding surcharges and cash. Before credit card companies tried to prevent a discount being offered if a customer paid cash as stipulation for taking credit cards. Durbin Act of 2010 changed that which made it legal in all 50 states.

> Durbin Act of 2010 changed that

Ah! I was always saying I'm surprised by the brazenness of gas stations to offer cash discounts in violation of their credit processing agreements. Today I learned that as of 2010 the law protects them. Thanks!

Re: Silicon Valley is terrified of California’s privacy law

#135

Post by irrational »

aeternum wrote: post #102
nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

I don't think lawmakers have thought through the ramifications. Here are a few: Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization? What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be bann…

I think of customer data as any data that has been created/logged/stored based on some action I took (logging into website, clicking a button, visiting a website, opening an app, etc.) that can be tied back to me, my friends/family/community, my devices, my ip addresses, my locations, etc. in any way shape or form.

Re: Silicon Valley is terrified of California’s privacy law

#136

Post by fragmede »

jjuhl wrote: post #83
rdlecler1 wrote: post #3

So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.

Just don't do stupid privacy violating shit and you'll be fine anywhere. Collect no information. Share no information. You are good - everywhere . And that really ought to be the default behaviour..

I'm not sure how ecommerce works without some information from the user, such as what they're trying to purchase, the quantity, a shipping address, and some form of payment, most likely a credit card.

Re: Silicon Valley is terrified of California’s privacy law

#137

Post by mirimir »

btilly wrote: post #103
mirimir wrote: post #33

Earlier quoted context omitted.

If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.

By your rule, companies should not engage in A/B testing to figure out how to make their sites easier to use. Because that involves tracking users for a purpose that is not actually essential to delivering content and services. Does this outcome make sense to you? (Disclaimer, I have worked in adtech a little bit, but I have worked a lot more with A/B testing.)

I suspect that A/B testing is doable without collecting user information. Except for the OS, of course. But certainly nothing that's not in server logs.

Re: Silicon Valley is terrified of California’s privacy law

#138

Post by fbonetti »

JohnFen wrote: post #120
aeternum wrote: post #102

Earlier quoted context omitted.

I don't think lawmakers have thought through the ramifications. Here are a few: Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization? What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be bann…

> Will that be banned as well? I sure hope so. > Many companies, including Google would have to significantly change their pricing model if so Good. It would be even better if they have to change their business model.

Are you willing to pay to use a search engine? How much?

Re: Silicon Valley is terrified of California’s privacy law

#139

Post by Supermancho »

aeternum wrote: post #102
nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

I don't think lawmakers have thought through the ramifications. Here are a few: Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization? What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be bann…

> Way too hard to enforce, the definition of 'customer data'

HIPPA manages with "Patient data". The standard techniques include non-reversible addressing of users. Patient N has an internal number and an external number. Without having Patient N's internal record in hand, you can't correlate it back to that user, which is particularly useful in a legal defense.

Re: Silicon Valley is terrified of California’s privacy law

#140

Post by Sweetness »

PopeDotNinja wrote: post #34
rdlecler1 wrote: post #3

So the author would rather see each state/country implement it’s own laws so that a small startup needs to ensure they comply with hundreds of regulatory jurisdictions... awesome.

And that's how privacy compliance as a service was born.

i hate this, but you're right. pointless regulations that lead to pointless jobs to oversee and sell compliance is such a net waste for society.
Post reply on HN