Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Silicon Valley is terrified of California’s privacy law

techcrunch.com

Post reply on HN
Print view View original

141–150 of 553 posts

Re: Silicon Valley is terrified of California’s privacy law

#141

Post by JohnFen »

bcheung wrote: post #36
mitchdoogle wrote: post #10

Earlier quoted context omitted.

The gist of these laws are all the same. Just respect ALL users' data from the start, and you shouldn't have any difficulty with compliance.

Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous. How do you scan all the logs that might somehow have an association with the requesting user that are in cold storage and alter data on write only archived optical media? You have to make an entire copy of it with those data removed. It's not about just treating customers better. It's governme…

> Many companies have to RADICALLY change their architectures just to support these laws. And often the costs will be enormous.

Yep. And there's nothing wrong with that.

That they may suffer a large expense to correct years of misbehavior doesn't make me sympathetic to them.

Re: Silicon Valley is terrified of California’s privacy law

#142

Post by Kalium »

DaveFr wrote: post #107
Kalium wrote: post #80

Earlier quoted context omitted.

> Each state can choose to be as restrictive as they like in their laws, and each startup can chose to invest in compliance on a wide scale or in the narrow scale as they'd like. There's a special hell that exists where one state mandates records must be held for at least seven years and another mandates deletion at five. When the two states border one another and you may not have home addresses, how do you determine…

Is this a hypo or a real example?

As far as I know it's a hypothetical, but it is very much the kind of thing that could happen. Regulations don't always align across political borders, which means there's the possibility there being no way to comply with both.

Re: Silicon Valley is terrified of California’s privacy law

#143

Post by mdavidn »

chooseaname wrote: post #131
nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. If you're ad dependent, would this basically mean you have to give your service to this user for free after this?

No. It just means you need to make ads relevant to the content rather than to the individual user.

Re: Silicon Valley is terrified of California’s privacy law

#144

Post by DoofusOfDeath »

mattbee wrote: post #126
aeternum wrote: post #102

Earlier quoted context omitted.

I don't think lawmakers have thought through the ramifications. Here are a few: Way too hard to enforce, the definition of 'customer data' is going to be a constantly moving target. Does every click count? How about aggregated clicks important for general product optimization? What constitutes 'selling' user data? Very few companies actually sell your data, instead they place ads based on your data. Will that be bann…

European here, I can help: Yes a click counts as personal data if you can reference it back to a real person. Aggregated clicks probably wouldn't. Selling ads based on personal data is selling your personal data. The personal data provides the value to the transaction. Yes lots of companies may need new business models, but for the most part what I've seen is dark patterns, non compliance or wriggling to avoid any re…

It's interesting to know what those terms mean in Europe's GDPR, but I'm not sure that will affect their interpretation in the U.S. court system.

Re: Silicon Valley is terrified of California’s privacy law

#145

Post by [deleted] »

wolco wrote: post #69
ohduran wrote: post #27

Earlier quoted context omitted.

This. Imagine if you said the same thing with taxes. "Gee, why do I have to pay taxes differently in every country?" Well, because that's what you have to do if you want to do business there. You're not forced to do anything in here if you don't want to; if the opportunity is worthy, others will take your place. Same with the laws, especially those that remove agency from the users.

But you don't. If I am from South Africa and I buy a US product from a smaller website I don't pay South Africa sales taxes. If I buy from Amazon I would because they have offices or a physical presence. When you buy a product from a website hosted/incorporated in a different country you are literally going into another country and buying a product under their laws. Your local taxes (national/stat wide/city wide) sho…

[deleted]

Re: Silicon Valley is terrified of California’s privacy law

#146

Post by noodlesUK »

People keep comparing this to the GDPR. I have lived in the UK pre and post GDPR and the US. I like the GDPR a lot. It isn’t just internet businesses either. Because it was such a crazy bogeyman, plenty of brick and mortar businesses have paid a bit more attention to their data security. I like being told what’s gonna happen with my PII, and having the right to control my data. Most people seem to like the effects of the GDPR in my (anecdotal) experience. Yeah you have people using it as some bizarre bogeyman to stop you doing normal things, but it makes you think about it. From a business perspective, the ICO provides great advice to people and companies when they need it. It’s not as though what you need to do is a secret. You just need to do business in accordance with peoples’ rights.

Re: Silicon Valley is terrified of California’s privacy law

#147

Post by gerbilly »

mahmoudimus wrote: post #109
nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

I think the idea is that regulation always has unexpected side effects, some of which can be abused to actually do the perverse inverse of what they're intended to protect against. This is intuitive because regulation + law can really put a competitive barrier for established incumbents who (and arguably, they would be the target for lawsuits here) have resources to implement and comply with these regulations. The la…

The status quo has unintended side effects.

Re: Silicon Valley is terrified of California’s privacy law

#148

Post by JohnFen »

bsder wrote: post #55
TazeTSchnitzel wrote: post #39

Earlier quoted context omitted.

GDPR is not a difficult law to comply with for an EU company, unless you're adtech.

We've already had this discussion. We've already seen non-adtech companies simply shut down EU access if they don't have enough revenue. That's probably not a good thing. I support the GDPR, but complying with it is far from simple and the jurisprudence is not yet clear.

> That's probably not a good thing.

Why not? Serious question.

Re: Silicon Valley is terrified of California’s privacy law

#149

Post by mirimir »

yuliyp wrote: post #105
mirimir wrote: post #33

Earlier quoted context omitted.

If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.

Do you have an error log on your web server? Does that only collect data that is essential or do you do something like log a referer or IP address or user id in hopes that it might be useful un debugging. Is there an access log? What happens if a user asks to delete their data. Do you go back and scrub all such logs? What about if you have a backend service that logs errors about what data it had problems accessing.…

I'm no expert. But typically, when installing web servers, I don't enable logging. I'm more familiar with the issue of logging by VPN services. And I've been assured, by someone who runs one, that logging isn't necessary. Everything can be done in real time, with any "logs" retained briefly in RAM.

Re: Silicon Valley is terrified of California’s privacy law

#150

Post by darknoon »

bcheung wrote: post #132
nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

Some problematic scenarios: - How do you identify what is customer data? There may be information stored in logs somewhere. Do you now have to write log parsers to extract personal data for everything that previously you just stored for general debugging and security purposes? How do you even know all the permutations of personal data that came be stored in the logs. There are possibly infinite possible ways personal…

Yes, if you log personal information like IP addresses you need to have a plan to delete it. Maybe storing it long term is a liability not a benefit.

Don't bring complexity theory into it.

Post reply on HN