Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Silicon Valley is terrified of California’s privacy law

techcrunch.com

Post reply on HN
Print view View original

341–350 of 553 posts

Re: Silicon Valley is terrified of California’s privacy law

#341

Post by brightball »

darawk wrote: post #172
nabnob wrote: post #52

I see a lot of comments deriding this law, can someone explain to me why these are bad things? Quoting from this article - https://techcrunch.com/2018/06/28/landmark-california-privac... - Businesses must disclose what information they collect, what business purpose they do so for and any third parties they share that data with. - Businesses would be required to comply with official consumer requests to delete that d…

> - Consumers can opt out of their data being sold, and businesses can’t retaliate by changing the price or level of service. This is something I object to. It's just fundamentally stupid and doesn't make sense. The entire premise of free exchange is that I give you my services in exchange for something of value of yours. Making it illegal to withhold services if you don't give up your data is crazy. The only reason…

Agree entirely. This part is overreach as it’s now forcing a company to provide a service for which they receive no compensation. That’s too far.

Re: Silicon Valley is terrified of California’s privacy law

#342

Post by rdlecler1 »

mirimir wrote: post #33
clay_the_ripper wrote: post #22

Earlier quoted context omitted.

Totally disagree. Complicate is not the same thing as following the spirit of the rules. Compliance is proving you followed the rules. Totally different. Also, you have to define what you mean by “respecting privacy”. Something that I do on my website, like basic retargeting marketing for abandoned shopping carts doesn’t feel to me like an invasion of privacy. To you, it might. The rules have to be defined clearly.

If you don't collect any information that's not essential to delivering content and services, there shouldn't be any problem. If you have a shopping cart, you must collect billing and shipping information. But you don't need to use it for any other purpose.

The IRS may see that differently.

Re: Silicon Valley is terrified of California’s privacy law

#343

Post by bduerst »

laughinghan wrote: post #337
bduerst wrote: post #333

Earlier quoted context omitted.

That is not how logs work. Did you reply to the right comment? Exemplify is gating database records from surfacing through their UI. These records still exist in the database and are admin accessible. The act of knowing if clustering the data is too much still requires knowing the data - i.e. the data existing.

Yes, I replied to the right comment, you're getting hung up on an irrelevant detail. I'm saying that the thought they put into anonymizing the data they surfaced through their UI, that same amount of thought should be put into the data we all store. If the data can't be clustered in a way that preserves anonymity, it should be deleted (after the desired aggregate statistics are computed). Emplify probably isn't requi…

It is not known at the time of storing the data if the data being stored will be denonymizable - especially for logs data.

Saying, "Just don't store logs data" is a fundamental misunderstanding of how web development works. This data is crucial for operational uptime, debugging, and running an online business. The scope of the data is so large that there inevitably are factors that can be used for denonymization, which is to GP's point.

The reason I asked if you replied to the right comment is because logs data is fundamentally different from database records, which is the working example you gave you gave with exemplify.

Re: Silicon Valley is terrified of California’s privacy law

#344

Post by laughinghan »

danShumway wrote: post #326
laughinghan wrote: post #286

Earlier quoted context omitted.

There's no conflict. necessarily there needs to be a way for that business to confirm your identity and link you to that data Why would linking you to that data require confirming your identity? My password links my HN account to me and me alone, while revealing nothing about my identity. There's no conflicting views. They're two, completely compatible aspects of the same view. One is how much or how little data each…

This works because you're the person who uploaded the data, and because you have a shared secret with Hackernews: in other words, an identity and a link between that identity and the data. Let's say someone else uploads a photo of my face to an image sharing site. Is there a way for me to prove to that site that the face belongs to me without sharing additional information? This principle also applies in the opposite…

My shared secret with HN, my password, is an identity? I don't think you'll find a lot of people who agree with that definition of the word.

As for the use of photos of me that are owned by other people, I'm pretty certain that neither CCPA nor GDPR cover those. The EU might have some relevant privacy laws, but they're not relevant to the "dichotomy" you brought up, because no one expects to be unidentifiable in a photo in which their face is identifiably visible.

Re: Silicon Valley is terrified of California’s privacy law

#346

Post by dillondoyle »

I'm pretty concerned about it, and we are a tiny political digital agency. My reading is that basically any small sized email list, website, service etc that 'receives for the business’ commercial purposes' data on more than 50k 'devices' or 'consumers' must be compliant which is a very low bar. Like small business email lists would hit this, though maybe burden falls onto Mailchimp for most.

It should be fairly easy to add a contact us address for delete and info requests to the bottom of websites. A lot harder and would take development time to automate a UI for a person to see all data associated automatically (e.g. lots of separate analytics; would have to build api to lookup ip/device/user data match across tables/dbs, and then how do I verify a user is requesting their data and not someone else's). Also harder to 'block' new data collection of device/consumer post delete request.

What I'm less sure about is 'inform consumers before the point of collection.'

Does a privacy policy link in footer count? If not what is required for compliance? What about advertising?

Another big concern for me is that this is going to be weaponized in my industry (politics). I think a political campaign wont fit the bill's definition of 'business' (profit seeking for shareholders) but I think it will still be weaponized by opposition campaigns and service providers.

Re: Silicon Valley is terrified of California’s privacy law

#347

Post by rpastuszak »

d1zzy wrote: post #332
jakelazaroff wrote: post #256

Earlier quoted context omitted.

> The entire premise of free exchange is that I give you my services in exchange for something of value of yours. "Something" doesn't mean "anything". You can't offer your services in exchange for e.g. my body parts. Why are we willing to ban that but not our data? > The only reason those services are being provided at all is to get that data. That's effectively a requirement that people provide services for free. We…

> "Something" doesn't mean "anything". You can't offer your services in exchange for e.g. my body parts. Why are we willing to ban that but not our data? Because if you were to run a survey over the general population the large majority is fine not having to pay for gmail, google search, maps and other "free" services while some data may be collected doing so while a much smaller percentage thinks it's OK to sell the…

I think you’re missing the point.

At least I know where my data is. Have you ever read a GDPR popup partner list? Do the people you mention understand how gmail business model works?

Re: Silicon Valley is terrified of California’s privacy law

#349

Post by mdorazio »

fedorareis wrote: post #336
d1zzy wrote: post #331

Earlier quoted context omitted.

> You just have to change the onboarding process to include a fee, and offer an incentive/rebate of the subscription price to match the cost to basically make it free. That way if they decide to change their mind and not give their data, you're still in the clear by removing the incentive and either charge their payment method or disable their service until they do (or reenable data sharing). The problem is that then…

You can still have ads you just can’t sell the users data to get them. Which means you either have to target ads yourself or you have to use non targeted ads. So you can still have an ad supported free level.

Exactly - you can still have an ad supported model all you want, you just can't be lazy about it anymore. You'll either have to tell the ad network yourself what your audience attributes are and likely take a hit on CPC because of less targeting data, or you'll have to do what people used to do (and some still do) and manually choose the ads you want to run.

It's not the end of the world, it's the end of some business models.

Re: Silicon Valley is terrified of California’s privacy law

#350

Post by rpastuszak »

As much as most browsers have implemented a standardised payment API, a generic, browser-level Privacy related GUI would be helpful. By that I mean something less repetitive than the multitude of consent screens people have to deal with (not to mention dark UX patterns in the existing solutions).
Post reply on HN