Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data Brokers

oag.ca.gov

Post reply on HN
Print view View original

41–50 of 80 posts

Re: Data Brokers

#41

Post by lmkg »

dodobirdlord wrote: post #11
ErikAugust wrote: post #7

I see six entries. Where's Google, Facebook, etc?

Google and Facebook don't sell user data. It's much more profitable to keep it for themselves than to sell it to others.

CCPA's definition of selling data is both expansive, and a little vague.

Google Ads (formerly AdWords) now has an API so that customers can disable possibly-sales-like features on a per-use basis if someone clicks "Do not sell my information." So, while Google doesn't sell users information, they're only willing to go to bat and say "this is definitely not a Sale Of Information under CCPA" for a subset of the services they offer.

https://privacy.google.com/businesses/rdp/

Facebook I dunno. My sense is they have a larger appetite for testing the boundaries of the law.

Re: Data Brokers

#43

Post by vineyardmike »

JumpCrisscross wrote: post #18
barbecue_sauce wrote: post #15

Earlier quoted context omitted.

I would say they're technically not data brokers because they collect data directly from an agreed upon relationship with a consumer, and they do not sell the data itself but rather productize it for advertisers.

> they collect data directly from an agreed upon relationship with a consumer Facebook builds shadow profiles. Those involve no direct relationship with the surveilled.

Presumably they get the data for the shadow profiler from tracking scripts and stuff that run in your browser, so technically that’s a relationship you accepted when you ran their script and allowed it to phone home.

Re: Data Brokers

#44

Post by vineyardmike »

ronzensci wrote: post #40
lmkg wrote: post #39

Earlier quoted context omitted.

If you use Google to search (or use Chrome or gmail or...) then you have a direct relationship with Google, meaning Google is not a data broker.

"Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of th…

The ad you see in the search results was put their by google after an advertiser said “advertise to someone who searches for X, and also likes hacker news”. Google wouldn’t share that data to the advertiser. Once you click the ad... that’s another story.

Re: Data Brokers

#45

Post by lmkg »

ronzensci wrote: post #40
lmkg wrote: post #39

Earlier quoted context omitted.

If you use Google to search (or use Chrome or gmail or...) then you have a direct relationship with Google, meaning Google is not a data broker.

"Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of th…

The law has a lot of requirements for every company that collects data about you. It has additional requirements for companies that are data brokers. The quote you provided is about the former. The list linked in this post is about the latter.

Re: Data Brokers

#46

Post by lmkg »

whtifbru wrote: post #29

What about businesses that aggregate api data, if you use 2-3 data brokers are you a data broker? Seems to me only the source should register but the i think theres a lack of definition there. So every user who uses a api with consumer demographics and sells data should register as a data broker?

Data brokers are middlemen. Not the source (no direct relationship to the data subject), and not the consumer (derive revenue from selling data).

If the process of selling data involves a daisy-chain of three middlemen companies, they're all data brokers.

Re: Data Brokers

#47

Post by downandout »

Klonoar wrote: post #25

Skimming the bill is frustrating (readability doesn't seem to be a strong suite with govt sites) and a question comes to mind: does this basically only apply to California businesses, or any entity who has consumer data on California residents, or...? I'm all for it, just wish that tidbit was more clear I guess. Or maybe I'm just not reading it correctly, who knows.

California has no jurisdiction outside of California, period. If you are not based in California and do not deal with the data of Californians, then you are not subject to it. If either of these things are true though, you probably are subject to it.

The problem of course is that you may not know that you are dealing with a Californian’s data. For example, you may have scraped an email address and have no idea who it belongs to. I suspect that for this reason, I got a bunch of emails from affiliate programs recently saying that they had to close because of this law. Example:

“Unfortunately, the Yelp For Business Owners program is being paused immediately due to 2020 California Consumer Privacy Act (CCPA) concerns. As of the sending of this notification we have expired all affiliates, which will be effective 1/13/20.

As you may be aware, the newly enacted California Consumer Privacy Act has placed new requirements on Yelp. While we evaluate the implications of these requirements, we are taking the step of temporarily pausing our affiliate program. Thank you for all of your hard work in 2019 and we?re looking forward to working more closely with all of you in 2020 once we work past this issue.”

Re: Data Brokers

#48

Post by downandout »

lmkg wrote: post #45
ronzensci wrote: post #40

Earlier quoted context omitted.

"Existing law, the California Consumer Privacy Act of 2018, beginning January 1, 2020, among other things, grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of th…

The law has a lot of requirements for every company that collects data about you. It has additional requirements for companies that are data brokers. The quote you provided is about the former. The list linked in this post is about the latter.

Correct. While this law certainly enables you to send “nightmare letters” and generally make yourself a PIA for Google and all other companies, it does not require them to register as a data broker because of the consumer’s direct relationship with them.

Re: Data Brokers

#49

Post by mportela »

all_blue_chucks wrote: post #42

This list seems like a good place for hackers to start. These brokers likely don't have the infosec teams that Google or Facebook have.

That's why they should be tightly regulated and directly responsible for incidents involving data leaks à la Equifax

Re: Data Brokers

#50

Post by mportela »

whtifbru wrote: post #29

What about businesses that aggregate api data, if you use 2-3 data brokers are you a data broker? Seems to me only the source should register but the i think theres a lack of definition there. So every user who uses a api with consumer demographics and sells data should register as a data broker?

If you collect data from third-party APIs and then re-sell them, you are a data broker. If you only use the data, then you aren't.
Post reply on HN