Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Removing email registration improved retention

solitaired.com

Post reply on HN
Print view View original

161–170 of 180 posts

Re: Removing email registration improved retention

#161

Post by GoblinSlayer »

threeseed wrote: post #98
Nextgrid wrote: post #86

Earlier quoted context omitted.

Criminal gangs could also say that crime such as theft, robbery, blackmail, extortion, etc works for them and makes them money. It doesn't mean we should be legitimizing and encouraging this behavior that most of us agree is detrimental to society.

I think you need to calm down with the rhetoric. Criminal activities hurt people. Ads do not. Especially in this case where PII data is not being provided to the advertising company.

Ads kill brain cells and create the problem of spam filtering, which consumes a lot of resources.

Re: Removing email registration improved retention

#162

Post by _j9fj »

threeseed wrote: post #64

This is not advice any startup should ever listen to. The most successful and lucrative form of marketing, by far, is re-marketing. That is where you take someone who signed up but is not currently a customer and you target Facebook/Google ads specifically at that email address. I've seen conversion rates as high as 30% and it's typically pretty affordable. It's such a critical part of marketing that many companies w…

As much as I agree with this, I hate the privacy implications behind this approach.

Plus, hey.com (from DHH) has seen huge growth without any sort of re-marketing or spy pixels (as he says)

Re: Removing email registration improved retention

#163

Post by tgsovlerkhgsel »

gingerlime wrote: post #155
tgsovlerkhgsel wrote: post #151

Earlier quoted context omitted.

The German DPAs have a FAQ on this topic, and they're very clear about the fact that hashing isn't anonymization and doesn't change the fact that you're sharing PII. (The FAQ also mentions that you need consent and can't claim "legitimate interest").

Thanks for that. Would you be able to link/quote the relevant section? I'm personally interested in it, but my German language skills are extremely limited.

https://netzpolitik.org/2019/facebook-custom-audience-illega... would be an article in English about it from a digital rights organization.

https://www.lda.bayern.de/media/pm2017_07.pdf is the official press release of the Bavarian DPA (in German), with their guidelines attached (starting on page 4).

There is two kinds of "custom audiences" - one list-based and one based on tracking pixels. I'll only quote the parts relevant to the method where customer lists are uploaded.

a.Rechtmäßiger Einsatz - Der Einsatz ist nur aufgrund einer informierten Einwilligung der Kunden zulässig. Das Hochladen der Kundenliste kann weder auf eine Rechtsgrundlage des BDSG noch des TMG gestützt werden. Diese Rechtsauffassung beruht auf einer europarechtskonformen Auslegung der geltenden deutschen Datenschutzbestimmungen und berücksichtigt die jüngsten Entscheidungen des EuGH zum Datenschutz. Im Übrigen wird das Übermitteln dieser Liste an Facebook auch auf der Basis des ab Mai 2018 geltenden Rechts, d.h. nach der Datenschutz-Grundverordnung (DS-GVO), nicht ohne Einwilligung zulässig sein.

b.Widerruf der Einwilligung - Widerruft der Betroffene seine Einwilligung, so muss er von der Kundenliste entfernt werden. Da der Webseiten-Betreiber keine Kenntnis davon hat, welche Kunden auch Nutzer auf Facebook sind und beworben werden, ist die vollständige Custom Audience-Liste unverzüglich zu aktualisieren.

(Translation - Google translate with misleading issues corrected manually:

Lawful use - Use is only permitted with the informed consent of the customer. The uploading of the customer list can neither be based on a legal basis of the BDSG nor the TMG. This legal opinion is based on an interpretation of the applicable German data protection regulations in accordance with European law and takes into account the most recent decisions of the ECJ on data protection. Beyond that, transmitting this list to Facebook will also not be permitted without consent according to the law applicable from May 2018, i.e. according to the General Data Protection Regulation (GDPR).

Withdrawal of consent - If the person concerned withdraws his or her consent, he or she must be removed from the customer list. Since the website operator has no knowledge of which customers are also users on Facebook and are being advertised, the complete Custom Audience list must be updated immediately.)

Re: Removing email registration improved retention

#164

Post by tgsovlerkhgsel »

gnopgnip wrote: post #118
tgsovlerkhgsel wrote: post #112

Earlier quoted context omitted.

Exactly, and this is why users don't want to give it to you.

I would much rather get an ad from someone I shared my email address with than whatever random businesses decided to pay google/facebook/etc the most

That's fine. They can ask for your consent and you can provide valid, informed consent to this ad targeting, and then get better ads.

What's no longer acceptable according to GDPR is forcing this onto people unknowingly, or by packaging it into a "take it or leave it" package of fine print.

Re: Removing email registration improved retention

#165

Post by Nextgrid »

dependenttypes wrote: post #133
icedchai wrote: post #109

Earlier quoted context omitted.

The emails can be hashed, turning it into a pseudo-anonymous ID. It is debatable whether that is PII. It probably comes down to whoever can afford the better legal representation.

Hashes are not a panacea. I see them being suggested as solution for anonymization of ip addresses/domain names/urls/file names/emails all the time but these people that make said suggestions are either clueless or are arguing in bad faith. It is extremely easy to brute-force the majority of said hashes. (in addition to that I doubt that anyone is passing hashed emails as it would make it slightly inconvenient to sen…

It's indeed extremely easy to brute force these hashes when you have a database of the original (plaintext) data stolen from people's contacts which reduces your search space dramatically.

Re: Removing email registration improved retention

#166

Post by GoblinSlayer »

megous wrote: post #53
GoblinSlayer wrote: post #21

Earlier quoted context omitted.

Give a password reset code and ask the user to write it down on paper.

People likely to lose a password, would likely lose this paper code too. People using password manager would not lose the password in the first place.

Nothing is perfect, email isn't that reliable channel either, e.g. Google locks accounts regularly at random.

Re: Removing email registration improved retention

#167

Post by Macha »

threeseed wrote: post #64

This is not advice any startup should ever listen to. The most successful and lucrative form of marketing, by far, is re-marketing. That is where you take someone who signed up but is not currently a customer and you target Facebook/Google ads specifically at that email address. I've seen conversion rates as high as 30% and it's typically pretty affordable. It's such a critical part of marketing that many companies w…

And this is what you get @ which gets spam filtered as soon as promotional email comes in.

Re: Removing email registration improved retention

#168

Post by Macha »

dependenttypes wrote: post #134
buzzert wrote: post #130

Earlier quoted context omitted.

I registered a domain name that’s basically just a UUID, and pointed it’s MX records to my self-hosted email server (you could also point it to Google Apps or Fastmail). Everything before the UUID domain is just the name of the service, so something like hackernews@e913ff00...xyz. If someone sells out my email address, I can instantly burn it by just adding a sieve rule since they’re all unique. I even know who sold…

I heard that some services have started rejecting email addresses that contain their name.

Oh no, I can't have google@mydomain, guess I have to have goog@mydomain or ggle@mydomain or meggl@mydomain

Re: Removing email registration improved retention

#169

Post by dependenttypes »

Nextgrid wrote: post #165
dependenttypes wrote: post #133

Earlier quoted context omitted.

Hashes are not a panacea. I see them being suggested as solution for anonymization of ip addresses/domain names/urls/file names/emails all the time but these people that make said suggestions are either clueless or are arguing in bad faith. It is extremely easy to brute-force the majority of said hashes. (in addition to that I doubt that anyone is passing hashed emails as it would make it slightly inconvenient to sen…

It's indeed extremely easy to brute force these hashes when you have a database of the original (plaintext) data stolen from people's contacts which reduces your search space dramatically.

It is extremely easy even if you don't.

Re: Removing email registration improved retention

#170

Post by mindhash »

tgsovlerkhgsel wrote: post #112
threeseed wrote: post #64

This is not advice any startup should ever listen to. The most successful and lucrative form of marketing, by far, is re-marketing. That is where you take someone who signed up but is not currently a customer and you target Facebook/Google ads specifically at that email address. I've seen conversion rates as high as 30% and it's typically pretty affordable. It's such a critical part of marketing that many companies w…

Exactly, and this is why users don't want to give it to you.

Typically users don't want to give you email unless you prove them it's worth it. So instead of making email mandatory for registration, you can now try showing articles around improving there game skills or ask them if they want reminders. Let them opt in on emails. This is called permission marketing. Seth godin has a while book around it.
Post reply on HN