Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

23andMe updates their TOS to force binding arbitration

stackdiary.com

Post reply on HN
Print view View original

21–30 of 252 posts

Re: 23andMe updates their TOS to force binding arbitration

#21

Post by thrtythreeforty »

hsbauauvhabzb wrote: post #8
consumer451 wrote: post #2

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

I fully agree with everything you say, but until legislation is enforced you can hardly blame a company for capitalizing on the lack of privacy laws (you can still hate them). Point is, start demanding legislation around data privacy and security to anyone who will listen.

There's no law against being a dirtbag but I am definitely still going to blame you for being a dirtbag. You could always choose... not to be a dirtbag.

I would rephrase your point, "don't be surprised when a company capitalizes on lack of laws" -- this I agree with. It's virtually a force of nature.

Re: 23andMe updates their TOS to force binding arbitration

#22

Post by space_fountain »

deckeraa wrote: post #7

The more TOS I read through, the more it seems we need a "common law" solution. (I use the term "common law" loosely here) Something like a couple of pre-defined categories for software services (e.g. info provider, social network, real-world interface) with pre-set rules (e.g. the client cannot attempt to break the social network; the owner of the social network cannot re-sell data to a third party). We have somethi…

I like this idea, but I think it's not flexible enough. Instead my over complicated dream is to allow companies to propose new TOS in a similar way to new top level domains. They can put in a lot of money and add TOS language to the approved list, but then anyone can use that language. Ideally the pricing would be such that only 10 to 50 unique TOS would exist at any point in time

Re: 23andMe updates their TOS to force binding arbitration

#23

Post by spondyl »

There is perhaps one upside.

As it turns out, when binding arbitrarion is forced, those very same companies can't handle the caseloads that come with thousands of cases being filed individually so it can be a bit of a footgun

https://www.nytimes.com/2020/04/06/business/arbitration-over...

Re: 23andMe updates their TOS to force binding arbitration

#24

Post by space_fountain »

gen220 wrote: post #19
deckeraa wrote: post #7

The more TOS I read through, the more it seems we need a "common law" solution. (I use the term "common law" loosely here) Something like a couple of pre-defined categories for software services (e.g. info provider, social network, real-world interface) with pre-set rules (e.g. the client cannot attempt to break the social network; the owner of the social network cannot re-sell data to a third party). We have somethi…

It's difficult because digital ToS are so tightly tailored to your business, and digital businesses are so malleable and formless. If you went through the effort to standardize your ToS, it would only be "useful" to a tiny handful of businesses at specific points in their growth trajectory. Regulations like GDPR are a top-down approach to the privacy component of a Terms of Service (i.e. there are only so many variat…

Is that true? Often ToS seem to mostly consist of boilerplate that's copied from business to business

Re: 23andMe updates their TOS to force binding arbitration

#26

Post by anon35 »

consumer451 wrote: post #2

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

This 2021 New Yorker article: How Your Family Tree Could Catch a Killer (https://www.newyorker.com/magazine/2021/11/22/how-your-famil...) was incredibly illuminating and changed my perspective on our sense of privacy. With a surprisingly small fraction of the world's population sequenced, we can still match a sample to a person whose sequence we don't have. To quote the article: "Genetic genealogy, it turned out, could function as an all-purpose de-anonymizer".

So perhaps be less upset that Mom signed up; our DNA really isn't ours in the same way the documents on our hard drive. You were never going to be able to opt-out.

Re: 23andMe updates their TOS to force binding arbitration

#27

Post by gorgoiler »

consumer451 wrote: post #16
hsbauauvhabzb wrote: post #8

Earlier quoted context omitted.

I fully agree with everything you say, but until legislation is enforced you can hardly blame a company for capitalizing on the lack of privacy laws (you can still hate them). Point is, start demanding legislation around data privacy and security to anyone who will listen.

I feel like I can blame the humans involved with 23andMe specifically, as they are the specific humans who allowed unknown 3rd parties to have enough of my DNA to profile my family and myself. However, I entirely agree with your last statement. I would like to call upon anyone who appreciates privacy to get behind a neural bill of rights. While it sounds a bit "tin foil hat" at the moment, non-invasive brain–computer…

By “unknown third parties” do you mean the hackers? The breach was bad but not that bad — it didn’t include your genetic material.

> The stolen data included the person’s name, birth year, relationship labels, the percentage of DNA shared with relatives, ancestry reports and self-reported location.

https://techcrunch.com/2023/12/04/23andme-confirms-hackers-s...

Re: 23andMe updates their TOS to force binding arbitration

#28

Post by neilv »

Regardless of TOS, relatives who never agreed to the TOS may still have standing.

Will some non-TOS-signing relative who was impacted by the data breach lead a trillion-dollar class action suit?

(Class action, with the goal of putting a healthy fear of the public into abuse-inclined industry. Not the class action goal of letting a misbehaving company pay off liability with a small percentage of their gains from misbehavior, in exchange for making a few lawyers wealthy.)

Re: 23andMe updates their TOS to force binding arbitration

#29

Post by jen20 »

dudul wrote: post #12
consumer451 wrote: post #2

My mother innocently used this service, and filled out the form identifying all relatives by name. The results she received were entirely unenlightening, 50% of my DNA is now in their sketchy database, and I have no way to opt-out of anything. I truly despise this organization.

What does "innocently" mean in this context?

I'd assume: "with the understanding of a layman who believes the marketing claims they make without understanding the problems inherent".

Re: 23andMe updates their TOS to force binding arbitration

#30

Post by rpmisms »

space_fountain wrote: post #22
deckeraa wrote: post #7

The more TOS I read through, the more it seems we need a "common law" solution. (I use the term "common law" loosely here) Something like a couple of pre-defined categories for software services (e.g. info provider, social network, real-world interface) with pre-set rules (e.g. the client cannot attempt to break the social network; the owner of the social network cannot re-sell data to a third party). We have somethi…

I like this idea, but I think it's not flexible enough. Instead my over complicated dream is to allow companies to propose new TOS in a similar way to new top level domains. They can put in a lot of money and add TOS language to the approved list, but then anyone can use that language. Ideally the pricing would be such that only 10 to 50 unique TOS would exist at any point in time

So instead of the richest companies setting the standard for what a TOS contains.... The richest companies would formally set the standard for what a TOS contains.
Post reply on HN