Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maine passes bill to prevent ISPs from selling browsing data without consent

techcrunch.com

Post reply on HN
Print view View original

221–230 of 233 posts

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#221

Post by xkcd-sucks »

umvi wrote: post #71

Is this personally identifiable? I don't see any issue with collecting and selling anonymized observations. It would be like police setting up cameras and using them to train a machine learning model on drunk driver detection. It's not collecting who is driving, just observing how normal cars subtly drift in and out of a lane and brake vs. intoxicated drifting/braking and using that to train a DUI detection model.

The example, run anonymously, can be no more than unsupervised clustering. In order to train "a DUI detection model" there must be actual DUIs and BACs recorded, which isn't anonymous.

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#222

Post by shrimpx »

malloreon wrote: post #35

I look forward to the day when selling user's data requires the user's opt-in every single time a third party wants to access that data. No more "yes to all" or allowing blanket usage in TOS/EULAs. People who use apps that sell their data should be bombarded with requests to use that data each and every single time, until they either decide the app isn't worth it or the app decides they should try a different busines…

I agree and this points to the problem of "high level, usable TOS/EULA". Today's EULA "culture" is so hopelessly broken. Whereas the software is interactive and intuitive, using readable labels and buttons, the EULA is a couple dozen pages of non-interactive legal fine print. Companies will continue to get away with evil until we come up with better requirements for this nonsense.

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#223

Post by SaltyBackendGuy »

chii wrote: post #207
altfredd wrote: post #193

Earlier quoted context omitted.

This law sound like it was written by data brokers. It does nothing at best and legitimizes corrupt practices at worst. WTF is "consent" doing here? Why would ISP ever need to sell someone's data in order to operate? Do they also plan to explicitly prohibit ISPs from torturing customers and selling their organs? From selling illegal drugs to minors? Dear state of Maine, I too would like to waive all my legal liabilit…

Torturing is currently illegal. Selling customers' data is not currently illegal. Won't the law only help then?

I wonder if they will make you sign a release when you sign up for a service. So you will need to consent to use the ISP.

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#224

Post by kelnos »

PeterStuer wrote: post #119
kelnos wrote: post #75

Earlier quoted context omitted.

> no one wants to have to pay a subscription fee to every single site on the internet. If we had a reasonable micropayments system so I could spend a few cents per article I read online from non-subscription sites, I'd be thrilled. I do not want to see ads, ever. I do not want companies collecting or selling my activity patterns. If I've signed up for something, I don't want my personal details sold to someone else i…

"I will gladly pay my proportion of what's necessary to keep the service running in order to avoid the "you're not the customer, you're the product" mentality." Since both are complementary and independent revenue streams, why do you assume that you paying cash for something does not mean you will be monetized in other ways as well?

That would be the deal. Either I "pay" via targeted ads, or I pay with cash. If you want to mix the two, then you've lost a potential customer (and I just continue to use my ad blocker).

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#225

Post by kelnos »

khawkins wrote: post #168
kelnos wrote: post #75

Earlier quoted context omitted.

> no one wants to have to pay a subscription fee to every single site on the internet. If we had a reasonable micropayments system so I could spend a few cents per article I read online from non-subscription sites, I'd be thrilled. I do not want to see ads, ever. I do not want companies collecting or selling my activity patterns. If I've signed up for something, I don't want my personal details sold to someone else i…

Legislating such a micropayments system would centralize the monetization of internet services in a way unprecedented since the advent of the internet. If you're worried a lack of Net Neutrality would suppress free speech, this would strangle it. You'd create two internets: a bourgeoisie sphere of corporate sites with enough influence to be included in the micropayment system, and the unwashed masses, the sites deeme…

Who said anything about legislation? There's no need for legislation around this.

The problems so far with micropayments infra is that publications don't believe their readers will prefer payment over ads. Which is unfortunately largely true, so anyone starting a micropayments company will have a lot of trouble developing the network effects (both on payer and payee side) to be successful.

I don't know the solution to this, but I'd hope it's not legislation. Well -- a possible solution might be legislation that makes it economically infeasible to run sites on ad revenue and selling data. If we make it onerous or impossible to allow sites to collect and sell data, and make it harder for ad networks to target people, sites will have little choice but to implement subscription schemes, or, hopefully, adopt a micropayments-type structure.

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#226

Post by ocdtrekkie »

tzs wrote: post #218
ocdtrekkie wrote: post #203

Earlier quoted context omitted.

That analogy is completely arbitrary though, and only drawn to serve tech companies' interests. Because Facebook and Google are platforms , not end destinations in themselves. In your analogy, perhaps the ISPs are the highways, and tech companies are the neighborhood streets, but they're both roads. Because you're not trying to get to Facebook, you're trying to get to your grandma's photo album, that unfortunately yo…

You can only get to grandma's photo album because she put it on Facebook. She could have put it on Flickr, or iCloud, or numerous other places. No matter which she chooses, though, to get to it a large number of people only have one choice for high speed internet access to go through. ISPs are low level infrastructure tied to specific geographical locations. If you don't like the infrastructure where you live then ge…

"an alternative is a URL change away" isn't really a true statement. You can move off of Facebook, but you can't move your friends and family off of Facebook. You can use a YouTube alternative to watch videos, but all the videos you want to watch are not going to be there.

Pretending platforms are a wholly different thing than infrastructure, and easily switchable seems willfully ignorant of the real world. Moving platforms is almost as difficult as moving real world locations. And popular opinion aside, most people have two or more ISP options. (I have three wired residential ISPs here, two offering gigabit connections, and at least four wireless carriers.)

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#227

Post by duckMuppet »

altfredd wrote: post #196
ssalka wrote: post #159

Earlier quoted context omitted.

Isn't this covered by: > The bill prohibits a provider from refusing to serve a customer...if the customer...does not consent to the use, disclosure, sale or access [of their data]. ?

> The bill prohibits a provider Nobody cares, what provider does. What matters is whether or not you sign a damn consent form. Suppose, that there is a popular mobile App, written by Zhang Li Ltd. The App allows you to buy travel tickets, receive discounts in local stores and upload contents of your address book to it's servers. After a while you notice, that everyone uses it. Your local store no longer sells large a…

You're not forced to use an app.

You can go on a web browser even a phone browser and do almost all the activities you can do in an app, and not deal with the T&C of the app once declined. Of course, no one does because they can't be inconvenienced. Again, you might believe that you can't check your Facebook/tender/whatsapp/Snapchat/etc, but that's generally untrue for most of them..

In most places due to govt regulation, you only have one or two ISP's serving a geographic area. So the T&C in this case have an actual impact, not some mythical and perceived injustice by "big tech".

Those app providers have the right to suck every last detail from their meatspace, down to what color socks they like on Tuesday and sell it to Hanes.

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#228

Post by kajmagnusmobile »

altfredd wrote: post #196
ssalka wrote: post #159

Earlier quoted context omitted.

Isn't this covered by: > The bill prohibits a provider from refusing to serve a customer...if the customer...does not consent to the use, disclosure, sale or access [of their data]. ?

> The bill prohibits a provider Nobody cares, what provider does. What matters is whether or not you sign a damn consent form. Suppose, that there is a popular mobile App, written by Zhang Li Ltd. The App allows you to buy travel tickets, receive discounts in local stores and upload contents of your address book to it's servers. After a while you notice, that everyone uses it. Your local store no longer sells large a…

What app do you have in mind? I don't live in the US so maybe I haven't heard about it. I searched for "Zhang Li app" but found only game apps

Re: Maine passes bill to prevent ISPs from selling browsing data without consent

#230

Post by shanty »

wildrhythms wrote: post #220
shanty wrote: post #132

Earlier quoted context omitted.

I wasn't responsible for the data intake, but I know that the data was extensive, and always included time on page, full URL, other request information (often post stuff). I know that HTTPS provided a technical hurdle that our company and data providers worked around after about 6 months. My guess is that some MITM-type collection? Some data providers gave us IPs and some just gave us some Tokenized ID. I don't know…

>get a bigger picture of who you are. Sorry if I'm reading too much into this, but are you saying this data being collected and sold contains PII?

Well, PII is a bit of a nebulous term. Some websites still transfer some signup/user info in url parameters or unencrypted responses. We would even see SSNs pop up now and then.

Most data being sold has some good faith effort to remove PII, but that's never 100% complete, and by utilizing multiple data sources, an industrious person or team could de-anonymize your data. We were mostly doing this type of work for segmentation and persona analysis. Targeting an individual was never a goal, but would not have been terribly difficult.

I'll give you an example. We might receive all urls a person visited. Many contain person information that would not be caught in usual PII filtering process: https://mail.google.com/mail/u/1/#search/my+viagra+prescript...

Post reply on HN