Would you then pay for the services in full that you now could use for free?
How many people will accept the deal, and why doesn't it already exist?
Or to ask a different question, will companies demand $20 for the services instead of offering it for tracking-as-payment? How will they fare against less polished services that are given away for free by people who run it on their spare time?
If we are comparing a regular $40-$20 software sale to pay-by-tracking, then the people being tracked need to generate personal information that is worth equal amounts. It need to have mass market appeal in order to generate billions. How will pennies per day tool-bars do that?
Further, I believe a service like Google Contributor does what you're implying, but it doesn't get much press - which doesn't surprise me: the overall market deems free content worth that privacy "trade-off."
I don't understand why this is necessarily a "bad" thing -- it's like the equivalent of a real-estate broker telling me that 10/20 houses on a block have 2 bedrooms, and the other 10 have 3 bedrooms, even though I know nothing about the people living in those houses.
For example it is forbidden to take organs from people as payment. We could forbid taking certain private data from masses of people as payment.
If you are criticising that people are not willingly and knowingly entering into agreements with Facebook or Google, that is another debate. Yes I think there should be the utmost level of transparency and regulatory action on that front is justified in my view.
But telling people that they cannot trade access to personal data for access to services goes way beyond the role I think governments should have.
If that sort of thing is prohibited, how can a government allow its people to make any decisions that potentially affect their safety and their future, like choosing a career path, choosing a place to live, making decisions on health, education, kids, etc?
And now please explain to me what sort of voluntary agreement does not have negative externalities when it occurs en masse! Voluntary agreements inevitably create markets and markets have well known negative externalities. Even the democratic process itself has negative externalities. On that basis you can ban everything.
I'm not against all regulation, but your justification is way too general. It leads straight into authoritarianism.
Outright bans are the strictest form of regulation. They should only be used as a last resort.
We don't even ban industrial scale cruelty towards animals and now we should ban voluntary trade in personal data? That seems completely out of proportion.
Now, there is actually precedent for banning consenting adults from sharing private information in order to ensure the survival of the democracy that is quite common in stable democracies: You are usually not allowed to prove to third parties how you voted in an election. That's only because of the externalities that that can have on the democracy if third parties can pressure you into voting a certain way/can buy your votes.
Not just that, it's also about weighing the restrictions on personal freedoms against the extent of negative externalities. In some cases the protection of personal freedoms is absolute. The ban on torture is a precedent for that.
>Now, there is actually precedent for banning consenting adults from sharing private information in order to ensure the survival of the democracy [...]
It's a precedent only if it's comparable, which it isn't.
You are overstating your case. There is no reason to believe that letting an algorithm parse some of your data for clues as to what you might want to buy makes democracy fall apart.
What is likely to have an effect on democracy is when governments analyze data for political reasons. Where that happens, people will simply stop volunteering so much private information. They don't need to be banned from doing that.
What if companies analyze data for political reasons?
> Where that happens, people will simply stop volunteering so much private information. They don't need to be banned from doing that.
Except that they don't. Heard of a certain Edward Snowden, maybe?
Except that they can't because the data is already there and isn't under the control of the affected people?
Except that the nature of data is that people don't know how it's being processed?
Except that there are network effects that limit people's actual freedom to decline using a quasi-monopolist's services?
Your argument could pretty much be applied to the Stasi in the GDR: Do you have an idea what the consequences were when individuals simply stopped providing more data?
Your logic is flawed. You are reversing cause and effect. Where there is a lack of democracy, privacy is often taken away in order to make it easier to oppress political opponents. But giving up some privacy in exchange for services doesn't make that happen. Yes the Stasi would love Facebook's database, but using Facebook doesn't cause the Stasi.
Snowden isn't proof of that at either. The NSA hasn't hunted down and imprisoned supporters of Bernie Sanders after all, has it? American democracy hasn't fallen apart and where it is lacking it has little to do with Facebook.
But please don't get me wrong. I find it very problematic when governments scan everybody's data. It could have an effect on how people behave even if it doesn't make democracy fall apart. It may deter people from doing perferctly legal things because they could be misinterpreted. None of that is voluntary though. I haven't given the NSA permission to scan my data at all.
I don't use Facbook and I am very careful with information I make available publicly. I just don't feel very threatened by any negative externalities created by those who choose to use Facebook.
My problem with your line of thinking is that you are extrapolating every single danger to the extreme until you arrive at the conclusion that people must be banned from ever making these choices. As I said, you can ban everything based on that sort of thinking.
Your logic is flawed. You are reversing cause and effect.
There simply is no unidirectional causation between lack of privacy and lack of democracy. Obviously, the Stasi took away privacy in order to suppress democracy. And at the same time, the lack of democracy helped with establishing and maintaining the Stasi. It's a positive feedback loop.
> Yes the Stasi would love Facebook's database, but using Facebook doesn't cause the Stasi.
Does using Google cause the NSA? No. Did the NSA take advantage of the data collected by Google (by eavesdropping on their internal communication), thus increasing their power? Yes.
Things aren't simply a linear chain of causes and effects. There are lots of factors contributing to certain historical developments, there are feedback loops, it's complicated. In particular, the development of power structures doesn't care about intentions behind a source of power. When the Netherlands collected information about the religion of their citizens prior to WW2, they didn't have an intention of killing all jews. But the database confers the power to find them very efficiently. Which is what the Nazis did when they invaded.
As you yourself say, the Stasi would have loved Facebook's database. Does that mean that Facebook is the Stasi? No. Does that mean that it cannot possibly attract interest from people who want to use it like the Stasi, who might end up getting access to it, thus contributing significantly to the establishment of an authoritarian dictatorship?
> Snowden isn't proof of that at either. The NSA hasn't hunted down and imprisoned supporters of Bernie Sanders after all, has it? American democracy hasn't fallen apart and where it is lacking it has little to do with Facebook.
1. So, even if that abuse by the state did not happen, what about all the abuse by the state that indeed does happen? What do we know about which role the NSA plays in those cases?
2. More importantly: What kind of evidence would you accept to consider something a risk to democracy? So far, it seems like democracy needs to have been destroyed before you accept that whatever has caused it to fall apart could indeed cause a democracy to fall apart.
> But please don't get me wrong. I find it very problematic when governments scan everybody's data. It could have an effect on how people behave even if it doesn't make democracy fall apart.
Well, except that is a major way in which it does? Surveillance changes how people discuss their opinions. People changing how they discuss their opinions is how people end up making different choices in elections. An idea that's not being discussed is less likely to gain support in an election.
Imagine a world where everything was being monitored by a Stasi-like entity, but with the exception of actually fair, secret, democratic elections, where citizens actually knew and could verify that the elections were fair and secret. Would you consider that a functioning democracy?
> It may deter people from doing perferctly legal things because they could be misinterpreted. None of that is voluntary though. I haven't given the NSA permission to scan my data at all.
1. The externalities of people using facebook aren't voluntary either.
2. The point wasn't whether you have given them permission, but whether the majority of people have given them permission. Your claim was that people would stop volunteering their data. If you go by the general reaction to Snowden's relevations, people don't care. It's probably not informed consent, but neither is it with Facebook.
> My problem with your line of thinking is that you are extrapolating every single danger to the extreme until you arrive at the conclusion that people must be banned from ever making these choices. As I said, you can ban everything based on that sort of thinking.
Except I don't, that's just your interpretation. Just because I don't write pages upon pages for a short HN comment, doesn't mean that there isn't any more reasoning behind it.
I'm not convinced that this is reason enough to ban advertising based business models in democratic countries. We can't live our lives preparing for the day democracy ceases to exist. Any negative effect the lack of privacy has on stable democracies seems small and rather speculative in the first place. I don't believe it's a real threat. You do believe that. So we're going to have to agree to disagree on that one.
Also, I'm not convinced that globally the effect of Facebook, Google or Twitter on democracy is a negative one. On the contrary. Free services provided by overseas companies are often the only way for people in undemocratic countries to get around their local police state. Pay services are even more at odds with privacy than ad based business models.
Well, yes, but I think it's a mistake to divide the world into "undemocratic regimes" and "democratic paradise". It's a sliding scale and not a binary distinction, and every democracy on earth has some rather undemocratic stuff going on.
> I'm not convinced that this is reason enough to ban advertising based business models in democratic countries.
Not advertising based business models, but surveillance based business models.
> We can't live our lives preparing for the day democracy ceases to exist.
The point isn't to prepare for the day democracy ceases to exist, but to prevent it from ceasing to exist. Why can't we do that?
> Any negative effect the lack of privacy has on stable democracies seems small and rather speculative in the first place.
How do you know that?
> I don't believe it's a real threat. You do believe that. So we're going to have to agree to disagree on that one.
Nope, we don't have to "agree to disagree". I don't just believe that because I believe that, I believe that for what I think are good reasons, which can be examined for their logical consistency and for consistency with reality/evidence. Now, possibly you aren't interested in doing that, which is your decision to make, but that's not some kind of unavoidable fate, it's simply your disinterest in the matter.
> Also, I'm not convinced that globally the effect of Facebook, Google or Twitter on democracy is a negative one. On the contrary. Free services provided by overseas companies are often the only way for people in undemocratic countries to get around their local police state. Pay services are even more at odds with privacy than ad based business models.
Possibly. Though it should be noted that free services do not necessarily have to be surveillance-based services. There are lots of free to use IRC networks, for example. Or Tor is also free to use. But those are not surveillance-based offerings. And not even advertisement has to be surveillance-based.
>How do you know that?
I don't claim to know anything with any certainty. That's why I used the word "seems". You are the one who is making extraordinary claims based on extremely thin evidence. You are claiming with great certainty that giving up any private data to advertisers makes democracy fall apart, and yet you are unable to point to a single stable democracy that has fallen apart for that reason. Your sample size is zero.
>I believe that for what I think are good reasons, which can be examined for their logical consistency and for consistency with reality/evidence.
I have examined your reasons, and even though I can follow you on many individual details, I find your main conclusion contrived, exaggerated and inconsistent with the thin evidence we have. You are overstating your case.
This is a very common way in which predictions of doom tend to go wrong. Take one aspect, follow it to extreme conclusions as if there were no other variables or counter forces or reactions to what is happening. This isn't logic or consistency.
And this lack of a good model starts where we haven't even discussed what privacy or private data is in the first place. It's definitely not one thing that you can switch either on or off. We always have to trust someone with some of our data. Much of our "private" data isn't ours exclusively as it may be about interactions with others. The data we give up to advertisers isn't used exclusivly for advertising either. It's also used to provide some of the services we want (like search or spam filtering).
"Ban it all!" is neither proportionate nor even possible.
And even if I did follow your argument that giving up any privacy at all makes democracy fall apart, I see no alternatives to advertising that are better for privacy.
Just look at the numbers involved and you will quickly find that funding everything like Tor or a few IRC channels is impossible. Donations, self-funding and sponsorship involve payment and are subject to extremely detailed surveillance. There is nothing more heavily regulated and traced than payment and you can be absolutely sure that governments will never allow large anonymous money flows because everything that could fund something like a Google data center could also fund organized crime and terrorism.
That said, I also see a lot of negatives in the excessive and brazen behavior of the ad industry, and I also think there is a need for regulation. A better regulated ad model is our best shot at more privacy and fewer negative externalities.
Sure, I don't expect certainty, just some justification. Are you saying it's just wild speculation on your part?
> You are the one who is making extraordinary claims based on extremely thin evidence. You are claiming with great certainty that giving up any private data to advertisers makes democracy fall apart,
First of all, I don't actually make that claim. I can see how you maybe can get the impression from the short version (as I mentioned, it's kinda hard to condense a complex topic into an HN comment), but really, it's a matter of the severity of the possible consequences combined with non-trivial probability. Which is one reason why the comparison to laws regulating how you cannot prove to other people how you voted in an election is an insightful one: Those restrictions don't exist because the probability is particularly high that any given election would be corrupted, they exist because the downside is massive if it happens even once under the wrong circumstances. We make every single election more complicated than usually necessary, in order to help protect against the few cases where the consequences would be catastrophic, even though there is not even remotely a guarantee that that would ever actually happen.
An important question to ask is: Does a stable democracy protect against those risks, or is preventing those risk by other means what keeps the democracy stable?
> and yet you are unable to point to a single stable democracy that has fallen apart for that reason. Your sample size is zero.
May I suggest that your categorization is counterproductive?
Suppose I build a bridge from papier-mâché made from cardboard that was used to package the iphone 7. You might argue that that's not a reliable bridge and it shouldn't be opened to traffic because of the risk that it might collapse, given the track record of papier-mâché and our knowledge of physics. Now, I would reject all your arguments by pointing out that no bridge built from cardboard that was used to package the iphone 7 had ever collapsed and that your sample size is zero, and that we therefore have no clue whether that bridge is a risk to public safety. Would you agree?
It's hardly surprising that that specifically hasn't happened yet, given that the technical developments are relatively new, and some of it is yet to happen. That doesn't mean that we can't draw any conclusions from similarities to other power structures in history, or that we have no clue how current or expected future technology could be abused.
> This is a very common way in which predictions of doom tend to go wrong. Take one aspect, follow it to extreme conclusions as if there were no other variables or counter forces or reactions to what is happening. This isn't logic or consistency.
It seems like you are just filling in the holes in what I wrote with the most idiotic ideas that I could possibly have, and then you pretend that strawman is what I actually wrote.
BTW, as far as I can tell you are making that exact mistake in the opposite direction: You find some aspect that isn't necessarily quite as bad as my simplified model desribes it, as there is some other influencing factor or some counteracting force that could decrease the impact, and from that you conclude that therefore a catastrophe is completely unrealistic.
> And this lack of a good model starts where we haven't even discussed what privacy or private data is in the first place. It's definitely not one thing that you can switch either on or off. We always have to trust someone with some of our data. Much of our "private" data isn't ours exclusively as it may be about interactions with others.
As you say, we haven't discussed it. From that it doesn't follow that my concepts are idiotic.
And yes, I agree that privacy is not a binary distinction, nor is privacy an end in itself, nor is some sort of "total privacy" a sensible goal, let alone achievable.
The root problem is that personally identifiable information confers power. Power is not inherently bad either, nor something that could realistically be avoided completely. But if there is one lesson we as humanity should have learned from history, very much the hard way, it is that concentrations of power are dangerous. There is no clear line between how much concentration of power is harmless and where the danger begins, but it still is quite clear that too much of it in one place/in one person's hands is a terrible idea.
If you think about it, the whole point of democracy (and the rule of law and checks and balances) is to prevent concentrations of power. And we accept a lot of inefficiency in the government, compared to dictatorships, in order to maintain that distribution of power. The laws governing the election process are only a small part of how we build democratic societies with lots and lots of expensive safeguards to prevent the concentration of power.
> The data we give up to advertisers isn't used exclusivly for advertising either. It's also used to provide some of the services we want (like search or spam filtering).
I think most of the data shouldn't really be necessary to achieve a sufficiently similar result.
> "Ban it all!" is neither proportionate nor even possible.
Depends on what exactly you mean by "it all".
> And even if I did follow your argument that giving up any privacy at all makes democracy fall apart, I see no alternatives to advertising that are better for privacy.
Is it intentional that you are equating advertisement and surveillance?
> Just look at the numbers involved and you will quickly find that funding everything like Tor or a few IRC channels is impossible. Donations, self-funding and sponsorship involve payment and are subject to extremely detailed surveillance. There is nothing more heavily regulated and traced than payment and you can be absolutely sure that governments will never allow large anonymous money flows because everything that could fund something like a Google data center could also fund organized crime and terrorism.
Why is it necessarily a big problem that payment is subject to surveillance in this context? How is surveillance of the fact that the average human in the industrialized world pays a certain amount of money per month for telecommunication and data storage services equivalent to surveillance of the contents of their interactions with each other?
Also, who says that we need something like a Google data center?
> That said, I also see a lot of negatives in the excessive and brazen behavior of the ad industry, and I also think there is a need for regulation. A better regulated ad model is our best shot at more privacy and fewer negative externalities.
And I don't think there is one that's going to improve much other than to forbid the collection of personally identifiable information, possibly unless it's completely optional (not in exchange for anything) with requirement for informed consent before any data is collected and with the option to revoke consent at any point, in which case all collected data about a person would have to be deleted immediately.
>Why is it necessarily a big problem that payment is subject to surveillance in this context? How is surveillance of the fact that the average human in the industrialized world pays a certain amount of money per month for telecommunication and data storage services equivalent to surveillance of the contents of their interactions with each other?
If payment wasn't for specific websites or content then it wouldn't be a privacy problem at all. But how does that money get allocated fairly to individual websites without putting governments (or someone else?) in a position to say yay or nay to funding pornhub.com or alt.com?
... which is a completely different problem than funding services such as those provided by facebook and the benefits in terms of communication possibilities those services provide.
One problem is the funding of infrastructure, another problem is the funding of the production of "content". Those happen to be intertwined a lot at the moment, but that's not a technical necessity, but rather a result of the current business models that build on surveillance (and the creation of de-facto monopolies and the subsequent potential for vendor lock-in).
It would be relatively unproblematic to fund development of infrastructure with donations or even tax money--think development of open standards/protocols and possibly reference implementations of those protocols. Then, it's unproblematic for most people to pay directly for the operational costs of processing and storing their own data (that is, computers running implementations of those protocols, storage devices, bandwidth). None of that requires anyone to have any access to or control over the actual content that people communicate. For that aspect, there is no need to have "websites". The central entity is completely unnecessary, you simply pay directly for the actual costs of the technology without the need to reveal anything about what you communicate or process or store.
As for the funding of content production: I think we have to have some possibility to pay for that anonymously if we want to keep democracy stable. We can buy newspapers with cash without leaving much of a trace in anyone's database as to which paragraphs of which articles we read. Letting terrorism paranoia destroy that would be a terrible idea. Also, as I have repeatedly said, I don't understand why you seem to be constantly equating advertisement and surveillance. Just because you can use surveillance to make advertisement more efficient, doesn't mean that advertisement without surveillance is useless.
It's not a different problem at all. Facebook is not infrastructure. They provide content and communication services that many find useful but not everyone does. It's exactly the same with porn.
> As for the funding of content production: I think we have to have some possibility to pay for that anonymously if we want to keep democracy stable.
Good luck with that. So far it hasn't worked on digital platforms and I fear it never will. There is very little governments pursue as vigorously as cracking down on unexplained money flows. They will stamp out anything that reaches mass appeal with an iron fist.
Also, making people pay for everything puts poor people at a great disadvantage.
>Also, as I have repeatedly said, I don't understand why you seem to be constantly equating advertisement and surveillance.
That's right, I have been doing that. Mainly because the link between advertising and wanting to know as much as possible about potential buyers is very strong indeed. Advertisers will always be highly motivated to find ways around any ban. It's unenforceable.
You may ask why I am so confident that governments are able to enforce a ban on anonymous payments and so pessimistic about them enforcing a ban on ad targeting. It's because there aren't that many payment networks and they are highly regulated in the first place.
Financial sector regulation is extremely deep. You can't regulate millions of service/content providers worldwide in the same way. It would take enormous resources and international treaties that take decades to negotiate. In the end you would have something that doesn't just enforce an ad targeting ban but also provides ideal opportunities for censorship.
If you enforce a ban only for the big US based internet companies, then others will will quickly take over their ad business. If Baidu and Yandex can show us personalized ads but Google and Facebook can't, then ad money is going to Baidu and Yandex and they are going to subsidise mobile phones and other free offerings. It's not going to be long until we're back to square one in terms of privacy.
But I do think it is possible to force the biggest internet companies to not use some particularly privacy hostile practices like real name policies, browser fingerprinting and a couple of others. The goal should be to let them target ads all they want, but allow people to unlink their real identity from that ad targeting profile.
I am not sure what you are trying to tell me here?!
Also, Facebook provides content? I don't use them, so what do I know, but from what I understand, Facebook only provides the platform for others to publish content and to communicate through, don't they?
> Good luck with that. So far it hasn't worked on digital platforms and I fear it never will. There is very little governments pursue as vigorously as cracking down on unexplained money flows. They will stamp out anything that reaches mass appeal with an iron fist.
I am not sure what your point is here?! Government will try to expand surveillance as much as possible, therefore, we should accept surveillance? I mean, I agree that it might not be easy, but I didn't say that it would be easy, but that there will be bad consequences if we don't, whether easy or not.
Also, perfectly legal possibilities to pay anonymously online for small amounts do exist, such as paysafecard.
> Also, making people pay for everything puts poor people at a great disadvantage.
Making people pay for everything and surveillance are not the only options. You can have donation-funded stuff, you can have publicly funded stuff, you can have advertisement funded stuff, and also, you should have a social security system that provides for people's ability to participate in culture. None of that requires surveillance.
> But I do think it is possible to force the biggest internet companies to not use some particularly privacy hostile practices like real name policies, browser fingerprinting and a couple of others. The goal should be to let them target ads all they want, but allow people to unlink their real identity from that ad targeting profile.
What do you mean by "real identity"? The name on the birth certificate? How does that limit any of the potential abuses of the data that's being collected? Or what else do you mean by that? Which data specifically should they not be allowed to collect?
As for the ban being unenforcable: Well, I am not that sure. Sure, the US cannot regulate what tracking Yandex does. But you sure can regulate what business a US company can do with Yandex, and Yandex won't advertise for US businesses for free.
Also, there is no need to be 100% effective. The problem is mass-surveillance, not that some company might know everything about a bunch of people. As far as the abuse potential is concerned, regulating 80% of the market probably is more than good enough. The problem, after all, is a concentration of power. A few million companies that make up the remaining 20% of the market are most likely not a concentration of power.
As for the supposed connection to censorship: How is that supposed to work?!
The difference between that and seemingly "ordinary" data is that HIPAA data can be used against us unfairly.
I argue that's the case now, and we have proof it is already happening. You better bet your bottom dollar insurance companies and the likes are mining social media to charge different prices based on silly facebook posts
http://www.cnbc.com/2014/04/16/data-mining-is-now-used-to-se...
It's only a matter of time before police forces will begin to use these same techniques to "optimize policing"
We live in a different time now. Our data is not as harmless as it used to be. Hackers can attack various sources of services and build complete picture of peoples lives. Companies are using data mining techniques to leverage people's private interaction with friends and families against them. The worst part about it is -- it's complicated, and we have a technically inept Congress that barely understands the implications of all these technologies, and we will soon have a technically inept soon to be incumbent president, so these legal issues are not going to get any better.
this, plus what zAy0LfpBZLC8mAC mentioned, until we have the right to "be forgotten" or the ability to have our records completely purged after a period of time -- like you do with debt, like you do with criminal records, like you do with basically any public record, we will have these privacy issues. Right now if you want to purge false information about yourself on the internet, you have to go through hell and back (trust me, I've tried, Salon has had a completely fabricated story about me for almost 10 years now. I send an email every week asking them to redact my name from that article. Unless I seemingly spend hundreds of thousands to fight their legal arm, it's probably never going to change.)
For example, if you are not allowed to accept personal data without detailed (and interactive) information about possible uses, perhaps signed. Or if you constrain the actual uses to those that have been enumerated, in full detail, before consent was given.
One the primary "banning" arguments I hear basically boils down to "people don't understand what they are agreeing to", which I think holds some truth.
What we cannot do is to completely protect people who don't give a shit from any and all consequences of their own laziness.
I accept as a fact of modern life, that I unless I want to go be a hermit in the woods, I'll find myself entering into many contracts of adhesion that go against my ideals. And that as much as I try to limit this (not using facebook or whatsapp) I can't actually escape them entirely.
It is disingenuous to think that either (a) people fully understand and knowingly make the agreements they do w/r/t data or (b) do so willingly.
To draw the conclusion that it's just adults freely consenting in light of the previous paragraph is sophistry.
But if most people are in fact fine with granting access to their personal data in exchange for services then peer pressure on the rest of us who refuse the deal cannot be justification enough to ban the entire business model.
I'm in the same boat as you. I refuse to use Facebook.
To be honest I don't mind the mining so much, as long as I know there is some "protection" for my data - as is under discussion here. I do object to annoying poorly targeted ads though.
I don't use them free, I pay with my information. I just don't know exactly how much I'm paying.
I'm happy to pay in either form, as long as I know exactly what I'm paying.
As a consumer I'd also like a way to force my data to be deleted, and be notified if my data is being sold or transferred by an acquisition or something, but I'm not sure how that would work.
What I don't want is not having the ability to "pay with data". I don't want to subscribe to everything out there, and paywalls threaten the web as we know it. Plus there are times where I want to be tracked. If a company has info on how I use the product, they can improve it for me.
ALL of it, too. Every time. Not just what was collected since last report. Even require that they provide it on physical media if desired. Again, for free, including postage.
"But that will be so expensive because we collect so much and never get rid of any!"
... yeah, so what?
Now they're free to do it but can't hide what they're collecting and can't hold your data hostage. And there's some cost associated with collecting more than is absolutely necessary.
Edit, clarification:
- this does not mean that I want to pay an monthly fee to use pro features on static apps. Anyone who does this instantly loses a star in the review as soon as I get around to it.
- however I also understand and appreciate that I sometimes can pay a higher up front price to support the developer(s) for apps that works offline without a service connection.
- feature keys or even donation addons etc to support further development are also well received. This nicely aligns the incentives for developers/users.
- and finally, for some select projects I would think it would be OK with a subscription that gave me all new features as they arrived.
But I can't see why a company like FB would be interested in offering a privacy enhanced version of this service. What could they reasonably expect a user to pay, 10 dollars a month? User data brings in far more revenue than that 10 dollars per user per month. I would think that 10 dollars is peanuts to them by comparison.
It's a mere launch rock page, but i am gauging interest on the project. I actually have a big portion of ready, and rest under work, but finding people to pick up the idea is tough.
Everybody say they'll pay, but it's different from actually doing.
On the other hand, paying a dollar a month to use a service like email doesn't pose a technological problem. But since most services, unlike email, are walled gardens, I can't pay a provider to give me access to e.g. WhatsApp or Facebook without serving ads or collecting my data.
The promise is with sufficient adoption by users and pubs, new pubs will have incentive to do this. Except maybe apps by large corporations.
I still think they would make their nut. They would still be winners!
And yes--I would pay for the right service, if they couldn't manage to compete by being hobbled with not targeted advertising. I paid for many websites before Google made advertising a science.
(My post has nothing to do with advertising. I get advertising. Just leave my info. out of it.)
I have a similar prediction. There will come a time when companies with the USP of user data would be struggling to keep themselves afloat. What happens to user data, then? Will the organizations sell user data to keep them afloat?
https://medium.com/foursquare-direct/foursquare-predicts-chi...
Look at Google Analytics for the perfect example: Millions of websites help Google collect data, but they only ever get anonymized data in return. Google keep the valuable stuff to themselves.
So many clueless people are freaking out over this, completely ignoring the fact that sharing user data between companies like that would be highly illegal in many countries and get them fined to hell and back if they were seriously stupid enough to consider it, which they aren't.
Collect any data you want if and only if you have the informed consent of the user. This means explaining in detail what you're intending to collect and gaining permission first (opt-in).
> This information can never be sold.
Sell the information if you want (that was collected with informed consent of the user), but collecting data brings a responsibility of care for that data and liability for any problems that happen because those records were stored.
Doesn't this already satisfy your requirements?
It is, of course, well known that users never read TOS / EULA for software or services.
Exactly. So I printed it out, made the changes I wanted to see, signed it and send it to Facebook with a notice that continuing to provide me with service constitutes acceptance.
I didn't really do this, but it seems like it should be as legally binding as a click through EULA.
If your argument is that click-through agreements are invalid in general, then no Internet services at all are legal, no matter how benevolent their TOS is to the user, how simple it is, or how clearly it's written and presented. The same goes for software licenses.
The law says that by default, absent a contract that says otherwise, you are not allowed to use software, and you are not allowed to use online services that require login and a TOS click-through. If you want to use them, you have to agree to some offer made by the provider or the copyright holder. And you can only agree to an offer they actually make.
I'm not talking about WhatsApp.
> users never read TOS / EULA
Then the user hasn't given informed consent! It's the responsibility of the collecting party to make sure that the user is aware of all aspects of the transaction.
Should the user be required to correctly answer some quiz questions about the TOS every time they use the product? I don't think any users would agree to that, for any product.
Do you have a positive example of how to do this successfully?
Well, that's technically a problem of service provider. If you're afraid your product won't be used because of a complicated TOS, then... simplify the TOS. Drop the tons of legal bullshit, and stop hiding shady stuff in it.
The more I think about it the more I like the incentive structure it creates.
Licenses are long and complex not only because they have "bullshit" and "shady stuff" in them. This is an unfortunate fact of life.
It's true that some services can do with much simpler TOS. The BSD 3-clause license is 220 words long (most of them in scary caps). But how short and simple does a license need to be to make the average user actually read it before clicking OK? My guess is most users would read 1-2 sentences. But some users, as soon as they see a dialog with a single "OK" or "Next" button or an "I agree" checkbox, will automatically click it without reading any text at all: this can be practically muscle memory for people used to next-next-finish installation wizards.
None of those licenses are for the user of the software. Some are long(-ish) because they address copyright law and are intended to be read by software authors and distributors, who presumably have the luxury of time to read and research which license they would like to use for their software or 3rd party software they want to redistribute.
> Licenses are long and complex not only because they have "bullshit" and "shady stuff" in them.
That's fine. Now find a way to explain it plainly to the user so they can make an informed decision.
> But how short and simple does a license need to be to make the average user actually read it before clicking OK?
Well, that varies, but you can be sure that anybody that clicked OK after only a few seconds did not read anything. Choosing to continue when you know the contract wasn't read is prima facie evidence that no contract was established.
However, the larger problem is you think simply presenting legalease and waiting for someone to click OK can ever meet the standard of informed consent[1], which is a much stronger requirement than the click that's required for some contracts. Contract law is sufficient for most of what's in an TOS, but data is very important and most people have a poor understanding of what is being collected and what is possible when their data is aggregated with other sources. To protect people, the higher standard of informed consent should be used before collecting any data. This would only apply to the data you want to collect, not the entire TOS.
[1] https://en.wikipedia.org/wiki/Informed_consent#Valid_element...
Of course licenses are for the user! Without a license, copyright law forbids you from downloading and running an application, let alone copying it to your other PC or emailing a copy to your friend. Addressing copyright law doesn't makes licenses longer, it makes them exist in the first place.
It's true that the GPL talks about some additional things like access to the source and the right to modify it, which ordinary, non-programmer users don't care about. But you also need it, or some license, to use the software at all. The BSD one is much simpler, but it's still a license and still needed.
Networked services don't fall under copyright law, but other laws exist that prohibit accessing a service (if it requires authentication) except under such terms as the service provider offers to you in a license or other contract.
Another example: when you edit a Wikipedia page, you are presented with this text:
> By saving changes, you agree to the Terms of Use, and you irrevocably agree to release your contribution under the CC BY-SA 3.0 License and the GFDL. You agree that a hyperlink or URL is sufficient attribution under the Creative Commons license.
The linked Terms of Use, CC BY-SA, and GFDL contain many thousands of words combined, and require a grounding in copyright law to fully understand. Very few people ever give informed consent when editing Wikipedia.
> the higher standard of informed consent should be used before collecting any data
The Wikipedia article about informed consent says:
> Capacity pertains to the ability of the subject to both understand the information provided and form a reasonable judgment based on the potential consequences of his/her decision.
Most of the people in the world, and a significant part of the population even in Western countries, won't be able to understand the potential consequences of sharing their data.
I can't be sure I fully understand them myself! Twelve years ago, when Gmail was opened, I didn't know de-anonymization of large datasets would prove to be so easy. I didn't imagine Internet mobs doxxing and swatting people. What might be possible ten years from now with the personal data I share today?
If the law puts the burden of verifying the user's understanding on the service - meaning they can't trust the user's assurances - the service would need to administer an exam or interview to each prospective user. And indeed Wikipedia says to get informed consent, "the investigators must ensure that subjects have adequate comprehension of the information provided [....] assessing the level of understanding during the meeting". Obviously this isn't practical for Internet services.
The biggest source of personal data Facebook gathers is what its users post themselves. This would be true even if they didn't gather anything from Whatsapp messages, tracking cookies, etc. So should any services letting users post often-private content, like blogs and image hosters, require "informed consent"? That's just not practical.
I agree there's a problem. I don't see a solution yet. Banning everything until there's a solution is neither practical nor desireable.
That is an idiotic interpretation of copyright that has only been upheld in some court cases. The only copy being made by the user is the transient "copy" in memory. Selling someone a download to use as software while later claiming the necessary and transient copy in memory is a violation of copyright is simply fraud at the point of sale.
> copying it to your other PC or emailing a copy to your friend
Making additional copies is an entirely separate matter. Do not confuse use of software (or any other creative work) with copying. You seem to be intentionally conflating these terms, probably because of your erroneous belief that some type of permission is needed for use.
> GPL talks about some additional things
The GPL only talks about distributing extra copies. Have you even read it? From The FSF's FAQ[1] on the GPL:
You are not required to agree to anything to merely
use software which is licensed under the GPL.
> But you also need it, or some license, to use the software at all.
If this was true, we'd be in real trouble because the GPL does not grant any kind of usage license. When you last used a typical Linux distro you used software without usage licenses.
> Networked services don't fall under copyright law,
Correct, though their output may fall under copyright. This is why the AGPL exists to help with the problem of immoral Services as a Software Substitute[2].
> Very few people ever give informed consent when editing Wikipedia.
Nor do they need to. The copyright issues are orthogonal to the risks associated with logging personal (meta)data. As far as I know, there isn't any hidden safety risk associated with editing Wikipedia.
> I can't be sure I fully understand them myself!
While I have studied a lot about data-exposure risks, I know that I only see a tiny portion of the risk-space. Similar to the Schneier Principle where anybody can make crypto that they themselves cannot break (i.e. you're not the smartest person in the world), the risks of data aggregation are probably more numerous than anybody realizes.
That's kind of my point: when we have potentially open-ended risk, you need to minimize your exposure. More data stored in more locations is all additional attack surface.
> Obviously this isn't practical for Internet services.
Security is often in conflict with usability. I personally think that the impact on usability can be minimized through better UI or other solution (which may not exist yet).
Perhaps something like a small set of standardized licenses that are very clear and specific in scope. People could be expected to know what those "standard agreements" mean because those licenses could be taught outside of any particular business transaction.
> Banning everything until there's a solution is neither practical nor desireable.
If the Underwriters Laboratories didn't exist, you wouldn't think it was acceptable to continue using cheap wire ("A more desirable price for the consumer!") and unsafe designs ("it isn't practical to redesign all of our products"). You would (hopefully) insist that your products shouldn't set your house on fire and that we probably need some sort of higher standard (like those provided by the UL and other safety standards).
The precautionary principle cautions that when you don't know the risk, you should take the safer path. Making products or services that create massive amounts of new attack surface with completely unknown risk is not the safe path.
[1] https://www.gnu.org/licenses/gpl-faq.en.html#ClickThrough
[2] https://www.gnu.org/philosophy/who-does-that-server-really-s...
I'm not talking about that. The user is making a permanent copy on disk when downloading. IIUC this has been ruled by various courts to require a copyright holder's permission.
Some courts and countries disagree and say that only uploading is illegal. Some countries say that downloading is illegal but not criminal, and do not prosecute people for it. But, IIUC, they are in the minority.
Naturally, the fact that this is so does not imply that I like it being so or that I want it to keep being so.
> Do not confuse use of software (or any other creative work) with copying. You seem to be intentionally conflating these terms,
I am not conflating them. In addition to the apparent illegality of downloading, ordinary users often do create extra copies, and that is another reason the copyright license affects them.
> As far as I know, there isn't any hidden safety risk associated with editing Wikipedia.
Wikipedia logs edits, including IPs for anonymous ones. (This includes inter-user discussion on talk pages and the like.) They probably expose this data in aggregate form in their periodical database dumps (though I haven't checked). A person's edit history can contribute to building a profile of their online activity and their life and beliefs, just like their Facebook posts or Whatsapp messages.
> The precautionary principle cautions that when you don't know the risk, you should take the safer path.
We don't have good estimates of the future risk of sharing data now (as you agree above). We don't want to blindly maximize security either - both of us are posting personal opinions here on Hacker News. Without good risk estimates, people will keep disagreeing greatly on how much risk to take, and many of them will prove wrong in their predictions or hopes for the outcome - but we don't know in which direction.
To go with your analogy, it's good that Underwriters Laboratories exists. But before it existed, the correct action wasn't necessarily not to sell or buy any electrical products. People had to make their own decisions somehow.
The copy was made by the party that distributed it to the user, which was implicitly authorized by the fact that they sold it to the user.
> IIUC this has been ruled by various courts to require a copyright holder's permission.
This is wrong on several levels. First, no copy is being made by the user. Second, copyright only applies when copies are made and distributed. Third, no court has ruled that copyright even applies to the user when a copy sold by the copyright holder.
Please read about basic copyright law if you want to argue on this topic.
> Some countries
I can only speak about US law.
> the apparent illegality of downloading
Downloading is never a violation of copyright. Clearly you have never read anything about copyright and it's history.
> ordinary users often do create copies
That would be a violation of copyright, but recent rulings have ruled that transient copies that are a temporary and part of the normal technical process of using the software (such as RAM copies) are not a "copy" as far as copyright is concerned.
> Wikipedia logs edits, including IPs for anonymous ones.
Are you being obtuse on purpose? There is an obvious difference between voluntary edits made by the user, who is necessarily aware that Wikipedia will record when and what you edit as part of the editing process, and unknown "telemetry" or "analytics" that happen invisible to the user and may apply to data that was not directed at Facebook/etc. Obviously Wikipedia will log your edit; that's the intended result. Facebook reading messages you sent to your friend is spying that requires informed consent.
> We don't have good estimates of the future risk of sharing data now
We know they can be incredibly damaging right now, and I don't see this risk getting any smaller in the future. It will only get easier to de-anonymize data.
> the correct action wasn't necessarily not to sell or buy any electrical products
Of course. The moral action would have been to sell products that err on the side of caution, even if that makes them more expensive or less usable. To do otherwise is to willingly risk your customer's safety.
How about this: if you are so sure the risk is acceptable, you should indemnify your users against any future problems that result from data collection and sharing. If you think this is unreasonable, then you're admitting the risk is too large and you simply want the user to bear that risk. On the the other hand, if you think this risk is fine, then you shouldn't have any problem accepting liability.
Something on the lines of don't collect any data, besides name, password, email address. This information can never be sold.
I have weird feeling, in the near future, we will find that information/data has been abused. No just abused by marketing/big data, etc..
And I'm not even arguing about the obvious--personal privacy. Although personal privacy should be the number one reason for this hypothetical statute.
I have a feeling, it will be the next big financial insider trading scandal. It will involve people we talk about here-- Google/Bing/FB insiders(the ones who can see individual IP's, and their data.), took all that information, and traded stock upon it.
I have a hard time believing every email that Warren Buffet/George Sorrows/every sussessful trader makes isn't looked at by someone. And it's not just email; it collating search histories, in order to get a "feeling" of where the money to is to be made.
They are then using that info. to invest in stocks, bonds, real estate, etc..
And yes, they will claim we don't care about getting insider info. on investments--we make a killing selling the data to marketers. Why would we do such a thing? Because you can. I would have a hard time not looking at that information, and I don't have a penny to gamble.
I think it will be a huge story.
(Edit to a legitimate question about the poor websites that depend on advertising.)
Yes--I didn't bring up advertising. They could advertise like the old days, like newspapers did. They just couldn't target market their advertising--like they presently do at nausium. I still think they would make their nut. They would still be winners! And yes--I would pay for the right service, if they couldn't manage to compete by being hobbled with not targeted advertising. I paid for many websites before Google made advertising a science.
My post has nothing to do with advertising. I get advertising. Just leave my detailed, personal info. out of it.)