Edit: oh, this is in addition to the Mirror stuff. Yea this should never be a thing.

"Users don't care" is such an intellectually dishonest argument when users aren't technical enough to understand the subject.

On one hand, a TOS usually describes privacy implications. On the other hand, there's no accountability that a user has understood or even read the TOS. Is it unreasonable to assume people will read the fine print?

Unequivocally, yes. Even if someone hypothetically had enough time to read every TOS they've agreed to I would venture to guess the average user wouldn't be able to comprehend most of the terms[1] anyway. Disclosure documents are written by lawyers (corporate CYA) for lawyers (regulators, plaintiff's counsel, judges).

The law, however, disagrees with me entirely.

[1] Edit to clarify I mean "terms" as in the terms of the agreement

Most users probably don't assume anything, it doesn't even enter the lists of concerns or cares they have or ever would. It's not that they don't understand the subject, they simply do not give a crap one way or the other.

Random family in the US or elsewhere simply does not give a crap about things like this, no matter how much you want them to.

It's not ignorance, and the most intellectually dishonest arguments are really the argument here - "If people knew more about the subject or could know more, they'd care!".

If they knew as much as you did, they still wouldn't care.

Let's say they knew Microsoft can share this information with third parties which might affect their credit worthiness,employability and other very real and immediate aspects of their lives? Let us say the quality and availability of goods and services might change if MS or a third party used this information against them? What if MS can use ML to infer very personal and private aspects of their lives?

By your logic 4th amendment search and seizure restrictions don't matter either because most people assume the government can search them anyways.

There is a reason you have the right to legal representation when accused before the law, you don't understand the law well enough to answer questions and argue on your own. Tech isn't that different, people don't understand it well enough without relying on factual opinions of professionals in the field.

I found myself in the unexpected position of trying to explain why (IMO) it was ok and not a big deal that they did that. I dont know whether I convinced her.

People assume they have privacy when they are alone. Its that simple.

IMO its not ok for any company to change that basic private-when-alone without a very simple, very clear explanation.

"Only 33.3% were concerned about their personal contact information like email address and phone number being shared with third parties, while 10.2% were worried about their friends and contacts being shared."

Can you find me one that says most did?

Because I can't.

Truthfully, if people cared half as much as hacker news thinks they do/should, it would already be a solved issue.

I can easily imagine people not caring about third parties knowing their phone number and email, thats already a lost battle. Everyone is used to giving those out.

Their search history though? their private chats with their friends? the websites they visit when they are alone? Their medical history?

The things they have bought themselves in the last 12 months? their favorite magazines?

Take some time and talk to people, I agree with the studies you found that said people dont care about their contact information, but ask people about other information.....search history is expected to be private, IME, by people who are not tech savvy. The same with their other private actions.

""93% of adults say that being in control of who can get information about them is important; 74% feel this is “very important,” while 19% say it is “somewhat important.” 90% say that controlling what information is collected about them is important—65% think it is “very important” and 25% say it is “somewhat important.”

Most people don't care what's in their food exactly, but that doesn't mean the producer has no responsibility.

1) Is it possible to care about something that you don’t understand?

2) Is it possible to care about something whose existence you aren’t aware of?

I personally don’t think anyone can have a meaningful discussion about this issue without answering and agreeing on the answers to at least those two questions I ask above.

From https://privacy.microsoft.com/en-us/privacystatement:

Browser activity, including browsing history and search terms, in Microsoft browsers (Microsoft Edge or Internet Explorer).

For example they could hash the domain, path and query separately.

The "Google Safe Browsing Update API" (used by Firefox, Chrome, Safari and others) solved this a long time ago. In that protocol, the browser hashes the URL, sends a short prefix of the hash to the server, and receives a list of hashes for the URLs that should be blocked. A huge number of valid URLs all hash to each prefix and the server does not know which one the user has visited. Also, the client caches the list of hash prefixes for which the block list is non-empty, to avoid unnecessary fetches of empty lists, which further improves privacy and reduces response time.

Also, the client doesn't send any kind of user ID token to the server.