News for hackers. Stuff that matters.
Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @02:14PM (#23565894)
One problem with your argument (from a political perspective) is that it undermines the entire system of mandatory disclosures (for drug warnings, investor relations, real estate, etc.). Accepting this argument means that all the (many) disclosure-based lawsuits and regulatory actions taken against companies are blatantly unjust, as they are based on the idea that consumers can and should read lengthy, confusing documents.

I should add that despite what people here are saying, the complexity of the wording is usually driven by legal requirements, not a desire to confuse people.

Re:Nobody reads privacy policies, senator wants lawmakers to... by AnthonyMouse on Thursday June 18, 2020 @04:37PM (#23567733)
> One problem with your argument (from a political perspective) is that it undermines the entire system of mandatory disclosures (for drug warnings, investor relations, real estate, etc.).

A key factor here should be the complexity of the agreement compared to the value of the transaction.

If you're buying a house, you're laying out at least six figures and can be reasonably expected to read the fine print or hire somebody to do it for you, even if it takes multiple hours or several hundred dollars. If you're buying a $1 app or using a free service, expecting the same thing is facially absurd.

Meanwhile if you're buying a $5 bottle of drain cleaner, it's ridiculous to expect someone to read 20 pages, but 20 words is not so unreasonable.

This also bodes ill for "we may update this agreement at any time" because that's imposing the burden of re-reading the agreement every time you change it, which is pretty unreasonable for anything where the other party isn't paying you (or getting paid by you) hundreds or thousands of dollars a year.

Re:Nobody reads privacy policies, senator wants lawmakers to... by specialist on Thursday June 18, 2020 @07:22PM (#23569259)
I love this line of thinking.

Trying to paraphrase: Transaction costs should be proportional to value of transaction.

Such inquiry will help daylight the value these hoarders derive from our data.

Re:Nobody reads privacy policies, senator wants lawmakers to... by Retric on Thursday June 18, 2020 @08:20PM (#23569661)
That’s a reasonable idea. One issue is cheap real world products like painkillers can be useful and dangerous.
Re:Nobody reads privacy policies, senator wants lawmakers to... by AnthonyMouse on Thursday June 18, 2020 @08:31PM (#23569728)
If the danger is too complicated for people to reasonably understand in the amount of time they ordinarily spend trying to understand it, you already have a bigger problem. If the danger isn't that complicated and can be easily explained, you don't actually have this problem.
Re:Nobody reads privacy policies, senator wants lawmakers to... by coopsmgoops on Friday June 19, 2020 @03:57AM (#23572129)
Well what is reasonable for a $5 bottle of ibuprofen? How about:

"Misuse of this product is dangerous and may cause death. Advil is not responsible for damages caused by misuse. Read and follow instructions on back of bottle"

That's a bit wordy but it indicates who is responsible (you) and what the gravity of the situation is (possible death). With that established, it means the onus is on the user to do more reading.

IANAL but I would like to belive something like that would satisfy all parties.

Re:Nobody reads privacy policies, senator wants lawmakers to... by Wowfunhappy on Friday June 19, 2020 @02:08PM (#23577221)
I don't necessarily disagree, but the way you framed it is a little too close to "Please read our privacy policy for more information", which doesn't get us anywhere. It works for ibuprofen because those instructions on the back are really quite short, so expecting customers to read them is more than reasonable IMO.
Re:Nobody reads privacy policies, senator wants lawmakers to... by btilly on Thursday June 18, 2020 @03:21PM (#23566698)
I should add that despite what people here are saying, the complexity of the wording is usually driven by legal requirements, not a desire to confuse people.

I emphatically disagree. In https://news.ycombinator.com/item?id=23566627 I take a sample from Apple's privacy policy that is written at a college reading level, and show how a rewrite can say more, in less words, while being readable at a grade 7 level.

This is merely an example illustrating that the vast majority of complexity in legal documents is driven by lawyers trying to look smart and not caring how impenetrable their prose is.

Re:Nobody reads privacy policies, senator wants lawmakers to... by dbcurtis on Thursday June 18, 2020 @04:09PM (#23567389)
Well, not quite. Certain phrases have been tested in court. That is why arcane word-strings appear on contracts. Courts have established meaning and precedent for that word string. Going rogue with more readable language is asking for a ride on the litigation merry-go-round again, and nobody wants to foot the bill for that.
Re:Nobody reads privacy policies, senator wants lawmakers to... by btilly on Thursday June 18, 2020 @05:03PM (#23568017)
I am well aware of that. But those phrases also make up a small portion of most contracts. So I stand by my, "the vast majority".

Furthermore I believe we are one well-argued case away from concluding that consumer contracts are not enforceable if the language is too complex. Consider. You only have an enforceable contract if there is a meeting of minds. Automated complexity tests show that most consumer contracts require college level reading level to understand. Per https://www.wyliecomm.com/2019/03/us-literacy-rate/ it turns out that only 2% of US adults read at that level. Therefore no contract can exist with anyone in the remaining 98% of the public.

For comparison, 13% of Americans speak Spanish. Which means that if you the average consumer contract would be understood by more Americans if it was rewritten into plain Spanish!

We all know that this is true and the current state of affairs is beyond absurd. I do not believe that this absurdity will survive indefinitely.

We already have automated tests of language complexity. There already are courts that have said that materials have to be available to consumers in a form that they can understand. For example see http://www.illinoiscourts.gov/Media/enews/2018/032118_plain_... for such a ruling in Illinois. To end the absurdity just takes one clear precedent saying that a contract is not enforceable if not understood, and cannot assume to have been understood by the average consumer if it requires a reading level of over X on test Y.

Re:Nobody reads privacy policies, senator wants lawmakers to... by matthewmcg on Thursday June 18, 2020 @05:03PM (#23568019)
I disagree. Contract language ends up in court because it is unclear enough that the parties can plausibly argue it means different things. Arcane word strings are, in my experience, usually just due to lazy copy and pasting from forms or false belief in the notion of “tested” language.

There are certainly terms of art that have well established meanings in certain fields but those should be used sparingly and don’t explain the massive amount of cruft in most contracts.

No one is well served by using deliberately arcane language.

Check out Ken Adams’ books and blogs[1] if you’d like to read more about this.

[1]: https://www.adamsdrafting.com/a-proponent-of-tested-contract...

Re:Nobody reads privacy policies, senator wants lawmakers to... by phkahler on Thursday June 18, 2020 @04:21PM (#23567541)
Not my problem. If this crap gets thrown out they will have to change strategy. The cost of snaring unwilling users in legal agreements should be high.
Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @04:55PM (#23567923)
Well it is your problem, because this stuff isn't getting thrown out, and was in fact created by our current legal system.
Re:Nobody reads privacy policies, senator wants lawmakers to... by phkahler on Thursday June 18, 2020 @09:05PM (#23569961)
TFA is about changing that, in which case the companies and lawyers will have to try some untested language or methods.
Re:Nobody reads privacy policies, senator wants lawmakers to... by mywacaday on Thursday June 18, 2020 @04:23PM (#23567567)
So I need my lawyer to read every EULA I need to accept?
Re:Nobody reads privacy policies, senator wants lawmakers to... by thephyber on Thursday June 18, 2020 @08:13PM (#23569619)
The current legal system effectively requires that you need a lawyer for everything you do.

Also, just having a lawyer read it isn't sufficient. They still need to communicate to you whatever information you need to be able to avoid violating the contract/law (if that is your intent).

Re:Nobody reads privacy policies, senator wants lawmakers to... by sudosysgen on Friday June 19, 2020 @05:11PM (#23578895)
Indeed. Our legal bureaucracy is not built to empower the common man.
Re:Nobody reads privacy policies, senator wants lawmakers to... by gowld on Thursday June 18, 2020 @07:45PM (#23569421)
Or sign up for EulaAdvisor.com's service to translate EULA's into simple terms and recommendations, and use that to guide software usage decisions.
Re:Nobody reads privacy policies, senator wants lawmakers to... by altoidaltoid on Thursday June 18, 2020 @07:58PM (#23569510)
Yeah but who do I get to look at their EULA?

EULAs all the way down...

Re:Nobody reads privacy policies, senator wants lawmakers to... by suifbwish on Thursday June 18, 2020 @02:23PM (#23565999)
I think he is saying that terms of service and user end policy agreements in their current state are completely unacceptable. We need to simplify these policies and contracts if we expect people to be legally accountable for understanding their contents.
Re:Nobody reads privacy policies, senator wants lawmakers to... by Wowfunhappy on Thursday June 18, 2020 @04:41PM (#23567774)
I actually don’t even think there should be contracts, unless they can be cut down to a few paragraphs. Because nothing longer than that will be read by 99% of consumers.

Merely providing a bullet point summary of the contract (as I’ve seen some do, iirc GoG.com is one) is not enough—those bullet points would need to actually become the contract of record.

There is no reason the absence of contracts should lead to a breakdown of the tech industry. Tech companies are already protected by extremely generous copyright laws. Maybe they wouldn’t be able to collect everyone’s data all the time, but that’s a good thing.

I can’t speak as much to other industries because I know less about them. But I think e.g. landlords have a reasonable expectation that renters do read their contracts. I know I read my lease—that seems like a normal, reasonable thing to do. Reading a software ToS or Privacy Policy is, by contrast, exceptionally abnormal.

Re:Nobody reads privacy policies, senator wants lawmakers to... by TeMPOraL on Thursday June 18, 2020 @06:14PM (#23568735)
> But I think e.g. landlords have a reasonable expectation that renters do read their contracts. I know I read my lease—that seems like a normal, reasonable thing to do.

I also imagine it was much shorter than a typical software ToS/EULA.

> Reading a software ToS or Privacy Policy is, by contrast, exceptionally abnormal.

Part of the cause here is path dependence - we've been conditioned to ignore EULAs in the pre/early-Internet era, back when software walked and quacked like a product, not a service.

Re:Nobody reads privacy policies, senator wants lawmakers to... by gowld on Thursday June 18, 2020 @07:46PM (#23569430)
Copyright is a totally different dimension from what ToS/EULAs cover.
Re:Nobody reads privacy policies, senator wants lawmakers to... by Wowfunhappy on Thursday June 18, 2020 @08:09PM (#23569588)
The only reason I mentioned copyright is, the classic thing all software ToS’s traditionally say is that you cannot create unauthorized copies of media.

What else is in ToS’s that tech companies absolutely must be able to enforce?

Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @02:29PM (#23566076)
The problem is that the only reason they are complicated is because the courts require complexity. Each one of those complicated legal terms exists because of some lawsuit somewhere. Blaming it on the company, or saying that it's obfuscation simply misses the point.

If we want to get rid of these complicated 'agreements', we need to change the way our legal system operates.

Re:Nobody reads privacy policies, senator wants lawmakers to... by throwaway_USD on Thursday June 18, 2020 @03:08PM (#23566531)
>because the courts require complexity.

No the Courts do not require complexity.

The famous example in law school being writing a agreement on a cocktail napkin being an enforceable contract.

The legal system may be in need of reforms, but in these instances the complexity and length of tech company TOS or PP is a direct result of these entities having an army of in-house and outside counsel looking after their own interests.

There is simply a power imbalance between FAANG companies and even their most legally savvy and educated user. This has nothing to do with the courts, and if you don't believe me, then reach out to one of the FAANG legal departments and tell them you want to use their service but need to negotiate the TOS/PP first.

Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @03:11PM (#23566574)
How many lawyers write their employment agreements, per-nuptual agreements, wills, or letters of engagement on cocktail napkins? Sure, it'd be enforceable, but almost worthless.
Re:Nobody reads privacy policies, senator wants lawmakers to... by throwaway_USD on Thursday June 18, 2020 @03:46PM (#23567055)
Pre-nups and wills are great examples of how simple agreements can be...prior to the internet you could pick up standard forms from stationary stores.

Google "contract on a cocktail napkin", most of the top results will be for million dollar contracts on cocktail napkins...so maybe we just have a different opinion about "enforceable, but almost worthless."

Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @03:59PM (#23567265)
Contracts are only important when there is a disagreement. When everyone is getting along (which is most of the time), the contract can be verbal, cocktail, form, or lengthy, and it doesn't matter. You can see this from the fact that the most contentious subjects (such as construction) have the most rigorous contracts.

IANAL, but I have never heard of a lawyer writing a contract on a napkin, or advising a client to do so; and they say verbal contracts are worth the paper they're written on.

Re:Nobody reads privacy policies, senator wants lawmakers to... by throwaway_USD on Thursday June 18, 2020 @04:26PM (#23567597)
>IANAL, but I have never heard of a lawyer writing a contract on a napkin, or advising a client to do so

Where did I or anyone say that is what lawyers advise. In fact I specifically said it is because of their army of lawyers tech companies have long and complex TOS and PP.

The point is TOS and PP are not complex because Courts require them, and the cocktail napkin contracts are examples (the pinnacle law school example) of how simple contracts can be while still being enforceable.

>Contracts are only important when there is a disagreement.

No, contracts are most important before the disagreement because they are what help avoid the disagreement. It would be very difficult to explain in this forum, but if you know what Summary Judgment is, breach of contract cases essentially never end in summary judgement, which is actually very counter intuitive because one would think with all breach of contract case should end in summary judgement...because the contract should speak for itself right? In other word one would think either the contract was performed/breached or it wasn't right? The thing is whether a contract was performed or breached is a question of fact for the fact finder; thus, contract cases never end at summary judgement and would always have to go to a finder of fact (judge or jury). You would probably have to spend a semester or 2 to fully grasp this concept and even then, it probably takes some actual practice of law with contract cases to fully grasp why contracts do not resolve contractual disagreements. The reality is once there is a dispute and you are seeking enforcement you would much rather have the cocktail napkin than a complex agreement, it will save you years of litigation and the cost of the same.

Re:Nobody reads privacy policies, senator wants lawmakers to... by gowld on Thursday June 18, 2020 @07:51PM (#23569468)
Those articles are about expensive lawsuits fighting over the meaning of the contract. So they are almost worthless at their single function, which is to form an agreement.
Re:Nobody reads privacy policies, senator wants lawmakers to... by throwaway_USD on Friday June 19, 2020 @08:25AM (#23573749)
>Those articles are about expensive lawsuits fighting over the meaning of the contract

Yes that is generally what breach of contract cases are about...do you think a breach of contract case for extremely complex agreements are any different in nature?

Do you think there are more or less questions regarding interpretation, intent and meaning, with respect to complex agreements or simple agreements? In my experience litigating these matters the more complex an agreement the more protracted the litigation, in fact in some of the jurisdiction I practice there are specific divisions (complex civil litigation divisions) where those types of agreements generally end up.

Re:Nobody reads privacy policies, senator wants lawmakers to... by telchar on Thursday June 18, 2020 @03:33PM (#23566861)
If companies expected and wanted users to be informed, the standard "we've updated our privacy policy" would be accompanied with a detailed list of changes or some sort of friendly marked-up change log. I have never seen anything like that from any company, so I have a hard time believing privacy policies and TOS are meant to be informative.
Re:Nobody reads privacy policies, senator wants lawmakers to... by gpderetta on Thursday June 18, 2020 @04:35PM (#23567707)
At least in the UK, banks and utilities do send human readable deltas of their contract changes. I assume there are laws that force them to.
Re:Nobody reads privacy policies, senator wants lawmakers to... by londons_explore on Friday June 19, 2020 @02:25AM (#23571590)
In the UK, far more companies are making contracts for end users that fit on one screen of a phone as 3 bullet points...

Eg.

To use this service, you agree:

* You have no criminal convictions

* You have only 3 donkeys.

* No family member has ever owned a kazoo.

[ I agree ]

Re:Nobody reads privacy policies, senator wants lawmakers to... by blaser-waffle on Friday June 19, 2020 @09:14AM (#23574168)
Discrimination against kazoo owners is a thing in the US and US-based EULAs too :(
Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @03:56PM (#23567223)
One potential problem is that any error in the markup might be the basis of a class-action suit; it's safer just to provide the full text, and there is no benefit to providing the markup.
Re:Nobody reads privacy policies, senator wants lawmakers to... by kerkeslager on Thursday June 18, 2020 @02:51PM (#23566313)
There aren't legal requirements for many (most?) pieces of software. You can release a piece of software without any terms of use at all--that's perfectly legal. So I don't buy the idea that complexity is driven by legal requirements.
Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @03:03PM (#23566473)
The legal problems come in when the software is discovered to have some flaw or an undisclosed interaction with some other system, and the class-action lawyers swoop in to eviscerate the publisher.
Re:Nobody reads privacy policies, senator wants lawmakers to... by kerkeslager on Friday June 19, 2020 @09:57AM (#23574563)
Lots of open source software has gone for decades with the following license, without the wrath of god falling on them:

    Copyright (c) <year> <copyright holders>

    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:

    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
    SOFTWARE.
It seems to me like you could just cut the paragraph starting with "Permission" and the words "and this permission notice" from the next paragraph, and you'd have the same protections, but for a closed-source project.

So yeah, I'm going to go ahead and continue to believe that these EULA's are definitely not written with the user in mind.

Re:Nobody reads privacy policies, senator wants lawmakers to... by 0xffff2 on Thursday June 18, 2020 @03:23PM (#23566718)
Has this ever actually happened? Particularly, has a software publisher ever lost such a case?
Re:Nobody reads privacy policies, senator wants lawmakers to... by fapjacks on Friday June 19, 2020 @02:17AM (#23571541)
Class action? Like, on behalf of consumers? I can't think of any off-hand.

Cases on behalf of Larry Ellison, however...

Re:Nobody reads privacy policies, senator wants lawmakers to... by SkyBelow on Thursday June 18, 2020 @05:05PM (#23568033)
>One problem with your argument (from a political perspective) is that it undermines the entire system of mandatory disclosures (for drug warnings, investor relations, real estate, etc.).

Is this a bug or a feature?

>as they are based on the idea that consumers can and should read lengthy, confusing documents.

The resolution of such lawsuits are based around the notion that consumers should be able to read such documentations. The law suits themselves are about a deeper issue of consent. I would see this action as nullifying the resolutions but not the problem. It is unjust, but to the consumers.

Re:Nobody reads privacy policies, senator wants lawmakers to... by paxys on Thursday June 18, 2020 @03:09PM (#23566543)
Big difference between disclosing something and having people agree to a contract though.
Re:Nobody reads privacy policies, senator wants lawmakers to... by monadic2 on Thursday June 18, 2020 @11:28PM (#23570655)
Why is that a problem? That seems like a decent argument this is necessary to resolve passing liability onto the customer.
Re:Nobody reads privacy policies, senator wants lawmakers to... by mijamo on Thursday June 18, 2020 @02:34PM (#23566142)
I don't really agree. Disclosure for drugs is comprehensive and short. You can usually read the whole thing in 10 minutes and I always do because taking a new drug and I know many who do. For investor relation, real estate and such the value is such that those are also read, usually by multiple eyes. And most software user agréments are actually much larger and harder to understand than the real estate papers worth millions I've seen, or even shareholder agreements worth even more.

Contrary to what you think it is very possible to have short legal agreements. The GDPR data policy basic template is quite comprehensive and rather short for instance, although it could get better. We could also imagine some informative shortened version with icons and standardized information in the same way you have for food components or drug warnings, or crucially apps permissions nowadays, that would cover 95% of the legalese in the user agreements.

Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @02:39PM (#23566194)
Apparently the Chief Justice of the Supreme Court of the United States disagrees with you on the length of drug disclosures.[1] He said that "[p]roviding too much information defeats the purpose of disclosure, and since no one reads it", and that "the legal system obviously is to blame for that".

[1] https://www.abajournal.com/news/article/chief_justice_robert...

Re:Nobody reads privacy policies, senator wants lawmakers to... by btilly on Thursday June 18, 2020 @03:24PM (#23566743)
As I commented elsewhere, all that it would take to fix this is a precedent or law saying that, "Any consumer contract with a Flesch-Kincaid Grade Level of over 8 shall be unenforceable because the average consumer cannot be expected to have understood what they were agreeing to."
Re:Nobody reads privacy policies, senator wants lawmakers to... by nickff on Thursday June 18, 2020 @04:47PM (#23567835)
You're really begging the question here. Why should we all follow your whim? Is there any reason at all, other than that it makes sense to you?
Re:Nobody reads privacy policies, senator wants lawmakers to... by btilly on Thursday June 18, 2020 @05:13PM (#23568112)
Yes, there is a very clear reason. I've stated it elsewhere but I will state it again.

Under common law, there is no legal contract without a meeting of minds. There can be no meeting of minds without comprehension. Per studies of reading abilities, only 2% of Americans read at a college level. (See https://www.wyliecomm.com/2019/03/us-literacy-rate/ for a source.) Therefore such contracts should not be legally enforceable on the other 98% of Americans.

This reasoning applies only to contracts where members of the general public were expected to review the contract unassisted. By contrast in a business contract where both sides retained legal counsel, the complexity of the language is not prima facie evidence that the contract was unlikely to be understood.

Re:Nobody reads privacy policies, senator wants lawmakers to... by SkyBelow on Thursday June 18, 2020 @05:08PM (#23568062)
Because people generally find that informed consent is the only consent that counts. If someone cannot read a contract, how can they give informed consent to it?

If we decide that uninformed consent is still consent, we open a significant problem. And if we try to patch it by selectively applying the standard, we introduce arbitrariness which is an even larger problem.

Re:Nobody reads privacy policies, senator wants lawmakers to... by gowld on Thursday June 18, 2020 @07:55PM (#23569497)
The GDPR has been a subject of constant dispute since it was born. Not a great example.