Erich Schmidt's audacity is both telling and shocking. This is pretty much the equivalent of an armed robber saying that everyone can still be save from harm, as long as you just stay home and don't go outside. Probably the biggest shame here is how people like Schmidt still have platforms to suggest these kind of things unhindered, without any punishment.

I do not know how this particularly works in the USA, but in most reasonable countries I know of, the ways in which anyone (company/government/etc) can interact with anyone who isn't a legal adult are limited. For good reasons too, I believe. I think it even is dictated by signed/ratified international treaties/declarations, but I don't recall any details right now.

I'm pretty sure that the tracking of minors (or the unborn), essentially surveillance, is actually in violation of the legal protections those are supposed to have. I've heard plenty people argue that this tracking is somehow admissible, if their legal guardians sign off on it. Often based on the assertion that legal guardians are responsible for those under their care. However, the legal protects of minors are a thing on their own. As far as I know, guardians can not "give away" the legal protection of minors. No more than any person can "give away" their inalienable human rights (also not by consent), which is what makes them inalienable.

So here we have an industry that in all likelihood is seriously violating the legal protections that minors (and arguably unborn too) are supposed to have. Instead of demanding that governments address these rogue corporations, which considering the systematic nature of their violations probably even warrant to be classified as criminal organizations, we instead listen to what key people in this industry say in an attempt to justify their actions, or suggest as remedy for their behavior.

I'm not really all that shocked about people like Schmidt saying such things. About as predictable as a politician talking any kind of bullshit that will sell their agenda. However, I am appalled that this industry gets away with what it currently does. To me, that says a hell of a lot about the system, and how it apparently prefers to protects these interests instead of protecting the people it legally is supposed to protect.

If only the groups that warned us about big tech had had the sort of support say the EFF has.

> This is pretty much the equivalent of an armed robber saying that everyone can still be save from harm, as long as you just stay home and don't go outside.

This also happens to adequately describe how it feels to live in Brooklyn, NY these days...

What can Eric Schmidt do differently? Let's say Google suddenly made it their #1 priority to make sure to never ever collect profiles about minors. Would that make the advice any less useful? They still have competitors from all around the world who may be less scrupulous than them making that advice still useful.

The problem is not individual bad people or bad companies. Take out the ones that exist now and a sea of new adtech startups will take their place.

This argument keeps coming up in similar discussions and I don’t really understand it.

Can you not imagine a scenario where we didn’t leave everything in the hands of a completely unregulated market?

I struggle to see the type of regulation regime that could work effectively to prevent such profiles from being created (the data collection would move overseas and then later be re-sold as contact lists, or as audiences, etc.).

Isn't that a cop out argument? Just make it outright illegal and fine heavily per violation. You have profile information that a user didn't explicitly give you? $10k fine, each.

We have (kinda) world wide copyright laws. We have world wide drug laws. We have world wide sea and war laws. Why don't we have world wide privacy laws?

> We have (kinda) world wide copyright laws.

... which get flouted all the time

> We have world wide drug laws.

... And the war on drugs has been a huge success.

> Why don't we have world wide privacy laws?

The Internet makes trying to enforce world wide privacy laws much harder than physical laws: anyone in the world can reach you and collect data about you.

> Just make it outright illegal and fine heavily per violation. You have profile information that a user didn't explicitly give you? $10k fine, each.

How do you propose to discover violations? Self-reporting won't ever happen. If you then propose to give draconian sanctions to trying to cover up such issues, congratulations, you've killed the ability of people to build anything and share it with the world.

> They still have competitors from all around the world who may be less scrupulous

Is robbing ok, because if you don't do it, someone else might?

No, but knowing how to avoid it doesn’t make you one yourself.

No, but if you are a robber and suggest to people who complain about being robbed by you about how to reduce the problems associated with being robbed in the future it makes you sort of a hypocrite.

A lot of people use Google so it would of course make a huge difference if Google would stop collecting profiles.

> They still have competitors from all around the world who may be less scrupulous

Not really. European Union services are more regulated towards user rights (GDPR) and services from other big countries are usually targeted towards domestic or regional market (typically East-Asian apps for example).

There is no other way to say this: that is a simplistic non-solution.

This is akin to saying: if you desire privacy, you can just clear your cookies.

There will always be a way to find these "name reset" folks - the privacy policies if services will have sentences like "to combat fraud..." "to protect the service..."

This will seem reasonable because one person desiring privacy shouldn't be able to skip out on a utility bill!

Without regulation - strong regulation - this won't change anything. Unfortunately it seems like anti-business regulation rarely works - if bills progress, they are defanged at the last minute.

The reason the EU has these laws is they remember people being put to death, even with minimal data collected in the pen-and-paper era.

Even though the US had pearl harbor, they haven't had their data pearl harbor moment.

I worry that we might have passed a "point of no dissent", where groups and even individuals in favor of privacy regulation can be surgically removed from dissent.

> There will always be a way to find these "name reset" folks

No problem, you just need simultaneously to change your name, your address, your bank account and credit card, your friends, your hobbies, and your biometric properties. Of course, also buy a new computer with different hardware, and install different applications.

Then hope you didn't forget anything, otherwise you need to do the whole thing again.

I love this solution, as it reveals that the "name reset" answer is not given in good faith. "become someone else" is not an answer to "how to remove this from myself".

Changing your name might work for: potential employers searching by your chosen name. (Assuming you can also change the name which your qualifications are in)

Won't work for: Google/Facebook tracking you across the web, probably not even 10 years ago when this article was published. You're still the same person.

Do name changes actually work? Even if you closed your accounts with every company you do business with, your persistent identifiers (eg. SSN, DL number) would stay the same, so I'd imagine it's trivial for credit reporting agencies to link back to your old name. Not to mention, if your social graph is compromised (eg. your friend enabled contacts upload to facebook), then it's very easy to infer that the guy who dropped off the radar 6 months ago is the same person who appeared out of thin air 6.5 months later.

Name changes would be meaningless without corresponding behavioral change. You will instead have multiple names associated with the same behavioral profile.

True, already many people change names, & most of the databases label those names as AKAs.

Is it really worth even considering if it works or not? Nobody should have to change their names to escape childhood surveillance

When it’s really obvious it won’t work, it’s worth considering when forming your opinion of the person who said it.

Nothing is gonna change, if you have the same Facebook friends sharing your photos. Worse, Facebook will demand a government document to prove your new name.

I think things can and likely will change -- facebook did not exist 20 years ago, and the masses will probably move on to another platform in 20 years from now.

I'm more interested in how decentralized platforms might impact the current trend of verified accounts and use of real names. I can see a couple potential outcomes with decentralized platforms:

1) The use of pseudonyms grows further and speech gets even more divisive as people can speak without it coming back tarnish their real-life identity.

2) The use of real names grows more popular as people want to own their speech without fear of being de-platformed.

Pseudonyms have been and are again the defacto standard in the internet. Really only facebook did change that for a few years. I dont see this becoming normal.

We also need to change change SSN, address, sim card, credit card number, etc? it's getting expensive... maybe even your face?

Sadly, it's pretty hard to change your SSN unless you want potential legal consequences.

>>Of course, a better way may be to introduce new right-to-be-forgotten laws like in the EU.

In combination with flipping Data Ownership laws to where a person owns the data about then, and Right to Know laws where companies are required to (on request) give you all the info they have about you, and allow you to correct that information. Basically expanding on the Credit Rating agencies laws where (in the US) you are entitled to a free credit report and the ability to dispute info.

I've honestly been entertaining the idea that upon adulthood, everyone should receive one free name change if they so wish.

Why would you put the burden of tech companies' failure to regulate themselves on the victims? Changing your name is not just an administrative thing, it is a change of identity, it is one of the most important bits of your psyche, your internal and external ID, you think of yourself as the person with that name.

Not necessarily. As an anecdote, I don’t think of myself as a person with a specific name. If I look at the mirror and try to say my name it just does not sound like it fits the person in the mirror. Also I can tell different names to baristas in Starbucks etc. It’s not that I dislike my name either, I think it’s a great name overall.

I never gave it particular thought so maybe I’m in the tiny minority though.

That's interesting. One of the first things many cults do in an attempt to wipe out a persons identity is to force them to choose a new name for themselves and to put some kind of penalty on using their old name. This conveniently cuts them off from their whole support network which might question the grip the cult is exerting on the new recruit.

Honestly i dont dislike my name, however i dont define my personality on it. If i am in a group of people that all call me something different i dont care either and represwnt the very same person. Not all people know me by the same name.

Pretty sure changing your name is free most places in the world.

In Indonesia, the cost is more than Rp 1.7 million (120 USD) more than 10 years ago. Also you need a very good reason to change your name (religion, etc). You can not change your name on your whim.

Pretty sure its not. Its also kinda hard to nearly impossible in many civilized countries if you do not have a very good reason.

This gets me thinking. From a legal perspective, does a parent's consent to tracking pass over to their children even after reaching adulthood? (say for GDPR etc.)

I think (and this is probably why this is part of the general tech conversation now) that we're on the verge of a massive legal shift with data ownership.

A child born since Facebook's inception will be approaching 18 soon, and might have had parents who posted the child's entire life on Facebook from the ultrasound all the way to (maybe?) high school graduation.

When that child turns 18 and the child does not consent to tracking, what happens to all those photos, behavior, and YouTube videos that kid has watched? Maybe the kid starts as a clean slate since they've reached an age of majority, but how can you technically even keep track of that?

It's not in the future, it's right now:

https://www.usatoday.com/story/news/nation-now/2016/09/16/18...

https://www.independent.co.uk/news/world/europe/facebook-fin...

Search for: "child suing parents over facebook photos" and you'll find plenty more.

The person who took the photo owns the photo in most of the world. You don't need the permission of everyone you take a picture of to upload it to facebook

Whilst that is technically correct, you do need the consent of the subject of the photo to share it, in most of the world, except for in a narrow set of circumstances. (Public good, expectation of privacy).

Well consent was given (by the parent), when the photo was taken.

Seems a little "too late" to retroactively remove consent some years later. That being said, I can see arguments either way that make sense. :/

In most legal circumstances consent can be withdrawn at a later date. That generally can only not be done if something is permanent. Requiring the photo to be "de-published" is something that publications have done for some time.

That's interesting, thanks. :)

Just to note, consent to take a photo does not automatically imply consent to publish that photo.

This is not true in most of the world. Unless you are using their likeness to advertise a commercial product, you don't need the subjects permission to publish it on the internet, sell the photo, upload it etc.

And the parents do consent when the photos are taken.

> This is not true in most of the world. Unless you are using their likeness to advertise a commercial product, you don't need the subjects permission to publish it on the internet, sell the photo, upload it etc.

Lets take a run at this one. I did specifically mention a couple exemptions above, which include expectation of privacy - a crowd in a public space don't have an expectation of privacy.

(In the US this goes further, where you can photograph anyone in public, with or without their consent, so long as it is within the nebulous "community standards" - but the US is not the norm.)

However, that's not the case for a wide variety of other photographs.

For example under the Australian Privacy Act:

> Images of individuals in photographs or video (images) are treated as personal information under the Privacy Act 1988 (Privacy Act) where the person’s identity is clear or can reasonably be worked out from that image. [0]

Similarly, in the EU, photographs or video of someone who can be reasonably identified within that work, is to be treated as Personally Identifiable Information under the GDPR, and thus requires consent. GDPR also requires you notify anyone in a public space ahead of time that you may be filming or photographing in the area.

I think it's fair to say that it is _not_ normal in most of the world to require no consent if you're not doing something commercial. Consent is the norm.

[0] https://www.oaic.gov.au/privacy/guidance-and-advice/posting-...

The GDPR doesn't prohibit photographers from taking photos of people in public places and posting them on the internet.

The GDPR doesn't directly include photographs as protected information, unless the are attached or connected to other info.

It probably does not need any specific consideration, as consent can be freely withdrawn at any time (GDPR Art 7.3), so the consent not passing over is equivalent to consent passing over but the child deciding to withdraw it the moment they are legally able to - in any case, legal consent persists only if the legal decisionmaker actually consents.

And it's worth noting that this is not about collection of data but use of data - if the legal basis of the processing was consent (perhaps there was a different legal basis, then consent isn't relevant) then withdrawing the consent does not make the earlier processing illegal, but it does require the controller to stop processing (using) the data they collected while they had consent and ensure that any processors to whom they delegated data processing do so as well.

OK, but withdrawing requires a process on the part of the child, what I'm referring to is even without a process of withdrawing consent. Since the child has never consented to begin with, shouldn't it automatically be illegal to continue?

Additionally, the child will usually not know every site their parent has consented to tracking use.

Right-to-be-forgotten laws are a not a solution

Your right to be forgotten does not out weigh my right to remember and share what I remember with others.

You have no right to tell me that I can't tell someone else I was in a hacker news conversation with Flowerlad on HN in January 2021 where he wrote "....whatever you wrote...." and that includes writing an article on my blog, tweeting about it, publishing it in the NYTimes, etc... and the idea that some law would prevent a search engine from indexing my content because your name happens to be in it seem wrong to me. You'd have effectively de-platformed me to talk about you or even my own memories.

As far as I understand, the earlier EU right-to-be-forgotten laws have been replaced by the GDPR and the right-to-erasure in it.

You are correct that right to be forgotten does not outweigh you right to remember and share what you remember with others. The law does not restrict this right - GDPR, including that clause, does not apply to private persons personal activity.

However, that right is more narrow than you imply. First, you personally have the right to share your memories with others, but companies and businesses do not have such a right. Second, you do not have a right to have your content indexed by a search engine - your right to talk about these things in everyday outweighs the other persons right to privacy, but their right to privacy outweighs your privilege to publish your memories in mass media. Yes, you would be effectively deplatformed, but that does not violate your right to speak about this - the right to privacy is a fundamental human right, the right to a platform is not; any rights to free speech does not include a right to be widely disseminated.

> the right to privacy is a fundamental human right

no it is not.

The world seems to disagree - United Nations Universal Declaration of Human Rights Article 12, European Convention on Human Rights Article 8, etc - the human rights definitions that we use explicitly list privacy as one of the fundamental human rights.

IIRC the ECJ ruling is not de-indexing - the requirement is to remove the link from certain search results, ie. when you google for "flowerlad" but not when you google for "greggman hacker news conservation".

I don't see the distinction. I want people to be able to search for "greggman's conversation with flowerlad". Flowerlad should have no say over what I can share and how others can find it.