You walk in to a home expecting to meet your friend, when you enter there is a man from the TV network there. You didn't expect him, his intention is just to watch you and your friend talk about television shows.

Perhaps an example that gets closer to the crux of the problem:

You're at a restaurant with a friend, and an unrelated stranger nearby can overhear the conversation. Not a participant, right? Now imagine they were sent to listen to you, and report back to the TV networks. I would say that, they have a very clear intention to participate in the conversation.

Does that mean Amazon was invited to the conversation? Should you as a visitor to the home expect that every logo you see in the house means that you agree to have that company present in your conversations during the visit?

Does a Facebook icon or a Google icon or an Amazon icon on a webpage give them the right to participate in your conversation? Does a Windows logo in the corner of your screen give Microsoft the same right?

Is it ok if they don't record audio or video, just metadata?

In states with two party consent laws, I think you're required to have signage or other explicit message that declares recording is in progress (this may be different for residential properties): a Ring logo may not be sufficient.

In short. Yes. Some states only require the _owner_ of the device to consent to being recorded. PDF download below

[1] https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&c...

I hope that's the law everywhere (especially private property) or else security cameras could not exist be legal.

Additionally, they must always be clearly labeled, clearly visible, and before getting into the range of them you'll have to have a visible sticker warning about them, and having a clear GDPR privacy policy as well as contact data for whom to contact to retrieve or delete the footage in case it might contain you.

For a long time, I (as a human) have permission to watch people around me.

I also have the legal right to record what is happening around me (many states only require one people to be aware of recording activities)

I also have the legal right to record YOU, assuming we are in a location where I can lawfully stand. And I can tell other people what I saw.

Now, I can put a camera somewhere, record EVERYONE, track people, and sell that tracking information.

All because we didn't anticipate the computing potential to record and process EVERYTHING.

Is a government website a private setting? Is a personal blog private or public?

I wonder if other countries have already explored this and written some law about it.

You have an expectation of privacy in your own home - but you can't take back what you shared to your friend when you discovered he writes down every conversation on his blog. Intent isn't super relevant.

For the purpose of the wiretap act, 'participant' is unrelated to intent.

Maybe the analogy should be: you go to meet a local contractor, and a representative from the cable company is there to help advise on the work. Neither of you are aware that he is recording the whole conversation, and that will use that information to send you targeted junk mail.

Here, let me refocus the goalpost for you.

> I have no way to know that their widget is even on the site until I visit it

You can ask, and expect an honest answer, from your friend about any TV news crew.

And you don't really have an expectation to privacy in many restaurant settings.

A stranger in a restaurant can't help that they heard you talk about something private, but it was entirely the fault of the person sent to intentionally record a conversation so you could say they willingly participated in the ordeal.

Backing out of the analogy, Facebook willingly collected the data, it was entirely their intention to collect the data. So the responsibility of that data collection is theirs, and they were an active participant. I think it's important to set that precedent, because we all know the technology was entirely indifferent to what it was collecting, but we can't use the inadequacies of a technology and process as a way to excuse companies from responsibility. Holding them accountable would force them to get better processes and improve the technology so it doesn't happen again.

You come to a restaurant to eat dinner with your friend, who arrived early. Unbeknownst to you, your friend arranged for one of their acquaintances, who you don't know, to sit at the next table and secretly record the whole conversation.

You come to a restaurant to eat dinner with your friend, who arrived early. Unbeknownst to you, your friend arranged for one of their acquaintances, who owns a business, to observe and document your arrival, from a concealed location, behind a sign for that business.

What's relevant in this case should be that a reasonable person, upon observing a Facebook "Like" button on a page, comes to the conclusion that "that button exists for me to interact with, and interact with Facebook, related to this business."

More specifically, a reasonable person would not come to the conclusion that a Facebook "Like" button allows Facebook to load arbitrary code into your session with the business, the purpose of which is to track you and compile information on you.

It's unreasonable to expect people to choose to opt out of what they don't even understand.

You are communicating with your friend, but instead of talking directly, you write a note, hand it to Mr. Facebook, who opens it, reads it, then closes it and hands it to your friend, who in turn writes back, handing it to Mr. Facebook first. That’s more how communication happens on FB. FB acts as the mediator of the communication, a middle man whom both of you interact with to have the conversation. They are not spying from afar—you are directly giving them your communications.

If you write something on your note, which Mr. Facebook doesn't like he takes the liberty to alter the note before handing it to your friend.

If I write “A” is it possible that “B” arrives?

Or are you talking about censorship, so if “A” is unlawful, then it does not arrive at all?

[1] https://www.google.com/search?q=facebook+censoring+messages

[2] https://linustechtips.com/topic/912936-facebook-private-chat...

Famous people and their paparazzi followers probably know all too well that when you are anywhere an eye can see from a public location you can be recorded.

All of this was worked out in the 1960's and 1970's, and I don't keep up on it so I'm not sure how courts have mapped Limited Purpose Public Figures onto modern social media: is an Instagram influencer a LPPF or a all-purpose public figure or a regular person?

> My understanding of the rule that has emerged from prior decisions is that there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as "reasonable."

[0]: https://en.wikipedia.org/wiki/Katz_v._United_States

For doing that, he feels entitled to share his notes with anyone who pays him.

The only people you can see that your friend hired are interacting with these snack droppers, telling them which tables to go to. It's unclear if this is very effective.

The country/world leaders are probably still thinking in analogue terms, so it might be important to find an accurate representation.

They might also be disincentivized to change anything, so it might also be a fool’s errand.

You visit VendorB for private financial counseling (like an https web session). VendorB is wearing the button during the session.

Unbeknownst to you (and probably VendorB), the button is recording some metadata of your encounter: when you went there, for how long, how loud your voices were, and VendorA periodically scans the button for this data and collects it.

Just like on the web, you were never aware of the implications of the VendorB button, and had no chance to opt out before the recording began.

I think this is the whole crux of everything. Trying to look back on past analogues really don't make much sense in my opinion. The fact is the old decisions were made in the past environment they were a part of. That environment has changed dramatically. The surveillance possible today simply wasn't possible in the past. Sure someone could setup a wiretap or a directional microphone, but the shear ubiquity of easy surveillance by so many different actors makes the environment fundamentally different at the application of past analogues pretty much pointless (in my opinion anyway).

I understand that legal precedent is built into the US legal system, but I think its applicability is often over emphasized. These are new times. Trying to apply past logic when the game has so completely changed is a fool's errand.

There are real world examples of ad tracking that are more similar. Bluetooth trackers in physical retail, digital billboards. For the TV if you're using Roku or similar they are probably running content ID and know what you are watching.

You can skew these examples to make your point stronger, too. (The Radio in the restaurant is listening to me!)

The only situation that matches is the exact one at hand: Facebook tracked user information in their share/like widgets. Is that ok under the law? It wouldn't surprise me if it was, but I don't I think the laws should be tightened up on this as well.

Every shop you walk into has a secret camera that tracks everything you do. The cameras are all owned by a private advertising company that uses them to build a very detailed profile on you. On the plus side, the goods in the shop are often free.

A better analogy for the cafe is the eaves dropper works for the cafe.

The term "direct particpant" is not from the statute. Those are the words of Facebook's defense lawyers.

The statute provides an exemption for a "party" to communication, but it does not define the term "party".

The 1st and 7th Circuits, when faced with cases similar to this one involving third party "tech" companies that subsist on internet advertising, have interpreted the term "party" to exclude third parties such as Facebook. The 3rd Circuit however has interpreted it to include them. The 9th Circuit on hearing Facebook's case followed the 1st and 7th Circuits. Facebook wants the 3rd Circuit's interpetation to be the law of the land. The Supreme Court denied Facebook's appeal.

As such, the hypothetical requires some more facts. Where is Company A domiciled? Where do they do business? What state do you live in?

I have no idea what California's laws are regarding the matter, or the laws governing any of the other participants. I'm just speaking in the general case, that some states allow it, and the argument that could be made.

Is "asymmetric" one-party consent a thing in any jurisdiction?

In a two-party consent state, the corporation just has a message that the call may be monitored or recorded and me staying on the line qualifies as 'consent'. I'm not provided with an option to talk without being recorded and for many functions companies won't deal with you except through these specific phone numbers.

However, if I tell the company I want to record them, they have very little reason to humor me. In practice, this means I'm almost always being recorded anyway, but I can't generally record them back. It looks to me very much like corporations get one-party consent, and I don't.

I've heard it argued that "This call may be monitored or recorded..." can be interpreted as consent, but I'm not sure how that works out in practice, especially since I'd be recording the individual employees (who may have consented to their employer, but haven't to me).

I’m pretty sure you’re allowed to record calls if a company plays that message. It’s implicit that if they are notifying you the call is being recorded, that they are also aware and agree to being recorded.

Not aware of this being legally tested but seems like a stupid hoop to meet the two party consent jurisdictions.

Then again, the caller could use similar reasoning of saying their assistant placed the call and waited on hold, and only then did they get on the line. Or really any phone conversation where a new party comes on the line after the recording has started.

I think the call center employee would have a pretty hard time arguing some expectation of privacy regarding your recording, when their employer has made it clear that the call can be recorded. I'd be interested in any precedents to the contrary though.

However, talking in terms of "consent" might just be a red herring. A company hasn't actually obtained your consent by playing a notice that they are recording the call. What they have done is destroy your expectation of privacy.

Each person you talk to needs to hear the disclosure.

For example, an employer with power over an employee can ask the employee to do something unscrupulous without worrying about being exposed if the law forbids the employee from being able to expose the employer.

For a large corporation versus small individual, I don’t see what the small individual would ever have to lose by being recorded (or gain by not being recorded). The small individual is never going to be in a position where they can twist the large corporation’s hand into doing something wrong, and if they were, then I would say the large corporation is the weaker party in that interaction.

Tricky.

I just heard that.

[1] - https://www.dmlp.org/legal-guide/california-recording-law

It all seems so obvious in retrospect, but at the time there wasn’t a lot of pushback from people explaining why it was a terrible idea.

You were stupid enough to not devine my intentions 10 years ago, so now I think the US Supreme Court should decide you are that stupid now too.

I’m inclined to believe Backblaze were not cognisant of the implications of adding Facebook scripts to their site, given the speedy (~12hr) turnaround on resolving once brought to their attention.

If tech companies are unaware, what are the odds that the majority of other companies are?

Discussion from here earlier today: https://news.ycombinator.com/item?id=26536019

"Expectation of privacy" is yet another quagmire. Similar to obscenity - difficult to define, but I know it when I see it.

If you meet someone at some office for an interview or a negotiation or something, and a third party is there whose presense was not announced beforehand, aren't they a "direct participant"?

And didn't you also had "no way to know that they would even be there" until you visited that location?

Clearly this analogy, particularly with respect to "informed" and "consent", does not apply to a Facebook widget on a site.

There are of course ways to avoid sending a HTTP requests to Facebook, but not within the confines of the expectations of web developers where the user is expected and even prodded to use a browser deployed by an advertising company or one that tries to match it feature for feature. These browsers are ideal for serving ads.

You could check for the "Like" button by first retrieving the page from an alternate source, with Javascript disabled, e.g., the Internet Archive.

Even if you retrieve the page from Company A's site, unless you have Javascript enabled and use a browser that automatically loads resources, you can check for the "Like" button poiting to Facebook's servers by inspecting the contents of the page. (Note I have seen some websites host a Facebook "Like" button image on their own servers.) Checking for things in the contents of a page can of course be automated.

But putting technical solutions aside, it is worth reading the 5th Circuit case that suggested Google was a "party" under the Wiretap Act.^1 In that case Google tricked iPhone Safari users into believing third party cookies were being blocked. Meanwhile they disabled third party cookie blocking in Safari by sending a cookie from a hidden form in an iframe.^2 The 5th Cir Court of Appeals noted that using fraud to become a "party" to the communication has no effect on the Wiretap Act exemption. If law enforcement can use deception to become a "party", Google can too.

This is not to suggest Google was innocent of malfeasance. When Google's behaviour was first disclosed by a Stanford grad student in 2012,^2 the WSJ picked up the story.^3 This attracted the attention of the DOJ who filed a complaint. Google ended up paying a $22.5M civil penalty. State AGs also filed a complaint against Google. Google settled for $17M with 38 states. It was only when private lawyers in multiple states attempted to bring a class action suit on behalf of users that the Wiretap Act claims failed.

1. https://web.archive.org/web/20160126074106/http://www2.ca3.u...

2. https://web.archive.org/web/20120217235344/http://webpolicy....

3. https://www.wsj.com/articles/SB10001424052970204880404577225...

   curl https://www.wsj.com/amp/articles/SB10001424052970204880404577225380456599176|grep -o "<p.*</p>"|sed '1s/.*/<base href=https:\/\/www.wsj.com\/amp\/articles\/ \/>/' > 1.htm
   firefox ./1.htm