DroidScript is a non-profit organization; when they signed up for Google AdMob and Google Play Store, they provided the same tax ID (their EIN) in both cases. Creating separate Google accounts with separate email addresses would not have been sufficient; Google knows that they're paying the same company.

(The ads in question were being run inside the same app that accepts Google subscription revenue. Google can and will follow that thread!)

Creating a subsidiary business for every type of Google account you have would be quite expensive, and, if Google realizes what you're doing, it will make you look like you have something to hide, making you more likely to get banned, not less.

Do you really have to create a separate subsidary business? Why not just get another EIN for the account? Then as far as the online service is concerned, that will be another taxpayer id, unlinked to the original one. The IRS does have limitations[0] (you can only apply for one EIN per day), but as far as I could tell, there is no limit to the number of EINs you can get for your company.

In fact, I would argue that if you are a self-employed person, you should get an EIN and use it when creating accounts at any SAAS that require a social security number.

[0] https://www.irs.gov/businesses/small-businesses-self-employe...

Self driving crashes for example are rare enough to make the news. That might not be good enough, but it is a very high bar. We crossed a threshold where it’s significantly more dangerous for someone do 90+MPH on the open road than set their car to do 5 over the speed limit and take a nap on that same trip.

That’s a long way from level 5, but Honda has approval to operate at level 3 where drivers don’t have to monitor road conditions under specific conditions. https://carbuzz.com/news/honda-reveals-first-level-3-self-dr...

Costs roughly $1000/yr to run a properly sheltered LLC. Just saying, that’s a low barrier to overcome for any company turning modest revenue.

I set them up. Clicked on each one once to make sure it worked. Closed it. Didn’t open the domains again.

Week later banned from Adsense for click fraud…

I don’t get it. But I really hate Google now.

Evidently not. And sadly there’s no teacher to refer to, unless you can afford to shell some real cash.

> An $800 annual tax is generally imposed on limited partnerships (LPs), LLCs, ...

Source: https://www.ftb.ca.gov/forms/2020/2020-568-booklet.html

https://sos.wyo.gov/Business/docs/BusinessFees.pdf https://www.wyomingagents.com/

But yes--if you live in another state, you'll need a company in that state regardless.

For me, running a company was never expensive, just hassle like sending your annual update to Companies House and understanding the various overlapping communications from HMRC for tax.

https://www.gov.uk/file-your-company-accounts-and-tax-return

it can be done entirely for free on the Government's Companies House site, which generates your accounts, the regulatory statements and also does your tax return

takes me about 10 minutes a year, sending the figures to an accountant rather than punching them into the government's website would take longer

I'm paying $200ish annually in Georgia. Am I missing some major filing requirement? This is a big discrepancy.

Even at a mega-scale social games publisher like Zynga, we had to deal with automated bans all the time. That's why at one point we used an avatar for each game that was separately managed and was basically a separate identity with a separate bank account with a holding company etc.

- Invent an avatar that has their own profile, residence, birth date, gender etc.

- Use separate email addresses, not on your company's domain (to avoid domain bans).

- Use a separate mobile phone number, if possible.

- Use a separate smartphone device. There's Android devices for less than 100 bucks now, so that shouldn't be an issue.

- Make sure the geolocation of the Android device doesn't change too often. Paypal and others block you immediately because they're too stupid to realize people can actually travel and work from multiple locations; even with 2FA and SS7 enabled.

- Use a password manager, use 2FA, and make sure to backup account data and every security question. (and all the other standard practice advice)

- Treat your app's / game's avatar as a separate identity, which means don't have the same friends that your private accounts do. Don't link to other accounts of your ownership. Don't mention other projects of your company, otherwise they'll likely ban both accounts for click fraud.

Most of those mega companies probably are not even paying taxes in the US, due to them having their legal residence in a postbox office in Dublin.

In addition to my initial comment: Most banks that offer enterprise/business bank accounts have a feature to split up accounting so that you can manage the financials of teams and suborganizations in a separate manner which eases up filing tax reports, too. I know that this is the case in Europe, but dunno anything about the banking system in the US.

Nice of Google to educate people how to do this stuff.

My Amazon account has been locked for a few days now because I tried to buy a friend a gift card, and I can't even access my AWS account at all. Thankfully all I have on there currently is some old backups in S3, but I previously used AWS for some projects and this could've been a fucking disaster.

I tried to buy an Amazon gift card the other day for a friend's birthday, and a few minutes afterwards, the transaction was reverted and my account "was locked for unusual activity". I got an email saying they thought an unauthorized party accessed my account, and it included instructions to reset my password. I did so and then tried to buy the gift card again. A few minutes later, my account was locked again, and this time it told me to wait two hours and then call customer support. I did so, explained everything, got my account unlocked, and the customer service rep assured me the gift card purchase would work this time and volunteered to stay on the line for a few minutes while I reordered the gift card to make sure it worked correctly. It seemed to go through, and then an hour later it got reverted and my account got locked a third time. I waited two hours, called customer service again, and they told me that they'll mark the purchase as legitimate and that I should try logging in again after 24 hours. It's been a few days and my account is still locked. I need to call again. Seriously what the fuck.

About 75% of the times I log on to ebay, (no exaggeration, I only purchase something a few times a year and this happens almost every time), my account gets locked for suspected unauthorised access and I'm forced to reset my password.

I have a static IP, and only ever use the same two devices. I have a strong unique password.

I spent 15 minutes on the phone with their account security team who could tell me nothing about what triggered the lock, nor did they have any advice on what I could do to prevent this from recurring.

Something in their automated system is giving a false positive, and neither I nor seemingly anyone on the account security team has any way to address it.

They keep spamming me with the meaningless "help us protect your account" emails tho. The kind with a lock icon and zero useful information. I set up a rule to auto-delete those.

"""

We have closed your Amazon.com account and canceled any pending orders.

We took these actions because our records show that an unauthorized person has signed into your account. For your security, the credit card information stored on your Amazon.com account cannot be accessed via our website and your full credit card number is not displayed in your account.

"""

What the actual fuck. Do I at least get refunds for my digital kindle book purchases?!

Many attempts, calls, and hours later, I used my debit card from N26 and it finally went through.

Actions of both tech companies and content publishers make it clear as day that they have zero respect for people. Well, since consumers keep returning to them, they evidently don't have much respect for themselves either.

No one wants to be in this situation wrt megacorps and their stranglehold on the internet, free speech, and so many livelihoods. Putting the onus on consumers to fix this is hilarious and naive.

Just because people say to stop giving them so much money and attention doesn't mean that they think that's the whole solution. But if you aren't making even a token effort to stop giving them so much money and attention, you're probably more part of the problem than the solution.

If you think these companies are a problem... take action. If you aren't willing to even so much as cancel a streaming subscription or take responsibility for backing up your own photos or whatever the issue is, you're sending major signals to the legislative system or whoever else it is you expect to swoop in and save you that you don't care enough for them to need to do anything either.

I don't mean this to be absolutist, either. I use Google in a few places, even despite my distrust and distaste of them. But even there, I hold them at arm's length. If they completely nuked my current accounts, it would mostly be an inconvenience. Worst bit would be the ~$20 of apps I'd have to repurchase. (I'd lose more than that but mostly I could just let them go.)

All of this is of course fine banter, but there does seem to be a pattern where the end-of-the-chain responsible party just has some generic business related schooling that results in questionable practises in the name of profit, or in some cases just growth (or some derivative).

It's not the customer support agent that woke up one day and thought "how can I screw over the next customer I get on the line", it's probably not the engineer that made the software in such a way that it just screws over everyone who comes in contact with it. Middle management probably doesn't have much to do with it either; they are often just doing what their manager told them, and don't want to go against that and risk their position. They are often not responsible for the top-down policy either... so that leaves us with the people that feed a bad policy to the rest of the company.

If you created a new company with ten random people from this thread, it would not suffer this banning problem as everyone would be aware of this failure mode. But if you fed the same people one by one into Google, they would each either succumb to corporate politics or quit, and at the end nothing would change.

These kind of bullshit jobs are the best argument for basic income. Our society would be better off if they were paid to stay home and stay out of the way.

Delete your accounts and shop elsewhere.

This is a circumstance where society, in the form of government, needs to weigh in to force tech giants to behave more sanely, because only society as a whole is a bigger fish than Google, Facebook, etc.

I'm actually surprised/impressed with how successful that strategy has been for Google. I've always considered sideloading and alternate app stores to be an advantage for Android, but Google's store is effectively a monopoly anyway.

No one is forced to sell Android apps, therefore, no one is forced to do business with Google.

And you’re going to argue with me on the semantic definition of “force”, ignoring the sheer power Google (and a few other tech companies) wield over the technological word, which now encompasses basically all commerce and industry to varying degrees. The smartphone market alone means you’re forced to deal with Google.

Single line pithy comments set up these situations. They’re not good communication really, in my opinion.

Except your landlord when rent comes due.

Of course, granting Facebook access to the extremely private tracking data that you can gather during use of VR is another terrible idea.

I can’t wait for regulation to arrive and stop this kind of behavior.

(And if there were regulations around this, Github would probably still have done the same thing, because "national security" regulations punch through "consumer protection" regulations every time.)

If you need another reason. I've heard allegations that the recovery process for Amazon shopping accounts and for dedicated AWS accounts are different, with the former being easier to socially engineer.

Probably some risk management department figuring that in the case of the former any "fraud" can be resolved with any chargebacks/refunds

This should really go without saying. I’m sometimes shocked at the extent to which it has become normalized to mix up one’s personal accounts with work. I can’t count the number of times a colleague accidentally sent me an email using their personal account, or texted me from their personal phone. Some people even use their personal phone directly for work, without even doing so much as creating a work profile. Why are you doing this to yourself? You’re just asking for trouble.

Don’t even get me started on how entrenched “Sign In With [Company]” schemes have gained traction. Why deliberately have such a single point of failure? To save what? An additional password?

However, in practice, using "Sign in with Google" by default dramatically increases resilience to most failure modes for almost everyone without a sophisticated threat model.

> To save what? An additional password?

The average person does not manage their passwords in a sophisticated way; if someone is signing up for many different services, they are probably using the same password everywhere, or some simple enumeration scheme. Then, when some random forum or web service gets compromised (as they inevitably are), their password to everything is compromised - including Google! On the opposite end of the spectrum, if Google is the only service with a password, and everything else is driven by Google-owned SSO, that person is essentially immune to compromise; whatever I think about the company, I do believe in Google's security team to keep passwords safe and block dictionary attacks more than any other service on the internet.

And while we can evangelize setting up password managers and using strong random passwords everywhere, the truth of the matter is that many people simply cannot accomplish this. "Sign in with {Google, Facebook, Microsoft}" gets them 95% of the benefit at much higher reliability.

This is completely the case, and at least from my experience the reality is worse than what is often believed: people don’t have distinctions between websites.

i.e. if a layman registers [email protected]:correctStaple, and then they open another-sitename.invalid the other day, and presented with login screen, his intuition will be “john@.:correctStaple has to work”, because that’s what he “entered” yesterday.

Federated sign-in solves this by allowing users to use coherent id:password string for any login page without having to have distinctions between domains.

But I suspect that for the average consumer - people using their gmail to send and receive emails, and doing stuff like watching Youtube and installing Android apps - the odds of that are quite small, especially if they don't have a business or developer context associated with their personal gmail. Account loss/takeover due to password re-use is a much bigger threat for the average person.

Well, no, it doesn't save a password. People use the same password across all their independent accounts.

Sign in with [Company] doesn't improve that, obviously, but there is the idea out there that [Company] might be doing a better job not leaking your password than the couple dozen sites that know it under the other system.

In other words, Sign in with [Company] is a way for a website to protect itself (from touching your password) at your expense. It's not there for you.

Sign in with GitHub has also been nice for me on gitter. I don’t need a separate gitter account for any reason, and sharing my GitHub account on gitter is reasonable.

Absolutely!

My advice is to never, ever, use these links to sign in with a different company. It is a sure fire way to lose completely unrelated accounts just because ML went crazy somewhere and banned you.

(Also, on the advice front, always run your own domain for email. You need to be able to transfer it elsewhere when gmail blocks you, if you're using gmail.)

I wouldn’t do this with Facebook. Creating a second account is against Facebook policy, and they may ban both accounts.

If you want to represent your business, organisation, brand or product on Facebook, you can use your personal account to create and manage a Page.

We have a diametrically conflicting policy, by which personal accounts absolutely may not be used to manage company resources, for exactly the aforementioned reasons of minimising blast radius; so, we basically gave up on Facebook.

The double standard is evident: can you imagine any FAANG security team allowing a major corporate communications channel to be owned by a personal account? Answer: no; because doing something that fucking stupid would be a disciplinary offence.

A quick web search came up with Google's "associated account ban":

> "Associated account ban" means not just explicit account linkages, but also implicit ones, where a wife can be banned for the misbehavior of her husband

https://www.reddit.com/r/androiddev/comments/ckoej1/googles_...

It is also a common policy on many forums.

And while I love complaining about policies and behavior of FB, Google, Amazon etc, this one makes sense.

Almost always you ban person, not account - so standard is to allow one account or to require accounts to be clearly linked (for example, a separate bot account that is clearly declared).

I'd love to create separate accounts for other purposes, but doing this has become such a big pain that I only did it a couple of times so far.

Most services now require mobile number during account registration. It seems necessary to provide a unique number, but how to get one? Numbers from "burner" apps often cannot get the text with confirmation code. Also, the registration process itself is difficult; sometimes multiple genuine attempts at account registration get your IP blocked, at least temporarily.

If anyone has any tips, I'd be happy to hear them.

My Amazon retail account got flagged for fraud (cause I had an old CC attached to the account).

My AWS account got disabled as well

(yes, this is based on personal experience)

All cloud/hosting providers offer domains sometimes for free. You don't want that.

Because if you get locked out of an account you get locked out of your domain. Sure you can sometimes get at least domain back, but that usually involves layers and can take weeks or months.

If you can (its often not practical, but when it is) hosts your DNS elsewhere as well.

And most importantly, have at least one backup somewhere else (if you host on AWS have backup on something that isn't using AWS as a backend)

This is also why I NEVER use "Log In with Google" on any other service or site. I also just realized that even using the gmail address as the contact/backup is a bad idea, as if the acct gets reset and I no longer have access to that email, it's unrecoverable (exit's stage left making task to change all acct contacts off of Google..).

Also, seems from what I've read elsewhere, that the threshold for banning is as low as a single click on a known machine. this means that you can't even do a legitimate check of your own adverts.

In essence, this means that the Googles and Facebooks of the world are working to connect and consolidate identity information, and we now must work extra hard to dis-aggregate it. Seems there's an opportunity in this space to simplify and automate parts of identity fragmentation...

In fact don't let your business depend on these services full stop. EVER.

And sometimes they will ban all your accounts if they find something they dislike on one of them.

Part of the problem it seems is that even if these actions are unfair and unjustified it still makes financial sense for these companies to be trigger happy with automated account bans rather than implementing a more nuanced and intelligent approach which would likely require some human intervention or investment in more intelligence automated systems.

If we had some way to request human review or dispute automated actions it would become far more expensive to take unjustified automated actions as people would just complain and request a human reviews the case. Personally I think we've become far too comfortable with tech companies making it almost impossible to contact them. Requiring a human review process for automated actions and requiring companies have some way for customers to contact a human would create jobs and give us some legal right to adequate consumer service. It's weird to me that we have rights when it comes to how our data is used (at least in the EU), but no right to basic consumer service when our business is destroyed overnight because Google takes some automated action.

There is, with limitations. The relevant part of GDPR is Article 22, "Automated individual decision-making, including profiling" (Full text: https://gdpr-info.eu/art-22-gdpr/)

This is probably the most restricted of the rights granted under GDPR. You have the right to manual review of algorithmic decisions, only when those decisions result in "legal effects concerning him or her or similarly significantly affects him or her."

Whether it applies to Google depends on how you interpret "similarly significantly affects," and that's something likely to vary from country to country and well beyond my experience with GDPR. If this were the US, I would expect that to include housing and employment. There's a much stronger argument that this right applies to a Google account if it represents a significant fraction of your business income.

Not necessarily, if your [email protected] and [email protected] Gmail accounts almost always access Google from the same Comcast IP address, from the same Wi-Fi BSSID, and awake/active at similar hours, Google could easily tell these two accounts are likely the same person.

AFAIK AdSense also tries to detect forms of click fraud where you ask people in your network to help you click ads, and I can only imagine they can do that because know who you have e-mailed before, whose phone contacts you have, and who you have had calendar events or Hangouts with before.

Banning apps with no recourse or appeal process, however, should really be illegal. They could easily bankrupt certain small businesses and livelihoods from their rash algorithmic decisions.

- Never share the same IP address among accounts.

- But keep IP address range consistent for one service because anomaly means automatic ban.

- Never share the same physical computer among accounts.

Or you can be like never bother to relies on a single platform.

I mean, what about families sharing a single IP? A single computer? Sometimes a single phone number?

What about companies VPNs?

What about hotspots and public WiFi?

If the ban is permanent and results from a change in policy, this won't help significantly anyway: if Google actually wants to ban your business, they will find all related accounts, and ban them.

- Beware of impersonation. It is a felony offense. When you create accounts give the same first name and last name. There are many forms where you have to answer questions like "Have you ever used any other alias?". While 99% of times it is fine, there are rare cases where you might get into trouble. I know some people who did.

We recently had this issue with Apple. We wanted to create a separate account for App Store Connect to use with automated builds. Apple locked the account and required identification scans. Our VPE submitted his own info and it was rejected. For now we're stuck using someone's personal account.

The company is for sure tracking your IP's and if they see two account with the same IP chances are they could ban both accounts.

I would use a VPN with your other account to be careful, or just in general.

And then they could also be fingerprinting your browser.

I don't know of any safe way to have multiple accounts, other than separate computers and one of the computers is on a VPN.

To make it even worse: you should even keep separate devices for the profiles. God knows who uses device-unique identifiers to join "sock puppet" accounts together, it is pretty much suspected that Twitter does.

fyi this is against Google Ads's terms last time I looked into it. You can do it if you've got the secondary account registered as it's own legal entity but one Ad account per entity