Now imagine what would happen without any regulation at all…
As far as I can tell, that's the mandate.
Brands are about trust, so it makes sense.
Likely, but it's just demoralized workplace grousing. Tech employees are statistically sycophantic, and the exceptions get burned out or tossed out by executives who say things like "why don't they just shut up and work"
A lot of times unless you're on a team or in a department that's doing this stuff for nefarious purposes, you wouldn't know.
Anecdotal evidence:
I worked in RPA (robotic process automation) for a large software company. We were tasked with automating a decision process. The decision process was completely benign. Something like a payments process. Pretty easy. We finished it in a few months start to finish.
We hand it off, it goes into production. A lot of back slapping and high fives happen. I go on with my work, move out of the company a few months later. About a year later, a guy I worked with at the company emails me a news story about a company using the RPA program we built to auto deny insurance claims for their clients. Massive class action lawsuit.
The insurance company had taken our script and just re-purposed it to auto deny a certain percentage of claims. I was shocked and dismayed that someone would use the stuff we built for their own shady business practices. It was a huge wakeup call that even when you're building something completely benign, a company can pay millions for it and reuse it to do bad things to people and you'll never know until its too late.
And the tech industry leaders are mostly spoiled, entitled mill/billionaires who eject anyone who crosses them. A team of moral imbeciles.
Society is screwed until Zuckerberg, Bezos, Musk et al are stripped of their power and wealth.
Which will never happen.
people are usually motivated by more and faster
this means whatever opportunities present themselves for short-term more and faster will have no shortage of takers
TL;DR myopic greed
Companies are something else beyond people, which has a mind of its own. And leadership selects for sociopathy.
It's really not that complicated, if I squint hard enough it looks like an obvious tragedy of the commons variant.
Also, the incentive structure for reward (stock price etc) is predicated by squeezing every last bit of monetization out. They already know ahead of time how much money a new feature could bring in, and the potential litigation cost before hand. If revenue > litigation/fine expense, they are going to do it.
Money
> Externally we have some amazing security researchers who look out and dig these things out - and try to hold the companies responsible.
At worst they get some bad PR but most people aren't listening to security researchers (or don't care). Companies aren't being held "responsible" for anything, maybe a small fine but that's just the cost of doing business.
> And what is the internal process? Wouldn't these intrusive and privacy violating features (to track users for ex) be captured in design docs, emails, chats, code changes/PRs - and up for discovery?
Yes, probably all these things exist. See also Apple talking about how to make linking-out sound as scary as possible. There are chats with employees brainstorming how to make it scarier to end-users to drive them back into the IAP flow.
> Aren't employees saying anything against these features?
Some are afraid of losing their job or getting branded as a non-team-player. Some don't care. It can be easy to get lost in "implement the spec" instead of "is what I'm building morally ok?"
> What culture are they building?
A bad one.
> What leadership are they demonstrating?
That they only care about money and what they can get away with. Even if they get caught the profits outstrip the fine by a large margin. "It's just numbers/business".
> It can't all be about money by any cost damn the users and their privacy/rights, right?
It is.
https://en.wikipedia.org/wiki/Obedience_to_Authority:_An_Exp...
I recommend reading the book, it has a ton of useful stuff in it beyond what everyone knows about the Milgram experiment.
Externally we have some amazing security researchers who look out and dig these things out - and try to hold the companies responsible.
And what is the internal process? Wouldn't these intrusive and privacy violating features (to track users for ex) be captured in design docs, emails, chats, code changes/PRs - and up for discovery? Aren't employees saying anything against these features? What culture are they building? What leadership are they demonstrating? It can't all be about money by any cost damn the users and their privacy/rights, right?