Comments like these make me think that the pro-privacy crowd is officially a cult. I just don't see the argument about anonymized data that you can opt-out of being such a threat to the end user. I love these types of analysis, especially the ones about dating from OK Cupid. Tivo used to reveal all sorts of interesting things about viewership that was very enlightening. I'd hate to lose this data just because a minority think its a threat to their civil rights. There's a reason why no one outside of reddit and HN knows what the EFF is or cares about their mission. It doesn't fit in with most people's politics.

I really think the privacy advocates are holding us back at this point. They refuse to make reasonable concessions and while they think they're fighting the good fight, they've just marginalized themselves to the point where only a tiny extremist minority is engaged because moderate voices are shouted down as "selling out to the man" or the NSA or whoever the villain of the day is.

Its also sad to see a arguably progressive community like HN fall for this stuff. Not only are we doing this stuff all the time, the current fad of health devices, smart watches, etc are going to make this a lot more common. We're like cavemen throwing spears at an enemy with machine guns. Its a fight we've long lost. I think its better for us to focus on privacy issues that are legitimately victimizing instead of railing against anything and everything that kinda sorta rubs us the wrong way.

If anything, the cult of privacy is hurting us because its created a "boy who cried wolf" situation which is now a political liability. How am I supposed to tell Joe Midwest Voter that X is harmful when he keeps hearing about how tracking cookies or Tivo stats or iPhone policies are harmful and didn't give two shits about those either.

There is no such thing as completely anonymized data. And in this case there releasing information without the consent of their users. Sure, you might think that it's reasonable in this case but the important thing is users are not making that decision.

So, as long as companies feel they can do anything they feel like with the data your only option is to completely opt out. Which means companies have no reason not to release your data as everyone assumes they will anyway.

This isn't a question I have an answer to, but isn't it likely that users relinquish their right to data privacy when they sign a privacy policy and/or terms of use?

But they're probably not tremendously informed about this.

In clinical research it's considered unethical to take uninformed consent and a great deal of effort goes into educating participants on the risks and benefits of their contribution.

Such stuff is fantasy for modern EULAs though, which makes it sketchy when these entities do (public) research.

You're extrapolating from one comment the viewpoints of everyone who cares about privacy? That's quite ridiculous. As another commenter has mentioned, de-anoymising data isn't that difficult [1].

Why should privacy advocates 'make reasonable concessions'? What are they holding us back from? What concessions is the other side making? Who exactly is on each of these sides anyway? Your comment isn't particularly clear on these points nor on why the opposite view is any better (other than we get nice graphs occasionally). There are cogent arguments to be made on either side here but you've made none.

> "I'd hate to lose this data just because a minority think its a threat to their civil rights."

Minorities matter and it's ironic that you bring up civil rights. There are plenty of example from history so please do look them up.

[1] I'm not saying it's possible for the graphs in the article, but if one had access to the (anonymised) data that produced them, it may be possible to combine with other data and ultimately identify individual users.

I'm a Jawbone UP user and I have absolutely no problem with this anonymised data being used like this. It can make not only the product better but could also lead to useful research around sleep and health.

If I want out then Jawbone has a handy 'remove all my data' option.

People share all sorts of data in all sorts of places (as others have pointed out in this thread), and it is their own responsibility to read the T&Cs of those services.

I agree that data privacy is important for those who want theirs protected. But in this instance, people have chosen to wear their UP and have T&Cs which notify them of the usage. If they later change their mind then they have the option to have their data removed.

I can't see how any of that equates to 'shackles', but agree from some POVs it could be considered 'scary'.

> "... it is their own responsibility to read the T&Cs of those services."

While some people may believe/feel this is reasonable, it has rapidly become impractical. Have you read the T&CS for all the services you use? Any idea how many pages of text that comes to? Did you also know that the reading level of most T&Cs requires college-level education (just to comprehend)?

My point is that it is already impractical (& will become more so) to suggest that T&Cs can make people aware of anything.

I used to read them, then sift through them. Then I gave up. My defence would go along the lines of: you don't seriously think that any end user would read that, would you? (Exceptions for APIs etc.)

Same goes for legal disclaimers in email footers, cookie warnings, warning stickers etc. Why are we allowing this to happen?

(My solution: "Yes, you can sue them because the coffee was hot (etc) and there was no sticker on it, you just have to be prepared to give up your voting rights and your drivers license in the progress. Continue Yes/No?")

As an aside, the "coffee was hot" lawsuit wasn't as frivolous as people make it sound. See Liebeck v. McDonald's Restaurants for details.

Anytime someone says that lawsuit was frivolous, I lose a bit of respect for them.

Their privacy statement is short and clear:

https://jawbone.com/legal/privacy

~1400 words.

I liked this section:

When you use the Jawbone Companion app we connect with and upload to our servers the address book and calendar on your device along with other data that we normally collect through our mobile apps described in the app usage data section below.

I wonder how calendars are used.

I can't tell if you were being serious. Assuming you were, then 1400 words, presented as a wall of text, is an anathema to the short attention spans of many users. In addition, that 1400 words is a subset of around 5400 words for the Terms and use of software/services.

We can debate whether people should be educating themselves about such terms but my point is (still) that it's impractical in the long term as we want to use more services/devices. The only way out of this that makes sense to me is that people begin owning their data and (digital 'exhaust'). I'm working on FOSS tools to enable this (see my profile).

Yes, I was serious. It's a $80 dollar device that you wear a significant amount of time. In that context, 15 or 20 minutes spent understanding what it does is not onerous.

Note the comment I made earlier in another part of the thread where I said I pretty much refuse to use device+service combos like the one here.

In that case, I'm curious whether you use a smart phone (iOS/Android) and whether you've read all those documents too. That's typically a much higher-value product.

Also, recall that I said that a certain level of knowledge/understanding is required to even understand the basics.

> "I pretty much refuse to use device+service combos like the one here."

Could you elaborate why? Onerous T&Cs? No control of data? Don't care about such analytics?

My problem with how things are developing is that we end up in a world where either you resign yourself to the fact that you're constantly being data-mined or you become a digital hermit. There's very little that allows you to engage and retain control (without becoming a sysadmin).

I have an Android tablet, but not a smart phone. I'm not hugely careful with what I stick on there, but I think I've only shared my contacts with stuff like Hangouts and Skype (where the explicit purpose of the app is to contact people). I increasingly leave my cell phone sitting at home (mostly because I don't care about being reachable, not because I'm worried about network location pings). I take it with me if I'm going to be away for more than a couple hours.

As far as not using analytics, it's a combination of not caring (as an example, I run (maybe I should say jog?) regularly but don't time myself) and distaste over the way the data is managed.

The fact that people's views of their privacy rights are subjective means that a lot more than 1400 words would be necessary to cover every single action that at least one human perceives to be a privacy violation.

Maybe there should be regulated permissions, sort of like the way an OS might have a dialog to request permissions for push notifications or location data.

Example, you can still include any terms you want but some items need to be individually agreed to in plain language, like "This product will report your location back to us"

Sort of like FDIC notices or nutrition facts.

That is a good point - it is quite difficult to read and interpret all these sets of T&Cs these days. Something should be done to make these more accessible / standardised.

However, that is a problem that is equivalent across all facets of all services people use, and I think is independent from this problem.

The likelihood is that most people don't read the T&Cs and most people don't care about their data being used like this. But if someone is concerned about a particular facet of a service (privacy/data usage) then there is a place they can look and relatively easily find out what they need before signing up.

What can be done about the wider problem of T&Cs and how they are unwieldily is a tough one.

> Have you read the T&CS for all the services you use?

No, but if I personally thought that practices which are extremely commonplace (like the collection of anonymous data) were privacy violations, I probably would read the T&Cs. Unfortunately, I would also be unable to use the vast majority of electronic products, including virtually all websites.

And has anyone seen the notice "This site uses cookies" and said "aw shucks"?

And if they do, do they also continue using the sites that don't have to tell you about their cookie policy?

I still believe it's reasonable because once you've read one, you've read them all. They all pretty much say the same thing. Jawbone doing this or Facebook experimenting with the feed should not come as a surprise to anyone who has skimmed over a TOS.

> "They all pretty much say the same thing."

This is not a safe approach when you're dealing with legal contracts, which is what T&Cs purport to be. Minor difference in wording can have very different intents/outcomes.

Having said this, they pretty much give carte blanche to the service provider to do whatever they want -- so in that sense, they're all the same.. That doesn't make it right and it doesn't mean it can't/won't be contested at some point.

At first I thought something along these lines, then I remembered:

1. Google has "trends" when things happen, and "Earthquake" was most certainly googled near/at the time it happened. 2. The phone company has records, which many people texted/called near/at the time it happened. 3. 911 has records and calls were made near/at the time it happened.

and so on…

So there are private entities and government that have data around the event that can correlate behavior and situations, so it shouldn't seem scary to me… it's just should I have better access to the data? And if I do, what can I tell from the correlation?

I think it also has to do with what content is being recorded.

Intimate sleep data is a bit different than knowing I called 911 for an emergency situation.

Are you saying that the sleep data is more personal than calling 911? I have to question that, because you could call 911 for all sorts of private situations that you wouldn't want publicly known. So no, it's not really different.

Especially in this case. Saying something like, "I couldn't go back to sleep after that earthquake woke me up" is the kind of thing many people would share on twitter, facebook, or around the water cooler with coworkers.

It's subjective. I would consider a call I made to 911 to be a lot more personally sensitive than my sleep patterns.

Quote from [1] Jawbone Privacy page: "We may share your Information with third parties to provide services on our behalf such as to process payments, or to store information collected through our site, app, and services." Does this statement allows them to use users data for this purpose?

[1] https://jawbone.com/legal/privacy

The Use of Information section includes press releases although it is not counted in the sharing section. I also see no commitment to anonymising the data.

Jawbone uses your information to provide and deliver products and services you request; personalize your experience and customize content, marketing, and recommendations; respond to requests that you make, provide you with customer service, send you press releases, general informative announcements, and promotional information about us or our products, or to aid us in serving you better; and protect, investigate, and deter against fraudulent, unauthorized, or illegal activity.

Well, we the general web audience aren't providing any services to UP wearers on behalf of Jawbone, and they're not giving us the data to store (that is, they're not asking us to store it), so that quote doesn't allow such a sharing of an UP wearer's data. However, they might be willing to argue that sharing aggregated data isn't the same thing as sharing your personal data; it wouldn't be a totally ridiculous idea.

Oh, come on. I'm getting a little sick of how far the pendulum has swung in this privacy conversation.

I get the desire for privacy, but if every time people have data about them used we get this complaint, no one's going to listen when there's a real violation of privacy.

You don't need a sleep monitor to function in the 21st century.

If you try to take a Jawbone off, I believe it will take a few seconds.

I dislike these data collection and analysis as a service gadgets enough that I'm not using any of them, but I think you could be a little more considered in your criticism of them.

As an UP user, I think Jawbone make it pretty obvious when using their app that you're sending data up to a server, and as others have pointed out, the EULA explains that this data can be used elsewhere.

The UP bands data processing happens server sided and is indicated by the UI. Was there an indication here that a third party was involved (the post indicates its their internal data team)? Otherwise I think everyone has generally accepted internal company use of data (critical part of growth) let alone when its aggregate and anonymous.

I look forward to NSA serving an FAA 702 order on Jawbone to track a non-U.S. user.

It would require that Jawbone perform a live intercept so FedGov agents can plant physical bugs or insert TURBINE-derived malware or attach a keystroke logger. The order would use existing legal authority to compel Jawbone to provide real-time data on the user’s precise geographical location and whether he or she is awake. Obviously if the target is at home and awake, the Feds would abort the black bag job.

The Google Play store listing shows that the Up app wants access to precise (GPS) and approximate (network) location, so the lat/long available for NSA perusal with compulsory process is likely pretty detailed. And the marketing literature on the Jawbone site uses “always-connected” and “real-time” language, which is perfect if you're in the real-time surveillance business.

The non-U.S. user targeted by FedGov may think he’s escaping surveillance because he’s using only local phone providers and local email providers. He’d be wrong; Jawbone is based in SF and subject to U.S. law… Another interesting use would be tracking physical movements of non-U.S. users and correlating them to see who’s meeting with whom; does Jawbone force SSL for its API usage? (The API web page only says “communication should be done over a secure channel,” not “must.”)

I’m joking above, of course, and I have no reason to believe the NSA has done this for a non-U.S. citizen or the FBI has for domestic surveillance. My point is to suggest that folks here at startups think in advance about how to respond to legal process, how to encrypt data in transit, and how to store user data in a way that minimizes your legal exposure and protects your users’ privacy.

Better to think about this early vs. after you get an early morning knock on the door with a very serious plainclothes guy with a badge serving you with some very serious papers demanding info. That happened to me in a different context years ago, but that’s a story for another time.

To me, there's a world of difference between sharing my personal commute between home & work, and using my drive to show traffic patterns.

Does anyone know if there's a device like this that DOES NOT require uploading all collected data to "the cloud" in order to analyze what I've collected?

It's pretty obvious that this could be done on client side without needing an internet connection. Or do all of these companies sacrifice usability and privacy in order to make more money?

First off, I have a Jawbone UP24 and love it. You know how they got that sleep data? I pushed the "start sleep" and "stop sleep" buttons, then they gave me an awesome visualization of how I slept last night. You know what you'd do if you didn't want them to have that data? Don't push those buttons.

How are they not aware the data is sent to 3rd parties? Isn't that a key feature of the device?

Total privacy invasion.