Ask Slashdot: How Is It Even Legal For Websites To Gather And Sell Users' Data?

Long-time Slashdot reader dryriver sees it like this: Lets say that I follow a person named John D. around for days without permission, make note of what John D. does and where he buys with timestamps accurate to the second without John D. knowing it is happening, analyze what kind of personality traits John D. has, enter that data into an electronic database where it is stored forever, and also make the data purchaseable to any third party who is interested.

Would I be breaking the law if John D. has not given me explicit permission to do this? Very likely. If this is the case for "meatspace data gathering", how can websites justify gathering information about visitors, and selling that information to third parties?
How would you answer this question? Attempt your own best explantions in the comments. How is your country balancing the need for online privacy with actual laws governing what can and can't be collected?

How is it even legal for web sites to gather and sell users' data?

Comments

That would probably mean you're a private eye

[Anonymous Coward]

They're completely legal.

Re: That would probably mean you're a private eye

[JustAnotherOldGuy]

Pretty sure if a company hired private detectives to follow millions of consumers around, documenting their daily habits, there would be a legal challenge.

They could challenge it all they want and they'd lose in court. As someone else pointed out, exactly what law is being broken by observing and recording public interactions?

Re: That would probably mean you're a private eye

[saloomy]

No, it isn't inadmissible if you overhear something. There is no expectation of privacy in the jail cell where others can hear you.

Just like that cell, you have no expectation of privacy in public. It is very legal to follow someone in public spaces and record what they do, and use that information for financial gain. Want proof?

Hedge funds pay people ( and dispatch) interns to count the number of people outside of an Apple store, and record their gender and approx. age to gauge the excitement the public feels about a new iPhone, in hopes of gathering data on real market demand on launch days. The same rules for mass-targeting like that are also allowed with individuals. When CEOs or activist investors are seen walking into a company headquarters, it can have a positive effect on the stock when it gets reported.

All of this is legal because "there is no expectation of privacy" in public.

Now, a website isn't a public space, but the operator dictates what he does with the information in his private space. If you go to someones house for dinner, and he invites a third party (Mark Zuck), and Mark records the fact that you showed up, that isn't against the law. You agree'd to enter the house and be subject to its operators' terms of use when you navigated there. If you are unhappy with those terms, don't visit the site. Do not however, try and infringe on the operators freedoms because you do not like how he chooses to exercise them.

Re: That would probably mean you're a private eye

[Kyr Arvin]

Then the question isn't "how are they not losing legal cases over this" and more "isn't it time to change the laws to make what is currently legal, illegal?"

Re: That would probably mean you're a private eye

[saloomy]

Facebook doesn't install anything surreptitiously on your phone or car, or anything. You elect to install those things.

Re: That would probably mean you're a private eye

[saloomy]

When you buy a piece or property, you have dominion over it, and can be private in it if you wish. You effectively make a contract with the state that this property is yours, and you are (somewhat) free to do in it what you please. So, it's private. Which is why the police can't barge in and search, absent a warrant. A homeless man has made no such covenant, since he didn't buy a home. He could try the homestead act if he goes to an unclaimed part of the public space .

Legal is relative to jurisdiction

[misnohmer]

One can't answer your question unless you specify "legal in jurisdiction X". For example Europe has GDPR, USA or Canada or Mexico or China does not, but they have other laws.

So I guess I would answer your question with "Legal where?" and a disclaimer "IANAL". ;-)

Re:Legal is relative to jurisdiction

[Tom Veil]

"Legal where?"

Post says "How is your country balancing the need." So the "where" is "wherever you are."

If you need something more specific than that, I'll have to wait till Slashdot gives me that location data I paid them for.

Re:Legal is relative to jurisdiction

[AmiMoJo]

It's definitely not legal in Europe. GDPR requires explicit opt-in permission for tracking and profiling.

Re: Legal is relative to jurisdiction

[Maelwryth]

You forgot to add that the privacy act was written by Hon Andrew Little, Minister Responsible for the GCSB.

Re:Legal is relative to jurisdiction

[Bite The Pillow]

In America it would be illegal for an individual to do so if the subject legally objected (restraining order). That's because your interest is assumed to be personal.

A business entity has an assumed interest of revenue. So it is legal as long as there's no law against it, such as the European privacy laws.

You can't equate individual actions and business actions, because individual actions do not have a business plan, charter, nor governance to claim a particular interest. Not that they have to be truthful, but they exist.

Private detective

[alvinrod]

Lets say that I follow a person named John D. around for days without permission, make note of what John D. does and where he buys with timestamps accurate to the second without John D. knowing it is happening, analyze what kind of personality traits John D. has, enter that data into an electronic database where it is stored forever, and also make the data purchaseable to any third party who is interested.

That sounds a bit like a private detective, with the exception that they typically work for a specific client.

Also, if you stop to think about it, going to a website it like going to some person's private establishment. I'm visiting their server, so it's their rules. Stores no doubt track my purchases, and some even have cameras on presence that record my every action. If I have a problem with it, I can take my business elsewhere.

Sure, terms of service could be more explicit, but most people wouldn't bother to read them or would just click through like they did when they signed up for a Facebook account or half of the other shit they use online.

Re:Private detective

[phantomfive]

Sure, terms of service could be more explicit, but most people wouldn't bother to read them or would just click through like they did when they signed up for a Facebook account or half of the other shit they use online.

They tell you that they will record all your data, and you agree to it. That's why it's legal.

Re:Private detective

[Anonymous Coward]

Also, if you stop to think about it, going to a website it like going to some person's private establishment. I'm visiting their server, so it's their rules. Stores no doubt track my purchases, and some even have cameras on presence that record my every action. If I have a problem with it, I can take my business elsewhere.

Ideally, yes. In practice, no. What is going on with all the "tracking" servers is comparable to one company installing cameras in every store in your city, then collating your movements from store to store as you go about your business. While store A may not know that, after perusing their goods, I then went and bought from their competitor store B; the ones who are running the cameras in both stores have access to this information. Worse, neither store A nor store B posts anywhere that my actions are being watched by another party.

Re:Private detective

[Jane Q. Public]

Not really.

Example 1: Facebook and Twitter track you on every web page you ever visit with Facebook or Twitter "share" icons (or "like" in the case of Facebook). They don't tell you that. (In fact they track people who have never been to Facebook or agreed to a damned thing.)

Example 2: It is illegal in the United States to track people who are less than 13 years old, without explicit parental consent. Yet not only to Google, Facebook, and Twitter do this on a massive scale, they don't care about the law and don't even try to abide by it.

The latter is BIG. The fine per violation is significant. If it were actually enforced, those companies would be out of business very quickly.

Re:Private detective

[phantomfive]

Example 2: It is illegal in the United States to track people who are less than 13 years old, without explicit parental consent. Yet not only to Google, Facebook, and Twitter do this on a massive scale, they don't care about the law and don't even try to abide by it.

Well I don't care if they go out of business.

Re: Private detective

[Anonymous Coward]

Not to worry. Facebook and others let you opt out. You just send in proof that it is really you, SSN, DMV, Passport, etc, and then they will let you go to a special page to log in and get a cookie. As long as you keep that cookie, they know it is you and that wherever you go, you asked to not be tracked.

They may need to send you a new cookie from time to time to make sure you are still you and don't want to be tracked, so you may need to login again. But they won't ever change the rules, without updating their TOS on incorporated by reference pages 304-666 of their "limits" section.

Re: Private detective

[Anonymous Coward]

It's an analogy that falls flat when you consider facebook has trackers everywhere, not just their 'store'. So you visit the beach, and facebook cameras still take snaps of you, to better target advertising the next time you visit their store. That would be considered too invasive in meatspace.

Re: Private detective

[JustAnotherOldGuy]

As long as you keep that cookie, they know it is you and that wherever you go, you asked to not be tracked.

So they track you in order to....not track you?

Re: Private detective

[micheas]

That's done frequently by loss prevention services.

You are assuming that the physical world doesn't do certain things that happen all the time.

Re:Private detective

[brm]

Google lets you opt-out, too. https://www.theonion.com/googl...

You're under the dangerous impression...

[blahplusplus]

.. the rule of law exists in this world. There are two sets of laws, one for the rich and corporations and another for the rest of us. The reality is the internet and technology has made it cheap and easy to collect data on everyone. Even if you wanted privacy it can't exist due to technological advancement. Our technology is making rule of law irrelevant.

The last 20 years the internet enabled software companies to steal peoples game and OS software (drm) and remove their privacy by force because we can't reach them. The only solution is reconstituting corporations legally so they certain behaviors aren't allowed or they lose their charter, but that's unlikely given the free market fundamentalism that grips the world. The only way out would be for society to have a say in how corporations or businesses are run and given the mass stupidity and huge amounts of money arrayed against that outcome it is unlikely.

How would this be illegal?

[jimduchek]

What makes you think any of what you described in 'meatspace' is illegal? It's not, in the US, anyway. PERHAPS could be considered under harassment or stalking laws if it was very blatent, but if you are in public, you are subject to anyone recording/photographing you and what you are doing, pretty much.

Re:How would this be illegal?

[PopeRatzo]

but if you are in public, you are subject to anyone recording/photographing you and what you are doing, pretty much.

There are exceptions, but you are correct. It becomes confusing when you start to take apart what being "in public" means. When I am on a website, I might be sitting in my home. Am I in public? Not all online behaviors and environments are analogous to meat space.

So I guess the answer is, "it's complicated, but we better have this conversation in a meaningful way and get it sorted."

Re:How would this be illegal?

[LynnwoodRooster]

Would the company whose website you are visiting have the right to watch what you're doing? It would be analogous to walking into a grocery store and having the cashier watch you walk up and down the aisles, and note what products you chose - and which you did not.

Re:How would this be illegal?

[kiviQr]

I am using HTTPS/secure connection - how am I in public?

Re:How would this be illegal?

[_Sharp'r_]

If you're in your home and ask your friend Joe what he knows about "treatment for liver cancer", you then have no recourse (except to be upset and not tell him anything in the future) if he uses the fact that you asked him about it to share it with an employer, insurance company, etc...

Asking Google, unless they promise you something different in a contract with you (typically contained in a terms and conditions, if you accept one), is no different.

Typically once you tell someone else something, they are under no obligation to keep it a secret unless there is some sort of explicit arrangement (a contract, a service provider law, etc...) to the contrary.

If you don't want Google to share something you told them, then maybe start by either asking them to agree not to share it before you tell them, or else don't share it with them. None of this is outside your control, it's just outside the realm of caring for most people, as they don't actually (in practice) value concealing information about them as much as you might think.

What seems to be missing from most of the analysis here is that you specifically took actions which told them X, Y or Z, so it's a bit much to be complaining later after you've let the horse out that the barn door is open.

Re:How would this be illegal?

[PopeRatzo]

What seems to be missing from most of the analysis here is that you specifically took actions which told them X, Y or Z, so it's a bit much to be complaining later after you've let the horse out that the barn door is open.

You made a logical leap. If I ask google about "treatment for liver cancer", am I "telling" them anything? Or is their algorithm making an assumption about me?

Can you cite the part in the Google user agreement where I waive my right to privacy regarding health issues?

Let's extend the thought experiment: If I google, "how to quit smoking", and then I get a notice that my insurance premiums are going up because I'm a smoker, has my privacy been violated? Did I agree to allow Google to share the assumption that I am a smoker with my insurance company? What if I'm googling that information because I'm trying to convince my neighbor to quit?

We conflate being online with being in public because we've been conditioned to do so by corporate behavior, but it doesn't necessarily have to be that way. We're already seeing laws being passed in parts of the world that are more protective of people's personal information when online.

Re:How would this be illegal?

[fustakrakich]

You didn't give them your name and address, did you?

Re:How would this be illegal?

[PopeRatzo]

You didn't give them your name and address, did you?

No, but they have it nonetheless.

The question becomes not "what information does Google have", but "what can google do with that information". I can see laws cracking down on it, the way they do in certain countries, and some very big companies not being quite so big any more. It's happened before.

Re:How would this be illegal?

[thegarbz]

Can you cite the part in the Google user agreement where I waive my right to privacy regarding health issues?

Except making an assumption about a person just not a privacy health issue.

Let's extend the thought experiment: If I google, "how to quit smoking", and then I get a notice that my insurance premiums are going up because I'm a smoker, has my privacy been violated?

No. If you walk into your insurance office and they notice you smell of cigarettes that isn't violating privacy either. The thing about the privacy of your health is that your health records need to be kept private, those analysis, doctors diagnosis, and treatments are subject to strict privacy regulations. What people think about you based on what they overhear you say is not subject to any privacy.

What if I'm googling that information because I'm trying to convince my neighbor to quit?

What if you were having that conversation on the phone outside the insurance office? Again people here are making assumptions. If you have problems with the assumptions that others make due to imperfect communication and you're the only one with the correct information then it's ultimately your responsibility to fix it.

Poor bob is off work today.
Yeah I heard he had his leg amputated.
How horrible! We should do a fund raiser for bob.
*one week later bob walks in* ... guys my leg was only broken!

We had this very situation at where I work. It was awkward but Bob (not his real name) did not know the assumptions made about him and was the only person with the correct information. On the upside since we couldn't remember who donated to the cause we ended up using Bob's funds to throw a big lunch.

Re:How would this be illegal?

[fustakrakich]

The question becomes not "what information does Google have", but "what can google do with that information".

Exactly. You can't stop them from collecting, because you can never verify anything they say. The law should read a little like the 5th Amendment: "Nothing you post on the internet can be used against you."

Re:How would this be illegal?

[JustAnotherOldGuy]

HIPAA is widely misunderstood.

HIPAA applies only to the keepers, transmitters, or receivers of medical records. Observers (third parties) cannot violate HIPAA.

For example, if you're taking pictures in public of a child being treated by paramedics and they tell you that you cannot record them or the child "because of HIPAA", they are wrong.

Recording the entrance of a hospital (and the people coming and going) is not a violation of HIPAA.

If medical records are improperly handled or stored and you see them, you are not violating HIPAA- the keeper of the records is in violation of HIPAA rules.

Re: How would this be illegal?

[TimothyHollins]

But if the internet is indeed considered a public place, you have made your resources open to public visitation. How can you exclude anyone from using a public area?

If it's a private space, then you have no right to listen in because the person visiting is doing so from a private location. But that is also the only scenario where you may set rules.

Re:How would this be illegal?

[dryeo]

As an AC up the page pointed out, a better analogy is some company, or rather a couple, running video cameras in all the stores you visit and tracking what you do in every store and putting it together in a way that a cashier following you around one store could never do.
Still legal, but much more creepy, especially when it is all done without your knowledge.

Re:How would this be illegal?

[_Sharp'r_]

I'm not sure you're seeing this literally enough. Yes, you're telling Google that you're interested in finding web sites about "treatment for liver cancer". You're literally sending Google's a communication to that effect. You personally told them, using your computer, that you value that information for something.

In terms of assumptions, if anyone is making assumptions about you, then that's a different (or at least additional) question, which isn't different legally if you tell someone at a generic service provider like Google, Target, or Starbucks which you use (either over the internet or in person), or your friend Joe in a txt message, or a random person at a bus stop. Obviously, any unsupported assumption that you're interested based on your own medical condition, as opposed to a friend's, would be dumb on the other party's side.

There's nothing special about the communication from a legal perspective just because you used a computer's web browser to communicate your message to the people at Google.

Re:How would this be illegal?

[PopeRatzo]

I'm not sure you're seeing this literally enough. Yes, you're telling Google that you're interested in finding web sites about "treatment for liver cancer". You're literally sending Google's a communication to that effect. You personally told them, using your computer, that you value that information for something.

I get you. But it has to be taken as a whole. If google collects enough information about me from other sources to determine my real identity, even though I never gave them such information, then connecting my identity to liver cancer and then selling that information would be considered by most people to be a breach.

Maybe not according to the law (in some places) but according to the law (in other places) it s a breach. I'm just saying we need to have this conversation about what online privacy laws should look like. Saying, "You did it on the internet, so you are fair game" isn't going to cut it in a future legal framework.

They are not gathering data,

[Grand Facade]

They are enhancing the customers experience.

Re:They are not gathering data,

[fahrbot-bot]

They are enhancing the customers experience.

Sounds like a good tag line for a WiFi connected, smartphone controlled vibrator -- even has a built-in camera.

USA Laws

[Shikaku]

USA Laws are limited by these 2 main laws that limit it by age (under 13) and healthcare respectively: COPPA https://www.ftc.gov/enforcemen... and HIPAA https://www.hhs.gov/hipaa/for-...

And then it's not really limited anymore except by state. Which a summary exists here: https://en.wikipedia.org/wiki/...

They're not following you to observe what you do.

[aussersterne]

You are going to their house and doing what you do, and they're just making note of what you did in their living room.

Not "following them around without permission"

[SlaveToTheGrind]

The real-world analogy would be more like keeping track of someone's location and activities who entered your retail store, then using/selling that data as they see fit. People may not like that, but I don't think there's any serious theory that it would be illegal. (Let's ignore for a moment the places in that retail store where you'd have a reasonable expectation of privacy like changing rooms, since that's outside the scope of the submitter's doe-eyed question.)

In the same way, you visit someone's website, you play by their rules. This doesn't seem particularly complicated or surprising.

Re:Not "following them around without permission"

[Anonymous Coward]

Except your conception of the interaction is backwards. Websites are sending representatives of the company to your house (or more specifically your computing device). Despite the common terminology, it is entirely unlike going to a retail business. The web is a lot more akin to traveling salesmen, and I doubt most people would be comfortable with a salesman that, once invited in, can never be removed from the premises (and in fact will often invite third parties in through other entrances once inside).

The misapprehension of how the web works compared to our real-world retail experiences reinforces the situations enabling this consumer abuse.

Re:Not "following them around without permission"

[Kjella]

Well... while I can't fault your logic, I think your summary understates just how much previously private information we're now exposing. For example take newspapers, my dad still gets one in the dead tree format. Nobody knows what articles he reads or how long he's read it in total and outside the paperboy nobody knows if he's picked it up at all. With online newspapers they know exactly when and what you've read and with JavaScript probably how long it took, how often you scrolled the page and overall created way more data on whoever read the semi-critical article on the Party. Same goes for video games, TV series and whatnot... it used to happen on your computer, now there's a log in the cloud.

Re:Not "following them around without permission"

[Actually, I do RTFA]

don't think there's any serious theory that it would be illegal.

Under current law, or you think there's no way we could make it illegal??

Re:Not "following them around without permission"

[CrimsonAvenger]

For example take newspapers, my dad still gets one in the dead tree format. Nobody knows what articles he reads or how long he's read it in total and outside the paperboy nobody knows if he's picked it up at all.

Hmm...one of my neighbors gets the dead tree newspapers. I don't have a clue what they read of the paper, but I DO know whether it's been picked up daily, since I walk by their house every morning with the dog. And I've occasionally known when they were on vacation when they forgot to stop paper delivery while they were out of town (five or six papers in the front yard is usually a good clue).

And while I don't know what they read, I do know what they could have read - it's not like every newspaper in the world has every story in the world....

Re:Not "following them around without permission"

[Impy the Impiuos Imp]

Http request is requesting data. It is not requesting to be tracked, much less shared around.

Public space?

[LynnwoodRooster]

No reasonable expectation of privacy. Perfectly legal.

Re:Public space?

[Anonymous Coward]

That's true in the USA. In Europe there is a (limited) expectation of privacy in public space too.

Re:Public space?

[TimothyHollins]

If it's a public space you have no right to exclude visitors that do not agree to your terms. You only have the right to enforce terms in your own private space. You can't go into a market square and start kicking people out. And if it's private space, then it's private for the user as well, meaning you cannot record it without consent.

So which one is it?

Why wouldn't it be ?

[Crashmarik]

Especially since you agree to their terms of service when you sign up.

The free product is not free.

[AHuxley]

The user and their content is the product.
Use an ad company that offers "free" services and the ads will flow.

Block it as best you can & live with what's le

[spywhere]

I use uBlock Origin, Ghostery and a Hosts file to block as much Web advertising and tracking as possible.
This makes the leaks obvious: one random item I browsed will follow me around in ads on several sites.

Of course, Amazon knows exactly what I want, and Google knows I go to (legal) cannabis dispensaries on my vacations, but I can live with that.

Re:Legal Injustice System Serves Corporations

[LynnwoodRooster]

I guess Kenneth Lay never was convicted of insider trading and stock manipulation which impacted millions of individuals...

You are confusing the impractical with illegal

[Anonymous Coward]

It's not necessarily illegal to follow someone around without there permission to the extent you are not entering private property illegally and trespassing. Basically assuming nobody tells you to say leave a store following someone onto private property of a nature open to the public it is going to be legal. There may be statues against harassment, but those are going to be more specific. There may also be laws against practicing investigations without proper licenses. However following someone around and making notes about them is not in and of itself necessarily either of these things. It's merely impractical to make such a business model work and so nobody has done it until more recently and really only to the extent it is automated via technology via cameras, cell phones, etc.

...and then there's the copyright issue

[coats]

The copyright-absolutist position is this: My life is *my* performance before God and all mankind. As soon as it is recorded, that recording is a copyright work for which I own the copyright (unless there is a specific written contract to the contrary), according to US Code Title 17. And use of that work without my permission for commercial gain is felony copyright infringement. Felony copyright infringement is exactly the behavior all these data-gatherers are doing. FWIW.

Re:...and then there's the copyright issue

[Anonymous Coward]

This is definitely a misapplication of copyright law, in literally every jurisdiction.
What you do in public is subject to recording. Angry reactions to glassholes aside, people have the right to photograph you in public.

Re:...and then there's the copyright issue

[coats]

not just a photograph, but a full history that does constitute "performance art", protected under both USCTitle 17 and the Berne Copyright Treaty.

Re:Improper Analogy

[Krishnoid]

And that they can be expecting even before he expects it.

The Traveling Salesperson analogy

[williamyf]

Imagine you phonecall a company and say:
Send me a travelling Salesperson, please. Or a delivery service and say, please deliver a newspaper to my office.

They answer: "sure, but there are some conditions for that convenience, please, for the next 8 minutes listen carefully to them."

You do not listen, instead, put the phone on the table, set your watch to 7 minutes, and go brew a tea.

You return, and when the operator asks: "Do you agree to our terms?" You say "yes"

It turns out that the terms include the salesperson or deliveryperson staying in your office long after the transaction is concluded (you place your order or get your newspaper), taking notes of many of the things you do, correlating those notes with those of other delivery companies/salespeople/third parties and a long and creepy et cetera.

But hey, you neglected to hear the terms of their service, because those terms were boring, and instead you went for tea.

Having corrected the analogy used by dryriver, the correct question to ask slashdot is:

Are the terms of service used by most websites even legal?

Re:The Traveling Salesperson analogy

[technology_dude]

It may be more like:

You call a company and say you would like to use their service because 9 out 10 of your friends use it and it is free.

The company says all you all to do is listen to the terms that are in a different language and then click a check box. After that you will be equal to your peers and benefits galore await you. Just click the box. It must be ok because 9 out of 10 of your friends are doing it and even though you didn't understand the language, all you have to do is click the box. Even though you may have a little uneasiness about not understanding the terms, it must be okay because 9 out 10 of your friends are doing it and enjoy hours of interacting with others and finding great purchasing deals all with no ill effect. So, just click the box.

Maybe the question to ask is:

Are we any different than the leaders of the tech companies whose products we use? (we want something for nothing)

Well, we've been electing anti-regulation

[rsilvergun]

pro-business and pro-corporate leaders for nearly 50 years now. If the people in charge of regulation don't believe in regulation then we don't get regulation.

Seriously, it's not complicated.

This was settled ages ago

[rsilvergun]

if you're out in public and somebody takes your picture you don't own the picture.

If we made every bit of data that involves you copyrightable it wouldn't really help. You don't have the money to litigate dozens of copyright lawsuits. It would just turn into a useful tool for the wealthy to quash criticism against them.

Re:This was settled ages ago

[coats]

...but copyright violation for commercial gain is not just a civil-suit issue, it is a felony (a crime), and should be prosecuted by the feds.

Not there yet.

[Anonymous Coward]

My country is still debating if Global Warming is real or not, if Evolution is real or not, if Vaccination creates Autism or not, if the Earth is flat or not etc. Online Privacy is too advanced a topic for us right now. Perhaps in a couple of decades we will get there.

It's not users' data

[Anonymous Coward]

Simple answer: It's not users' data. It's data *about* the users.

When you take out a pen and paper and write down the colour of your dog, that data isn't *owned by* your dog. If you kept a record of your customers height and weight on your own hard drive, your customers don't own that data.

If you make a website, and record data about your site's visitors, your visitors don't own that data. It's data *about* them.

Re:It's not users' data

[jwymanm]

I agree, well put. This is data about something the user did using the service provided. In exchange they get to use the service. I have no idea why people are all of a sudden in a uproar about this. It's been happening forever and it's almost required to make things better for the end user without charging them some flat rate and having them fill out questionnaires they usually just click skip anyway.

Re:Most authorize it, but there's a bigger issue..

[_Sharp'r_]

In a free country, everything is legal which is not explicitly illegal. So nothing has to be "made legal" unless it was previously made illegal.

In this specific case, the information you choose to send to a website from your computer is completely under your control. You don't even have to hook your computer up to someone else's network if you really don't want anyone to know anything about what you do with it. They aren't pointing TEMPEST gear at your windows, you're voluntarily sending them information from your computer to their server.

Stalking laws?

[bagofbeans]

Per the following someone around parallel, I wonder if this comes under stalking laws?

its legal because.....

[indy_Muad'Dib]

you give them permission to do so.

even this very site is like that.

see also: https://slashdotmedia.com/priv...

I see a business opportunity here

[mea2214]

Follow everyone around and collect data on them.

Terms-Of-Service is irrelevant

[evanh]

The only thing that covers is your expectation of continued service.

Privacy is covered by law and is not something that can just be signed away because a company would like it that way.

The real problem is simply these companies aren't being challenged in a way that financially hurts. I'd be happy if Facebook couldn't exist due to burden of fines.

well

[renegade600]

well, you do give the website permission by agreeing to their terms of use.

Seems to be a blind spot in people

[Solandri]

People seem to think at the individual level, not at the group level. I first ran across this in the 1990s playing Everquest. In response to complaints about griefers harassing regular players, they came up with an anti-harassment policy. You could be banned for targeting a player and harassing them. This had the opposite effect than intended. Griefers didn't target specific players. They tended to hang out in an area and try to ruin the day of anyone who came into the area. On the other hand, people who got fed up with the griefers and tried to drive them out of an area were targeting a specific player. And so the anti-harassment policy ended up protecting griefers, while getting anti-griefers banned.

For some reason people seem to judge the harm of bad behaviors in terms of the average harm done to an individual, rather than to the overall harm done to society. A spammer sends out a hundred million spam emails, and people say "what's the big deal? It only takes you 3 seconds to realize it's spam and delete it." But 3 seconds times 100 million is 9.5 years of cumulative wasted time and productivity. Likewise, people handling private customer data don't take it seriously, since each individual's data is probably only worth a few dollars. Nobody cares if they lose a few dollars, right? But multiply it by several hundred million people and you're doing serious economic damage if you take it without permission or let it get stolen by hackers.

Re:Legal Injustice System Serves Corporations

[cwatts]

He was, in fact, convicted of ten counts of securities fraud. And then he died.

Why is this a worry

[jwymanm]

We have so much other crap to worry about right now. Everyone takes our data. Heck it's part of our freedom as a species to monitor other people / animals / objects and record things about them. What the fuck is going on that this is all of a sudden a huge concern? What's driving this? Apple? EU? There's got to be some kind of financial motivation behind wanting companies to STOP taking our data. Or is it socialism trying to stop them? I don't get it. What do we get in the end if say none of us could record what other people do using a service we provide? Where's the benefit? So some company doesn't know when to stock for pudding pops during a storm? I mean what is it we're trying to stop here that is so damn harmful. This is coming from a person who fucking hates data being collected by Verizon with their horrible "deep" network cookies, hates answering agreements to share data, always clicks on free/non free software disagree to sharing crash reports. Yeah I don't like it but why the fuck does it matter? Really. I hate this anti freedom approach and trying to pass even more laws to make more things illegal. It only hurts all of us in the end and way more than some company knowing I visited beeg.com 25 times today.

The wrong metaphor

[Kamineko]

You've got the wrong metaphor.

Open up the session monitor in your browser of choice and you'll see it as a series of requests. Now the metaphor is much clearer: you're ringing them up, and asking them things. Your browser, on your behalf, is sending the data that lets the session persist and allows inferences to be drawn.

*ring ring*
ACME: This is ACME products, how can I help you?
John: Hi, I'm John, can you show me products related to 'shoes'?
ACME: Okay, here are leather shoes, casual shoes, trainers.
John: This is John again. I want casual shoes.
ACME: Mens or womens?
John: This is John again. Mens please. Brown, size 10.
ACME: Here are some styles of mens shoes in that colour. - writes down that John may be male, adult -
John: This is John again. Thank you I'd like to buy these ones.
ACME: Okay John, done. Would you like to see some women's shoes?
John: This is John again. Yes, women's, adult, formal.
ACME: Okay John, here are some formal women's shoes - writes down that John may be married to a woman, employed -
John: This is John again, bye.
*click*

I think the idea that this is 'users' data' to be misleading. It's the company's data regarding a request from a user. If I keep track of how many red or green apples I sell and in which months of the year and whether the seller is male or female or tall or short, that's sales data.

I think we keep begging a question, here...

[BankRobberMBA]

We keep assuming that it's our data. I'm not so sure it is.

Consider a different situation:

A woman has a baby. He grows up to be a famous actor. He doesn't want his birthday published because he believes there is age discrimination in Hollywood. His mom wants to write an autobiography. They each have a valid claim that the date in question is their own personal data.

If I google erectile dysfunction treatment, I think "My request for Google to bring me information on ED is my data," but Google thinks "That request I received for info about ED is my data." Obviously Google winds up with a freakishly gigantic amount of data, so our assumption seems natural, but I'm not 100% sure it's reasonable. Every search is transaction with at least two parties.

I hate and fear the data gathering. That's why I don't have a Facebook account, or Snapchat, Instagram, Pinterest, etc. I do search using Google, though, and I shop on Amazon sometimes, so I guess I don't hate it as much as I tell myself I do.

Re:I think we keep begging a question, here...

[PopeRatzo]

We keep assuming that it's our data. I'm not so sure it is.

Legal custom would seem to indicate that your medical history is yours, but I get your point.

Every search is transaction with at least two parties.

I guess what it comes down to is what we will allow Google to legally do with our data. As someone else pointed out, it depends on jurisdiction. We will eventually move to similar privacy laws here. There is a chance that we will look back at the past few decades as an anomaly in regard to the public/private properties of being online.

Re:Legal Injustice System Serves Corporations

[LynnwoodRooster]

How is that possible? GP said that only corporations were protected, it was only a crime if you robbed a corporation, not another person...

On your computing device?

[BankRobberMBA]

Serious question.

If all online services did not leave tracking cookies/spyware/etc on your computer, would you be ok with all of the other data accumulation and trading that happened?

is consumer tracking legal

[peterofoz]

Every retailer wants to know more about their target markets to get that competitive advantage.

Before the web, user information was gathered based on TV channels you watched by vans equipped with radio equipment that could detect which channels were active on a TV as they drove through neighborhoods for ratings or licensing purposes: https://www.theguardian.com/no...

Credit card companies, magazine subscriptions, and mail order catalogs requested were also valuable sources of consumer interests

The search engines and social media are simply extending the concept which is how they get paid for all the free software and services you get.

You can skew the AI engines and results somewhat by periodically visiting completely random sites or posting completely random things way out of your normal interests and watch where those interests show up in ads on other web sites. Industrial equipment is my favorite alternate go to.

Borked

[Humbubba]

It's legal for websites to gather and sell our data because there is no legal right to privacy in the Constitution.

It's called Surveillance Capitalism. More than just our labor, information about us is an object of economic value. In effect, people have been turned into commodities.

Market research's psychographics classifies us according to our social niche. That information is then used to micro-target specific segments of the market, the segments we occupy. As part of a massive feedback loop, words and phrases we are comfortable with are used in tailor-made messages designed to massage our psyche, and get us to buy whatever they're selling, be it goods, services, logos, ideas or politics.

https://en.wikipedia.org/wiki/Surveillance_capitalism/

Signed away

[BankRobberMBA]

Jurisdiction and liability can't be signed away, but privacy absolutely can. In fact you can give it away for free, just make your your private information public, and bang! You're there.

Re:Signed away

[jouassou]

Depends on your country. In many European countries, legal rights cannot be signed away, because that would be quite prone to abuse. Instead, if you signed a contract where you gave away any legal rights, then that part of the contract is simply considered illegal and void.

Not that complicated

[BankRobberMBA]

Yes, it seems we're not that good at overcoming simple, sound-bite messaging. For too much of the American electorate, 'simple sells.'

Ask Equifax

[Anonymous Coward]

I would pose this question to Equifax and transunion. They have been doing it for decades before the internet was born.

Re:They're not following you to observe what you d

[Can'tNot]

No, all of those social media buttons and ad banners and "free" analytics tools and fonts, etc., those are mechanisms to spy on you. That's how they follow you around, well outside of their living rooms.

Not the same

[holophrastic]

In the case of a web-site, it's not like following a person through public. It's like following a customer of yours around your own store.

I don't think you'll find any jurisdiction in which it's illegal, or even frowned upon, to record how customers walk through your store, which shelves they look at, which clothes they try on, which products they pick up. And if you want to sell your customer-usage data to someone, it's yours because it's actually your customer data.

This all comes down to the purple pages. Phone books were illegal, in concept -- a book of everyone's phone number, name, and street address. But it was accepted anyway because you had to know the person's name. But there were the purple pages -- the very same phone book, indexed by street address. So you could look up a street address, and see who lived there. The purple pages were considered illegal -- for privacy reasons -- and were not widely published as a result.

Until they were.

So the only true answer to your question is actually the simplest one: slippery slope.

What user data?

[Waccoon]

I expected this question to be about data collected from my computer, not the data I send to the web site.

Ad blockers are a security tool, and the main reason I use them is to keep ad companies from trying to break into my computer. I've come across way too many malicious scripts in ads over the years. Given how many legitimate companies have been caught doing that, is anyone taking that seriously?

I don't own a smartphone at all. I don't even want to know how much questionable yet suspiciously legal data collection is going on in that arena.

Think About The Harm

[ytene]

The OP compares one physical activity and one digital activity and suggests one might be illegal whilst the other is perfectly legal.

It might be worth taking a brief detour here and considering the way that society determines whether or not a particular activity is legal or illegal. This is a significant simplification, but in general terms we could summarize the core principle of illegality as being a range of activities which cause harm or damage to those disadvantaged by it.

If I steal from you, you are harmed. If I injure you, you are harmed. If I kill you; well, you get the point.

A big part of the apparent disparity between physically stalking someone [or, to simplify again, actions in meatspace] from the digital equivalent stems entirely from the fact that it is very difficult to evidence the harm being caused by digital stalking. That is not to say that digital stalking is harmless.

There are no end of ways that the unregulated actions of private companies such as Facebook and Google can harm you as a private citizen.

With no regulation of what data is collected, how it is analyzed, or who it is sold to, the opportunities for that data to harm you are diverse and significant. You may be unsuccessful in securing your next job if you are blacklisted by recruitment agencies. You may have to pay more for credit, or you may be refused loans, if you cross invisible lines with your digital life. You may be denied health insurance. You may be subject to even more surveillance if data collected on you by a private company is caught up in a government data request dragnet. You may be significantly defrauded if a company with whom you have shared data knowingly and willingly then fails to protect it, allowing you to become a victim of identity theft and associated fraud.

Governments the world over have failed to take steps to address these harms - even though that is the principle on which the concept of law was founded - for two broad reasons. The first is ignorance. As elected leaders demonstrate almost every time they speak, very few of them have a reasonable grasp of just how much harm this data harvesting can cause. The second is self-serving: the agencies charged with protecting citizens rights would much rather be able to issue a subpoena or NSL and get access to all that juicy data for themselves.

The only reason that the activities of companies like Facebook and Google are not illegal is because neither the people nor the government[s] truly understand what they can do. To get even the narrowest of ideas, look at what Christopher Wylie (of Cambridge Analytica) told Congress.

Re:They're not following you to observe what you d

[Freischutz]

You are going to their house and doing what you do, and they're just making note of what you did in their living room.

No, all of those social media buttons and ad banners and "free" analytics tools and fonts, etc., those are mechanisms to spy on you. That's how they follow you around, well outside of their living rooms.

It's more like each major tech company controls a fleet of cameras. These cameras are absolutely everywhere, on the roads, in the shops, in the fitting booths, in your living room, in your bedroom in your car, at the restaurant where you eat, at the cash register where you pay for your groceries, in the sex shop where you buy your dirty magazines ... everywhere. If you sit down on any toilet to take a dump you'll find cameras belonging to Google, Twitter, Facebook, Pinterest, and a whole legion of tech, advertising and market research companies recording every strained look on your face as you struggle to squeeze out that turd and taping every loud wet fart. Every leaf of used toilet paper is copied in triplicate and carefully archived. Then they sell their records of your activities to anybody willing to pay. You can try to make it harder for them to keep tabs on you by wearing a VPN mask wherever you go and wearing a camera blinding laser AdBlocker laser on your head but that has only limited effect at best.

It's not.

[Qbertino]

... Oh, wait, you're probably in the US. Errrm ... Nevermind.

Seriously you guys across the pond should probably just copy the new EU GDPR verbatim and be done with it. That would save you a lot of hassle. It's a great law and although it forces me to do muy job more diligently that actually by and large is a good thing.

Just sayin'.

Another tinfoil hat question?

[alphad0g]

Is Slashdot so in need of stories that anything gets published? There are such things as dumb questions, no matter what the nice smiling teacher may have said.

Nothing illegal about watching and recording where someone goes. I can watch my neighbors house and make extensive notes about all that goes on. And yes, I can follow you around and document what you do. You may be able to convince a court of a restraining order if I push things to far, but surveillance is not illegal.

It is not illegal in person or on line.

Most things are legal...

[Tomahawk]

...until they are made illegal.

Yes, the submitter's feelings aren't laws. Laws wr

[raymorris]

The submitter seems to have some misunderstanding about how law works. "Very likely illegal"? What law would be violated? The submitter doesn't seem to quite understand that laws are written down, and given numbers for easy reference. For example, web sites must comply with US Code 2257. Unless the submitter can point to USC [number], they have a *feeling*, not a law.

I used to work as a private investigator and I did follow people. I had to be very diligent about documenting what I saw, because a PI is not supposed to tell the client or court what they *think*, only exactly what they *saw*. As a PI, I couldn't say "he's boning his secretary". I had to say "at 6:35 PM the subject entered hotel room #123 with a blonde woman of medium height. Both parties left the hotel room at 7:40". I can't speculate about what they did in the hotel room (could be discussing his campaign for governor of Arkansas), so I have to be specific about what I saw to allow others to decide how to interpret the facts.

Re:They're not following you to observe what you d

[jittles]

You are going to their house and doing what you do, and they're just making note of what you did in their living room.

So... when they send their response to me and they include a 3rd party ad that is malicious and it is executed on my computer are they held liable for serving up a 3rd party ad? If they can do whatever they want while I am connected to their server then they need to be held liable for what they push to my computer.

Article 27 will balkanize trade

[tepples]

Article 27 of the GDPR includes a requirement to hire a representative within the customer's country or confederation thereof. Currently, article 27 representative service from VeraSafe starts at $2,700 per year even for the smallest businesses, including those with less than $1 million of annual revenue. If counterparts to GDPR adopted by other countries include a counterpart to article 27, then any small business that sells goods or services internationally may end up spending so much on representative services for each country with which the business trades that these businesses are likely to make a business decision to offer services only in one country or only in a small set of countries.

Other than limiting to which countries goods and services are offered, what solution would you recommend for recovering the cost of representative service pursuant to article 27 of the GDPR or counterparts thereto?

It's legal because ToS agreements make it so

[stevent1965]

I believe that just about every legitimate website or social media platform has a privacy notice and usually requires explicit acceptance of its Terms of Service Agreement. No one reads them but they provide the legal justification for those sites to collect the information. We consent to that collection.

Nope

[JustAnotherOldGuy]

"Would I be breaking the law if John D. has not given me explicit permission to do this?"

No, you would not be breaking the law.

Repeat after me: "There is no expectation of privacy in public, PERIOD."

Anything that can been observed from a public vantage point can be recorded, noted, drawn, sketched, photographed, etc etc etc.

False premise

[apraetor]

That question has a false premise. In virtually all countries it's legal to occupy public spaces and record all that you see, even if that amounts to trailing a particular person.

A couple of points:

[morethanapapercert]

1) Your trip to the store uses public roads, so you are already accepting that other people can see you doing so. A random member of the public is allowed to watch you do so and in every jurisdiction I know of, is allowed to write down what cars he or she sees, along with the direction, speed, license plate and so on.

2) Any store you patronize must know that you were there. That is inherent in making any transaction. Since the store is their private property, just about everywhere allows them to set up security cameras for loss prevention. Thus, it is straight forward to combine your face with the time you entered, how long you shopped before heading to the cash, what items you purchased, what payment method was used, paper or plastic etc. And once collected, they own that data, so they can in most areas, sell that to whomever they like. You implicitly agree to this when you choose to shop at that location.

3) Same thing applies to your credit card. Visa/Mastercard/American Express/Discover know, usually to the second, when and where you make credit card purchases. For some things, it is obvious what you bought based solely on where you bought it. But for the majority of charges, the data collectors have to infer from other data. (e.g. Visa doesn't know what appears on your grocery list, but can make some shrewd guesses at the liquor store, dealership parts counter, local pizza joint et al) You agreed to this when you signed the card holder agreement#

4) Air Miles and store loyalty cards are among the worst offenders for data collection, analysis and distribution. For any of the ones I know of, it is their core business. Again, you agreed to this when signing the card holder agreement#.

5) Most of this isn't new, this sort of thing has been going on literally for decades. What IS new is that the collected data is being shared more widely than before. It used to be a store wouldn't share its data for fear of giving competitors an edge. But now, everyone is doing it and, most importantly, making enough profit by doing so to make it a good idea from their perspective. Also new is the ever increasing sophistication of the analysis being done.

#Foot note: As far as I know, every card of every kind includes text in its contracts to the effect that merely using the card is legally equivalent to signing the contract.

Looking back

[BankRobberMBA]

Well, here's hoping you're right.

Re:They're not following you to observe what you d

[Impy the Impiuos Imp]

How would a company do if they set up face recognition in their store, had AI analyze everything you looked at and bought as you walked around, and shared all that info back into facebook or google or amazon's database on you?

Well, there was a little disclaimer in the lower right of their sliding door, I suppose.

It's in the EULA...

[fbobraga]

... the user grants the permissions needed there: you don't read that?!

You gave them permission!

[Tony Isaac]

You know that link on the home page of every site that says "Terms of Service"? Or that long document you clicked "I agree" to when you started using a Web site? You may not have read those documents (and that is what they want), but in those documents, YOU give the Web site explicit permission to track you, and for them to sell your tracking data to whomever they want.

Sure, you just skipped over that. They didn't. They knew you would agree to whatever terms they put in front of you, because you want to use their site for free.

There are a few alternative sites that promise not to share your data, and in exchange, you agree to pay a subscription. How popular are those sites? Nobody goes there, that's why you haven't heard of them.

People, including you, are all too willing to give up your right to control your data, in exchange for free stuff.