throawayblahads

Joined 4 years ago

Karma

Submissions

Member since

Dec 19

Recent submissions

Yeah, I think that's right. But it does raise an interesting point. The meta-point of the study was a good one, I think, which is to "study privacy on the internet".

I'm soooo behind that (one reason I am disappointed in the ethical lapses here)—I've often considered publishing the steps I take for each website on a substack or whatever, to help other people. Sometimes, it can be hard to figure out (1) if your data can be requested-to-be-deleted, and (2) how to even do it.

Clearly, the deception was bad; I guess, just thinking out loud, how could this study have been done ethically? Perhaps, sign up real people to request the data, and transparently include a notice that this was part of a study?

The last bit is the tricky one; including that might skew the results in favor of websites being compliant.

Comment · 4 years ago

EDIT: Some grammar, and minor clause clarification in second-to-last paragraph.

Yes, frequently. And throwaway.

About once a week, I pick an account in my LastPass collection, and initiate the following process:

1. Initiate a CCPA data request using a form or email, and I always include language about the timeline. I am not a lawyer, I'm just a person.

2. Then, once I have the data, I delete the account. I'm trying to purge my web presence before I move out of California. I have about 200 accounts left, and have done this with 50.

Admittedly, these are all large businesses, so far. Think Google, where I've worked myself, so I know they are equipped to handle it. But, I will be working my way down to small businesses eventually, and I am surprised to find out that simply quoting the statute (which is what I do) is considered anything but vaguely legally threatening. If the website doesn't fall under CCPA, or hell, if it does, I just expect it to be ignored. I mean no ill will.

I'm personally pretty conflicted, since I actually fully agree with this [1] about the study being unethical, but if I send an email as an individual to a website with my data, quoting a California law, that doesn't seem wrong to me, even if it causes $10k in legal costs, since my request is truly genuine and not intended to cause harm.

I would agree that there is a distinction at the study level, but I'm not exactly sure why.

[1] https://news.ycombinator.com/item?id=29599553#29601020