I recently attended an automotive dealership conference where I was being pitched for a product that would let me know if my customers were at rival dealerships. I poked and prodded to understand if these were legitimate claims or just marketing hype. They revealed that they purchased location data from app developers. I was shocked and surprised -- I don't know why I was because this should have been expected. It really enlightened me on the exploitation and misuse of data by crappy apps.
My team used to buy location data that we packaged up into reports for equities investors - the premise being the more foot-traffic your brand had, the more revenue you're likely to have.
Tons of apps sell this info. I think a lot of the 3rd party weather apps have been the traditional worst offenders because everyone wants to know the weather where they actually are in the moment.
I know the "best" way to stop this kind of privacy violation is good consumer protection and privacy laws, but I wonder if we couldn't also regulate the downstream market. I.e. make the sale and resale of personal data, as Cd00d is describing, illegal. It seems pretty proven that the humans doing that buying and selling aren't going to stop doing it out of civic responsibility or moral disgust
That's still whack-a-mole. Even if you changed the rules to selling user data, these apps would just update it in their TOS that consumers agree to without reading.
Even laws have this problem. There are so many cookie bars on websites that users just click through them anyways.
Whack-a-mole by the way the laws are written. You can write laws that aren't whack-a-mole. E.g. "it is illegal to sell or transfer user's data to another company without positive informed consent from the user within 1 month of the transfer"
Every time a company wants to sell on your data, they have to email you and ask permission. Not responding to that message isn't consent.
Company A sell data to party B. Party B resells the data to party C, D, F without informing company A. Company A & B are owned by the same conglomerate.
Your law as written would only cover company A doing the sale of data to B, but not the downstream intermediaries.
Alternatively, company A doesn't sell the raw data, and instead sells reports and anonymized data that can easily be joined with other datasets. As this is not a sale of "user data", but an aggregated, anonymous insight.
“You may not sell the information of any person without explicit written consent for that instance of sale from that person. Aggregation counts as information. Rights are not transferable.”
The data industry is full of scum - nothing less than scorched earth in advertisers and brokers is sufficient at this point.
This would eliminate, like, caniuse.com, wouldn't it? Information about what browser version is used by 99% of visitors to a website is an aggregate of personal information of users of a website.
They’ll just come up with some aggregated form of the data they claim doesn’t violate the letter of the law, sell that, and be in business for years before anyone finds out let alone tries to enforce the rules and find out of they are violating it.
This would honestly still be a huge improvement imo, as even forcing data brokers to anonymize or aggregate the data, even if it is ultimately not actually providing privacy, is still a recognition of the problem over the current system in most states.
They'll put it in an "updated terms of service" dialog. People always just accept updated terms of service just like they always just accept the initial terms of service
Especially if the terms of service are 147 pages of 6pt text containing nothing remotely concerning privacy, with a link buried in there somewhere to their privacy policy that then has some disingenuous weasel wording on page 14 which might imply that the "legitimate reason" they have for scraping your data is to sell it to third parties.
The loophole is regulatory capture. The laws are written strongly, then watered down by self-interested companies throwing money at the legislative pipeline.
I don't know the answer to this, but it would probably be a crisis of some sort, like cambridge analytica.
It's sort of amazing how far out of hand things have gotten, with phones, cars, televisions, and more collecting data and matching it with your "dossier(s) in the cloud"
> You can write laws that aren't whack-a-mole. E.g. "it is illegal to sell or transfer user's data to another company without positive informed consent from the user within 1 month of the transfer"
The problem is people are stupid and uninformed about giving consent. You're the one trying to loophole around that.
If you actually want to regulate this the way you describe, you have to do it by removing peoples' right to give certain consents. For example, nobody may give consent for more than 6 months for the use or transfer of their data.
This is a big deal! You're removing a free mode of contracting. But if you think about it, we do it all the time. That it has a higher burden of proceeding around new technologies is a large reason why American (where we are careful about rulemaking) and Chinese (no rule of law) tech companies are ascendant. But at a certain point, the usual rulemaking frameworks may need to be applied.
>The problem is people are stupid and uninformed about giving consent. You're the one trying to loophole around that.
Not really. People have a limited amount of time to deal with issues and aren't trained legally. This doesn't make them stupid. Their inability to suss out all possible downsides of a set of EULAs across various products for a service they're looking for isn't stupidity; it's just an inherently complex space that requires a lot of time and specialist knowledge.
This is one of the main ideas behind consumer law; certain contracts are inherently slanted towards those who draft the contract, therefore we remove some of their freedom to abuse consumers by placing limits on the clauses we're willing to enforce.
That lack of willingness to place restraints on these types of freedom has less to do with the inherent difficulty of restraining freedom of contract and has more to do with the fact that the harm is distributed diffusely amongst a massive swath of consumers, vs felt acutely by specific data aggregators so one side advocates far more for their position - even if that position is antisocial in nature.
I think good arguments often have to begin with an assertion that "we aren't as dumb as we tend to think" and introduce color that gives the average person the benefit of the doubt. This post does that nicely.
> "Their inability to suss out all possible downsides of a set of EULAs..."
This is the part I quibble with, however. This assumes folks even read legal-speak. Privacy laws have undermined this by forcing more text and more "I see, I agree, go away" links/checkboxes/buttons in front of people. The problem isn't the EULAs, the problem is that no sane person can (or should) keep up with it.
Yes, sometimes people can be surprising. My wife has an awesome t-shirt from MailChimp from a not-so-hidden "if you read this, you get a free shirt!" clause she found in their legal stuff. But relative to the amount of cheap "consent" given, this is a huge outlier.
That said, I also have to give kudos to some of the lawyers I've worked with in the GDPR/CCPA/etc era. At least at the point of purchase, there was no better corporate consumer advocate of "boil it down to two or three crystal clear sentences and link to the details, which must cut to the chase" to be found.
They obviously don't, but you're missing a key idea; why aren't they?
You can't benefit from reading without expert knowledge, and the cost is a massive time-sink. Even lawyers, with experience reviewing these types of documents, take a substantial amount of time to get through them and note them up.
If EULAs said: "In exchange for this free Solitaire App, we're going to reserve the right to inform your insurance company about which doctors you visit and the government about which abortion providers your phone keeps going to" you'd obviously read it because you can understand what's going on and you'd understand the exchange in a reasonable time-frame.
This situation doesn't exist because people are stupid. People are smart, which is why they aren't wasting their time trying to go to law school each time they need software.
> I know the "best" way to stop this kind of privacy violation is good consumer protection and privacy laws
But I don't want any of my data collected or shared!
The laws you are hoping for won't allow that - if they existed, at best they would only allow those companies to whom you have consented. Ie the mega-corporations. Local shops would be the ones without the data. Which would be pretty much exactly the opposite way I would choose to share my data, if I were forced to by law.
> I know the "best" way to stop this kind of privacy violation is good consumer protection and privacy laws
I agree such laws are necessary, but I'm not sure they're the best of the various solutions. Technical measures might be more robust, such as fine-grain permissions in mobile operating systems. I'd rather it not be possible to collect my data in the first place, than trust that some developer (in whichever jurisdiction) isn't breaking the law.
An advantage of the web is that hostile code is more easily tamed than in native apps, but in itself this observation doesn't do the user much good. Apps are pushed in part because of their superior capabilities for user-hostile functionality.
Similarly, Free and Open Source software is rarely this user-hostile, as few people have the nerve to publish their user-hostile code for all to see. Again though there's a sort of collective-action problem: if only the abstemious few like Stallman insist on not using proprietary software, things don't improve.
I'm wondering whether the opportunity to legislate consumer protection and privacy laws has long passed because enough companies have sprung up to take advantage of this covert surveillance data flood that there could be relatively severe economic impacts caused by any attempt at trying to dam it.
ie. the political will to make any such changes just may not exist beyond pure lip service to minority who actually know and care.
I've considered what the options would be for something like "privacy-as-a-service", but I get the feeling that such an industry would be more likely to be regulated to death than the one it's in reaction to.
Ironically, "privacy-as-a-service" already exists to protect the financial records of those with big enough financial records to be able to afford said privacy protection service. One law for me, another for thee.
I think the opportunity has passed because companies who rely on violating privacy have effectively taken over humanity's social fabric.
Any politician that attempts to regulate this can be thwarted by just shadowbanning any content that mentions them on social media - and he'd effectively disappear for a large chunk of people.
Easy solution is to make user data toxic. Make it a liability. Poison the well.
Make a law where if you ever sell a minor’s data, regardless of whether that minor lied about their age or agreed to a contract (wouldn’t be binding!), then you face steep fines. If you’re found buying data belonging to a minor, also steep fines. If you buy and then de-anonymize data belonging to a minor, really steep fines. To collect and hold data that may belong to a minor, you need to justify it (like GDPR).
Obviously this doesn’t scale for aggregators, advertisers, basically SV, which is the point.
A restaurant is responsible if they sell booze to a minor. A store is responsible if they sell cigarettes to a minor. Serving a minor that lies about their age does not get you off the hook!
Problem solved. User data is toxic. You won’t want to hold onto it for any other reason than a legitimate use.
Steep fines are barely a speed bump to either a profitable business or a scammer. They take years to actually get implemented, don't survive bankruptcy and get reduced in court.
Jail time. Mandatory. Zero room for judges and juries to go easy on the perps.
Even this does not stop white-collar crime, but it maybe slows just a little bit of it.
Steep fines for “each” occurrence. You can most definitely deter all but the dumbest companies from trafficking in toxic data.
Are you going to buy shares in a company who’s entire worth is derived by it’s user data when it turns out that a significant but unknown amount of that user data is actually a very expensive liability?
There’s always going to be someone searching for loopholes, like anything, so keep it unambiguous and straightforward.
I think this would be a better state than we have now...
... but I feel like it isn't the ideal solution. I don't think we should make the perfect the enemy of the good, but what I'd really like to see is that people own their data about them.
I should be able to figure out what vendors have data about me. I should be allowed to be forgotten. There should be severe liability if they don't forget me.
I should be able to contract away my data, but in return for a real benefit, and that shouldn't extend to sale / redistribution.
I don't buy anonymization. De-anonimization is too easy, too good, and progressing too quickly.
I think the best way is to attack the market from all sides.
- GDPR-like legislation to try to prevent the inappropriate collection of this information.
- Ban the sale of or trafficking in illegally collected personal information. Apply serious monetary penalties to anyone who sells such information improperly. Additionally, anyone who sells such information and subsequently learns that it was improperly collected or was GDPR-deleted must tell their buyers, who must then delete it.
- Buyers are liable if sellers are found to have violated the rules and don’t pay. They are also liable if they fail to honor delete requests. Buyers who consider this liability unacceptable may attempt to purchase or require insurance.
> Ban the sale of or trafficking in illegally collected personal information.
In the US isn’t the sale of illegally acquired data already illegal under 18 U.S. Code § 2315?
I wonder if any existing stalking laws would cover existing data collection practices. Most people are upset when they learn there are records of their location down to a meter or so wherever they go that are sold to anyone who wants it. Does that meet the bar of “emotional distress”?
Along with blocking commercial creepy behavior, I would love to see similar restrictions applied to governments that use commercial access to simply vacuum up large quantities of this information without warrants. (IIRC, ICE in the US is one well-known offender here.)
I wonder... Is there a way to overwhelm them with useless junk data?
I'm just thinking out loud, but maybe send my own phone a bunch of fake GPS signals, say, within my own house? Or maybe, somehow 'trade signals' with someone else in a way that collecting the data is useless? Or store my phone in. Faraday cage when I'm not specifically using it? Im sure other people who know the specifics better than I do will flesh it out better that I have, but maybe this will get the ball rolling...
I was thinking the other day of setting up a bunch of VMs with some browser automation with the goal of aimlessly browsing popular sites with the plugin enabled in the background in order to have most ad providers blacklist my IP for ad fraud and thus not trust any data coming from me.
I only know one guy who used Ad Nauseum, two or three weeks later his gmail account was banned and to this day he has to complete a CAPTCHA every time he visits a Google site from his home IP.
Selling personal data is illegal unless the person opted in
That's not possible to opt in to under the GDPR, FAFAIK. People can consent to the purpose for which their data will be used, and any such purpose must be enumerated explicitly. "Selling the data" is not a processing purpose, and it would still be illegal even if the person consented (it does not meet the bar for informed consent).
Under the GDPR, the only legal way for personal data to be transferred between companies would be for the "buyer" (processor) to use the data original data from the "seller" (controller) on behalf of the controller. The data, as consented to be collected, remains the liability of the controller for its entire lifetime.
On the other hand, the main source of the money for the industry - major advertisers - are legitimate above-board companies, who either are honest or are liable for enforcement.
GDPR is not really about selling personal data but about using it; a big part of its effect is on buyers of data since GDPR effectively (there are all kinds of nuances) means that it's not legally possible for legitimate company to simply buy personal data for arbitrary purposes, since the data subject obviously did not opt-in to that particular purpose by that company when the data was collected.
Honestly, I'm not sure it needs to be illegal. I'm not sure it shouldn't be either.
I wholeheartedly admit, some of our data providers are shady, and there's no way I would go work for them. I don't like the way they mislead people.
That said, the data we get is anonymous. Sure, if I know enough about you, and you're in one of my panels, it's feasible that I might be able to figure out which panelist you are. I know there's been some kerfuffle there with less than upstanding "private investigators" and bounty hunters in the past. But, the data we deal with is far too expensive for those sorts.
We find valuable consumer behavior insights the data at regional levels. That creates information that's valuable not only on Wall St, but to retailers and brands, who are desperate for anything to help them understand market share and loyalty.
I dunno. It's a weird world. It's also a very commoditized world. Just having access to the data is no longer the main value add - you have to provide the meaning of it as well.
There's no way to anonymize location data. Where does your phone spend the night plus where does your phone spend the weekday equals a unique identifier when cross-referenced with an address database.
That's a fair point, and I'm guessing why my previous comment is being downvoted.
I know our location provider did some things proactively - like they would not geofence hospitals, for example, but "home" is likely very visible.
That's a dataset I didn't work on as much, so maybe I'm not being sensitive enough to the "this should be illegal" argument. I guess on reflection misleading you for the collection should be illegal, though how to do that isn't obvious.
What I've worked on the most is people's credit card transaction histories, and that's quite a bit more naturally anonymous, though again, if you know enough about a person they would be discoverable.
Bin it until its anonymous again. Your route is too identifying, but is "people who appear to be driving away from a residential location between 9:30 and 10"? Fun to think about.
Weather data is so tiny that there’s no good reason to not just fetch the whole weather point-map for your country and then select from it client side.
I just had a look at the per-app data usage on my phone. Out of a total of 5.7GB of data usage, the weather app used 12.1MB of data. Sure, that seems tiny. But I live in Canada where there are over 4000 weather stations. Multiply that by 12.1MB and you get 11.8GB of data usage for the weather app, dwarfing all other apps. Either the fidelity of weather data would have to be reduced, or the update frequency, or a smaller selection of weather stations would have to be downloaded from (those in my area), defeating the purpose of fetching the whole map (hiding my location info from the server).
Are you sure that is 12.1MB of weather data, and not 40kB of json and 12.096 MB of ads and tracking data going back to them?
For example, a full month of hourly weather data for a single Canadian station is 131KB (pulling from the Climate Canada site), meaning that if you wanted an hours worth of data for the ENTIRE country you're looking at less than ~800kb.
But if you just limit it to a geographical subset, say the lower mainland of BC, or even just a single town, then you can eliminate pinpoint data about yourself. Knowing that a person is in Abbotsford is far less invasive than knowing that they went to the Shoppers Drug Mart at 8:46 PM after searching for cold medicine.
This isn't a black and white thing, I wish that I had more control over my iPhone. I would love to be able to tell it to report a general location (somewhere random within a 10km of my actual location) to some apps, and a precise location to others. I get that Wunderground has server bills to pay, and I'm not paying them, but I would imagine that there is still a viable ads based business model that doesn't get quite as invasive.
> I wish that I had more control over my iPhone. I would love to be able to tell it to report a general location (somewhere random within a 10km of my actual location) to some apps, and a precise location to others.
The iPhone (actually iOS) allows you to do exactly this. You can choose precise or general location on a per-app basis.
I use the built in weather app on my iPhone. I’ve never seen any ads in it, so I don’t know what “ads and tracking data” you’re referring to. The app does update on a minute-to-minute basis when it’s raining out, though. It looks like this [1] and it doesn’t just scroll left on a local timer. The magnitude of the predictions in the graph change on a minute to minute basis and can disappear entirely, giving a very nice prediction of when the rain will stop so that I can go out and expect not to get wet.
I have a feeling that weather data compresses together well — especially if stations 1. are ordered along a space-filling curve geographically, with read-outs of geographically-neighbouring stations in sequence; and 2. are stored column-oriented where each future time is its own column. Basically the same optimizations as you would use to store any other IoT time-series sample-cloud data.
I suspect that, encoded this way, weather for 4000 locations wouldn’t be much bigger than weather for 1 location.
Also keep in mind that half the reason the Weather app needs to use as much bandwidth as it already does, is that whenever you move even slightly, it can no longer give you accurate info without grabbing the point-forecast again for your new location. It uses far less data if you just stay at home all day every day. If it had a pre-cache of forecasts for the entire local area, it wouldn’t need to do that; it could just refresh once every few hours. Maybe even wait for you to be on wi-fi before doing so, if it has modelled you as usually connecting to wi-fi several times daily.
I think the bigger issue is the update frequency. My weather app updates minute-by-minute, giving me essentially real-time precipitation information from my neighbourhood weather station. If each future time is a column, you're looking at 60 columns just for the next hour of forecast. It really adds up!
This level of detailed information can't be pre-cached, either. I believe they are feeding the real-time weather recordings from the weather station into their supercomputer model to generate minute-by-minute high resolution forecasts over the next 6 hours.
Here's the local conditions at Sea-Tac at 7:15pm Pacific time. We have wind direction and speed, visibility, cloud conditions, temperature and dew point and barometric pressure in one small snippet.
The forecast data for the next 24 hours is given similarly. Radar data would be more complex but the basics for any weather app are only a handful of bytes.
I can't find the source but I believe there are about 4000 METAR sites. There are plenty more small airports that will issue a weather report but they are pulling from the closest site that actually records METAR data.
I can look out the window and see what the weather is where I am now. Beyond that I am interested in the weather for my general area over the next couple of days, which is imprecise enough anyway that my exact location doesn't matter.
I use the 6 and 12 hour forecasts every single day, personally. Simple stuff like - is it going to rain while we go to the playground, what's the UV going to be while we're at that outdoor thing, how cold is it going to be after I go to bed and do I need to close some windows... that sort of thing.
I distinctly remember a time when all we had was tomorrow's forecast on TV after the evening news and/or today's forecast on the radio before the morning shower. And before that, it was mostly looking at the sky and listening to our intuition.
Im not going to claim that everyone needs live access forecasts all the time but to claim that there is no benefit to having live access to forecasts is just silly. Sure you were fine, but that doesn't mean that what we have now isn't better.
> 's forecast on TV after the evening news and/or today's forecast on the radio before the morning shower
I don't know about you but I certainly don't want to watch the news or listen to the news and traffic reports to get the weather. I'm _very_ glad we've moved past that
> And before that, it was mostly looking at the sky and listening to our intuition.
Really, your argument is that things were fine before we had instruments so we don't need them?
Well no, but the daily forecast gives me a good enough approximation. If I know the temp in the AM when I get up and I know the forecasted high, I can get a pretty good guess of what midday temps will be. If a massive front is moving through that will lead to significant changes, well the forecast will capture that too in wind and precipitation forecasts.
As for the next 30 minutes, I have tried AccuWeather and DarkSky. Both get the timing wrong about as often as they get it right for my location.
Those daily forecasts are highly localised though. I live in a city with half a million people that has its own little microclimate because we're surrounded by large hills on 2 sides and ocean on the other two. A general forecast for even 20 miles around us would almost certainly be wrong.
> As for the next 30 minutes, I have tried AccuWeather and DarkSky. Both get the timing wrong about as often as they get it right for my location.
Anecdotally here the met office is right far more often than it's not.
I recently added AccuWeather back to my device. I didn't permit continuous access to location and it kept an incorrect city for the desktop widget. I was tempted to give full access but now I realize I'm best to just delete the widget at least and double check permissions.
The amount of data available in the automotive world is incredible. License plates connect VINs with everyone who owned the car. Driver's licenses can be inferred if not directly connected. History of fines tied to person or vehicle. Dealerships and insurance have records tied to the VIN. Who financed loans for how much...
Houston tracks every car on the major highways by their built in Bluetooth interfaces. Even if you do t have a Bluetooth phone, the car has Bluetooth and will give up its ID to large antennas on the light posts along the highway.
There are plenty of very good reasons to track vehicle locations (ex. new road planning, maintenance). Problem is, there are plenty more, more profitable, reasons to do so (ex. invading your privacy to sell you ads).
I think it's fine, if you're going that fast, you can't be anonymous. Airplanes aren't, missiles sure as shit aren't, the whole atmosphere is under surveillance for anything larger than a baseball.
I fly a light sport plane (Canadian Ultralight which is not the same as a US ultralight) in airspace controlled by the military over an airbase. It is frankly astounding how often they lose me on radar coverage while in their airspace. I have a Mode C transponder blasting my data out to them as well.
The capabilities that the military/government pretend to have are VERY different than the capabilities they actually have.
Specifically for cars, that's not actually surprising. They're between several-to-tens-of-thousand dollar highly-mobile multi-ton pieces of hardware that are both incredibly valuable should they be stolen and incredibly dangerous should they be misused.
The tracking probably shouldn't extend to customer marketing uses, but the fact that VINs tie to plates tie to drivers' licenses is a system built out of hard decades of experience on the kind of damage people can do if the system isn't tracked and audited.
> Specifically for cars, that's not actually surprising. They're between several-to-tens-of-thousand dollar highly-mobile multi-ton pieces of hardware that are both incredibly valuable should they be stolen and incredibly dangerous should they be misused.
How does this data prevent either of those things?
It doesn't. It's incredibly hard to stop a first-time bad actor in the general case. To a first approximation: that's what the car key is for, but if that fails (or an authorized user is the one doing the damage)...
The key is part of the sentence is tracked and audited. It helps to make people whole after-the-fact and minimize repeat harm.
To give a few concrete examples: commit a crime while operating a car? Your plate is, in modern times, now in the databases of multiple police precincts. You will now find it difficult to operate on public roads without getting pulled over (which also impinges on your ability to easily flee from the scene of the crime). Steal a whole car and ditch or replace the plate? Your VIN is now flagged stolen, so good luck getting any legit operator to do work on that car. Crash a car and try to repair it and re-sell it with a damaged frame? Again, the VIN is logged if you had any professional do major repairs on the car. And if the cops pull you over on a public road and you aren't licensed to operate a vehicle on a public road... Oh boy, hope you didn't have plans this week.
And now the vehicles you buy are tracking and selling your data. I worked as an SWE in research and development at one of the bigger manufacturers just a few years ago. The executive level rhetoric was "it's not the customer's data, it's our data." This is how they justified tracking and selling a customer's data. Let that sink in...
I made a big fuss about it at every opportunity and is one of the biggest reasons I left.
All these advertisers get to do all sorts of creepy stuff and yet I, a normal person, can't go from plate to name. I just wanna offer to buy cool old shitboxes I see driving around.
There’s a form to fill out. Looking at the instructions it’s E or F, so in theory if you can fulfill one of the reasons in F, I suppose you don’t need the owners information.
Outside of the US, you can also request similar information - Ontario for example.
> Vehicle records ordered online do not contain information about current odometer readings, collision information, driver’s licence numbers, owner names or personal address information.
It says it contains:
Vehicle description
Plate number of current plate attached to the specified vehicle and all other previously attached plates
Date(s) the vehicle was registered to each registrant
Vehicle status
So, not really equivalent or what the parent comment was looking for.
If you scroll down further, there’s a separate section to submit a request specifically for current owner information. While it doesn’t have their address, it would be a first step in identifying the person. This is also using the “official” sources. There are for profit entities that correlate better.
After that, with the information you get about the current owner, you may be able to submit the paper form for one of the driver history requests that do include addresses.
I don’t live in Canada, nor do I really have a solid understanding, but it seems like for ~$40 and some time you might be able to obtain a lot of information from a plate.
They do say you need to be a business / approved entity, however, it looks like you could request it as the person as an uncertified record online.
While I’m sure that’s illegal, it doesn’t seem like it would actually stop someone who started at the plate, and wanted to get to name and address.
And/or
It does seem like you need the current address, but, you could probably abuse the system to confirm an address by seeing if your order is cancelled or not.
Once you have name and date of birth, you can probably begin to track most people down.
Edit: so it wouldn’t work quite that easily, you can get to name, but I confused license and permit on the one form. So barring trying the paper form for a 3 year check without the licence number, I’m not sure you can get beyond name from the plate.
There's a federal law that restricts the info to a list of specific purposes (basically that list) and states are slowly updating their processing accordingly so you generally have to lie on the forms. Different states go to different lengths to do their due diligence.
If you have money, is there anything really stopping you? Just set up a fake corporate-looking website and start contacting vendors! You will have to meet minimum order volumes though.
Same if you register to vote in most places. It’s just insane that in order to participate in society you have to blast all your info out into the public worldwide for anyone to use for any purpose, forever.
Scummy data brokers and stalkers win, everyone else loses.
That's part of why I refuse to own a car. Walking is much better. I love walking.
Plus the whole thing is highly conspiratorial, like you talk about. Getting you to the bargaining table ie into the dealership. Then they work you, edmunds.com has an article about all the shitty little defeating tactics car dealerships do, at the direct verbal instructions of the dealership owner, and him directly under orders from the car companies.
Plus it's oil, American soldiers die every day for that oil in the Middle East, and many local people with them. It's no joke, in fact one time a military man I knew told me he just drove slower on the highway, like 30 mph under the limit, strictly because that oil is American blood, and you use much less driving slower to reach the same place. Like the lower speed limits of the 70's, but under his own volition.
In WW2, there was propaganda (not being negative, I don't consider it a negative thing, means words to be spread, spread the word) saying if you drive alone, you're driving with Hitler. Later, if you drive alone, you're driving with terrorists. There would be no war, at all, in the whole Middle East if it weren't about oil exploitation. That's the whole deal. Israel a little bit, but oil all the way. The Middle East had, up until I think 1947, including Iran, a very high opinion of America, blue jeans rock and roll, pizza, inventions, California, Cadillacs, what's not to love. Then came the Israeli War of Independence, then grossest of all the coup in Iran in 1953 which was just disgusting, and things changed very quickly.
> American soldiers die every day for that oil in the Middle East
We could dig it up in the US, we were a net exporter under the Trump administration. We just decided to dig it up a ocean away and use bunker fuel to bring it to us. Apparently for environmentalism, it's still unclear how that is better.
Just like there's corruption masquerading as defending Human Rights, there's corruption masquerading as environmentalism. Not all of it is like that, but there's a lot of it. And the lines get blurred sometimes.
The numbers have to square up. That's critical. And the reasoning must be sound, no in-befores (inb4's) or soundbite explanations or silencing critics, in fact let the judge and jury decide for the most part, and if you are opposed, become a juror for the next time around.
When I was a consultant, I sat in on a lot of meetings at startups who were getting near the end of their runway. So many of them talked a good game about privacy, but when they couldn't find enough revenue, they at least talked about selling user data. The main argument against it was not that it was unethical, or that they'd told users they wouldn't do it, it was that they didn't have enough users to make it worthwhile. Since then, I just do not trust any company not to keep, process, and sell my data, no matter what their nominal values or privacy policy says.
We need laws that makes possessing such data a liability for companies. It's the only way to make them handle it with care and reduce misuse. Should feel radioactive to them.
This was just ordinary software consulting; meetings on site with our clients. I often I met with their lead product people, though sometimes the founders, since the companies were small. After a while, especially if you are working from their office, people don't hide things. I'm not sure they cared, either.
It’s funny that when the story is about their political allies, that data becomes much less concerning:
> “It’s really, really hard to assign even what side of the street you’re on when you’re using this kind of data,” said Paul Schmitt, a research scientist and professor at the University of Southern California.
Looking at the preceding paragraphs, I'm not sure I understand what point you're trying to make:
> Mr. Phillips and Ms. Engelbrecht’s case is largely built on cellphone data. A report created by the group includes an appendix that claims to list “IMEI” numbers of the tracked devices — 15-digit codes unique to each cellphone. But each entry on the list is a 20-character string of numbers and letters followed by a lot of x’s. Mr. Phillips said new IDs had been created “to obfuscate the numbers.”
>"The same report says the group “purchased 25 terabytes of cellphone signal data emitted by devices” in the Milwaukee area in a two-week period before the 2020 election. They claim to have isolated 107 unique devices that made “20 or more visits to drop boxes” and “multiple visits to nongovernmental organizations” that were involved in get out the vote efforts.
>A number of researchers have said that while cellphone data is fairly precise, it cannot determine if someone is depositing ballots in a drop box or just passing by the area.
>“It’s really, really hard to assign even what side of the street you’re on when you’re using this kind of data,” said Paul Schmitt, a research scientist and professor at the University of Southern California.
The parent posted a NYT article about cell phone data being used to inferring an individual activity based on their location. Recently, the NYT is implying that the data isn’t really all that accurate and can’t be used to infer an individuals activity.
Both are articles are perfectly consistent with being able to locate a person to within at best a 16 feet radius or so, and less accurate when in a built-up area. Hence the quote about not being able to reliably tell which side of the road someone's phone pinged on.
It’s also the same data used by police to identify devices (and by extension their owners) that were near the scene of a crime. Phones don’t use “just” GPS for calculating position.
My point is one article uses the information to (rightfully) strike fear/discomfort in the reader. The other article uses it to dismiss an investigation that is inconsistent with the paper’s narrative.
Someone more informed might know this better than me: are all mobile apps constantly collecting as much data on you as they can and reselling it? I had this realization sometime during COVID (I know, I'm late to the party). I assume any free (as in beer) app is doing this and possibly even paid apps.
An alarming number of them are. And consider that in many, many cases, the apps don't even know they're doing it, because the developer is including some SDK that helps them (e.g. SDKs that help them monetize by handling ad placement). The SDKs can do whatever the app can do, so they're quietly siphoning all kinds of data off and sending it back to the publisher of the SDK.
<s>Right, just like the Linux kernel and OpenSSL.</s> Just because something is free doesn't _automatically_ mean you are the product. That said, I agree in this case - lots of free scammy apps are free because they make more money that way than selling the app.
Not all mobile apps, but your mobile phone is your own personal surveillance device. So when mobiles first came out they didnt have any background noise cancelling algo's so if someone's phone "accidentally" called the last person whilst it was in their pocket, you could listen into everything they were discussing and identify the other people they were talking to. The Edward Snowden leaks, showed the phone's can be remotely activated if switched off, a bit like the Intel Management Engine is for PC's, so to defeat that you need a phone you can take the battery out of. If you want to analyse it in greater detail, do a replay attack on the transmission from your phone, like you can with wifi and then pick apart the data that is being transmitted. You might have to write your own software and get a suitable SDR dongle to listen in to a smart phone, but its doable. About a decade ago, you could get apps for android which allowed your phone to override the cell traffic management, in other words you could make you phone use a particular cell mast when there was a choice, as this can also be used for triangulation purposes, it offered a level of privacy by ignoring the other masts so triangulation couldnt take place. The smart thing to do is roll your own OS for your devices, you can even use wifi to identify whether someone is carrying a gun or knife on their person because different alloys react differently to RF signals like wifi, so you could have one of the new Garmin Fenix 7 Super Sapphire's with your own OS working with a smart phone on you that is also running your own OS scanning for metals. Anybody doing a concealed carry near you gets found out. Hacking firmware like the OnePlus 8 Camera which see's through plastic also removes privacy for people, because nylon is plastic and plastics are being used more and more in clothes, like winter Fleece jackets.
https://twitter.com/MaxWinebach/status/1260564386546094081https://twitter.com/BenGeskin/status/1260607594395250690
Science is stealing everyone's privacy and I stopped carrying a mobile years ago!
This info is anonymized and barring extreme measures you can’t be identified individually in a data set. It’s sold with very specific usage rights, and for advertising uses a cpm (cost per thousand) fee. You can’t ever buy the data set, but just the ability to target users who exist in it.
For example Visa has an exclusive deal with oracle. So only oracle can buy audiences with visa data, and visa has super strict requirements and only builds them in house. If you say “I want users who purchased x product” the size must be 5mm users minimum (I think) and visa models it up using lookalikes/etc to 20mm+ users (maybe slightly off on sizes). Then it’s like $4 cpm to use at a dsp. Brands/agencies etc have to go through oracle to get visa data.
> This info is anonymized and barring extreme measures you can’t be identified individually in a data set. It’s sold with very specific usage rights, and for advertising uses a cpm (cost per thousand) fee. You can’t ever buy the data set, but just the ability to target users who exist in it.
I attended a presentation some years back from TMobiles marketing team.
According to the speaker, when you visit their homepage they pull up complete financial records on you, including how much your home mortgage is, if any, and use that to customize what products you see promoted first.
As far as I’m aware (and I’d hope I’m up to date here) that’s only possible if you’ve logged in to your account, so they’d have your name/etc.
Matching a cookie to individual names is not instantaneous and would be very expensive for someone at t mobile’s scale to do every time a session started.
Some b2b companies do something similar where they can match your ip to a list of known corporate ips to find where you work in real-time, but that’s pretty expensive.
The example I linked, Amerilink data set, I have a copy of (via my company), sitting on our internal corp NAS drive, and it is 100% raw data with PII. Can query on name, mailing address, DOB, etc. We have an unrestricted license that we pay a good chunk for annually.
> SafeGraph calls the location data product “Patterns.” In total, the data cost just over $160. Not all Planned Parenthood locations offer abortion services. But Motherboard verified that some facilities included in the purchased dataset do.
> SafeGraph’s data is aggregated, meaning it isn’t explicitly specifying where a certain device moved to. Instead, it focuses on the movements of groups of devices. But researchers have repeatedly warned about the possibilities of unmasking individuals[0] contained in allegedly anonymized datasets.
This was my company by the sounds of it. This product has failed because the location data just isn't all that reliable.
Also, when digging, the data is heavily skewed in favor of low income. This was instantly noticed by the difference in data available for budget brands and models compared to the pricier lots.
This is why I refuse to install apps on my phone. The companies will push and prod you to install their app, but it isn't worth it. I could have had a free hamburger from Burger King recently, but you had to order it through their app - my privacy is worth more than a burger.
Everything in auto sales is a game. The more information on you they have, the more they can "persuade" you to buy at numbers more favorable to them. They look at the status of your car. If it's clean, they think you're more serious to buy and might not have to negotiate as low. If doesn't look like you've made the effort to clean it out before getting rid of it, they might think you're just shopping.
If they know you're looking at other dealers, then yes, they might think they need to play harder. If they know you're looking at accessories for this new car, then they can think you're more ready to buy. Every bit of detail they can get, they will use.
Seems like rival shopping is on the margin and recouping the location service tracking costs feels unlikely or at least untraceable in terms of tying it back to an ROI.
this is very old info, but back in the 80's, finding a solid lead--a person who was in the market to buy a car--was worth around $150 of marketing money
Tim Horton's sells donuts, so I doubt comprehensive data about where you are wrt donut shops all year comes close to that value even 35 yrs later
It's a 'fast food/coffee' chain that really was made popular by a recurring skit on a TV show called: Royal Canadian Air Farce (Sketch based usually heavy on the political satire)
The skit had 3 people sitting around a table drinking coffee and cracking jokes about current-events and mostly political fiascos. It was this lampooning of 'typical Canadian behaviour' of art imitating life that caused more people to show up and start hanging out at the corner coffee shop. In my small home town (40,000 people) there were maybe 3 shops (aka Timmies). During this boom to it's popularity that number increased by atleast 10. They made their doughnuts in-house every morning, and the coffee was tolerated as being acceptable.
As the franchise grew in popularity it became something of a joke and expectation that a person could find a Timmies on nearly every block, and you would never need to drive more then 10 minutes to get to the closest one.
Throughout it's financial hardships and ownership changes there has been a lot of complaints that "The coffee isn't as good as it used to be." And rumours that McDonalds (with it's McCafee push) bought Timmies old supplier of beans.
Now the food is no longer made in store, and my impression is that the coffee is worse. There have been other cost-cutting measures like making the popular contest "Roll up the Rim" (where a person could unroll the lip of the cup of coffee to reveal a prize from free confections, to money and a car); becoming an APP-only prize (more like a lottery style jackpot then a winning cup).
In total, I am not surprised. Their quality has gone downhill, and the treatment of staff is horrendous.
Tim Hortons is everywhere in Canada and they used to be decent. The current owners are subsisting on brand recognition and market inertia.
Once enough negative associations form with the brand, it'll be the work of a generation to turn things around. Tracking user locations probably won't have a huge impact. Most people just don't care enough about privacy issues.
Tim Horton's real problem is that they are becoming known for bad coffee, bad donuts, and bad food, while similarly ubiquitous chains, like McDonalds, now have decent coffee and have added donuts to their menus. If I have to choose between a McDonalds burger and a microwaved chicken-finger with a shelf-stabilized tortilla wrapped around it from Tim Horton's, the choice is easy. Practically every truck-stop town that has a Tim Horton's also has a McDonald's very close by, so it really is just market inertia propping Tim Horton's up at this point.
> Tim Hortons is everywhere in Canada and they used to be decent.
Apparently before Wendy's bought them out (mid-90s) that was true, but I'm too young to remember. It certainly hasn't been true since that time. Even co-founder Ron Joyce lamented at the time about how the quality was decimated under their ownership.
> Tim Horton's real problem is that they are becoming known for bad coffee, bad donuts, and bad food
Tim Hortons' problem is that Tim Horton's daughter, who is a Tim Hortons franchisee, made some negative comments towards minimum wage workers which was mistaken to have come from Tim Hortons corporate.
The bad coffee, food, and donuts isn't anything new. They moved to the par-baked donuts in 2003 (a part of the same Wendy's push for cheapness). People were willing to overlook the bad quality for decades because they felt they were supporting an upstanding Canadian business. The aforementioned comments changed minds about that.
I do have childhood memories from the late 80s/early 90s where I remember them making the donuts in store. They were better and had a lot more varieties.
In the brief period when they were still baking in store and indoor smoking was banned, it was a pleasant experience to go into a Tims, even if you were just getting a coffee.
I used to live near the first Tim Horton's. A tiny, smokey storefront on the east side of Hamilton.
You could taste the cigarette butts in the crullers
The coffee was so weak it tasted like the cardboard-and-wax cups it came in. There's a reason why they marketed ordering "double-double" (double cream, double sugar), it's the only way to get any flavour!
In the early nineties they opened a fancy new non-smoking one in Westmount, and the donuts were freshly baked in-house. I would go out of my way to visit that one, the crullers would melt in your mouth, and the chocolate walnut actually tasted like chocolate and walnut.
It wasn't too long before the donuts were centrally distributed, and with that they became completely artificial. Nowadays every flavour tastes the same - sickly sweet with lingering sour-chemical note.
Personally I'd rather have the cigg butt taste back.
Also worth noting that McDonalds started buying their coffee from Mother Parkers, Tim Hortons' longtime supplier, after Tims was bought by Burger King/Brazillians and switched to distressing dirty bean water to save money.
They were everywhere long before the Air Farce sketch. That's why they used Tim's in the sketch.
It used to be better. Or more accurately other chains used to have worse coffee.
Back when it was getting established its competitors (eg Country Style Donuts) focussed more on the donuts than coffee.
Tim Hortons made it's name on brewing fresh coffee carafes every 20 minutes. The standard at the time for other shops was to brew a large coffee urn in before the rush in the morning and let it sit all day.
Walk in for a coffee at 5 am and you might get the dredges of yesterdays brew.
So if you're on a long drive and need a cup of coffee at an odd hour, Tim Hortons was a good bet. Also if you were driving to hockey practice early in the morning. Or an early worker.
Is it a great choice now? Not really, but if you're driving it's still consistent and open late.
I would dispute the idea that Air Farce made Tim Hortons popular. Tim Hortons has been a fixture of small town life in southern ontario for as long as i've been alive. They've historically been cheap and cheerful, the go-to place for working people. Not just coffees but bagels and donuts. Old folks would sit around all day and drink refills from a china mug and munch a single old-fashioned plain. Most towns have at least one, and bigger towns have a ton of them. Recently they have tried to go up-market with premium drinks, more food, etc. and the low end has been squeezed by McDonald's which has better filter coffee.
Yeah that claim is absolutely not true. It might have made Tim Hortons known to OP, but the reason the skit worked was because Tim Hortons was already a ubiquitous part of the Canadian experience.
Tim Horton's modus operendi was to find the successful coffee shop in small towns all across Canada, and open up across from them, putting them out of business.
I often wonder why it's so loved by small-town Canadians when it's done us no favours. Especially since it hasn't actually been a Canadian company for 30 years.
Side note - on a trip to Corke, Ireland I was taken to a Tim Hortons by my hosts to make me feel at home!
Relevant: “But then Tim Hortons entered the roasting business, building its own plant, freeing up all that production capacity in the other companies. Mother Parkers started supplying McDonald’s” [0]
Tim Horton's was bought by RBI, which also includes Burger King and Popeye's. They run things super lean, though quality at the restaurant is going to be mostly up to the franchisee. For Tim's, I got the feeling that they don't really understand the customer; business seems to be doing fine since the acquisition, though the grumbling doesn't stop.
A friend of mine back in Canada is a cop and he told me that ever since they switched from Costa Rican beans around 2010 the coffee has been bad. I remember a friend of mine got a job there and he was like the only things that are fresh on the menu are the tomatoes and lettuce, literally everything else comes shipped into the store frozen - yet their tagline, on the sign of every store and on every cup of coffee, is 'always fresh'. heh
>ever since they switched from Costa Rican beans around 2010 the coffee has been bad
The unfortunate problem for Tim Horton's in Canada is that going to McDonalds (of all places) is better in every single way- their basic coffee is miles ahead in quality, their cups and lids are better, and their food is too.
Sadly, their coffee in the US is absolutely atrocious, to the point where I'm not convinced it even qualifies as "coffee".
McDonalds is good now. It was always fine in several other countries (UK, Japan, Australia) but it's good in the US now too, even if the ice cream machine keeps breaking.
The black coffee is okay and they have those mango smoothies that are pretty good.
I don't patronize ANY of these chain places. Like I might get a donut and a coffee at the airport from tim hortons because that's literally all there is open at 2am but i've just never been impressed by literally any big franchise and kinda feel more cheated I spent 10$ on some meal or whatever that really doesn't cost that much. It blows me away that people compare them cause they're literally all atrocious. I had a girlfriend come to Canada at one point and she was so un-impressed by the fact that people act like timmy's is some national treasure.
A friend of mine in Costa Rica knows Starbucks has a pretty funny trick to say they have coffee from there (Higher altitude begets better coffee). They actually just ship it in these big bags with the 'hecho en mexico' eagle on them and then re-bag it in Costa Rica. It's incredibly non-sustainable.
Well, you're at the airport at 2am and there's a Tim Horton's, a Starbucks and a McDonald's next to each other. This is the situation I'm talking about (though I was thinking on a road trip and wanting a quick coffee). I'd choose McDonald's.
I'm not super picky with coffee but whenever I've had Starbucks drip, it's tasted burnt. They make their money on the coffee milkshakes and it shows.
"Always fresh" is accurate because they brew fresh coffee every 20 minutes, and the baked goods are baked fresh every day (from frozen dough), then filled and frosted. I don't see the problem, personally.
No, I'm not that old, and my standards aren't super high. But by my dad's recollection, back when smoking in public buildings was acceptable, all the doughnuts tended to taste like cigarette smoke after sitting out for a few hours.
I live 40 minutes from a medium sized city. I can still drive to 3 different Tim Horton’s in under 8 minutes. I fact I find the smaller towns in SW Ontario actually have more stores per capita. For example my parents town of 40,000 people in the middle of nowhere has 15 Tim Hortons stores.
The coffee has gotten worse. They use cheap, bitter Arabicas beans and hope they can coast on their reputation. The donuts were never the same after they started shipping frozen dough from Toronto.
I assume every app that has location permission does this. I can't imagine google doesn't, or the phone company. I don't think it's right (and even less right that apparently google will provide this information to law enforcement). I just think the only practical thing to do is assume you are being tracked and don't install apps unless you're ok with the tradeoff.
The flip side of this, is why would I ever install a Tim Hortons app, why do I think they are offering an app, and what possible meaningful benefit (even assuming I went there regularly) would I drive from having an app?
I have the app and it's surprisingly useful, mostly because Tim Hortons can have pretty long, slow lines. I'll usually place my order when I'm a few minutes away so that I can simply grab my order and walk out.
It can also be helpful if you show up and there's a long lineup. Mobile orders get pushed to the front of the line, so instead of waiting in line you can place a mobile order and go grab it right away. I feel a bit guilty doing that though.
My anecdote is that once I was traveling on the 401 and stopped at an ONroute to grab a coffee. The line was extremely long and not moving at all, I had time to download the app, register, place an order, see it print out at the register and someone took it an made my coffee before the line even moved. I just quit the line, moved to the empty section where the mobile orders are and picked up the coffee as I was deleting the app.
> Mobile orders get pushed to the front of the line, so instead of waiting in line you can place a mobile order and go grab it right away.
Interesting, so customers pay for queue priority with their location data. Except the problem is it's not a fully consentual agreement, customers aren't explicitly aware of the arrangement.
My apathetic side says we're entering a world where it's so inconvenient to have privacy that we'll probably not bother.
It's always weird though on iOS; many times I've selected "Only while using the app" and then a day or two later I get a pop up that "{app} has used your location data 53 times in the last 24 hours" which never makes sense considering I never opened the app.
Is the prompt about the app requesting your permission using the API designed for that?
And is the counter about the app making background data requests? Any network request can be used to infer permissions from your IP address?
That IP addresses can be mapped to physical locations is unfortunate but usually the precision is bad (eg enough to know what town you're in, but not where in the town)
It isn't really an app though, it's one of those half arsed SPA in an webview that CONSTANTLY updates the large JS payload whenever you open it. Agree about the line bypass feature.. Tims can be insanely slow at rush hours.
They also switched Roll Up the rim to REQUIRE the app if you want to roll (2? 3 years ago?) - I hope a successful lawsuit comes out of that given this privacy ruling.. a lot of people were forced to install the app just so they could collect an occasional free coffee/doughnut. If they did that last minute at the counter they wouldn't even have read the permissions (a similar argument to that which renders many EULA invalid in Canada).
I used to go there a ton and I wanted to see if there were any good deals, see if my go-to was in stock, accumulate rewards, and check hours if I went to a new store. The app theoretically provides the "best" experience as well -- I've yet to see a mobile website recently for something I use day-to-day that isn't trying to push me towards the mobile app, or was clearly never tested on a real device. (Obviously, that's the ideal, but such is the state of things.)
The website didn't really suffice because the UX was bad, and wrestling with it got tiring. Apple+Google's hours were never quite correct.
In retrospect you probably feel pretty silly for falling for such a stupid ploy to rape your privacy just so you can save a nickel on a donut. I know Canada's in a food crisis but is it worth your soul?
I strongly disagree with the way people just throw up their hands and accept defeat. It is possible to have privacy on the Internet. Projects like Tor, I2P, and Nym are working to make this a reality. Fight back against the surveillance capitalist dystopia. Normalize privacy.
Android too. On later versions of Android, background location access isn't even option unless the app explicitly requests it, and even then the user has to manually go into settings and enable it (the app can't trigger a prompt).
This is why I install so few apps. Yes granular permissions are a thing, but I always ask myself am I okay with this app potentially getting my data even if I saw no thanks to some yet-unknown side channel attack? Google apps are whatever because obviously they already have my data since I'm on Android.
Yes, I am waiting patiently for the backlash against everyone and their brother "needing" you to install an app. Every device you buy, every new service you sign up for, they all want you to install an app that easily could have been a web page. My phone contains none of this (ok, I have 6 apps that I consider essential and they all have permissions as restrictive as possible, and I honestly even feel a little dirty with a few of those). My old phone, which spends 99% of its life in a drawer in airplane mode, is riddled with trash apps like my Asus router setup app and any app that is forced down my throat by a product that I want to use and can't be properly set up without installing an app. Loyalty program app? Not a chance. I have no idea what group of clowns wrote that thing, but one thing I do know is that it was outsourced most of the time.
I look forward to the day when we've reverted back to simple web-based interfaces and most of the general public says "install an app? yeah, right" because they've learned not to trust that shit.
Yup completely agreed. Restaurant chains badly wanting everyone to install apps is one that really annoys me. Mind you the general hunger for data even beyond mobile bugs me. I went and bought shoes a few weeks ago and they needed my email address as that was how I would get my receipt. So of course now they keep sending me all their sales bullshit. It is all incredibly frustrating and stupid.
For what it's worth, the email address for receipt thing is not always a marketing scam. Home Depot asks if you want a receipt emailed to you, and they have never sent marketing emails. Furthermore, they link the email address with the card you used to pay, so the next time you buy something it auto-fills the email address field. If it's a one-off purchase it's not worth it, but if you buy stuff there all the time (often expensive stuff that might need to be returned), having emailed receipts is great.
Same, also on Android. I have maybe half a dozen apps installed that did not come with my phone. Most of the apps that did come with my phone I have removed or disabled.
I also keep location turned off unless I am actively navigating in Google Maps. I know that doesn't eliminate all tracking but it's an easy thing to do.
On the flip side, people install the app because they usually are how the rewards programs are implemented now.
From the app page:
Mobile Order & Pay
Select and customize your favourite food and drinks, choose your preferred Tim Hortons location, and pay from the app. It’s now that easy to order your favourite Tim Hortons items from your phone.
Personalized Menu
Add recently ordered items with one tap. Customized orders are saved on your menu so you can get your order just the way you like it.
Tims® Rewards
After just seven eligible purchases, receive your choice of a FREE coffee, tea or baked good. Keep checking for more special offers to come. It’s time to reward your routine!
Scan for Tims® Rewards
A digital version of your loyalty card that you can scan easily when ordering in the restaurant – never miss an opportunity to earn rewards.
Scan to Pay
Save time and pay for your order right from the app -- no need to carry cash or a credit card!
Take Out, Dine In or Drive Thru
Choose your pick-up method. Payment is completed in-app, so you can grab your order to go, or dine in with us. Your choice.
I must be an outlier. On the remote ordering side, I feel like inevitably it won't work out and will end up taking as much time as just ordering - but I do see the the appeal if it works well enough that it doesn't leave me pissed off once a week because they gave away my order or something.
For the rest of it, it's just a meaningless distraction to me. I have enough going on without caring about tracking coffee rewards, or managing yet another payment method. I just don't find they make my life easier, and they take time and focus, plus nudge me to buy stuff I don't need or load money onto cards or whatever. I have frequent flyer memberships for the perks, but otherwise I've always found loyalty cards to be a gimmick, even more so when they want me to install a data harvesting app.
They have frequent heavy discounts on certain items. I often eat there anyway, and almost half price for a meal at least once a week is a good deal. (I know, I know, spending money on cafes is a "waste of money", I can already hear you say it. For me it's not, trust me.) Plus, a free XL coffee/tea every 7 purchases if you're a regular customer is a no-brainer.
(You can deny the Location permission prompt if that bothers you. You don't even need the app to collect points, just register once and delete it, but you do need to manually "activate" offers that are then linked to your card.)
This is the reason I've been so frustrated with working with bluetooth devices on Android. Android places all bluetooth usage under Location permissions, and if you need talk to bluetooth devices in the background, users have to manually consent to background location tracking, even though that's not what we want to actually do.
Unless I'm misunderstanding you, none of this is true for the Android devices I've owned. Vendor specific perhaps? Devious way to do it. Doesn't Apple suffer with the same problem (location+bluetooth tied?)
That article says that from Android 6-12 if an app wanted to scan for bluetooth it ALSO had to require the location permission. Not that BT had hidden location information. As of Android 12 apps could bluetooth scan without requesting/enabling location.
That's what the person you're replying to said as well. In order to use Bluetooth, their app had to request a location permission from the user. If they wrote an app targeting a version of Android before that range, the permission would be requested for them even if their code didn't explicitly request it. If they targeted a version in that range, they would have to request the permission at build time.
IIANM, this is only when _scanning_: as soon as you pair/bond with a device, the app can communicate with it even with the location permission switched off.
I don't see why Google would sell your location data to others. Store your location data? Absolutely. Use your location data? Absolutely. Target ads to you based on your location data? Absolutely.
Sell it to others, though? No way. Why would they give away their valuable advantage? It's very much in their interest to stop anybody else from getting that information, and I trust them to be self-interested.
https://policies.google.com/privacy is pretty comprehensive, and details pretty much everything about what Google does with various types of information.
>The flip side of this, is why would I ever install a Tim Hortons app, why do I think they are offering an app, and what possible meaningful benefit (even assuming I went there regularly) would I drive from having an app?
All of the fast food restaurants now offer "deals" and/or points only available through the app. Tims popular game "Roll up the Rim to Win" used to be printed on the cups, and is now only available through the app.
I wouldn't install them anyways, but lots of people have no idea how compromising these applications are to their privacy, and wouldn't infer the amount of information collected even if they read the privacy policy.
These sorts of spying applications should just be banned.
Nothing will change due to this investigation, and I doubt Tims will be fined any amount that would actually stop them from doing it, and no one will go to jail.
Discounts, freebees, coupons, loyalty club benefits and other financial incentives, usually. Pretty much the only reason you want it, because all these kinds of things usually do otherwise is nag you that you're near one of their locations.
But that's like not native and so unhip. I'm convinced the whole push to get away from mobile web to native app is solely for the personal data hovering for the vast majority of apps.
For example, a friend just downloaded the Wayfair app. Why is that necessary? She saved a couple of items, and now the app relentlessly notifies her about things even with notfications off. Doesn't happen with a mobile website.
One of my deepest worries about the field of software engineering is what happens when people in general stop responding to ads or irritating demands to engage. Suddenly, the demand for software becomes much smaller than it is today.
I'm never happy about people no longer having jobs, but there's an entire swath of the industry specializing in building crap apps/sites specifically to 'all your data now belong to us' that could just go away and make the planet a better place. That's one of the rare occassions that I actually agree with that lame SV phrase.
You can't win either way. Push for web apps and the necessary capabilities in the browser to make rich web apps and you get hit with "but browser fingerprinting!" malarkey from the privacy fetishists.
That's a simple thing to just not do and is a lame excuse.
If you're doing browser fingerprinting and get called out for it, you're the one full of malarkey. Building a web app does not require being shady, just as building a native app does not require one to do nefarious things. The devs* in either scenario choose to do it.
*Devs meaning whoever is behind it whether it is corpOverloards or shaddy devs, a dev somewhere obliged the overloards wishes.
The Tim Hortons app doesn't do this. I don't think it sends any notifications at all, at least I've never gotten one and I haven't disabled notifications.
That was meant as a general statement about many of this class of apps; sorry if that wasn't clear. So the TH app doesn't nag you, it just takes wildly inappropriate amounts of data that it has no legitimate business collecting. Awesome...they have that going for them.
Not just the location permission; apps have been found to scan pictures taken to build a location history out of the location metadata that is stored in pictures and such.
Practically speaking, unless you disable location tagging in pictures, any app with media access can track your coarse location history, depending on how many pictures you tend to take throughout the week.
It's their attempt at keeping up with Starbucks, who locked in the app game years ago. A better question is why would anyone go to Tim Hortons in the first place
Because it's ubiquitous and highly consistent, they have decent food and tea/coffee, it's relatively cheap and very fast, it's a great place to meet friends or work from home (away from home), and most of them are open until midnight at least, if they're not 24 hours.
I was being a bit facetious, but it is really hard to work remotely from Tims, and it doesn't really function like a cafe in the community sense. 24 hours is nice, I'll grant them that, but they fight tooth and nail to not pay their workers even 10c more per hour and strive for cheapness above all else. There's a place for that, but if the only cafe within a 20 min walk is Tims, that place would suck to live, and that's pretty often the case.
> it doesn't really function like a cafe in the community sense.
Some do, and those are the ones I frequent. At mid-day and early afternoon it is often very busy with people that hang around for half an hour or more—not just to eat, but to socialize. The amount of first dates I've witnessed (universally older people, often divorced), mothers or fathers with babies or toddlers catching up with a friend, college-aged people having openly-public heated discussions about their sex lives, old biker dudes planning their next trip and going on the wildest tangents about mystery vacations picked by lottery, primary-aged boys arriving by bike to get an iced cappuccino and hang around talking, work colleagues planning a company outing and dissing their other colleagues, etc. is incredible. Dozens and dozens of interactions that I've observed. And I haven't even mentioned the staff yet: the ones nearby me are almost always jovial and are free to discuss things among themselves, plainly audible due to the open kitchen designs, and listening to them is oddly inviting. Also, most of them don't play music, or if they do it's pretty quiet and is not distracting.
Friend works for real estate group that provides consulting services for companies looking to move into a new area.
Friend can drag a box around any area down to the block and see how many people visit that area, what part of the city they came from to get there, where they went to next, average income, etc etc etc
We all know we are being tracked but seeing him use his software was still shocking. Apparently all data is from 3rd party apps and they charge $30k++ for their real estate analysis service. Who knows how much they pay for the actual data or how many times over it’s sold. It’s all anonymous but adding just a small bit of information about an individual and pretty easy to figure out and track them even off this anonymized 3rd party data.
Wildly disappointing that this massive, and blatantly illegal collection of user location data has (of course) merely resulted in a slap on the wrist for the perpetrators here.
There should be huge (multi millions) fines and probably even jail time for the execs who approved / managed this app, but as per usual our corporate overlords get off with a "Stern warning" and a promise not to do it again.
On the face of it, no politician wants to risk tanking an org that employs a significant part of their jurisdiction. Providing even minimum wage employment to thousands is an objective public good and hard to do, even for scoundrels. Big employers are not above the law, but they sure get more leeway.
Honestly with Tim Hortons I bet the number of voters working there are quite small. They are one of the biggest users of the Temporary Foreign Worker program in Canada. Many locations are full of foreign workers. Some of these are students, some are from the program, but either way they largely aren’t voters.
Essentially, both Android and iOS apps were collecting data. Also interesting to note, that Ontario accounted for 54% of purchases in May 2020, of people that used this app. I wonder how close it to actual sales.
Full disclosure, I just used this app today in Ottawa. Doh!
Ontario makes up ~40% of Canada's population, so that isn't too far off. It probably goes up to >50% when you filter on young urban professionals, who are the target demographic of Tim Hortons.
I'm enjoying this mini thread about who goes to where for coffee.
In Ottawa, we have many choices. I just went to Tim's because it was the closest. Ideally, I go to Happy Goat, or Bridgehead (which was purchased by Second cup). Starbucks and Tim Hortons are at the my bottom of the list.
At the end of the day, I just go where it's convenient. It doesn't help that at the end of my street there's a Tim Horton, which is where I used the app.
Haven't been to Ottawa, but I'll keep some of those in mind if I ever visit. Are they significantly farther or just marginally?
I have a Tim Hortons close to me, and I'll get a bagel there from time to time, but there's many better options that vary between 5 and 15 mins walk. I've got no plans to move anywhere that's not at least that close to decent cafes in the future. That's because I like good coffee, but also because that's where the community is.
I live downtown, so they are all very close to me. I just get very lazy sometimes, and I'm taking care of kids and pets. So...priorities!
There is even a place called Arlington 5 in Centretown, and Little Victories in the Glebe (just outside of Centretown). Both of these are small one off shops.
Happy Goat (8ish? locations) are an independant chain that is starting to spread around the city. Also, they have 1 in Kelowna, BC in a Staples!
BridgeHead (20 locations) was an independant chain, but got bought by Aegis Brands (owner of Second Cup), but I still consider them "local".
Then there's Tim's, Starbucks and McDonalds. I'm sure there are many more small coffee shops, but I'm just a regular 1 cup a day drinker.
Oh wow, thanks for the run down Hadn't heard of any of them, but now I'm more interested in visiting for sure. Also seems like you have some good transit projects underway.
I'm in Vancouver, lots of specialty shops here, and some that are more low key. If I just want coffee, I have a decent home setup, so that's my usual, but I spend a lot of time working out of JJBean.
Or people who aren't douchey coffee hipsters that would rather get an ice cap in 3 minutes than wait 20 minutes for a bearded communist to serve lattes made with beans a blind Peruvian farmer sat on for 20 years
iOS app can only get your location data (or other data) if you give it permission. Current iOS OS's also give you the option for a wide area location which is basically useless for selling to anyone.
>“This investigation sends a strong message to organizations that you can’t spy on your customers just because it fits in your marketing strategy. Not only is this kind of collection of information a violation of the law, it is a complete breach of customers’ trust. The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out, and I hope other organizations can learn from the results of this investigation.” – Michael McEvoy, Information and Privacy Commissioner for British Columbia
Insane that there isn't any more forceful enforcement for "a violation of the law" than setting out "recommendations" and trusting that the guys under investigation for "violation" of the, presumably, privacy "law" will implement it.
Surely, there's no "stronger message" than a company getting to make money hand over fist by exploiting their customers and then getting away with nothing but a slap on the wrist. That'll make sure no company ever decides to do that same thing since they'd obviously hate making tons of money and getting "recommendations" after a stern talking to.
Talk to me about "strong messages" when CEOs are sent to prison and a company's assets are seized.
Why not do most of that too? Yes, it should be non-viable as a business decision, but also something that will result in very personal and life altering consequences for those running the company. If I spied on even just a single person like this I'd be thrown in prison as a stalker. "Charge them for all individual incidents at maximum allocation per law." would mean a life sentence for CEOs when really just a decade or two behind bars would be enough to ensure that companies don't risk it.
The individual goes to jail, not the company. So how much does a fall guy cost a company? That’s just cost of business if responsibility is only held by the individual.
The key is to set multiple avenues of responsibility. It may be easy to find loopholes individually, but collectively it would become too burdensome. At least, for the company, make skirting the charges be as costly as following suit.
There is a very long list of companies who have been fined for GDPR violations, and several which have been fined repeatedly. It's not working. Show me a list of companies which have been dissolved or were broken up and sold off after GDPR violations. Then it might be enough to be taken seriously.
for something like this, jail time plus asset seizures is surely too extreme (purdue pharma, on the other hand...). however a severe financial penalty for both company and executives (VPs and up, plus legal counsel) makes a ton of sense. for execs, you'd want to especially financially negate at least some past and future bonuses and stock compensation, because it makes up the bulk of most executive comp.
> for something like this, jail time plus asset seizures is surely too extreme
If you'd go to jail for acting that way, why is that suddenly too extreme for CEOs? The fact is that very very personal details including things like sexual preferences, the medical history, the political views, the sexual partners, and the religious practices of millions of people were exposed by this data collection and that can't be taken back. All that data will exist forever and will likely be used against these people for the rest of their lives.
I don't want Canada to become the dystopian prison-nation that the US is. The "Land of the Free" has more of its population behind bars than any other country on Earth, but some jail time (not life behind bars) is completely appropriate for the scale and scope of what was done here and it is necessary to prevent it from happening again.
you'd be wont to find anyone who'd support exective prison time more than me, but i'm against prison time as a de facto punishment for exactly the reason that it results in too many people being locked up frivolously. i agree that the scale and scope here are atrocious, but again, take away all their gains and more, especially in regards to prestige and esteem, and you'll deter this type of behavior as effectively as incarceration without any of the downsides of prisons (especially the perverse incentives and the exhorbitant costs).
the punishment should fit the crime. that's why i'd throw the sacklers in prison (because they ruined countless lives, up to and including death), but not these executives.
> take away all their gains and more, especially in regards to prestige and esteem, and you'll deter this type of behavior as effectively as incarceration
I guess that'll have be left to speculation until somebody actually manages to convince their government to try it, but I suspect that any financial penalties that don't outright end a company will rarely be enough on its own to act as a deterrent, and that absolving CEOs of any responsibility or accountability and placing the financial burden of fines for violating the rights of millions on the company as a whole will just cause it to be seen as an acceptable gamble for CEOs. It's not even a bad one. The gains to be made exploiting people are very great after all, and the risk of being caught fairly low.
CEOs certainly don't care about prestige and esteem. They are often sociopaths and psychopaths who care very little about others or how they are viewed. Even when their actions do destroy a company they'll just deploy their golden parachutes and happily drift off to another one. As much as our legal systems fail to hold CEOs accountable corporations themselves are certainly no better at it.
> "CEOs certainly don't care about prestige and esteem."
oh quite the opposite, even for psycho/sociopaths. it's really the core thing that humans care about, with everything else, even money (beyond subsistence), only being proxy metrics for it. people kill other people simply for damaging their (self-)image/reputation (the jilted lover being a classic example).
the point of this punishment is to strike right at the heart of what humans care most about by knocking them down a number of rungs on the status ladder (prison time alone doesn't do this, as they'll be just a rich and statused coming out and they were going in, though maybe a bit more humble/shameful). you don't necessarily need to make them poor, just relatively poorer than who they believe their peers are. but yes, the key to any of this is to raise the risk considerably, as you noted. no punishment can be effective without credible enforcement.
I know there are people who think capitalism is inherently harmful and unsalvageable, but I'm convinced that with enough regulation and oversight it can be kept in its place and beaten into something that does more good than harm. I suspect it'll be one hell of an uphill battle to get us there though.
Ah you know, it's a multimillion dollar corporation, so laws are just tough to enforce, because reasons. It's not like if a regular person was caught doing this, because then it'd be simple: that person would go to jail.
Also, there's no way that every other fast food app isn't doing the exact same thing. There's no way that mcdonald's is going to give me a free big mac just for having the app installed if they aren't collecting as much data as they can access on my device.
Agreed - especially when you consider the provincial and federal tax dollars needed to prop up the various privacy commissions and launch an investigation like this one.
You'd need a lawsuit for that. The investigation FTA was by "privacy agencies" which have no ability to enforce anything more severe than recommendations
I actually did read the article; I even grabbed a quote from it! Still, the governmental privacy authorities suggest that the law was broken; I'm aware that they aren't enforcement, because I read the article, but the language is pretty clear that they think these actions broke the law.
>You'd need a lawsuit for that
Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know.
edit: reading the Report of Findings [0] on the page itself suggests that because the violations ceased once, er, the violating entity had been informed of the investigation and had suggested that it'd delete the harvested data, the joint investigation "therefore found this matter to be well-founded and conditionally resolved". So, nobody really cares
>Yeah Canada isn't the US, we have remedies available to us other than sending people to jail
Can you elaborate? Is there Canadian privacy law being violated here that doesn't stipulate any penalty other than exposing Tim Hortons to private lawsuits? Forgive the directness of my question, your comment reads like you'd know.
...to be perfectly honest, "launch a civil suit and get pennies!" sounds much more American than throwing people in jail for privacy violations. The data is already out there.
Yeah I can, the The Office of the Privacy Commissioner of Canada, Commission d’accès à l’information du Québec, Office of the Information and Privacy Commissioner for British Columbia, and Office of the Information and Privacy Commissioner of Alberta collectively and individually do not have the power to imprison people. There is no determination they can make under the law that results in people or corporations going to jail.
Kind of a non-sequitur of a response, not sure you read my comment, with its direct question? Even if you were responding to the second paragraph only -- and construed it as my suggesting people be imprisoned -- weird! Anyway, you answered, in a roundabout way, my direct question in another comment, namely
>>They also have the power to refer their determinations to other branches of government / Attorneys General etc for further enforcement of the law should their concerns not be addressed [0]
from which I can infer that this ""voluntary" "compliance"" thing they've got going on is the extent of the shit they're willing to give. My layman's reading of PIPEDA [1] suggests that court orders are eventually possible, but this act of obvious malfeasance (or, if that encroaches on a legal term, try 'fuckery') deserves a... promise to do better?
Seems like the message is "if you get caught, we'll politely ask you to stop". Not the kind of response I'd like for the granularity of this kind of tracking. Sets a bad standard.
I mean, given the article, it doesn't seem like Canada has availed itself of any remedy, let alone sending people to jail, which is the point in this thread.
Like, in America, we might slap the company on the wrist, fine them something like the equivalent of $1 for a normal person. And then business continues as usual.
What are they in this case? And I guess your comment is true as long as you ignore the incarceration rates for First Nations. Which is coincidentally something we canadians really like to do whenever it's time to feel smug about our southern neighbors.
> And I guess your comment is true as long as you ignore the incarceration rates for First Nations. Which is coincidentally something we canadians really like to do whenever it's time to feel smug about our southern neighbors.
The US is at least as bad, absolutely and even relative to the White population, with Native Americans, though it gets less attention because Native Americans get less attention in US politics than First Nations do in Canada, and because it's further masked by the attention to both the general runaway incarceration in the US and the racial impact on Blacks of unequal incarceration.
That might be all true but saying "what about the US! they are even worse" is irrelevant to the fact that it also happens in Canada. While GP was saying that it doesn't happen here because we're not like those stupid Americans.
Though I'd still heavily dispute your claim. Native Americans in the US have much stronger treaty rights, much more autonomy and while they still face tons of discrimination, IME its very hard to beat Canada in that regard. In any case, between the Highway of tears and the fact
that some reservations don't even have access to water in the north... comparing ourselves with other countries just comes off as pointless deflection.
When Burger King "bought" Tim Hortons in 2014 (I believe this was a tax evasion effort by Burger King to leave US and "merge" with a Canadian food company), the whole experience went to pot. This was a Canadian institution. I won't even step foot in a Tims anymore, the food, the customer experience, the app, it's all junk.
Interesting. My first trip outside of Europe was my honeymoon in 2008 to Canada. Various tour guides told us that Tim Hortons (“Timmy’s”) was a Canadian institution.
Since then I’ve travelled a fair bit in US cities and a little in Canada and the only real difference I can see is that Canada has a Tim Hortons on the corner.
I mean, I'd still call it a Canadian institution, but it's not good.
> Since then I’ve travelled a fair bit in US cities and a little in Canada and the only real difference I can see is that Canada has a Tim Hortons on the corner.
Depends where you go. There's probably more of a different cultural feel in Quebec and the Atlantic provinces. e.g. Café Olimpico is a Montreal institution that feels quintessentially Montreal. (And the US has places with very different cultural feels to each other - of places I've visited, Honolulu isn't very similar to Billings - but I'm less familiar with the US than Canada.)
I was amazed by many things with our 3 weeks in Canada, including how cheap car hire for a massive (Ford escape) car was, how wide the roads were, how off road logging roads were
But one thing that stuck with me was seeing things I’d only ever heard of in tv/movies - Wendy’s and Dairy Queen come to mind.
But I’d heard of them. And of course Starbucks (which we had in the U.K.)
Never heard of Tim Hortons though, which I guess shows the relative strength of a medic an cultural exports vs Canadian cultural exports.
As a Canadian, this comment annoys me. It only makes sense to me if the only Canadian city you’ve been to is Toronto (and maybe Niagara or something as well?), and aren’t particularly observant.
It annoys you that Tim Horton’s is considered a Canadian institution?
I get that it’s mainly owned by a Brazilian company now, and quality has gone to all hell, but it will probably always be a part of Canadiana due to its history.
I wondered why people thought so highly of Tim Hortons. I’ve only been there post-merger, so that explains it. It still doesn’t explain how anyone drinks the swill that is Starbucks, though.
Technically, I believe they still bake things, but they certainly don't prepare the doughnuts from scratch on-site anymore. Indeed, quality declined spectacularly when their slogan changed from "Doughnuts" to "Always Fresh".
>The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data.
Does this mean that the prompt is completely useless?
I suspect, at least on iOS, they would present users with a message in app during setup saying something like:
“we aren’t scum bags, we promise, and we’re about to ask for access to your location data, but we’ll only use it to help you find stores and cool stuff like that!”
And then they invoked the system permissions dialog that allows the user to grant location access, but instead of only asking for permission to access user data when the app is open, they told iOS to ask the user if they could always have access to location data. This is clearly a different prompt, but I’m almost certain most users either aren’t able to discern the difference, don’t know the consequences or think it’s normal.
Tbh, there are very few situations I can think of where I’d want to let an app always have access to my location. I just checked my iOS location privacy settings, and other than system services, the only app that always has access to my location is weather (but I could probably turn that off).
I wonder if apple’s app review team closely scrutinize any app that asks for always on location data? I couldn’t find any that had an option for ‘alway” on my phone other than Uber.
>And then they invoked the system permissions dialog that allows the user to grant location access, but instead of only asking for permission to access user data when the app is open, they told iOS to ask the user if they could always have access to location data.
It's been a while since I used CoreLocation but I do not think this is possible.
To request Always location permissions iOS apps _must_ first request When In Use location permission.
Only then, after the user grants Allow While Open (not Allow Once), and iOS starts delivering location updates to the app, will the iOS system give a _second_ prompt to the user requesting Always permission.
There's no way to jump straight to the Always permission AFAIK.
> If your app’s current state is CLAuthorizationStatus.notDetermined (the default) and you call requestAlwaysAuthorization(), Core Location uses two prompts before it fully enables Always authorization.
> The first prompt displays immediately with the string from NSLocationWhenInUseUsageDescription.
> The second prompt displays when Core Location prepares to deliver an event to your app requiring CLAuthorizationStatus.authorizedAlways. If the app is in the Provisional Always state, the system displays the second prompt with the string from NSLocationAlwaysUsageDescription. Core Location will typically display the second prompt when your app isn’t running.
> The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data.
How does this work on an iPhone? If in Location Services and I have app set as "While Using the App", I'm assuming it's not possible for Tim Horton's app to collect data "as long as devices was on". Did it somehow bypass these settings?
As others have noted the app works fine without location on. (Android also has "only when using App" settings) It does default full location access all the time which is where the problem starts. Sane defaults required.
Slap on the wrist for willfully violating the privacy of a massive amount of people. Par for the course in the US as well. Yet try violating the Wiretap Act as an individual, even accidentally, and see how it works out for you.
That difference in results between giant corporations and individuals should give you a strong clue about who the “justice” system works for.
> That difference in results between giant corporations and individuals should give you a strong clue about who the “justice” system works for.
It's not just the justice system either. It's also representation in government. We have research showing that the average citizen has effectively zero influence on public policy and that our government caters exclusively to corporations and a small number of extremely wealthy individuals. The only time the rest of us get something we something we want is when our interests just happen to align with the interests of the powerful. (see https://scholar.princeton.edu/sites/default/files/mgilens/fi...)
I wouldn't say it's a slap on the wrist. It's not even a scolding. Tim Hortons was literally found guilty of spying on millions of Canadians, and the only consequence they face is that they have to stop doing it.
And I should be able to provide fake data to apps out of the box. Some location that I can set manually, an address book with fake contacts, an image/video of my choice instead of camera access, audio for microphone, a directory of my choice for file/media access...
All of these apps are not entitled to collect accurate data.
I think there is an app on f-droid that does this.
I'm against companies tracking my whereabouts and wanting to know everything about my personal life. However. Here's what the "charges" are as per the statement:
>The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products.
So it's obviously ok for a business to collect information. This includes information _legally_ collected from customers' phones (I'm sure everybody just clicks OK agreeing to the terms when installing the app). So what's the issue? That the amount is "vast"? That it's "continuous"? That it's "not proportional to the benefits"? Who decides what's vast and what's not, what's proportional and what's not? I'm really not getting what they're being accused of doing. They got a lot of data and had no clue what to do with it (missed opportunity if you ask me), is that a crime now?
I may be in the minority here but IMO the only really legitimate purpose a "Tim Horton's app" would have for accessing location data would be to push offers to you when you're near one of their stores, and that should be opt-in not a default. Also, there's no legitimate reason for them to actually be storing the data - it's an app that you use to purchase coffee from retail locations, it doesn't need to track me 24/7 and store the info in a database. The number of apps that ask me for permission to access my Location, Contacts, Phone, Microphone, Camera, etc. is appalling. I feel like we need to revisit the whole idea of telemetry in mobile apps, like start over from scratch.
>I feel like we need to revisit the whole idea of telemetry in mobile apps, like start over from scratch.
Also the operating systems. You get a new Android phone, Google Maps randomly comes up and tells you "Hey you're at this location, want to do this check-in bullshit?" even though it wasn't previously open. And yet, the app list button only shows a few things that have viewable windows, no easy way to see every background task that's running adn presumably spying on you. It's designed like this deliberately.
There're ways to get rid of all of it already. Get a dumbphone/featurephone, install open source OS, or even get a phone with one installed. Yes, they're more expensive and way less polished. Android is way more developed, has a large number of apps, and it's free (at least Android OS itself). Why do you think that is? Who do you think is paying for all that?
In case if it was not clear from the way I phrased my question, it doesn't make any sense. The business _legally_ collected marketing information and then got fined because they collected too much, did it for too long, or didn't make a good use of it. I just don't get it.
Laws can turn things that are on their own legal, like using an accelerator when driving a car into criminal, like speeding, when done in a way that violates that law.
I should stop going to Tim's. Not just because of this, in fact the thought was already in my mind this morning as I was in a huge car lineup for morning drive-thru that extended out of the Tim Horton's parking lot and into the side street, barring entry to other businesses. And the garbage bins were overflowing with discarded coffee cups and dripping with spilt coffee. A rare but not insignificant minority of drive-thru workers can be downright authoritarian, once you pick up your order from the window some of them will bark at you to gtfo, even if you just take a moment to settle your coffee cup into it's holder.
> The investigation concluded that Tim Hortons’ continual and vast collection of location information was not proportional to the benefits Tim Hortons may have hoped to gain from better targeted promotion of its coffee and other products.
Is that the standard for privacy these days in Canada? It would have been OK if the benefits to the business were proportional?
Canadian Tire should be next. I don't trust their rewards app one bit. I refused to get it when it came out.
Reading their terms to cancel your subscription to the virtual coupons for dollars spent (aka Canadian Tire money) you need call their phone support line. No web-based cancellation but you can sign up for it using their web-based service.
Reminder that in addition to denying location permissions, on iOS you'll also want to turn off "Background activity" for apps that don't have a reason to need it. There was an article a couple years ago where some apps were polling your course location in the background based off of your IP address.
The fact that was labeled just means that they were inferring it on the client. Given any location stream from a person and POI data you can infer all of this stuff, including if they have kids, a mistress, if they are gay or straight, if they are religious, friends, age, sex, nationality.
I think Tim Hortons should be required to analyze and publish the data from questions supplied by the public.
What is the likelihood that I will have to visit a bathroom within X minutes after consuming a Tim Hortons? Visit a hospital? Get in a car crash?
What percentage of Tim Hortons customers also visit strip clubs?
What is the average waiting time in line for a TH visitor?
The exploitation and misuse of data by most apps we use is really sad but a reality we habe to accept. I am happy that here in the EU more and more regulations and antitrust lawsuits are being put in place.
> The Tim Hortons app asked for permission to access the mobile device’s geolocation functions, but misled many users to believe information would only be accessed when the app was in use. In reality, the app tracked users as long as the device was on, continually collecting their location data.
Why is this even technically possible? The iPhone app permissions settings has three modes: “always”, “when in use”, and “off”. I assume the second setting only allows the app to collect data when the app is actually in use?
Does Android not distinguish between “always” and “when in use”?
As far as I can tell, this happened between 2017-2020, so things have changed a little bit. You’re correct in that the second setting only allows an app to query native location data from the OS when the app is open but:
1) I’m assuming that’s not the scope Tim hortons asked for with their permission dialog (they lied about it, sure, by saying they would only use your location when you were using the app, but they presented the user with a prompt that granted them unfettered access). I’m guessing most users didn’t even notice, or aren’t aware of the consequences.
2) they relied on some sketchy third party company called “radar,” and I’m sure they also use heuristics beyond location data to figure out where the users are.
I’d love to know if the changes apple made with iOS 14.5 would have made this more difficult?
Anyway, this is disgusting and I wish there were serious, unavoidable repercussions.
(Disclosure: I only skimmed the actual report, I didn’t read the whole thing)
In this case, taking an order from a consumer and collecting a payment comes to mind.
Just because you have a useful app doesn't mean you have to sell the user's location data to make money, ESPECIALLY if you are ALREADY making money with the app.
There is currently a film making the rounds in right wing/election-interested circles called 2000 Mules.
In the film, the narrator/host purport to have purchased several trillions of points of tracing data from the time around the 2020 election, and claim to have identified "ballot mules", that is: people who appeared to be going from various Democrat affiliated non-profits to many different ballot boxes in their city.
The conclusion being: these people were stuffing ballot boxes.
However, the "technical" take downs of these claims are that this location data is not accurate enough to support them.
But then articles like this come out, or many of the comments below, which do support the idea that you could purchase highly accurate GPS tracking data of "anonymized" cell phone users.
It's just interesting how the technical analysis on these things seems to change so dramatically based on what the context is.
Linked from elsewhere, the original Financial Post story that triggered this specific investigation is quite the eye-opener. The reporter filed a PIPEDA request to get a copy of their own data, and then goes on to describe the findings in quite some detail. https://financialpost.com/technology/tim-hortons-app-trackin...
I think people need to start thinking about owning two phones now. One for Personal use. And one for government / business related use that you would have turned off most of the time to avoid tracking.
With the increasing push to have government apps installed (for example ArriveCan) and the new bill where they want to search your phone at the border.
You don't know how soon making fun of Trudeau on social media, or questioning covid rules will become a crime.
I'm reminded of the corporation taken to arbitration story yesterday. I'm curious if you would be able to get anything from Tim Hortons if you did that.
>Consistent with this explanation, our Offices confirmed that the SDK tracked, as Events, home, office, geofenced locations (including its competitors), and travel in and out of Canada. For example, news articles had noted that an event was recorded with computer code such as “user.entered.place” with “place.name”: “Rogers Centre”, or “user.entered.office”.Footnote 16 Using open-source resources and tools, the investigative team’s technology analysts determined that the SDK programming code included the following:
USER_ENTERED_HOME; USER_EXITED_HOME;
USER_ENTERED_OFFICE; USER_EXITED_OFFICE;
USER_STARTED_TRAVELING; USER_STOPPED_TRAVELING; and
USER_ENTERED_GEOFENCE; USER_EXITED_GEOFENCE.
Is there any sort of app (android) I can download that will tell me what other apps are constantly tracking my location and reporting back when they are not open? I'd also love that for anything that's constantly listening to what I say and reporting back.
I’m not interested in starting a flame war, but am interested to know how many of the users who were being tracked everywhere they go without the app being opened were iOS users and how many were android. Unfortunately the post doesn’t go into much detail.
A lot of people are rightfully upset over this, but a more nuanced point: if your phone is capable of installing "apps" from a "store" - there is far, far more insidious data collection going on by significantly more capable adversaries.
Like a tin-foil hat model I install as few apps as I possible can, and definitely no corporate ones. State Farm for instance keeps hounding everyone to use their app. Soon it'll be: use our app or you'll be charged an extra 10%. No thanks.
per linked 'report of findings' this is from the radar sdk?
> Once a User granted the App permission to access their device’s native location functionality (based on GPS), the SDK began, based on TDL’s configuration of the App and subject to certain limitations outlined in further detail in paragraph 26, collecting the User’s granular location data (“Radar Location Data”), including precise longitude and latitude coordinates, and forwarding that information to Radar’s servers to be processed for Tim Hortons – thereby tracking the User’s device location
have never used radar sdk, wonder if this is the default config or it has to be enabled
I'm looking forward to quitting the App Store once sideloading is allowed, once I can get my iPhone software from GitHub I won't go back to apps vacuuming up my data under Apple's oversight.
This is why I always use a retail store's mobile website and never download their "app". The browser sandbox saves me from having to worry about these shenangians.
I assume that at least one of the apps I have is probably sharing all my data right now. Be it the flashlight or the guitar tuner, or that menu planner thing.
I remember a time when app developers weren't the user's enemy, but that was a long time ago.
A&W is so disorganized that they have a mobile app for placing orders at nearby restaurants, but to get coupons, you go to a separate awcoupon.ca website. The coupons are quite worthwhile, often 30-40% off the sticker price for common meal deals, but it's baffling that it wouldn't be integrated into the main app.
...until they decide they'll make more money by forcing mobile users to use the app and start kneecapping the mobile web experience left and right. We need strict regulation for this or it'll never end.
According to Apple’s support site[0] App Clips can request your location, and permission’s automatically revoked after 1 day, and only works while the apple clip is in use. So, better in theory.
Because there is a setting for it, I assume that app clips can request location info. I have to assume, as there apparently is no app clip that has ever requested such. Come to think of it, I don't know that I've used an app clip.
in my experience the ordinary android or ios end user will automatically click "yes/accept/allow permission" on almost anything that pops up on their screen.
they don't say exactly when and why they disabled the tracking except "in 2020", but in june 2020 when the original expose on their trackign appeared in the Financial Post, tims had no plans to disable the tracking, just to edit their privacy and other policy texts so that it wasn't outright them lying.
Say what you will about the pains of implementing GDPR, I think it mostly got the core concepts right. We should implement something similar in the USA. California’s CCPA is a step in the right direction, but it seems to lack any teeth.
Apps should not be allowed to collect data on you without your consent. And, they should not be able to just claim they need everything; without a legitimate need you should be able to opt out of tracking like the OP. And finally, the fines should have teeth so that offenders are actually incentivized to avoid infringing, instead of getting a slap on the wrist and profiting from violations.
Based on my surveys of people in the US, 97-99% of people with handsets are location tracked nearly 24/7. I am in the 1% with my hardened phone free of Goople and on airplane mode 99% of the time. I hope these companies continue to be exposed and help people choose where to buy our coffee and not give up their freedom for coupons.
> The app also used location data to infer where users lived, where they worked, and whether they were travelling. It generated an “event” every time users entered or left a Tim Hortons competitor, a major sports venue, or their home or workplace.
> "This investigation sends a strong message to organizations..."
Canadian here. Sorry, sending a sternly worded message to law breakers isn't enough.
> " The good news in this case is that Tim Hortons has agreed to follow the recommendations we set out,"
No. GOOD news in such a case isn't an agreement to follow the law in the future. Didn't they already do that and then break the law?!
Good news in such a case might be, oh let me think ... a temporary loss of business license for violation of laws and customer trust, and then fines (or revenue loss due to license suspension) of a magnitude that shareholders or the parent company feel which can then inform the board, executive responsibility, policy decisions right down the chain, etc.
Duh, isn't it obvious that a whole part of business is trying to find ways to make money off the government, not just your customers? Tech has been doing this for a while if you are anyone at the exec level or have tried to understand what "business reasons" are when told that's why a bad technical decision is being made.
> So just stop installing stupid apps and you don't have to worry about issues like this.
I agreed with you up until that last line. The problem is that this sort of invasive tracking isn't limited to the apps on your devices. The devices themselves are spying on you, and the lack of meaningful privacy protections leaves us vulnerable even if we left our cell phones sitting in lead lined boxes.
Without installing any apps on our phones at all this kind of pervasive tracking data could be collected using bluetooth beacons, using cell phone tower data, using facial recognition technology, using license plate readers, using the GPS/OnStar systems in our cars or using radar systems that see through the walls of our homes.
This isn't a problem our personal choices can solve. We only have the power to make choices that hurt us in different ways. We need real regulation and laws with many rows of very sharp teeth.
The government likes all this tracking and spying. If you think you can rely on the government to cure this ill you're mistaken. It's still possible to live without a cell phone at all.
> The government likes all this tracking and spying.
I agree, and some companies like collecting it and enjoy being paid to hand it over to the state. I don't think that makes it impossible to outlaw this stuff, but it does make it much harder. We'll likely need a number of reforms around elections and bribery to get people in office who will represent our interests but however difficult they've made it so far (and they've been refining their techniques for centuries), it is still possible to elect a person of our choosing.
> It's still possible to live without a cell phone at all.
Not without considerable difficulty though. I put it off for about a decade or so after flip phones were replaced by smart phones until eventually my family insisted on my having one out of concern. They even bought the damned thing for me. I'm still conflicted about owning it. Even at that time it was growing more troublesome to function without one though since many businesses were offering services exclusively over their apps.
Like I said though, not having a phone won't spare you. There is an ever-growing list of ways to collect and track your activity both online and offline which don't depend on cell phones or apps. Ultimately, we're either going to have to insist on the kind of regulations we need to be protected or we'll have to resign ourselves to abuses enabled by the data collection going on.
