Comment by candybar | Hacker News Reader

Comment by candybar | Hacker News Reader

Parent Full thread

From New York Times privacy policy:

Some of the services and advertisements included in the NYT Services, including on NYTimes.com and within our mobile apps, are delivered or served by third-party companies, which may collect information about your use of the NYT Services.

These companies place or recognize cookies, pixel tags, web beacons or other technology to track certain information about our NYT Services website users. For example, in the course of serving certain advertisements, an advertiser may place or recognize a unique cookie on your browser in order to collect certain information about your use of the NYT Services. For another example, an advertiser or ad server may also be able to collect your device’s unique identifier in the course of serving an ad. In many cases, this information could be used to show you ads on other websites based on your interests.

We do not have access to, nor control over, these third parties' use of cookies or other tracking technologies or how they may be used.

For example, we use Google to serve advertisements on the NYT Services, which use the Google Doubleclick cookie, and in some cases, a unique device identifier, to show you ads based on your visit to NYTimes.com and other sites on the Internet. You may opt out of the use of the Google Doubleclick cookie by visiting the Google ad and content network privacy policy. If you would like more information about this practice, and to learn how to opt out of it in desktop and mobile browsers on the particular device on which you are accessing this Privacy Policy, please visit http://optout.aboutads.info/#/ and http://optout.networkadvertising.org/#. You may download the AppChoices app at http://www.aboutads.info/appchoices to opt out in mobile apps.

They are embedding third-party tracking technologies inside their app and letting each of them track however they want.

I'm sorry, but can you be more specific about your point? Is it that companies should always be held just as complicit as the third parties they use? And how absolutist are you on that? e.g. does the NYT have no moral right to report on climate change, because the NYT depends on energy suppliers, which produce the CO2 emissions the NYT complains about? Sure, that's a principle, but not one that leaves much room for actual discussion.

That's not the point - the point is that this is a loophole that effectively says, third-parties can do whatever they want with respect to your private information through our website and app and we're not at all responsible. This more or less renders the privacy policy entirely moot. It's like a vegan restaurant coming up with a "vegan guarantee" agreement that is supposed to guarantee that the dining experience is vegan, but excludes "third-party" ingredients from the guarantee. And it more or less says, you're subject to Google's privacy policy, when you visit the New York Times site, which means everything bad about Google's privacy policy is included in the New York Times privacy policy.

From a technical standpoint, what's happening is that New York Times is running arbitrary code that it doesn't know anything about on the browsers of people that visit their site. And they are claiming that they are not responsible for what it does, despite the fact it's delivered through New York Times.

Quite the opposite, they're basically saying "we use Google for ads and know what it does but if google changes what it does we don't have much control - watch our policy for changes"

Does any company in the world that serves ads from Google not do this or state this?

How would you technically host ads on your site without "running arbitrary code"? How would you add an analytics solution without doing that?

And also, focusing on this defeats the actual purpose of this article. I assume it means you agree with it's message and are just nitpicking? (Or don't and are deflecting.)

New York Times is saying much more than that - they are saying that they are using an unspecified number of third parties each of which is operating independently while having potentially full access to customer data. And throwing their hands up in the air and saying that they have no control over any of this. Google isn't their only vendor and at least Google is likely to be operating within some bounds - you don't know what their other vendors are nor what they are doing. This renders the entire privacy policy moot from the consumer's perspective.

And no this is not something they have to do. The idea that they cannot control what their vendors do is completely absurd - they have contracts with these vendors so they can state exactly what vendors are allowed to do under these contracts in the privacy policy. The only excuse here is that they are either too embarrassed to put what's in these contracts and/or they have no idea what's in those contracts. What NYT is doing is more or less equivalent to selling their users' data, which Google does not do.

And no this is NOT nit-picking and it directly counters the entire point of the article - Google's privacy policy is long because it actually covers what is being done with the data, as opposed to the New York Times policy, which states that they outsourced data collection/monetization third parties so anything goes and it's not their fault.

Reply on news.ycombinator.com