Hacker News Reader

Comment by gigel82 | Hacker News Reader

Be very careful with any tool like this; you'll need to prove who you are by verifying an email address and / or phone number to your real name, which in turn will most likely "confirm" your data with all the upstream brokers (if you pay for some extra service you're twice a sucker with them most likely getting paid by brokers for proving your identity and by you as well for using the "service").

Note: this could be totally legit but in my personal experience, 100% of the tools that promise to do this were in fact shady as fuck and working with the brokers to enrich their data.

View on HN

Hi! Co-creator of Optery here.

We do not sell data. We are not a data broker. We do not have any financial relationship with any data broker. We are not affiliated with any data broker.

We are privacy enthusiasts who believe consumers should be in full control of their data. You can learn more about our mission, background and values here: https://www.optery.com/about-us/

There are some bad actors out there unfortunately. The most well-known is OneRep, which has an opt out and removals business, but are owned by an ownership group that simultaneously runs the People Search Site data broker Nuwber. It's almost certain that they run off the same data spine, meaning your data is co-mingled. Another one is BrandYourself, which includes data brokers as part of its affiliate program. So if you pay them for removals, you are indirectly paying the data brokers. There are others that I have a strong suspicion of, but don't know for certain, so I won't risk sharing their names.

But please don’t lump the rest of us working hard to protect people from data brokers into that same bucket. Along with us, DeleteMe, PrivacyDuck, and Kanary and a few others are above-board with no affiliation or financial relationship with any data broker (to the best of my knowledge). Just working hard for consumer data rights.

The data brokers most likely already have info on you. There is a catch22 where in order to opt out, you have to tell them who you are. Other services use your own private email address to submit the opt outs. We do not share your private email address with any third party, including the data brokers we submit opt outs to.

I've no idea if you're legit or not,

but wouldn't a bad actor say the same thing?

why should people trust you with their information?

Does a good actor actually have a way to prove they are legit?

This comment is a little pointless because almost anything that need your data needs you to trust them.

A good actor doesn't ask for PII in the first place.

In order to opt out of a data broker, you have to submit PII to them to tell them who you are, otherwise, they won't know who to opt out. The exception to this is if the data broker is using an anonymous identifier, like that stored in a browser cookie, in which case you would need to submit that anonymous identifier to them, or somehow give them access to it (e.g. via a browser request).

The People Search Sites we submit opt outs to all transact in raw PII, therefore, if you want to opt out, either you have to submit your own raw PII to them (or a hashed version, where you and the data broker share the key so the underlying profile can be matched) to the data broker so they can identify you, or you can utilize a third-party opt out service (such as Optery) to do this for you. In either case, submitting raw PII to the data broker for them to identify you and opt you out is required.

We only submit to data brokers the minimum amount of information necessary for them to locate your profile, and then remove it, which, in the majority of cases is: First Name, Middle Name, Last Name, City, State, and an email address. If you do a few manual searches at data brokers, you'll see all of this information is already out there.

Note that we never share our customers private email addresses with any third party, including the data brokers we submit opt outs to.

Right.

Then you sell your company.

Then the TOS about my PII changes because that TOS is a one way contract subject to the whims of whichever entity owns it at some particular point in time.

And then your company starts selling my PII, despite what you say in a non-legally binding comment on hacker news.

So no thank you.

Hey there, good luck with the venture and look forward to an EU/UK option.

Just wanted to say IANAL but with putting your details out there as a founder and being in the US, unless you've had a lawyer check over your statements I would be very cautious about naming companies specifically. Would recommend anonymising it or deleting that comment if you can't edit it, unless you've already had it checked out.

Ethics isn't part of their business model so any statement without hard facts backing it can get you into trouble.

How do you guarantee any data you use is not sold later on down the line??

Per our Privacy Policy: “We don’t sell or rent your personal information to any third parties for any purpose. You are the only owner of your Personal Data and can request disclosure or deletion at any time.”

Also included in our Privacy Policy, as is standard terms in most privacy policies: “If we are involved in a merger, acquisition or asset sale, your Personal Data may be transferred.”

You can learn more from our Privacy Policy and Terms of Service here: https://www.optery.com/privacy-policy/ https://www.optery.com/terms-of-service/

Would be interesting to know why there is no EU option. One possibility is they do not have enough data to offer it; that's good news for EU residents. Another is they want to avoid the costs of GCPR compliance and the possibility of regulatory action in the EU that is de minimis in the US. Either way, the fact they have no EU option does not inspire confidence they are on the users' side. The US is incredibly friendly to these shady "businesses". As such, US residents are "sitting ducks". Very sad. The way to stop this nonsense is with laws not more people accessing the data; trying to label "good guys" and "bad guys" does not work.

Incidentally the same "confirm your data" issue exists every time there is a data breach and people set up "Have I been pwned" websites allowing people to search for their name/e-mail address in the data. (Instead of allowing them download the data and providing instructions how to search it in private.) Not every one of those sites is legit. It is an easy way to at least confirm there is a live advertising target who is actively concerned about this data, and we have an originating IP address for that person. That seems to be what many tech companies want to know, "Is it really you?", so they can more convincingly market "you" as a real target for online advertising.

The EU fall under the GDPR and is an “opt in” regime. The U.S. falls under a makeshift patchwork of privacy laws and guidelines, and is an “opt out” regime. In an “opt in” regime (e.g. EU), the onus is on companies to obtain a user’s consent before they can use your data (i.e. they need to get you to “opt in” before they can legally use your data). In an “opt out” regime (e.g. U.S.), the onus is on the consumer to “opt out”, and companies basically have a free-for-all on a user’s data, unless the user exercises their right to “opt out”. (What's crazy is in most U.S. states, consumers have no legal right to opt out, which in the year 2021 is insane. Hopefully a federal privacy law will get passed soon.)

Given this, there is not as strong of a need for an “opt out” tool such as Optery in the EU because the GDPR is already doing a lot of work for you. However, in the U.S. (i.e. an “opt out” regime), the need for an opt out tool such as Optery is much greater because U.S. residents don’t have a privacy law in place like the GDPR to protect them. They either need to submit the opt outs themselves, or use a service like Optery.

That is why there is no EU option.

yeah, we need to make this kind of data harvesting 100% illegal, and then, tada, no catch 22 to deal with! it’s a non-sequitur to negotiate how much data can be collected and stored by random third parties. the answer should be an unequivocal “none”. then as a nice byproduct, we wouldn’t have stupid equifax mass data leaks every other month.

Whelp. You were right. Their first shady move is auto-opting all signups for their newsletter. Thank goodness I used a disposable email address.

Why would anything think it was a good idea to spam users?? I'm taking them for a test drive and the first thing these guys do is betray trust.

Sadly, I doubt the brokers have much concern about their data being inaccurate!

I used a tool like this posted to HackerNews a couple years back (against my better judgement, eh), and the information on a few of the data brokers afterwards was not only not removed but actually showed a green checkmark ("verified").

It's entirely possible the data brokers are simply using the "opt out" requests as a way to validate the data, but it's just as likely that the tool works with the brokers to confirm information instead of actually removing it.

Reply on news.ycombinator.com