Hacker News Reader

Comment by jeffbee | Hacker News Reader

The politician's use of "shared" to describe this is misleading in a way that HN headline-only readers are going to jump all over. What these sites were doing was abusing Google Analytics to store private user data in custom parameters. That is, in one example, if a user of a tax prep site said that they had 1 dependent, the site would set a parameter like "cd17:1" in their Analytics request. I don't really see how that amounts to Google's problem.

If a company uses or abuses software platforms to improperly store private user data, that is their error and not the fault of the platform. I assume you would not blame Google if Intuit put everyone's AGI in a Google Sheet.

View on HN

It doesn't seem like anyone is saying this is the problem of Google Analytics or Pixel, but rather the problem of tax prep firms for storing the data in first place and perhaps meta for using this sensitive data.

The Senators demanding investigation and the article itself are both clearly implying Facebook has done something wrong. The accusation seems to be that Facebook used the data to target ads. I suspect that's true only in the sense that it went into the same generalized funnel all the URLs do and not that they're specifically parsing out this information, but I guess those details don't matter if your reputation stinks.

How do you know that they are not parsed out by Meta? The possibilities for this goes from collusion with the tax firms over somebody at Meta reverse engineering the coding to an automatic "AI" reverse engineering ("pattern discovery" Not sure if they do that but possibly?).

I don’t “know” that which is why I said I “suspect” it rather than “know” it. But it seems like such an obviously foolhardy move with such marginal gain to deliberately seek to collect and analyze that data from tax prep firms that I have a hard time imagining them signing off on it.

My point is that they might not have to sign off on it. The signal for the ads might have been discovered by an algorithm without making it explicit to the management.

I would not be surprised if google, meta and co don't have big ML codes that try to find signals to increase ad revenue, and they dump all data they have into it.

"It's an algorithm! Nobody knows how or what went into creating it!" Seems like the new version of "I'm in charge of making the rockets go up; where they come down is a different department."

Meaning, of course, people are in charge of the machine learning / algorithm, people manage the weights, they measure the outcomes, they exercise editorial control. It's not a mystical black box given to us by god or a super advanced alien race; it's people doing people things; if they get the profit they also get the liability / responsibility. Even if they're not sure how it works, they sure as hell still responsible for it.

I am not arguing against them having responsibility. They do. I am arguing that they might not have realized what the weights are doing. Because, yes, indeed, large neural networks ARE black boxes.

I am not sure how it would be workable for Facebook to be responsible for what information third parties choose to put into their tool. By that logic pretty much any application that allows users to upload text is equally guilty unless each post in manually reviewed.

I can easily imagine Facebook's machine learning algorithms picking a signal out of this data and using it to target ads. They may not have had to tailor a query to search for "size of tax deduction". The machine learning algorithms did that on their own. In a completely opaque manner.

I doubt it is anything anywhere near that fancy. Look at the primary source of this complaint, which is available in GitHub. One of the sites was putting sensitive data, such as income amounts, in the page title. The Facebook analytics thing sends the page title to Facebook. Google Analytics also takes the page title. You can easily see how any old targeting engine, machine inference or otherwise, would take the titles of visited pages as a signal.

Why on earth would you give Facebook the benefit of the doubt on anything?

Based on experience working in a similarly-sized company I have some guesses as to how they might operate. Is there a logical reason I should always assume the least favorable thing instead?

It's definitely on the tax company for sending extraordinarily sensitive data to google analytics.

However I'd say sending sensitive (or at least private) data to google analytics is more or less its intended purpose. I don't think the use and continued existence of google analytics is compatible with any reasonable privacy protection.

"if Intuit put everyone's AGI in a Google Sheet."

AGI here refers to Annual Gross Income, not Artificial General Intelligence.

My brain skipped a beat because I assume Intuit had AGI but backtracked because you can't really put AGI in a Google Sheet. :shrugs:

"I'm sorry, Dave, I'm afraid I can't make that deduction."

The article states that the information was "shared" with Google and Meta via their respective pixels for ad-tracking purposes, but claims that only Meta parsed out that data and misused it.

The original cited source is https://themarkup.org/pixel-hunt/2022/11/22/tax-filing-websi... and contains more details than the AP article (and was discussed here: https://news.ycombinator.com/item?id=33753058 )

>but claims that only Meta parsed out that data and misused it.

Can you quote the specific section for this claim? I skimmed the themarkup.org article and the closest thing I could find was this

>Meta wins financially too. The company says it can use the data it gleans from tools like the pixel to power its algorithms, providing it insight into the habits of users across the internet.

Which has a link to facebook's tos. That's not really indication of what they actually do, just legal ass covering.

Why doesn't Google encrypt/decrypt the data on the client so that Google can't be accused of having access to that data?

I expect it's because the firms wanted to use these values in Google Analytics to do analysis of their own customers.

https://support.google.com/analytics/answer/10075209?hl=en

Right. Someone at H&R Block wanted to know "what pages or functions do people with 1 dependent use the most".

This query seems innocent enough. It's maybe logical and an easy thing to ask for without realizing the implications. I would bet this type of thing happens with LOTS of sites that collect any sort of personal data.

Obviously for us here, blocking analytic platforms through an adblock tool is a smart thing to do, exactly for this reason. But obviously that doesn't scale to the masses.

Isn't having access to the data the whole point of this?

Because the whole point of Google Analytics is because Google wants the data. Obviously the platform here is just as much at fault as the customer using it inappropriately.

There is no way that google has interest in the effort it would take to try to interpret the custom data that websites insert into custom analytics dimensions in a meaningful way. Their algorithms may track trends for them, but they are not aware of what they actually mean in a semantic way. I doubt that it us useful for them to learn anything from that data that is scoped outside the single account.

People are so confused about this. They underestimate the cost and effort that would be needed to just grovel around in GA logs and infer things, nevermind the fact that Google promises not to do it. Then the same commenters overestimate the expected value of successfully doing it, handwaving about how valuable it would be when in reality there is not a market for such data. Finally, they underestimate the risk it would pose to the adsense business, which prints more money than Jerome Powell, and the risk averse culture of Google who would not put that business in jeopardy for anything that pays less than a billion dollars per hour.

Because it would be impossible for Google to do any kind of serious server side analysis of the data, which is why these companies use analytics, if Google don't have the data unencrypted.

I worked on apps where the data collected was completely empty of user-identifying information. Management seemed content with merely logging clicks from within the UI, seeing how (and how many) people used the app.

Sadly I think there is a trend in our industry to gather everything, decide what you actually want/need later.

I think Google (and related) are to blame for enabling this kind of "data hoovering". Giving the customer what they want at the expense of us the users is getting kinda evil.

The terms of service of Google Analytics specifically prohibit storing PII in it. "You will not and will not assist or permit any third party to pass information, hashed or otherwise, to Google that Google could use or recognize as personally identifiable information"

I think you can say it's "anonymous" data in that it doesn't have name/phone/email but still be relatively fingerprint-able given additional analytics data.

Sounds like your info is still tracking.

And that level of insight only works for small companies - at a certain point you want to combine analytics from your UI with things like “is this a high value customer” or “did this customer stop using the app after experiencing this frustrating UX”

I'm still not convinced how this is "bad" per se. Yet we're all here discussing this as if it's already decided that this data shouldn't be shared and I'm sitting here thinking "Wtf? Who asked me?". Ok, so the Tax firm I gave my personal info to put it on Google, okay. Will google see it? Sure. Is it on some DB on google? Sure.

Do I care? No.

We're watching the world burn right now with more pressing issues, and this whole thing seems so ridiculously academic and contrived.

Same here, this type of outrage bait doesn’t work on me either. Some income info on me is in Intuit’s database somewhere, it hypothetically maybe being in a database at Meta does not affect me at all, other than I might get ads for more luxury goods. I don’t care, I also click “allow” instead of “Ask App Not To Track” in every iOS pop-up scare message.

> We're watching the world burn right now with more pressing issues

The stampede of technology on our privacy, on our daily lives is, I think, one of those fires burning right now.

I don't understand why you'd be confused after reading the original source[1]. The authors explain at length why they consider it to be Meta's problem, and it's not hard to understand - Meta make misleading claims about their own ability to detect and filter personal information. It also appears the detail sent was a lot less obfuscated than you indicate here.

If you only got as far as the press release[2] then I can understand your view:

> * Tax prep companies shared extraordinarily sensitive personal and financial information with Meta, which used the data for diverse advertising purposes

> TaxAct, H&R Block, and TaxSlayer each revealed, in response to this Congressional inquiry, that they shared taxpayer data via their use of the Meta Pixel and Google’s tools. Although the tax prep companies and Big Tech firms claimed that all shared data was anonymous, the FTC and experts have indicated that the data could easily be used to identify individuals, or to create a dossier on them that could be used for targeted advertising or other purposes.

This paragraph is woolly and does not appear to support the claim in the bullet point. But the full report has much strong wording on page 2: "Meta also confirmed that it used the data to target ads to taxpayers, including for companies other than the tax prep companies themselves, and to train Meta's own AI algorithms".

The logic of this claim, via page 19, appears to be: Meta says if their sensitive information filtering algorithm detected personal information, the information would not have been used for advertising, and they'd have sent a notification to the tax prep firms. They also confirmed the negative case: if no notification was received by the tax prep firm, then no filtering of their data took place. Meta was asked to provide copies of notifications they had sent to the tax prep firms and they did not do so. So the assumption is that none were sent, therefore no filtering took place, and the data were used as a signal in the advertising algorithm.

I don't find it to be an unequivocal confirmation, but the sources don't support your claim that this article is misleading or your claim that there's no reason to consider it a problem of the tech companies involved.

[1] https://www.warren.senate.gov/imo/media/doc/Attacks%20on%20T...

[2] https://www.warren.senate.gov/oversight/reports/in-new-repor...

Agreed! “Shared” implies good natured oopsie. More likely it was _sold_

Not sure what's misleading about it. They shared that data through these analytics links, didn't they? And according to the article, Facebook then used it for targeted advertising.

I don't see where you get that people are blaming the platform. It sounds to me that they're blaming the tax prep companies that shared the sensitive data.

> I don't see where you get that people are blaming the platform.

Other than when Senators referred to it as a shocking breach of privacy by "Big Tech" and the article includes a digression on Facebook's supposed long history of privacy issues, clearly implying this is another such incident?

Well, they do. That's why those tax prep companies should be doubly careful about sharing sensitive data with them. And it was "by tax prep companies and by Big Tech firms", so they didn't put all the blame just on Google and Facebook.

Nobody said they put the blame "just" on Google and Facebook.

If I take your tax return and store it in my deposit box at the bank, it is misleading to say that I shared it with the bank, or the bank collected it.

The letter from Sen. Warren that caused this press article blames Meta and Google for these events. It says "The Big Tech firms also appeared to act with stunning disregard for taxpayer privacy" even though Google and Meta had no agency in these matters.

<< Google and Meta had no agency in these matters.

I take issue with this statement.

agency is defined as -- via google - as action or intervention, especially such as to produce a particular effect

If google/meta creates a product like google analytics that is then used by third parties ( even if it is misused -- for various values of misused ), in itself, it is an action. You can say they were not actively involved ( and I do wonder about that, but I have no definitive proof one way or another ), but it is hard to argue they have no agency.

It is an equivalent of 'look, we are only selling the thing that we also happen to completely control online and we have no control over how it is used'. It is not a great defense ( and it is very easy to portray negatively ).

Yes, if they have no agency then I would expect them to ban customers violating privacy laws. Doubt that happened. More than likely, the entire ad industry end to end, is a actively searching for and excuting on opportunities to generate revenue by raping user privacy.

According to the spokesperson quoted they do attempt to scrub the data they receive to remove sensitive items.

Relevant paragraph about Google:

> Taxpayer data was also shared with Google, through its own tracking tools — though the firm told lawmakers that it never used the information to track users on the internet, according to the report.

So, they only store a unique id in their user tracking system, but they put the sensitive information in their ad targeting system, then join the data at impression time.

I guess it is good that they don’t stick PII in tracking cookies that they use to interoperate with third parties, but that is an extremely low bar.

It is Google’s fault for creating a product that can be abused in such a way that would allow for these outsized and egregious invasions of individual privacy

In every other engineering discipline you are required to understand the impacts and uses of what you build.

This is what an “environmental impact study” is - and despite what people might think of how they are used - the core purpose and reason they are key to engineering is because second and third order effects are real, impactful and frankly mitigation costs a lot.

Unfortunately, we never actually developed such a practice in software development outside of cases where hard engineering was leading such as in defense, nuclear or other very highly regulated, lethal, or martial industries.

Is it Husqvarna’s fault if I use a chainsaw carelessly and amputate myself?

It depends. That’s the point.

In the past, machinery didn’t have covers over what are now internal moving parts. The law changed that.

Yes but some tools which are useful and important are inherently dangerous to oneself or others. There is only so much you can do to make them safer before you have to make the operator assume responsibility for using them properly.

This argument can be extended to anything, which suggests it might not add any value to the discussion.

- You make Microsoft Excel. Someone uses Excel to leak a million people’s PII.

- You build shovels. Someone murdered someone with your shovel.

- You build an analytics product, explicitly ban collecting PII in your EULA, someone does it anyway.

It’s fun to be outraged and hating on GA is very in vogue at the moment, but this specific incident is just someone (yes, someone, not a nefarious company) using a popular tool incorrectly.

> You build shovels. Someone murdered someone with your shovel.

In the US, we do do this with firearms, though generally the winning cases tend to be focused around advertising strategies

Well, I’ll tell you what the answer is not: ignoring these externalities, and assuming they are someone else’s problem

This is my least favorite part of product development, which is the part where people who like developing stuff just arbitrarily decide when to stop caring about what the product is used for, and then fighting the rest of the world on that design decision because it’s obstinately “simply their product and their choice.”

I don’t know anything more antisocial or lacking in responsibility than taking on the responsibility of being a leader, promoting your services or product to other people via advertising and marketing and then shirking all responsibility when people say your product is being used to harmi other people.

As long as you get paid and do only the things that ONLY you think are important, that’s that’s the kind of society we want to build, right?

I agree, these shovel makers need to be held accountable for their cavalier attitudes about how their products are used by murders to bury people, which is concealing evidence and that is a crime. As long as they get their fat shovel checks, it doesn't matter to them. Is this the society we want? Where murders are helped along the way by these fat cat shovel makers?

> This argument can be extended to anything, which suggests it might not add any value to the discussion.

Excel has many primary benefitial purposes, it wasn't built for leaking PII.

Shovels likewise are useful for a benefitial purpose, they are not made for beating people up.

Third party spyware ("analytics") has only one purpose, collect data from unsuspecting customers. They have no valid benefitial purpose, if one accepts that spying is not kosher.

Reply on news.ycombinator.com