Kudos, very nice write-up!

Oh interesting, I didn't know there was a citation feature but can't see them in Thunder. PR time perhaps.

Although it doesn't work for me. On browser, when I click the citation, it just opens the post again.

Sure, it's not the hundreds of dollars I'd estimated previously. In the past I've said "the data brokerage industry is a multi-trillion dollar industry" and come up with figures ranging from $100-$700 per year owed to the user.

However, it should be said that this is just data brokerage. Not all businesses sell the data they collect, instead they keep it proprietary and use it themselves. Google, for example, sells advertising, not user data.

So I think my estimations here have been very conservative overall, and the real value may well be much higher.

Also, it's not just about it being a small amount from an individual, it's the fact that they're robbing everyone blind that really gets my wick. No one really understands the value of user data, not intuitively, and the whole transaction is done in a deceptive manner to abuse this fact.

The way I see it, that number is a baseline figure for what their services would be offered for in exchange. If someone came up to me and said "here, I'll give you $53 and in exchange you'll let me surveil you for a year" I'd say no, but maybe someone else would've said yes. Then, as an experiment, maybe we can let the market take it from there, now that there's a price and some form of discovery mechanism.

6 bil ia a stretch.
I'd go with 60-70% of tge general population being perpetually online +10% of the older folks only having a smartphone for whatsapp and some other stuff.

Would that factor in the [unknown] costs of that revenue? Running all the servers (incl youtube), offices and staff aint cheap. So more likely some is paying enough to leave 23USD on top of massive costs.

That's very interesting! I'd also read somewhere that data collection was a trillion dollar industry, however the figure I found here is purely data brokerage so does not include Google per se - Google sell advertising, the data they collect is kept to themselves, so it's much harder to pin down a value.

It also stands to reason that an American's data is worth more on the market than, say, a North Korean's - users who use the internet more will have more data being traded.

I enjoyed reaching the gist of your meaning: Legislation needs to be written.

So let’s hope that can happen.

Agreed. The first step I think is education, letting people know the value, pointing out that it is a pandemic problem that affects everyone, then convincing politicians that they are being robbed too. If a lawmaker thinks they're a victim, then they might actually pull their finger out.

And on a personal level, what have you heard about people who intentionally make their data useless?

This has been my strategy.

I do that to some degree, with some things. Like with captcha, I play a game of getting things wrong, but just enough to get through. Not every attempt though, I want it to still think I'm a human that's smarter than the machine, then when I think it's giving me a genuine training screen I spoil it.

I don't use cash as much as I maybe should, I prefer it in some regards, but contactless card purchases are just so easy. I've never used Google or Apple Pay, though, but that's more because I run custom firmware. Also, I've since learned that when you use your phone to pay it's the equivalent to chip and PIN. You are authorising the transaction and taking responsibility for it, whereas if you use a contactless debit/credit card it is processed as "cardholder not present", whereby the seller assumes more responsibility if you dispute it. This method of transaction isn't new, it's how catalogue or telephone purchases were always done, as well as online purchases. But if you use your card with chip and PIN, or if you use your phone, you will have a much harder time disputing any transaction.

Have you heard much about this strategy? How might it work if everyone used it? Generally thoughts for how we can defy their machine and protect ourselves?

In terms of user data protection, really I think the cat is long since out of the bag. There's no putting it back in - and in many ways we shouldn't, as data is useful and has benefits to society. I think it should go either one of two ways:

1. Allow businesses to continue their free data collection, but force them to make the raw data public. Any processing they do can be private, but the raw data doesn't belong to them.
2. Have businesses start paying the data subject for their data.

In the meantime, one way a user can limit their data collection using restrictive privacy browsing settings. For my personal PC's, I not only run uBlock Origin but also uMatrix - a deprecated extension made by the same author. This has similar funcionality to uBlock Origin when you set it to author mode, where it can selectively block different domains, but uMatrix presents it as a matrix which also allows you to select the type of content as well as domains. By default, it blocks all 3rd party frames, audio/video media, scripts, XHR, and "other", so quite often it leaves websites broken on first load, but then I pick through and enable the bare minimum of content to get it working. This isn't for everyone, of course, as it can be a hassle sometimes - particularly with payment processors which are all done on multiple 3rd party servers. However, it does highlight to me how endemic Google are with captcha, even when it doesn't give you a captcha prompt. I can't log into some of my online banking without enabling connections to Google, which is sickening. This is an example of what uMatrix looks like:

The extension doesn't get updates anymore, so my lists are out of date compared to uBlock Origin. I'm pretty sure I could update them manually, but since I run uBO as well I don't really feel the need. I've tried running just uMatrix, but uBO has its own array of special lists and without those YouTube ad blocking doesn't work.

You need to hand a twenty to a dude on the corner. That’s privacy. We used to have it.

I closed the tab and am now wondering if I need a different weed shop.

The answer is yes. Make sure to also let management know exactly why so they know how bad they fucked up

Yeah I really hate that kind of thing. I went into a gas station once, and at the registers it had a tiny little label saying they had CCTV with facial recognition, for crime prevention and "legitimate interest" - the GDPR term that websites always hide and sneak in pre-ticked, even when you think the main points are completely unchecked. There wasn't even a clear way to opt out either, just a QR code you could scan. I didn't scan, I've avoided that place since.

I also vote for finding a new weed shop, but ideally do tell them your reason why.

Go olde skool and find a local weed guy. I assume they must still exist.

Those people were me lol

Glad to see there's someone trying to make the process more legitimate.

However, I feel like the better solution is to require that all raw data be publicly available - no one pays for it, but everyone can access it. Then, when people process the data, they can keep their methods and results secret. I think this is perhaps a more practical solution as the cat is already out of the bag, you're not going to get the likes of Facebook paying users appropriately.