#Data privacy

[shamefullyhornywrites]

maybe this is me being paranoid but be cautious out there folks with project 2025 outh there things will likely get worse

protect others, download things, and stay hopeful nothings over till we're all dead

Oi read this!

You guys clocked the warning by AO3 to reduce interlinks of accounts?

Especially for queer users in the US right now?

(written below for people who struggle to read text in images).

"Be mindful when sharing personal information, including but not limited your name, email, age, location, personal relationships, gender or sexual identity, racial, or ethnic background religious, or political views and or account usernames on other sites"

Then the normal "By checking this box you consent to the processing of your personal data in the the United States"

[greatrunner]

It is a truth universally accepted that when critiquing anything regarding AO3/OTW, reactionaries enter the building, and critical thinking and discernment gets locked out.

Nia Ola (on Substack) attempted to raise the alarm about AO3's changes in Terms of Service. This bit in particular:

Nia Ola: "[...]AO3 just updated their terms and conditions so that the only way you can use the site now is that you consent to them taking your data (so, works that you've written, distributed, saved, bookmarked, etc, everything) and give that data and information to the government."

In my time reading Terms and Conditions of Service, websites claiming that they're "duty bound" to provide data uploaded to the site to the govt, depending on jurisdiction, is not a surprise. You will not be informed or told by the site(s) when the government accesses/obtained your information. All on the pretense that it would "interfere with an ongoing investigation".

It isn't dissimilar to the one I've read here for Tumblr. The bit that says (legalese-y) that anything you post on the site can be used as evidence (IIRC) if it becomes "necessary."

But as usual, the AO3 brigade worked like hell to shout them down. Folk focused a lot on how OTW made their TOS "easier" to understand. They claimed Nia Ola was spreading misinformation. Most have gone as far as quibbling with her phrasing, "giving your information to the government" (which they would be doing) based on their personal interpretation of her meaning.

After making the video (they posted on TikTok) private, Nia Ola continued to encourage people to use security measures like VPNs and secure Browsers (they mentioned Firefox; I'm sure others are recommending Tor, Brave, and lesser-known browsers with better security features than Edge or Chrome) and to back up information they didn't want to lose.

Is it an explicit consequence of the election? Probably not. AO3/OTW knows entirely that they're hosting grimy shit on their website and refuse to do anything about it. If the US or any other country decides it's politically advantageous to go after them, AO3/OTW is gonna cover their asses and throw you under the bus.

Point-Blank-Period.

That said, I think it would be irresponsible to exclude the election as a factor altogether. Organizations (govt or otherwise) are hang-wringing about rustling conservative feathers. KOSA and COPPA are still in play. And there's the bill targeting non-profits to consider that's likely to pass not long after it got shot down.

When Tumblr wanted the favor of the Apple Store and their advertisers, they targeted sex worker blogs and fashion and art bloggers (primarily Black/non-Black). Then, they created an AI flagging system that still doesn't work.

When enough people (and advertisers) made enough noise about the NC-17 content that FanFiction (dot net) hosted on their site (at the height of its popularity, mind you)? They made a choice that allowed the website to survive and eliminate the target on their back. Both were financially motivated, yes, but if it's a choice of annexing content to stay online or getting shuttered?

AO3 will not be an exception. It's already embracing that "Obeying in Advance" phrase y'all are in love with right now.

Nia Ola is not the only one raising the alarm or alarmed by this decision. In your haste to fall on the sword for an organization that does not care about you, try not to make an ass of yourself by dog-piling people with experience regarding the consequences of data collection stemming from policies meant to criminalize sexual content, yeah?

This will continue unless we establish actual policies, education, and protections to prevent the mass surveillance of adult spaces under the pretense of "decency" and "protecting children." Additionally, we must address the ongoing elimination of healthy and safe spaces for children.

Until our culture/society receives a significant overhaul in its approach to sex education, divorced from white supremacy, the actual intention of creating spaces that aren't sex-negative and don't prey on uninformed children will probably always exist in short bursts.

That means our politic has to rid itself of the reactionary ilk that (a) demonizes all things sexual and (b) refuses to practice discernment and critical thinking in their so-called sex-positive spaces. Both are why places like AO3 manifest and then ultimately help no one. Reactionary AO3 loyalists will always fight to keep conversations about the site politically and socially stunted and unchanging.

Not all censorship and moderation is or should be sex-negative or censorious to the point of infantilizing. But, if the goal is maintaining free speech and freedom of expression, it cannot be to the detriment of itself or for the sake of it.

[zuko-always-lies]

From instructions on how to opt out, look at the official staff post on the topic. It also gives more information on Tumblr's new policies. If you are opting out, remember to opt out each separate blog individually.

Please reblog this post, so it will get more votes!

[heythisiseasy]

Fun fact! You don't currently have to worry that a US spy agency has taken your data from AO3. (Have they spied on you in other ways? Eh, probably.)

AO3's parent nonprofit, the Organization for Transformative Works has a neat thing on their website called a warrant canary.

This thing. It's hard to read on my screenshot, so I'll copy the text here.

"The Organization for Transformative Works has not received any National Security Letters or FISA court orders, and we have not been subject to any gag order by a FISA court."

What's that mean? National Security Letters and FISA courts are how US security agencies secretly subpoena data from US-based websites. They send the website owners and order to turn over data and NOT TELL ANYONE that they've done so. That's called a gag order. Disobeying this gag order is big time illegal and the US government WILL ruin your life over it. You cannot tell people, "The US government gave me a secret order to turn over my data."

BUT! The government cannot compel you to lie. A FISA court order cannot make you say on your website, "We have never received a FISA court order." So websites put the warrant canaries on their sites, and if they ever get an order for data that they aren't allowed to tell you about, they take the order down. Like a canary fainting from gas in a mine, the warrant canary stops singing.

So right now, we know that the OTW, and therefore AO3, has never had to secretly turn over data to the US government. Keep an eye on that canary. Check in on it occasionally. As long as the little bird's singing, don't panic.

https://www.cloudflare.com/learning/privacy/what-is-warrant-canary/

https://en.m.wikipedia.org/wiki/Warrant_canary

https://www.eff.org/deeplinks/2014/04/warrant-canary-faq

I've seen a number of people worried and concerned about this language on Ao3s current "agree to these terms of service" page. The short version is:

Don't worry. This isn't anything bad. Checking that box just means you forgive them for being US American.

Long version: This text makes perfect sense if you're familiar with the issues around GDPR and in particular the uncertainty about Privacy Shield and SCCs after Schrems II. But I suspect most people aren't, so let's get into it, with the caveat that this is a Eurocentric (and in particular EU centric) view of this.

The basic outline is that Europeans in the EU have a right to privacy under the EU's General Data Protection Regulation (GDPR), an EU directive (let's simplify things and call it an EU law) that regulates how various entities, including companies and the government, may acquire, store and process data about you.

The list of what counts as data about you is enormous. It includes things like your name and birthday, but also your email address, your computers IP address, user names, whatever. If an advertiser could want it, it's on the list.

The general rule is that they can't, unless you give explicit permission, or it's for one of a number of enumerated reasons (not all of which are as clear as would be desirable, but that's another topic). You have a right to request a copy of the data, you have a right to force them to delete their data and so on. It's not quite on the level of constitutional rights, but it is a pretty big deal.

In contrast, the US, home of most of the world's internet companies, has no such right at a federal level. If someone has your data, it is fundamentally theirs. American police, FBI, CIA and so on also have far more rights to request your data than the ones in Europe.

So how can an American website provide services to persons in the EU? Well… Honestly, there's an argument to be made that they can't.

US websites can promise in their terms and conditions that they will keep your data as safe as a European site would. In fact, they have to, unless they start specifically excluding Europeans. The EU even provides Standard Contract Clauses (SCCs) that they can use for this.

However, e.g. Facebook's T&Cs can't bind the US government. Facebook can't promise that it'll keep your data as secure as it is in the EU even if they wanted to (which they absolutely don't), because the US government can get to it easily, and EU citizens can't even sue the US government over it.

Despite the importance that US companies have in Europe, this is not a theoretical concern at all. There have been two successive international agreements between the US and the EU about this, and both were struck down by the EU court as being in violation of EU law, in the Schrems I and Schrems II decisions (named after Max Schrems, an Austrian privacy activist who sued in both cases).

A third international agreement is currently being prepared, and in the meantime the previous agreement (known as "Privacy Shield") remains tentatively in place. The problem is that the US government does not want to offer EU citizens equivalent protection as they have under EU law; they don't even want to offer US citizens these protections. They just love spying on foreigners too much. The previous agreements tried to hide that under flowery language, but couldn't actually solve it. It's unclear and in my opinion unlikely that they'll manage to get a version that survives judicial review this time. Max Schrems is waiting.

So what is a site like Ao3 to do? They're arguably not part of the problem, Max Schrems keeps suing Meta, not the OTW, but they are subject to the rules because they process stuff like your email address.

Their solution is this checkbox. You agree that they can process your data even though they're in the US, and they can't guarantee you that the US government won't spy on you in ways that would be illegal for the government of e.g. Belgium. Is that legal under EU law? …probably as legal as fan fiction in general, I suppose, which is to say let's hope nobody sues to try and find out.

But what's important is that nothing changed, just the language. Ao3 has always stored your user name and email address on servers in the US, subject to whatever the FBI, CIA, NSA and FRA may want to do it. They're just making it more clear now.

[hussyknee]

I do not have the words to articulate my level of rage about this. We need to start killing and eating tech bros.

[incognitopolls]

We ask your questions so you don’t have to! Submit your questions to have them posted anonymously as polls.

[would-you-punt-them]

Websites that demand you give them extremely private information to "verify your age"

[opensuse-official]

I think it is very cool how tech companies, schools, employers, and universities make it actively difficult to distance yourself from Google, Microsoft, and Apple.

Yes most Linux distros are very stable, way more secure, privacy friendly, and way more customizable. But every institution is built to make technological independence as difficult as possible.

Yelling on the internet that everyone should switch to Linux and FOSS really ignores how much of the technological world is designed to not let that happen.

[ahb-writes]

(from The Mitchells vs. the Machines, 2021)

[canadiancryptid]

Hey so just saw this on Twitter and figured there are some people who would like to know @infinitytraincrew is apparently getting deleted tonight so if you wanna archive it do it now

[justonebigbee]

Assigned Gay by Targeted Advertisements

Rated T | 10,979 words | Buck/Eddie | Loosely 5+1 style | Real world issues of data privacy and surveillance, justified technophobe Eddie Diaz

At first, Eddie thinks nothing of it. He lives in LA: there are plenty of ads specifically for queer people all over the place, so it’s not like he’s never seen a billboard with a rainbow on it. Then Buck starts talking about data privacy and the ads just keep coming, so Eddie starts to wonder if the advertising companies know something about him that he doesn’t.

[Read on AO3]

[allthecanadianpolitics]

The Supreme Court of Canada made a key privacy ruling Friday that means police must now first have a warrant or court order to obtain the numbers making up a person or organization's IP address.

The top court was asked to consider whether an IP address alone, without any of the personal information attached to it, was protected by an expectation of privacy under the Charter.

In a five-four split decision, the court said a reasonable expectation of privacy is attached to the numbers making up a person's IP address, and just getting those numbers alone constitutes a search.

Full article

Tagging: @politicsofcanada

[bookshop]

reminder not to do what i almost did just now and tell tumblr what your high school mascot is/was just because someone made a fun poll about it, because that's a SECURITY QUESTION ON A BUNCH OF YOUR PASSWORD-PROTECTED PLATFORMS

[whereserpentswalk]

[justinspoliticalcorner]

Christopher Wiggins at The Advocate:

A Houston-based surgeon stands accused of betraying the privacy of transgender kids who weren’t under his care by stealing their medical information and handing it over to a far-right extremist who vehemently opposes transgender rights. The federal indictment, unsealed on Monday, details Dr. Eithan Haim’s alleged unauthorized access and disclosure of sensitive patient information at Texas Children’s Hospital. Haim, 34, completed his residency at Baylor College of Medicine and reportedly reactivated his access to the hospital’s electronic records system in April 2023. He is accused of illicitly obtaining patient names, treatment codes, and attending physician details, which he then shared with conservative activist Christopher Rufo. Rufo, known for his hardline stance against transgender rights, used the information to publish an exposé claiming the hospital continued to provide gender-affirming care for minors despite a public announcement to halt such services.

The indictment alleges Haim accessed this sensitive information under false pretenses and with malicious intent, aiming to harm Texas Children’s Hospital. Haim’s actions followed a 2022 opinion from Republican Texas Attorney General Ken Paxton, labeling gender-affirming care for minors as a form of child abuse. Gov. Greg Abbott, a Republican, subsequently directed the Texas Department of Family and Protective Services to investigate parents seeking such care for their children. In response, Texas Children’s Hospital announced it would pause all gender-affirming services for minors to comply with these directives and protect its staff and patients from potential legal consequences.

Dr. Eithan Haim, who leaked the health records of trans kids to far-right anti-LGBTQ+ extremist Christopher Rufo, is facing charges of violation patient privacy.

[jeremyfuscaldo]

Hey everyone,

Today is the last day to possibly opt out of Meta (Facebook/Instagram)'s AI program and there is a way to opt out if you are trying to protect your data privacy.

Please do what you can to save your art and data before it's too late. Edit/Update: It may not be applicable to the US because people living in Europe have the direct ability to opt out-- but US citizens can still submit the form for consideration.