Well, that's not how terms of service work. You can still sue
Previous rulings such as Rubber v Glue and Face v Hand make this look like a really strong strategy
IANAL, but I think they should be in a far weaker position with their whole "if you don't object within 30 days we will consider you to have accepted". They can't really argue that no positive action from the other party is construed as acceptance of a new contract. If there was continued use of the service that would be different, but no action cannot reasonably be construed as acceptance.
I think you're going to be very surprised by how quickly they win any trial when they first impress upon the court, "I know you are, but what am I?" Of course, the judge will primarily be swayed by the moment when they call a customer to the witness stand and then mutter, "guiltypersonsayswhat"
You'd be forgiven for thinking that no judge would rule in favor of a company who, post-damages, tries to build a loophole that ties the hands of users who likely will no longer trust the platform enough to log on. But this is the legal version of a bully giving a triple-w (wet willy and a wedgie) to someone who's ignoring them and judges think that kind of behavior is super cool. That's why if you ever ask a judge "what's that on your robe?" as then flick their nose when they look down, they'll simply laugh and you'll be friends forever.
IANAL, but everything I said feels really accurate. ᕕ( ᐛ )ᕗ
I like anal too
Desperate strategy they're hoping will fool some of the people some of the time.
Trusting complete strangers with highly personal information is never a good idea. Even if they promise to take good care of it, before or after they've already got your money.
Not sure about other states, but in my state you can agree to mandatory arbitration for past incidents as long as they don't do reeeeeally egregious behavior like, eg, slipping a notice into your normal bills and having you "agree" by not objecting within X days.
Olnly if you opt out of the new terms, at least in us.IANAL of course
In much of Europe, at least in EU, ToS cannot take away legal rights.
in order for a ToS to be legally enforcable, the user has to see it. A user cannot give consent on an agreement they did not see, therefor in court it would be 23andMes job to verify that the user was indeed aware of the ToS and acted accordingly. they could not say everyone ops in and defend themselves that way by default because not everyone that was forcibly opted in gave an agreement to the new ToS.
Exactly. There's a world of difference between "You must agree to the terms to continue use of the service", displaying the new terms before a user can continue, and just saying "If you don't reply within 30 days we're changing the terms of the contract without your input".
You can still sue. Whether or not the suit goes through is different story.
PSA: you can request deletion of your 23andMe account. It won’t do anything for this past hack, but it’ll at least prevent your data from being included in future hacks (assuming they actually completely delete your data like they’re supposed to).
it's almost always a soft delete, that is, change active field in database to false, coupled with their terms of service that state vaguely how they start the deletion process which could take months and how they may still keep certain data for legitimate purposes.
And this is why I wish we adopted GDPR more... if they are compliant, then they have to remove all data held when requested. Too bad the US will never care that much to respect individuals' data like that.
Exactly. I made a GDPR request for deletion. They can get in big trouble if they are soft deleting.
Have they ever been audited?
How does the legal authority work with GDPR if the company's physical and financial operations are entirely within the US? Would the GDPR even be allowed to audit them without their consent?
No idea if they’ve been audited. GDPR doesn’t require it. My understanding is that American companies doing any business or having any users in the EU need to be GDPR compliant for those users. I don’t think that’s been challenged in any courts yet.
They didn't.
They just made it so you couldn't see it anymore.
Why would you this wasn't even a hack for my understanding?
It was a password stuffing attack. Meaning that a bunch of users with reused crappy passwords had their accounts accessed with their legitimate passwords by attackers.
I'm not sure why this reflects horribly on the company in a way that would encourage one to delete their account?
This would be like leaving the key to your apartment in a public place and then complaining about your landlords terrible security when someone accesses your house when you're not there.
They stuffed passwords to get them access to information not just on the compromised accounts' profiles but to detailed data on a large group of other people whose accounts weren't compromised through a function within 23andMe's database browser.
Too bad, it happened wile the old ToS were active. :p
Nu-uh, you can't prove that! And even if you can... LALALA! 🙉
I feel like ToS changes should require the user to accept before being enforceable with no right to suspend the user's account if they don't and when it comes to data it should only apply to data the user shared after the changes...
pretty sure ToS aren't enforceable, it's just that it's costly to challenge them.
Well, that's not how terms of service work. You can still sue
Previous rulings such as Rubber v Glue and Face v Hand make this look like a really strong strategy
IANAL, but I think they should be in a far weaker position with their whole "if you don't object within 30 days we will consider you to have accepted". They can't really argue that no positive action from the other party is construed as acceptance of a new contract. If there was continued use of the service that would be different, but no action cannot reasonably be construed as acceptance.
I think you're going to be very surprised by how quickly they win any trial when they first impress upon the court, "I know you are, but what am I?" Of course, the judge will primarily be swayed by the moment when they call a customer to the witness stand and then mutter, "guiltypersonsayswhat"
You'd be forgiven for thinking that no judge would rule in favor of a company who, post-damages, tries to build a loophole that ties the hands of users who likely will no longer trust the platform enough to log on. But this is the legal version of a bully giving a triple-w (wet willy and a wedgie) to someone who's ignoring them and judges think that kind of behavior is super cool. That's why if you ever ask a judge "what's that on your robe?" as then flick their nose when they look down, they'll simply laugh and you'll be friends forever.
IANAL, but everything I said feels really accurate. ᕕ( ᐛ )ᕗ
I like anal too
Desperate strategy they're hoping will fool some of the people some of the time.
Trusting complete strangers with highly personal information is never a good idea. Even if they promise to take good care of it, before or after they've already got your money.
Not sure about other states, but in my state you can agree to mandatory arbitration for past incidents as long as they don't do reeeeeally egregious behavior like, eg, slipping a notice into your normal bills and having you "agree" by not objecting within X days.
Olnly if you opt out of the new terms, at least in us.IANAL of course
In much of Europe, at least in EU, ToS cannot take away legal rights.
in order for a ToS to be legally enforcable, the user has to see it. A user cannot give consent on an agreement they did not see, therefor in court it would be 23andMes job to verify that the user was indeed aware of the ToS and acted accordingly. they could not say everyone ops in and defend themselves that way by default because not everyone that was forcibly opted in gave an agreement to the new ToS.
Exactly. There's a world of difference between "You must agree to the terms to continue use of the service", displaying the new terms before a user can continue, and just saying "If you don't reply within 30 days we're changing the terms of the contract without your input".
You can still sue. Whether or not the suit goes through is different story.
PSA: you can request deletion of your 23andMe account. It won’t do anything for this past hack, but it’ll at least prevent your data from being included in future hacks (assuming they actually completely delete your data like they’re supposed to).
it's almost always a soft delete, that is, change active field in database to false, coupled with their terms of service that state vaguely how they start the deletion process which could take months and how they may still keep certain data for legitimate purposes.
And this is why I wish we adopted GDPR more... if they are compliant, then they have to remove all data held when requested. Too bad the US will never care that much to respect individuals' data like that.
Exactly. I made a GDPR request for deletion. They can get in big trouble if they are soft deleting.
Have they ever been audited?
How does the legal authority work with GDPR if the company's physical and financial operations are entirely within the US? Would the GDPR even be allowed to audit them without their consent?
No idea if they’ve been audited. GDPR doesn’t require it. My understanding is that American companies doing any business or having any users in the EU need to be GDPR compliant for those users. I don’t think that’s been challenged in any courts yet.
They didn't.
They just made it so you couldn't see it anymore.
Why would you this wasn't even a hack for my understanding?
It was a password stuffing attack. Meaning that a bunch of users with reused crappy passwords had their accounts accessed with their legitimate passwords by attackers.
I'm not sure why this reflects horribly on the company in a way that would encourage one to delete their account?
This would be like leaving the key to your apartment in a public place and then complaining about your landlords terrible security when someone accesses your house when you're not there.
They stuffed passwords to get them access to information not just on the compromised accounts' profiles but to detailed data on a large group of other people whose accounts weren't compromised through a function within 23andMe's database browser.
One thing to note: the email says to send legal@23andme.com an email to opt out while the updated ToS say to email arbitrationoptout@23andme.com.
Too bad, it happened wile the old ToS were active. :p
Nu-uh, you can't prove that! And even if you can... LALALA! 🙉
I feel like ToS changes should require the user to accept before being enforceable with no right to suspend the user's account if they don't and when it comes to data it should only apply to data the user shared after the changes...
pretty sure ToS aren't enforceable, it's just that it's costly to challenge them.