Unroll.me to close to EU users saying it can’t comply with GDPR

https://techcrunch.com/2018/05/05/unroll-me-to-close-to-eu-users-saying-it-cant-comply-with-gdpr/

by lxm • 8 years ago

160 282 8 years ago

jacquesm• 8 years ago

Excellent. The GDPR is working as intended. Let's see how many other unscrupulous actors will try to pin the blame for their own malicious behavior on the new legislation.

reilly3000• 8 years ago

That will be most of ad tech and 100% of arbitrage publishers in the least.

apexalpha4• 8 years ago

Just like Uber circumventing labour laws to beat taxi firms. "EU not good for innovation".

Ehm, no. These laws represent how we want (our data) to be treated. If you're business model can't exist within that legal realm than your business model is one we don't want.

dmitriid• 8 years ago

Everytime you see news of a company" not being able to operate due to" or "shutting down because of" GDPR, the only actual reason is "our business model is unsolicited unrestricted access to, processing of, and selling of personal data."

So sad to see these businesses go (not)

megaman222• 8 years ago

Or they are not actually doing anything shady, but the revenue coming in from the EU is not sufficient to justify the increased costs and liabilities.

geofft2• 8 years ago

Do you have an example of this? I totally believe this is possible, but every thing I've seen in practice has matched GP's description.

krapp• 8 years ago

Or they are not actually doing anything shady, but the revenue coming in from the EU is not sufficient to justify the increased costs and liabilities.

Refusing to protect your users from your own predatory use of their personal data because the ROI isn't there is still shady.

ben_jones• 8 years ago

Or it's a free pass to cut out a less profitable market segment. Or it's an excuse for bad developers. Or its an excuse to shift blame from your already failing business.

nukeop4• 8 years ago

Exactly, the GDPR regulations are completely reasonable and it's actually quite odd to see them being put into practice so late. The user data selling wild west had to be regulated at some point to curb predatory practices of Google, Facebook, and many others. If your business model isn't based on exploitation and profiling, it isn't hard at all to comply with GDPR.

Hamuko9• 8 years ago

Yeah, I've wondered why everyone has been so late to the party. I mean, we have lived in a world with GDPR for two years now. Companies should have already been complying with it for two years. There was just a transitional period during which there was no enforcement.

Then there's all the GDPR expert blog posts, blasting the EU for not giving any leeway or transition periods. You were in it!

drivingmenuts2• 8 years ago

I did some work for a small game company that collects an email address as part of the registration for a contest within the mobile game.

They may well be shut out of the EU now, which is sad, because I know for a fact there was zero malicious intent.

craigsmansion4• 8 years ago

collects an email address as part of the registration [..] they may well be shut out of the EU now

Why would that be?

I think there's a lot of misunderstanding and/or uncertainty about the scope of the GDPR. The fact itself that you know, for a fact, there is no malicious intent, means that the GPDR will have little to no bearing on you.

If you're having a simple free e-mail raffle of goodies for a list of players that signed up for that, there's nothing that prevents you from doing that. What would change is that if someone asks you what you have on them, you have to mail back "we have your email address in a list of email addresses", and you have to really delete it if they request it.

These are things any decent company would normally comply with regardless. It's only problematic if you would be harvesting data for non-transparent purposes, but that's not something that could reasonable be included with "zero malicious intent".

ginko• 8 years ago

They may well be shut out of the EU now

Why would you think that? Collecting email addresses for an optional contest is a legitimate use case. The company just needs to ensure that these addresses are stored securely and must give users the option to get their data deleted.

hedora2• 8 years ago

I am increasingly tempted to VPN everything through Europe, and maintain a token postal address there.

bastawhiz2• 8 years ago

I don't mean this sarcastically, but why? It sounds like this impacts users that willingly signed up for this service. Why would you VPN/forward mail through Europe to be locked out of services that you signed up for?

dijit• 8 years ago

Because a company being unable to comply with GDPR is a red flag for how they treat user data. GDPR is written in such a way that you as a company are given freedom to use data if its for business reasons. But you need you need to keep track of it.

Enhanced data protections are a good reason to (by default) be a European.

neotrope2• 8 years ago

If you’re believed to be a EU resident, you’re granted associated user protections.

For example, if an EU resident browsing Facebook enjoys a higher level of privacy, it’s not hard to see the value.

ddtaylor4• 8 years ago

Apparently keeping a fake postal address and using a VPN is easier than simply not voluntarily giving out information.

Toboe• 8 years ago

I could think of two reasons:

Using EU-lockout as a red flag for the GDPR non-compliant. So if they try to use something and get a "nope, not for EU" their thought would be "must have overlooked how that offer is scam-y, better not use"

and

Getting extra rights from the GDPR compliant.

drivingmenuts2• 8 years ago

VPN everything through Europe

And then all your digital transactions become fair game for the NSA, so there's that.

johnnyfaehell• 8 years ago

Just now it’s fair game to gchq who just give NSA access.

StudentStuff• 8 years ago

As if the NSA doesn't work around the minor impediments they have to being able to spy domestically already: https://en.wikipedia.org/wiki/Tempora

If your not allowed to spy domestically, just permit foriegn agencies that are your lap dogs to do it for you, and assist them in doing so!

neotrope2• 8 years ago

Do you believe your current digital transactions are more inaccessible?

mirimir2• 8 years ago

The NSA looks at everything. As a military agency, they do not consider themselves subject to civilian law. If for no other reason, because the US is always at war. But really, because they can.

pm24601• 8 years ago

Seems like a good test for any new service. See if they deny access to Europeans, if they do - stay away from the service.

mvid• 8 years ago

I'm curious to know how they enforce the limit on EU users

Hamuko9• 8 years ago

Whatever they are thinking of, I can guarantee that it doesn't work.

bastawhiz2• 8 years ago

Almost certainly geoip lookup.

usr1106• 8 years ago

I don't think they have to enforce that very strictly. If the user incorrectly answers "No" to being a resident of EU, I doubt the company could be sued for violating the rights of "dishonest" EU users.

As a matter of fact I wonder how a company without physical presence in the EU could ever be fined for any violations. And even if they can be fined on paper, I doubt many non-EU countries will cooperate collecting the fines.

nukeop4• 8 years ago

This is fantastic news, if a company can't behave responsibly with user data, it deserves to go bankrupt. It's like a restaurant saying it can't comply with health regulations. Absolutely unacceptable. If the business model is to exploit and sell personal information, then the world is better off without that company.

ocdtrekkie3• 8 years ago

The only thing I am sad about with this news: Unroll.me is still able to function in the United States.

tomcooks• 8 years ago

I don't understand the downvotes you're getting

tobyhinloopen• 8 years ago

jahvo• 8 years ago

I couldn't have said it better myself.

Barrin923• 8 years ago

Put on your best unsurprised face: Unroll.me, a company that has, for years, used the premise of ‘free’ but not very useful ’email management’ services to gain access to people’s email inboxes in order to data-mine the contents for competitive intelligence — and controversially flog the gleaned commercial insights to the likes of Uber — is to stop serving users in Europe ahead of a new data protection enforcement regime incoming under GDPR, which applies from May 25. [...]
"We may share personal information we collect with our parent company, other affiliated companies, and trusted business partners. We also will share personal information with service providers that perform services on our behalf. Our non-affiliated business partners and service providers are not authorized by us to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements".

If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen.

apexalpha4• 8 years ago

Exactly! On their website you have to go to 'FAQ' on the bottom of the page and then to the bottom of that to find:

When you sign up for Unroll.Me, Unroll.Me uses your data to provide you email management services, and for other purposes described in Unroll.Me’s Privacy Policy and Terms of Service. Unroll.Me is a part of Slice Technologies, whose market research organization Slice Intelligence provides the world’s leading brands, retailers, and marketers e-commerce insights to help them better understand market and consumer trends. In accordance with Unroll.Me’s Privacy Policy and Terms of Service, Unroll.Me shares information from your commercial and transactional emails with Slice. Slice’s technology automatically extracts purchase information from these emails and uses that information to build anonymized market research products for its clients. Slice’s market research products do not include your personal information.

I think it is safe to say that 99% of the users using unroll.me have no idea how much data they are handing over.

If your business model is incompatible with GDPR then your business model in not compatible with how we want (our data) to be treated.

Companies complaining about GDPR goes into the same category as companies complaining about minimum wage for me.

gonehome2• 8 years ago

I think you're probably right - the nice thing about Unroll.Me though is that it works really well and the people that need to use it are probably in a bad situation with their data anyway.

I ended up using it to clean up my mom's email inbox because she was subscribed to nearly a thousand marketing emails and it was the only service I found that could actually fix that without at least a day's worth of manual effort.

s17n2• 8 years ago

Companies complaining about GDPR goes into the same category as companies complaining about minimum wage for me.

It's more like complaining about any other compliance cost. Consultancies are making probably billions of dollars off of the General Electrics of the world preparing them for gdpr compliance. Then you've got the legal fees. And in the end it feels like you have just burned all that money, because in most cases, regulation doesn't actually accomplish anything. But hopefully it is all worth it for the cases where it actually improves people's lives.

sp527• 8 years ago

When they say “anonymized”, they still mean tailored targeting right (probably by hashing)? Not statistical aggregates?

downandout28• 8 years ago

If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen.

This is the sort of business that GDPR makes unprofitable and unworkable - but unfortunately it's not the only sort. Normal, everyday services - sites that you might use and enjoy - will also have to close to EU traffic simply to avoid the liability.

At my company, we do nothing nefarious with user data. We have a combined total of a few million visitors per month across a handful of sites. After consultation with experts, we had to make the decision to either spend high six/low seven figures to hopefully comply and buy special liability insurance that would help pay any fines (this law is subject to unique interpretations in 28 distinct countries, so nobody can actually know what "full" compliance is), or simply block EU traffic. We chose the latter, and many thousands of other sites that have no intention of doing anything nefarious with your data will as well.

Barrin923• 8 years ago

I do understand that it might also hit legitimate business models that many users enjoy and that it can be stressful for businesses who deal with userdata in best interests, but on the other hand there really is no way to overhaul important regulation like this without any kind of friction.

The laws need to be broad enough to apply to everyone and have the intended effect, which means that especially in the early stages with a lack of clarity and guidelines it's goig to be a little messy.

But I look at it like I'd look at a 20th century environmental regulation. Yes, it might impact genuinely good businesses, but at some point you have to do it if you want to advance user interests. I don't really see a better point than now.

dvfjsdhgfv6• 8 years ago

After consultation with experts, we had to make the decision to either spend high six/low seven figures to hopefully comply and buy insurance

Change your experts. If you really aren't doing anything nefarious with the data as you say, the adjustments are relatively easy to understand, and very often also to implement. In fact, many subregulations of the GDPR were already implemented in many companies in Europe, so what's happening it's shocking much more to American companies, not so much the European ones.

lucb1e6• 8 years ago

I've heard this sentiment being expressed by at least one person in all of these threads, but you're one of the first that actually mentions having consulted with a lawyer. The thing I keep asking is: what is new? I have yet to hear anything non-trivial which a company suddenly has to do, which wasn't required by any EU country before.

The only new thing seems to be higher fines and aligning laws in all EU countries, rather than having different implementations of roughly the same thing. But if you don't comply with GDPR, odds are that you should never have been able to do business with a lot of European countries. To the best of my knowledge, you should have geoblocked the Netherlands long ago (the only country I know the laws well enough of, to say that there is truly only a small difference between the 2002 WBP and the new GDPR) if you have to close to the EU for GDPR.

switch007• 8 years ago

...will also have to close to EU traffic simply to avoid the liability.

Hopefully not permanently. Maybe over time the law will be clarified.

I can definitely see EU customers more or less funding GDPR compliance in the long term, though (see EU intervening in roaming charges - https://www.theguardian.com/money/2018/apr/30/three-mobile-r...).

glogla3• 8 years ago

At my company, we do nothing nefarious with user data.

Then why do you need millions of dollars to make it reasonable and transparent?

This is no different to environmental regulation or something like this. Yes, making you stop pour acid into river will make your business more difficult. No, it does not matter.

You say "we don't do bad stuff to environment but complying with 'stop pouring acid into rivers' legislation will cost us spend high six/low seven figures"? That kind of seems like you're not exactly telling us the truth, doesn't it?

Thinking about this, we should probably compile a list of companies that do this, so we can name and shame them.

throwaway413• 8 years ago

You don’t explicitly state what you DO do with your users’ data, and that makes me skeptical that your use case is non-controversial.

jotm5• 8 years ago

Clearly, you don't make much profit off EU citizens, so good decision.

tzahola3• 8 years ago

we do nothing nefarious with user data

If that was true then you would already be GDPR-compliant, by definition.

einarfd2• 8 years ago

I wonder what kind of lawyer your company consulted with. Are you sure they are experience with EU law? If they where American lawyers with no international law experience. Asking them would probably be as helpful as asking a Common Lisp expert about help with your Java application, if you are lucky it might work out, but probably not. In the same way not all programing languages are the same, nor is all law the same.

YeGoblynQueenne5• 8 years ago

> (this law is subject to unique interpretations in 28 distinct countries, so nobody can actually know what "full" compliance is)

As has been discussed before, the GDPR is an EU regulation and as such does not require national governments to pass any enabling legislation and is directly binding and applicable, therefore it is is not subject to "unique interpretation" of any kind. In fact, that was the whole point of making it a regulation, rather than a directive (like the previous Data Protection Directive).

Furthermore, the regulation establishes a European Data Protection Board, tasked with ensuring the consistent application of the GDPR. Articles 55 to 63 of the regulation are devoted to cooperation and consistency, with procedures for multiple Data Protection Authoritiess to coordinate investigations and promote consistent decisions and policies reviewed by the Board and reported to the European Commission.

Now, can we please stop it with the entirely unsubstantiated statements about how everyone will interpret the GDPR as they please?

DINKDINK2• 8 years ago

If that's going to be the sort of business that the GDPR makes unprofitable and unworkable then I'm very proud to be a European citizen.

You would you be equally proud if we sprayed weed-killer chemicals everywhere to wipe out dangerous plants ("If Water Hemlock is the type of plant that RoundUp kills, then I'm very proud to be a Monsanto stock owner") while killing scores of non-harmful plants? Your scope is narrowly framed and misses the big picture.

matthewmacleod2• 8 years ago

What’s the big picture? What business models are being rendered non viable by GDPR that we should support?

akerro• 8 years ago

Good, this way we can filter shitty services that don't care about my data but only care about using me as a product when I'm not looking.

ddtaylor4• 8 years ago

I'm sure there are still many services operating as "complying" that do in fact only care about the data they can extract from you, eg. Facebook.

lol7683• 8 years ago

Hadn't heard of unroll.me prior to this, but it looks like nothing of value was lost. GDPR doing its job and it hasn't even come into (en)force(ment) yet!

Do they do anything that a quick grep for "Unsubscribe" can't? I guess the digests are somewhat niche

Hamuko9• 8 years ago

Sorry, but GDPR came into force in 2016.

apexalpha4• 8 years ago

That's when they passed the bill I think, but as the article says:

[...] is to stop serving users in Europe ahead of a new data protection enforcement regime incoming under GDPR, which applies from May 25.

xkcd-sucks• 8 years ago

They were previously "famous" for selling people's Lyft receipts to Uber

https://theintercept.com/2017/04/24/stop-using-unroll-me-rig...

toyg• 8 years ago

Score one for GDPR. Between this and the umpteen services forced to purge my address unless I "resubscribe" (when of course I never subscribed in the first place), it has already achieved concrete results. If only the EU could also fix the mess with cookies and VAT, we could say we're finally entering an era of decent lawmaking over the digital space.

jMyles4• 8 years ago

So, everyone seems to be celebrating the blow stricken against this seemingly unscrupulous company. Fair enough.

But doesn't anybody else think this has at least some worrying optics of censorship?

Are we going to end up with another great firewall around Europe? And are you sure that only companies which enjoy a consensus as evil will be clawing the outside?

Won't the internet interpret this as damage and route around it?

matthewmacleod2• 8 years ago

But doesn't anybody thinks this has at least some worrying optics of censorship?

No. No more than I think being able to sell fake medicine is a censorship.

jMyles4• 8 years ago

I just don't have a great deal of confidence in my own ability to tell the difference between an arbiter who is making good judgments about which medicines are real and someone who is censoring a competitor by adjudicating their medicine as "fake."

In fact, I think I have better instincts about detecting fake medicine than I do about detecting the fake arbiter.

stordoff5• 8 years ago

Complying with the law that prevents certain business practices and using user data for your own ends isn't censorship, just as not being able to sell water labelled as vodka isn't censorship.

jMyles4• 8 years ago

If the result is that no vodka is available, hasn't vodka been effectively censored just the same?

M2Ys4U6• 8 years ago

But doesn't anybody else think this has at least some worrying optics of censorship?

No.

blatherard• 8 years ago

I’m no GDPR expert, but wouldn’t it apply to data of European citizens even if they’re not the customer? Since unroll.me slurps up email, don’t they still have to comply with all the rules for data because presumably some of that email data originates from the EU?

andypanik• 8 years ago

I am not an expert myself. But how should the EU enforce anything against a company that doesn't do business with EU citizens? They can't restrict any market access and they have no jurisdiction outside the EU.

crispyporkbites• 8 years ago

No, because they’re pulling out of the EU market there is no judiciary oversight from the EU of their business, so the rules simply don’t apply.

JeanMarcS• 8 years ago

So they don’t think privacy matters?

apexalpha4• 8 years ago

Selling your privacy / data is 100% of their business. The service they provide is 'free' as in a 'free toolbar' that then steals data off your system.

dvfjsdhgfv6• 8 years ago

That's great! I hope more companies like these follow their footsteps.

Grue3• 8 years ago

I hope so too. Countries that try to regulate Internet don't deserve Internet. I wish more websites had the balls to not give in to every ridiculous law passed around the globe (e.g. Github removing perfectly normal files because Roskomnadzor asked them too [1]).

[1] https://en.wikipedia.org/wiki/Censorship_of_GitHub#Russia

nukeop4• 8 years ago

This is a basic protection that should have been passed a long time ago, don't try to frame it as "censorship", it was created to give you control over your own personal information.

mirimir2• 8 years ago

I suspect this strategy will fail. I'm currently using a VPN with an exit in Germany. But through some sort of geolocation glitch, it's being identified as UAE. So unroll.me doesn't display the warning for EU residents.

Given the chaos around IPv4 assignments, I doubt that only VPN services are affected.

kowdermeister• 8 years ago

Unroll.me's ToS was one of the first I checked in detail and it shocked me how invasive it is. I noped the f* out before I granted access to all my mail.

hidiegomariani• 8 years ago

It won't be missed

mplewis• 8 years ago

I'm waiting to see what happens in the class action (COOPER v. SLICE TECHNOLOGIES, INC., https://www.leagle.com/decision/infdco20170920f18).

"UnrollMe does not adequately disclose its true business model to users. Instead, UnrollMe disguises itself as an email-management service to mislead users to sign up for the service so that it (and Slice) can access their data."

michaelgiba• 8 years ago

Judging from the other comments I guess I’m in the vast minority, but I think the fine structure is really bad for small businesses. I’m not a GDPR fan.

DanBC4• 8 years ago

I think you're making the mistake of thinking the fines mentioned are the minimum fines, when they're the maximum possible fines for the worst repeat deliberate violations.

EU regulators tend not to apply fines for companies making simple mistakes. They do want the companies to come back into compliance.

y_molodtsov3• 8 years ago

For SMBs that probably is really bad. Just the fact that a small website you’ve just heard about requires a lot of your data would be negative for their customer acquisition, while other people would continue trust major companies.

birksherty• 8 years ago

If small businesses don't have manpower or money to handle user's information transparently, they should not collect those information in the first place. That's why I like GDPR.

dawhizkid• 8 years ago

I feel like we’re living in the golden age of free personal financial apps - shocking to me how much we care when it comes to protecting our likes but so careless we are to giving third parties logins to our online banking and all balance and transactional data that comes with it

kelnos5• 8 years ago

If there's one good thing that's coming out of stories like this, it's that I (as a non-EU citizen) can avoid companies like this that clearly don't care enough about being good stewards of my personal data.

gerdesj14• 8 years ago

Yes, GDPR really is a force for good.

It is also a bit of a bugger to prepare for (I own a small UK based IT business) but it is a good thing in my opinion.

There are ~0.5 billion EU citizens and GDP is roughly 22% of the world. So it has some clout. The EU as a whole has decided that people's data is important and have come up with some rules about the same. Bear in mind the EU is a very diverse place and getting 28 states to agree on something is akin to cat herding.

I am still in shock about it. I am also very happy about it but it is only a start. Getting FB and Co into line will take a lot longer as will the world getting a decently diversified and mutually compatible, healthy social presence environment working.

elahd• 8 years ago

I prodded unroll.me a couple of years ago about their data retention policy. Their answer was sketchy so I ended up not using the service. Unroll.me users irreversibly hand over all of their emails to an unknown entity -- it's crazy to subscribe.

Original thread: https://twitter.com/elahd/status/575692415132135425

DMs: http://imgur.com/H0UABYa

fiatjaf• 8 years ago

That's amazing. I hope more and more companies will forbid the entrance of european users. If at the moment you put your feet on my company you're already making unreasonable demands the most decent thing to do is to put you out and refuse to serve you.

I hope GDPR defenders will understand that if more and more companies adopt this strategy.

Unroll.me to close to EU users saying it can’t comply with GDPR

Related Stories