Automatically opting-in customers to a more restrictive TOS is pretty suspect, especially given the timing. IANAL, but I'm pretty sure that a court would not allow that, given that the TOS was changed AFTER the breach and it's pretty clear that the company is trying to avoid legal issues after-the-fact.
I would expect the court would evaluate any breach under the TOS that was in effect at the time of the breach, rather than under a new (and arguably suspect one) that was put in place after it, arguably in an attempt to "rewrite history".
They ought to be evaluated as if no TOS exists. Given the clear intent to defraud customers by misrepresenting the contract they were bound by, the claims should be evaluated under the TOS most favorable to the plaintiffs. The most favorable TOS is the one that's invalid because 23andMe didn't get anyone to actually agree, ergo the claims are evaluated as if no TOS exists.
This is an attempt to undermine consumer protection laws, and the government should treat it as a direct attack. Other companies are watching. The government needs to send a clear message that this won't be tolerated before it spreads, becomes the status quo, and leaves many consumers believing that they don't have any rights or protections.
The head of legal should also be disbarred under American Bar Association rule 1.2(d):
> (d) A lawyer shall not counsel a client to engage, or assist a client, in conduct that the lawyer knows is criminal or fraudulent, but a lawyer may discuss the legal consequences of any proposed course of conduct with a client and may counsel or assist a client to make a good faith effort to determine the validity, scope, meaning or application of the law.
This reads as clear contract fraud in the factum [1]. Customers are told that they're bound by new contract terms, despite that 23andMe never got agreement, nor tried to get agreement, nor even know whether customers have read the new contract. I can't fathom any other reasonable interpretation of the situation. They created a fraudulent contract hoping to confuse other entrants to prior versions of the contract, and intend to benefit from that confusion. It seems clear to me. They are attempting to undermine the legal system, and the ABA needs to deal out swift punishment as one of the protectors of that system.
They probably know that it doesn't hold water legally. The hope is to victim blame as much as possible so that fewer people sue them in the first place. The next step will be to "remind" people about the TOS that they totally agreed to.
I don't know where you have been the last few years, but I am pretty sure things like that happen all the time, based on the emails I received regarding ToS updates. And I have never heard any company got into trouble in court. Maybe public opinion, but that's it.
Cornell's law school has a pretty good guide to these "adhesion contracts" such as web TOS.[0] This alteration strikes me (IANAL) as running the risk of being unconscionable. If the contract change is unconscionable, then the new terms mandating binding arbitration are void.
Again, IANAL. Just my opinion as a citizen, not legal advice. Seek competent legal advice before taking legal action.
Have they ever implied this would apply to accrued causes of action though?
Would like a laywer to correct me if wrong, but these terms would only apply to any future events, not to the hacks that happened under the previous terms, for which they've already accrued the right to sue in a court (or whatever those terms said) regarding that hack, and 23andMe hasn't really implied otherwise just by updating its terms?
If they wanted that, they'd have to have explicitly included language like "by continuing to use our services after this notice, you covenant not to sue in court for any prior causes of action" or the like?
Yep. Having defended contracts that legally the company could novate the circumstances that lead to the notation had to be either outside of our control with a third party changing our underlying costs or the first and second parties failing to agree a new contract and a standard contract that was already defined being put in place. This was later deemed unfair and the standard contract was made much cheaper. Ha!
My point being that in Australia my vibe is that this will be looked upon in a very negative light by courts and any regulators.
I would like to think they will be nailed to the wall, but the current is that they will get a pittance fine, at best, before accepting their well earned bonuses.
To duck out of the new ToS, just write this email to legal@23andme.com--
To Whom It May Concern:
My name is [name], and my 23andMe account is under the email [email]. I am writing to declare that I do not agree to the new terms of service at https://www.23andme.com/legal/terms-of-service/.
I am logging to my 23andme account to confirm my info and name registered there.
I forgot my password and did a password reset. They have password requirement of 12 characters minimum. A bunch of security theater just to get hacked anyways
I don't give Facebook permission to use my pictures, my information or my publications, both of the past and the future, mine or those where I show up. By this statement, I give my notice to Facebook it is strictly forbidden to disclose, copy, distribute, give, sell my information, photos or take any other action against me on the basis of this profile and/or its contents. The content of this profile is private and confidential information. The violation of privacy can be punished by law (UCC 1-308-1 1 308-103 and the Rome statute). Note: Facebook is now a public entity. All members must post a note like this. If you prefer, you can copy and paste this version. If you do not publish a statement at least once, you have given the tacit agreement allowing the use of your photos, as well as the information contained in the updates of the state of the profile. Do not share. You have to copy.
I would have presumed that security-minded people, which includes those who work in tech, would not so easily give away their genome, and that most of 23andMe's customers are a slice of the general population. But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas and I'm befuddled. Why would anyone willingly do that?
I'm familiar with security (I keep a copy of Applied Cryptography on my shelf for "fun reading") and tech, here's a copy of my whole genome:
https://my.pgp-hms.org/profile/hu80855C
Note it's a full human genome, far more data than a 23&Me report. You can download the data yourself and try to find risk factors (at the time, the genetic counsellors were surprised to find that I had no credible genetic risk factors).
Please let me know in technical terms, combined with rational argument, why what I did was unwise. Presume I already know all the common arguments, evaluated them using my background knowledge (which includes a PhD in biology, extensive experience in human genome analysis, and years of launching products in tech).
I've been asking people to come up with coherent arguments for genome secrecy (given the technical knowledge we have of privacy, both in tech and medicine) and nobody has managed to come up with anything that I hadn't heard before, typically variations on "well, gattaca, and maybe something else we can't predict, or insurance, or something something".
I am a security engineer. When I signed up for 23andme, I assumed with certainty that it would be hacked and all data leaked at some point. I balanced that with the value of knowing potentially important health/genetic bio markers.
In the end, I valued knowing these bio markers above the privacy of my genome. The former is actionable and I can use it to optimize my health and longevity; the latter is of vague value and not terribly exploitable outside of edge-case threat models.
>But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas and I'm befuddled.
I'm befuddled that anyone thinks Sam Altman is the least bit trustworthy after WorldCoin.
The same people believed crypto-currency, infinite growth, social media and many other things. At least 23andMe provided actual value, to some at least.
What I find strange is that 23andMe did not automatically delete data after 30 days, or at the very least took it offline, only to be available on request. Notify people that their results are available and inform them that the data will be available for 30 days after the first download. This is potentially really sensitive data and based on 23andMe's response, they seem to be aware of that fact. So why would they keep the data around? That seem fairly irresponsible and potentially dangerous to the company.
I was 24 in 2015 and not in tech or as security minded as I am now when I received the test as a Christmas present. Obviously now I wouldn’t have dared do it, but it’s too late. Lacked the foresight at the time.
> But then I read about things like WorldCoin and that people who go to startup parties jump at the chance to give away scans of their retinas
Well, in the case of WorldCoin, I think there's still some pretty significant questions of why they made Africa a prominent launch market (well, there are some reasons), but in some places they repeatedly increased incentives until they were offering people there up to a month's income to give their scans. That might not be a lot of money to a big startup, but is telling that they had to offer that much to get some people to "opt" in.
What's the implication here, that tech people should know better? I just don't care a ton about my privacy. At least that makes me not a hypocrite for working at a company that profits from user data (like many tech ones do).
I know someone who is very security-minded, but also he was born to parents misplaced due to a war and they didn't know where they come from (their adoptive parents would only know a region, but not for sure). At the time it was an easy option to learn something about his heritage to him. His curiosity was satisfied.
In case anyone is interested I've been compiling as much factual information on arbitration here. Not yet complete but reasonably useful and well sourced
I'm not a lawyer but I doubt that this will matter in the court because the time of actions matter; or in another words at the time when user registered they agreed to TOS A and later when 23andMe changed their TOS A to TOS B they achieved nothing because you can't unregister users and register them again and force them to agree to the new TOS B. I mean they can ask you to agree to new TOS but you don't have to because TOS is not a law, it is a voluntary legal agreement between a company and a customer. Retroactively enforcing something is not possible not even for the governments e.g. if I pay my corporate tax of let's say 20% in 2023 to the government, government can't say like 5 years later: you know what corporate tax is now 30%, compensate for all the differences in the past.
You got it wrong. They can throw a big TOS in front of you next time you login. Most users will just accept.
Additionally they sent an email out saying that you have 30 days yo tell them you want to "opt out" otherwise by default they assume you accept the new TOS agreement.
"In October, the San Francisco-based genetic testing company headed by Anne Wojcicki announced that hackers had accessed sensitive user information including photos, full names, geographical location, information related to ancestry trees, and even names of related family members."
For those who do not know, her sister is a longtime Google marketing person since 1999, who worked on AdWords, AdSense, DoubleClick, GoogleAnalytics and the money-losing data collection and advertising subsidiary YouTube.
It seems personal data collection for profit runs in the family.
I have tried to quickly diff the previous TOS with the new one and I wasn't able to identify any big changes. I would like to know what the actual changes are. I see a lot of articles criticizing the new TOS, but no one is showing the actual wording differences.
insertion into the middle of Limitation of Liability "WITHIN THE LIMITS ALLOWED BY APPLICABLE LAWS, YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT 23ANDME SHALL NOT BE LIABLE FOR ANY DAMAGES"
Lots of changes to the Dispute Resolution, and new content re: Mass Arbitration.
However, the previous ToS still had binding arbitration clauses, and stuff about class actions.
I interviewed for a security position there a few years ago, but they cut the role before the interview process was over. Kind of feels like they didn't prioritize security - you reap what you sow.
Forcing customers to use arbitration hasn't always been in the companies interest - if only a fraction of the 7M effected customers started the arbitration process it could cost a lot more than a class action suit.
Didn't Uber drivers get a large payment from them in this way?
Trying or arbitrating a large number of cases individually is far more expensive than litigating a class action suit. But only if the people pushing the arbitration hold firm, rather than agreeing to the initial settlement offering.
"reports revealing that attackers accessed personal information of nearly 7 million people — half of the company’s user base — in an October hack."
Breaking into a system should never provide access to 7 million people. The database should be divided up into multiple "cells" each with its own separate access restrictions.
It's the same idea that spy networks use to prevent one compromised spy from bringing down the whole system. Or you can think of it like watertight compartments in a battleship.
What if you want to run a query to compare your DNA to everyone else’s to see if you have any relatives that are registered already? Wouldn’t that need access to the entire database and essentially be a point of weakness?
Exactly.this behavior is why I never gonna send my DNA to any of these services. Certainly not US. I hope than EU will have some regulations for this soon.
Gladly I never used any of these services, not just knowing my ancestors origins will add zero value to my life, but also I don’t trust any cloud services to store my passwords or notes, let alone a biometric I will never be able to change, alive or not.
The slightly annoying thing with this data, though, is that even if you don't provide your data your privacy can be violated via any relatives' data that did decide to use the service.
Which companies offer similar services sans all the bullshit and privacy issues? I'm not interested in finding long lost relatives and even less interested in having my data sold or shared with LEO.
An alternative take is that they changed their terms of service so that if/when this happens again they'd have more control over the fallout. I think they're totally expecting to get railed for the last one and are preparing for it, but this doesn't mean they can't prepare for the future as well. I imagine other providers will also revise their TOS.
I honestly don't understand how "If you don't opt out within 30 days you'll be bound to the new TOS" works.
I have heard of two big "trends" of how people think about legal contracts:
[1] What is written there and what both parties agreed to is the truth.
[2] A contract is supposed to be a "meeting of the minds". If it's proven that one party was being deceitful, then the contract (or that part) doesn't hold.
If we go by [1], then the company can change the TOS by sending me a notice with "if you don't opt out, then you're bound by these terms"... but so should I. I should be able to send a letter to 23&me saying "if you don't disagree these are the new terms: if my information is ever hacked, you owe me 10M dollars in damages"
If we go by [2], then sending a notice like that is absolutely invalid. They have no way of proving that I read that notice within 30 days, so there was never a "meeting of the minds".
The theory is that you start the contract with the terms specifying that changes put forward by the company (but not the user) are automatically accepted with 30 days' notice. That's where the meeting of the minds occurs: in theory, from that point on, you've agreed that the terms can change.
However, I'm not sure if that's ever been tested in court as a valid theory, and regardless it certainly shouldn't be legal (any more than noncompetes).
I think there was a general pattern of people striking back against mass forced arbitration by saying "ok, that's fine, we'll all go to arbitration at once". And companies ended up having to foot the bill for hundreds or thousands of arbitration cases...
Newer arbitration clauses that I've seen now cover this scenario. Something like "If many identical cases come forward at the same time, you agree to combine your cases in a single arbitration action"
I'm a lawyer. Some of the assertions here are a bit extreme, as is the headline, imo. The company can add a class waiver to its terms when it wants to. Whether it's enforceable against people who have a claim predating the terms update will be an interesting legal issue to debate. But let's not call them the devil.
One interesting thing about this story though is that it appears that 23andMe is outright refusing to make a comment to anyone. Every single site that has covered the story and bothered to email them have added a, "23andMe has declined to comment" disclaimer.
Yes, from the perspective of any user/consumer of the service. But since they are facing litigation, any lawyer will tell you that keeping your mouth shut until the action is adjudicated is THE best course of action, regardless of what some politicians and corporations may do these days.
The only other thing that they could say would be "We do not comment on matters involving pending litigation." But that's just a longer way of saying "No comment." It's not any more satisfying for the customers or partners understandably seeking answers to what happened, how, and why.
23andMe would like to point out that hackers already have access to 99.9% of your DNA right now. That means they are at most only 0.1% at fault for anything else.
This should be a reminder to DELETE YOUR 23&ME ACCOUNT and destroy the samples asap. God knows who this horrible company will sell all that info to next.
Worth noting that 23andMe, plus many other low cost genealogy/health-focused companies do not sequence your DNA.
Instead, they perform what is called a genotyping microarray test, which looks at less than 0.1% of your genome.
To quote from 23andMe:
"In order to be genotyped, the amplified DNA is “cut” into smaller pieces, which are then applied to our DNA chip (also known as a microarray), a small glass slide with millions of microscopic “beads” on its surface. Each bead is attached to a “probe," a bit of DNA that matches one of the genetic variants that we test. The cut pieces of your DNA stick to the matching DNA probes. A fluorescent label on each probe identifies which version of that genetic variant your DNA corresponds to."
Changes to the consumer law in Norway tries to account for digital services that a product you bought had at the time of purchase and that no longer work. Also where a lack of an update has caused something to not work an expected.
The actual ramifications of this are yet to be seen, since the changes come into effect from next year. It will be interesting if this means that apps need to be updated to support new iOS and android versions, or if phones will need to get security updates, or if cloud services must be available, or if a feature can be removed from an app or not.
Exporting raw genetic data is conveniently "temporarily unavailable" at the time time this bullshit is happening, which is something I'm almost certain discovery would prove is an intentional choice by them.
I'm getting to a point where I automatically assume any business is both taking my money and trying to totally fuck other parts of my life behind my back to make more money.
If capitalism is so great why is it so incompatible with being a good and honest person?
> If capitalism is so great why is it so incompatible with being a good and honest person?
Capitalism was never about that. It was about having acting in their own self-interest as to maximize economic efficiency. That model works great when you are selling commodities and physical products.
Capitalism in the era of personal information as currency is a entirely different beast that needs to be reworked.
Meh not really binding in the EU, as its not done in good faith and it disadvantage consumers. I see no reason to write them and tell them you don't agree, if you are a EU citizen.
As someone living in the EU, these kind of things puzzle me a lot.
How can a legal system exist, where it's possible to deny a (consumer) contract party access to the legal system and law of the land?
(In the EU we do have arbitrations clauses, but they are only legal between businesses and tightly regulated. Arbitration "courts" must be neutral. And you can not put them into ToS.)
Also, I was under the impression that all sane legal systems on this planet are based on the broad principle of "pacta sunt servanda" = "agreements must be kept". One party of a contract never can change the contract without consent from the other party.
We do have the concept of "silent approval" for consumers over here, too, but that only applies to minor changes to terms that are not a "surprising" change to the consumer. It recently was ruled that for example Netflix increasing prices without active consent is not legal in the EU. There is not much that is not regarded as "surprising" by courts here. "You are not allowed to sue us after having lost your personal data, then lying about it" clearly would be regarded as surprising.
Im summary: Every aspect of that whole 23andMe story would be impossible in the EU. The amount of data they collected, the way they stored it, the way they tried to hide the breach, and them trying to prevent their customers to get access to the law.
I wonder how on earth the US legal system could deteriorate so much that such a story becomes possible.
[Disclaimer: I am not bragging about living in the EU. I did not have any influence on my place of birth. I do not wish to imply that the EU is "superior" to the US. I am just trying to give an outside perspective.]
> I wonder how on earth the US legal system could deteriorate so much that such a story becomes possible.
My impression is that everything in the USA has become lawyerized. Politicians are all lawyers. If you have assets of more than a mill, you have a legal team. You can't move for lawyers. I'm watching stories about a man facing 90 charges, who is still running for president (and has a good chance of winning). All of his co-accused are lawyers.
Youd think that, with so many lawyers around, it should be really quick to get justice. But it's the opposite; apparently, the more lawyers are involved, the longer justice is delayed.
I don't feel bad for anyone who sent their dna to a private capitalistic company. It was always obvious this was gonna happen. Especially when these companies paid so much to politicians like Bernie Sanders to appear on their ads to seem "benign".
Some comments were deferred for faster rendering.
kelthan|2 years ago
I would expect the court would evaluate any breach under the TOS that was in effect at the time of the breach, rather than under a new (and arguably suspect one) that was put in place after it, arguably in an attempt to "rewrite history".
everforward|2 years ago
This is an attempt to undermine consumer protection laws, and the government should treat it as a direct attack. Other companies are watching. The government needs to send a clear message that this won't be tolerated before it spreads, becomes the status quo, and leaves many consumers believing that they don't have any rights or protections.
The head of legal should also be disbarred under American Bar Association rule 1.2(d):
> (d) A lawyer shall not counsel a client to engage, or assist a client, in conduct that the lawyer knows is criminal or fraudulent, but a lawyer may discuss the legal consequences of any proposed course of conduct with a client and may counsel or assist a client to make a good faith effort to determine the validity, scope, meaning or application of the law.
This reads as clear contract fraud in the factum [1]. Customers are told that they're bound by new contract terms, despite that 23andMe never got agreement, nor tried to get agreement, nor even know whether customers have read the new contract. I can't fathom any other reasonable interpretation of the situation. They created a fraudulent contract hoping to confuse other entrants to prior versions of the contract, and intend to benefit from that confusion. It seems clear to me. They are attempting to undermine the legal system, and the ABA needs to deal out swift punishment as one of the protectors of that system.
1: https://en.wikipedia.org/wiki/Fraud_in_the_factum
throwaway092323|2 years ago
thereddaikon|2 years ago
d3w4s9|2 years ago
I don't know where you have been the last few years, but I am pretty sure things like that happen all the time, based on the emails I received regarding ToS updates. And I have never heard any company got into trouble in court. Maybe public opinion, but that's it.
smcl|2 years ago
dannyw|2 years ago
Of course, if people don’t accept the new terms, they are still bound by the one ones. But if you don’t opt out…
lozenge|2 years ago
You and a lot of the people who replied to you seem to be confusing what is unjust with what is illegal. You can't use one to deduce the other.
baryphonic|2 years ago
Again, IANAL. Just my opinion as a citizen, not legal advice. Seek competent legal advice before taking legal action.
[0] https://www.law.cornell.edu/wex/adhesion_contract_(contract_...
jalapenos|2 years ago
Would like a laywer to correct me if wrong, but these terms would only apply to any future events, not to the hacks that happened under the previous terms, for which they've already accrued the right to sue in a court (or whatever those terms said) regarding that hack, and 23andMe hasn't really implied otherwise just by updating its terms?
If they wanted that, they'd have to have explicitly included language like "by continuing to use our services after this notice, you covenant not to sue in court for any prior causes of action" or the like?
Affric|2 years ago
My point being that in Australia my vibe is that this will be looked upon in a very negative light by courts and any regulators.
gentleman11|2 years ago
pbhjpbhj|2 years ago
wackycat|2 years ago
amelius|2 years ago
sonicanatidae|2 years ago
I hate this timeline.
verve|2 years ago
To Whom It May Concern:
My name is [name], and my 23andMe account is under the email [email]. I am writing to declare that I do not agree to the new terms of service at https://www.23andme.com/legal/terms-of-service/.
apwell23|2 years ago
WTF. This is outrageous. And I had find that email in my spam after I read this comment. Hope this POS company goes down in flames after this.
nofinator|2 years ago
Some companies require that. Here is PayPal's process for example: https://www.paypal.com/us/legalhub/useragreement-full#table-...
ballenf|2 years ago
bunnyfoofoo|2 years ago
willcipriano|2 years ago
DNA driven targeted advertising that finds only the most docile consumers.
alephnan|2 years ago
I forgot my password and did a password reset. They have password requirement of 12 characters minimum. A bunch of security theater just to get hacked anyways
lynndotpy|2 years ago
stevehawk|2 years ago
jhardy54|2 years ago
d2049|2 years ago
dekhn|2 years ago
Please let me know in technical terms, combined with rational argument, why what I did was unwise. Presume I already know all the common arguments, evaluated them using my background knowledge (which includes a PhD in biology, extensive experience in human genome analysis, and years of launching products in tech).
I've been asking people to come up with coherent arguments for genome secrecy (given the technical knowledge we have of privacy, both in tech and medicine) and nobody has managed to come up with anything that I hadn't heard before, typically variations on "well, gattaca, and maybe something else we can't predict, or insurance, or something something".
xvector|2 years ago
In the end, I valued knowing these bio markers above the privacy of my genome. The former is actionable and I can use it to optimize my health and longevity; the latter is of vague value and not terribly exploitable outside of edge-case threat models.
p_j_w|2 years ago
I'm befuddled that anyone thinks Sam Altman is the least bit trustworthy after WorldCoin.
mrweasel|2 years ago
What I find strange is that 23andMe did not automatically delete data after 30 days, or at the very least took it offline, only to be available on request. Notify people that their results are available and inform them that the data will be available for 30 days after the first download. This is potentially really sensitive data and based on 23andMe's response, they seem to be aware of that fact. So why would they keep the data around? That seem fairly irresponsible and potentially dangerous to the company.
latentcall|2 years ago
PH95VuimJjqBqy|2 years ago
That doesn't stop my family from doing so, but I sure as hell will never.
FireBeyond|2 years ago
Well, in the case of WorldCoin, I think there's still some pretty significant questions of why they made Africa a prominent launch market (well, there are some reasons), but in some places they repeatedly increased incentives until they were offering people there up to a month's income to give their scans. That might not be a lot of money to a big startup, but is telling that they had to offer that much to get some people to "opt" in.
Dma54rhs|2 years ago
unknown|2 years ago
[deleted]
unknown|2 years ago
[deleted]
hot_gril|2 years ago
rand1239|2 years ago
Maybe they accept the possibility that they die one day?
akira2501|2 years ago
Is this actually happening, or is that just what the stories say?
switchbak|2 years ago
basch|2 years ago
varispeed|2 years ago
93po|2 years ago
eadler|2 years ago
https://grimreaper.github.io/arbitration/docs/problems/
ashtronaut|2 years ago
adocomplete|2 years ago
Take security seriously people. Especially when dealing with super sensitive data.
brianwawok|2 years ago
tuwtuwtuwtuw|2 years ago
micromacrofoot|2 years ago
snapcaster|2 years ago
[deleted]
mrkramer|2 years ago
onlyrealcuzzo|2 years ago
Aren't they forcing you to agree to the new TOS to continue using the product?
corethree|2 years ago
Additionally they sent an email out saying that you have 30 days yo tell them you want to "opt out" otherwise by default they assume you accept the new TOS agreement.
happytiger|2 years ago
skyfaller|2 years ago
1vuio0pswjnm7|2 years ago
For those who do not know, her sister is a longtime Google marketing person since 1999, who worked on AdWords, AdSense, DoubleClick, GoogleAnalytics and the money-losing data collection and advertising subsidiary YouTube.
It seems personal data collection for profit runs in the family.
clwg|2 years ago
emddudley|2 years ago
Does anyone have an actual diff?
e28eta|2 years ago
https://www.23andme.com/legal/terms-of-service/full-version/...
https://www.23andme.com/legal/terms-of-service/full-version/
two things jump out at me, as a layman:
insertion into the middle of Limitation of Liability "WITHIN THE LIMITS ALLOWED BY APPLICABLE LAWS, YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT 23ANDME SHALL NOT BE LIABLE FOR ANY DAMAGES"
Lots of changes to the Dispute Resolution, and new content re: Mass Arbitration. However, the previous ToS still had binding arbitration clauses, and stuff about class actions.
slingnow|2 years ago
pizzalife|2 years ago
hmottestad|2 years ago
helsinkiandrew|2 years ago
Didn't Uber drivers get a large payment from them in this way?
https://www.reuters.com/legal/litigation/uber-loses-appeal-b...
kelthan|2 years ago
zlg_codes|2 years ago
WalterBright|2 years ago
Breaking into a system should never provide access to 7 million people. The database should be divided up into multiple "cells" each with its own separate access restrictions.
It's the same idea that spy networks use to prevent one compromised spy from bringing down the whole system. Or you can think of it like watertight compartments in a battleship.
hmottestad|2 years ago
hsuduebc2|2 years ago
tamimio|2 years ago
TheBlight|2 years ago
tjpnz|2 years ago
xlbuttplug2|2 years ago
aeurielesn|2 years ago
scottLobster|2 years ago
bulbosaur123|2 years ago
Didn't use ancestry feature, but from what I understood my data has been leaked as well.
TheCaptain4815|2 years ago
dekhn|2 years ago
someotherperson|2 years ago
jbombadil|2 years ago
I have heard of two big "trends" of how people think about legal contracts:
[1] What is written there and what both parties agreed to is the truth.
[2] A contract is supposed to be a "meeting of the minds". If it's proven that one party was being deceitful, then the contract (or that part) doesn't hold.
If we go by [1], then the company can change the TOS by sending me a notice with "if you don't opt out, then you're bound by these terms"... but so should I. I should be able to send a letter to 23&me saying "if you don't disagree these are the new terms: if my information is ever hacked, you owe me 10M dollars in damages"
If we go by [2], then sending a notice like that is absolutely invalid. They have no way of proving that I read that notice within 30 days, so there was never a "meeting of the minds".
lolinder|2 years ago
However, I'm not sure if that's ever been tested in court as a valid theory, and regardless it certainly shouldn't be legal (any more than noncompetes).
deegles|2 years ago
master_crab|2 years ago
kryptiskt|2 years ago
It would be really funny if 23andMe got dragged to the arbitrator a million times.
nielsbot|2 years ago
Newer arbitration clauses that I've seen now cover this scenario. Something like "If many identical cases come forward at the same time, you agree to combine your cases in a single arbitration action"
Looks like CR wrote about it:
https://www.consumerreports.org/money/contracts-arbitration/...
gavinhoward|2 years ago
I hope that I would have cause to go after them if they leaked DNA from a relative, and that DNA was used to cause harm to me.
b800h|2 years ago
johndhi|2 years ago
josefritz|2 years ago
FredPret|2 years ago
TaylorAlexander|2 years ago
skilled|2 years ago
23andMe updates their TOS to force binding arbitration (https://news.ycombinator.com/item?id=38551890) - (372 points | 6 days ago | 243 comments)
One interesting thing about this story though is that it appears that 23andMe is outright refusing to make a comment to anyone. Every single site that has covered the story and bothered to email them have added a, "23andMe has declined to comment" disclaimer.
Pretty scummy.
kelthan|2 years ago
The only other thing that they could say would be "We do not comment on matters involving pending litigation." But that's just a longer way of saying "No comment." It's not any more satisfying for the customers or partners understandably seeking answers to what happened, how, and why.
JohannesH|2 years ago
jakedata|2 years ago
DesiLurker|2 years ago
henry2023|2 years ago
benchtobedside|2 years ago
Instead, they perform what is called a genotyping microarray test, which looks at less than 0.1% of your genome.
To quote from 23andMe: "In order to be genotyped, the amplified DNA is “cut” into smaller pieces, which are then applied to our DNA chip (also known as a microarray), a small glass slide with millions of microscopic “beads” on its surface. Each bead is attached to a “probe," a bit of DNA that matches one of the genetic variants that we test. The cut pieces of your DNA stick to the matching DNA probes. A fluorescent label on each probe identifies which version of that genetic variant your DNA corresponds to."
Source: https://customercare.23andme.com/hc/en-us/articles/227968028...
gkanai|2 years ago
Did 23andme not expect themselves to be hacked?
stainablesteel|2 years ago
why can't i be locked into what i chose to purchase?
hmottestad|2 years ago
The actual ramifications of this are yet to be seen, since the changes come into effect from next year. It will be interesting if this means that apps need to be updated to support new iOS and android versions, or if phones will need to get security updates, or if cloud services must be available, or if a feature can be removed from an app or not.
pkilgore|2 years ago
leemailll|2 years ago
theGnuMe|2 years ago
deathanatos|2 years ago
It's HIPAA.
IANAL: And unless 23andMe meets the HIPAA definition of a "covered entity", which I'm not sure they do, they're not going to be covered by HIPAA.
SpaceManNabs|2 years ago
zlg_codes|2 years ago
If capitalism is so great why is it so incompatible with being a good and honest person?
alephnan|2 years ago
Capitalism was never about that. It was about having acting in their own self-interest as to maximize economic efficiency. That model works great when you are selling commodities and physical products.
Capitalism in the era of personal information as currency is a entirely different beast that needs to be reworked.
1vuio0pswjnm7|2 years ago
Imnimo|2 years ago
lowbloodsugar|2 years ago
robg|2 years ago
stuaxo|2 years ago
tokai|2 years ago
jnsaff2|2 years ago
Fischgericht|2 years ago
How can a legal system exist, where it's possible to deny a (consumer) contract party access to the legal system and law of the land?
(In the EU we do have arbitrations clauses, but they are only legal between businesses and tightly regulated. Arbitration "courts" must be neutral. And you can not put them into ToS.)
Also, I was under the impression that all sane legal systems on this planet are based on the broad principle of "pacta sunt servanda" = "agreements must be kept". One party of a contract never can change the contract without consent from the other party.
We do have the concept of "silent approval" for consumers over here, too, but that only applies to minor changes to terms that are not a "surprising" change to the consumer. It recently was ruled that for example Netflix increasing prices without active consent is not legal in the EU. There is not much that is not regarded as "surprising" by courts here. "You are not allowed to sue us after having lost your personal data, then lying about it" clearly would be regarded as surprising.
Im summary: Every aspect of that whole 23andMe story would be impossible in the EU. The amount of data they collected, the way they stored it, the way they tried to hide the breach, and them trying to prevent their customers to get access to the law.
I wonder how on earth the US legal system could deteriorate so much that such a story becomes possible.
[Disclaimer: I am not bragging about living in the EU. I did not have any influence on my place of birth. I do not wish to imply that the EU is "superior" to the US. I am just trying to give an outside perspective.]
denton-scratch|2 years ago
My impression is that everything in the USA has become lawyerized. Politicians are all lawyers. If you have assets of more than a mill, you have a legal team. You can't move for lawyers. I'm watching stories about a man facing 90 charges, who is still running for president (and has a good chance of winning). All of his co-accused are lawyers.
Youd think that, with so many lawyers around, it should be really quick to get justice. But it's the opposite; apparently, the more lawyers are involved, the longer justice is delayed.
pyuser583|2 years ago
I doubt this will work. But there’s “no harm in trying.”
unknown|2 years ago
[deleted]
newsnotfound|2 years ago
[deleted]
khana|2 years ago
[deleted]
wly_cdgr|2 years ago
[deleted]
dev1ycan|2 years ago
nazgulsenpai|2 years ago
JohannesH|2 years ago
RIMR|2 years ago