Updates and Annotations

Because of the fast-moving nature of the tech industry and new developments happening all the time with the Big Tech firms, I am presenting on this page various updates and annotations to Containing Big Tech. This supplementary material will also include links to relevant blog posts I wrote plus any corrections that may arise. I am sorting these updates and annotations by Chapter and then by page number, with a date stamp for each update. I would humbly suggest that after you read a chapter you consult this page for the latest and greatest updates and annotations. I hope this page adds to the value and insight that my book provides!

Page 12 — as of June 2023, an additional 5 states passed privacy laws in 2023, bringing the total number of states with privacy laws to 10. Oregon’s privacy law passed the state legislature at the end of June and is expected to be signed by the Governor in July, and would make Oregon the 11th state to have a comprehensive privacy law. At the end of June 2023, Delaware also passed a privacy bill that will also be signed by their Governor in July so that will make 12 states having signed privacy laws by the end of July 2023. The tech industry seemed to overplay its hand when Montana passed its privacy law in May 2023, but have been successful in heavily influencing and “watering down” privacy bills in Iowa, Indiana, and Tennessee. At the federal level, as of June 2023, there is no comprehensive federal privacy bill that has been proposed as of yet in the current Congressional session (e.g., no successor as of yet to the 2022 American Data Privacy and Protection Act aka ADPPA). [July 10, 2023]

Page 17 — Correction #1: It should say that in 2000 (not 2020), Google made $19 million in revenue. Doh! Big thanks to reader Bob D. with Softec for flagging. As Bob notes, in 2020 that $19 million would be a rounding error for Google. [July 13, 2022]

Page 22 — Meta released a Twitter competitor called Threads in July 2023 that leverages its Instagram platform. Over 100 million users signed up for the service in the first five days of availability. But critics immediately called the new app a “privacy nightmare.” Per TechCrunch

Information provided about the app’s privacy via mandatory disclosures required on iOS shows the app may collect highly sensitive information about users in order to profile their digital activity — including health and financial data, precise location, browsing history, contacts, search history, and other sensitive information. … Given that Meta, the developer behind the app, the company formerly known as Facebook, makes its money from tracking and profiling web users to sell their attention via its behavioral advertising microtargeting tools this is hardly surprising. 

Knowing ahead of time of the various regulatory actions against it in the EU over GDPR privacy violations (e.g., the Irish Data Protection Commission fining Meta $400 million in January 2023 as documented on page 177), Meta as of mid-July had not released Threads in Europe. Meta may also be delaying Threads’ release in Europe given the Digital Services Act’s imminent enforcement that bans online behavioral advertising that targets children as well as bans the use of sensitive personal data such as religious beliefs, sexual orientation, and ethnicity in behavioral advertising. Meta itself partly blamed the lack of rollout in Europe on another law, the Digital Markets Act (DMA). Per The Verge the “DMA prevents companies as big as Meta from reusing a user’s personal data — including their name and location — across its products for targeted advertising without user consent.” See page 33 for more information on the EU’s GDPR, DSA, and DMA. [July 12, 2023]

Page 27 — Silicon Republic reported that Microsoft told investors in June 2023 that it expected the Irish Data Protection Commission (DPC) would fine Microsoft $425 million “for alleged GDPR violations through targeted ad practices by LinkedIn.” Microsoft said it would dispute the fine. This is another data point of the significance of targeted (aka behavioral) advertising to Microsoft. [July 11, 2023]

Page 30 — Public concern and employee pressure led Google to announce in early July 2022 that it would delete location data when users visit abortion clinics. As part of my research for the book, I found that as of August 2022 that was not the case, as I document on page 30 in the book. In November 2022, I was contacted by Johana Bhuiyan, a reporter with The Guardian, who eventually published an article entitled “Googling abortion? Your details aren’t as private as you think.” She published research findings from myself and Accountable Tech, and had some quotes from me in her article. Her conclusion was

new research has shown the way our location and other personal data is stored remains largely unchanged, raising fears that intimate details of a person’s abortion search could be used to penalize them.

Then in May of 2023, Geoffrey Fowler in the Washington Post was able to reproduce my and Accountable Tech’s similar findings and wrote an article entitled “Google promised to delete sensitive data. It logged my abortion clinic visit.” So even after Johana’s article came to light, a reporter was still able to reproduce our findings six months after Johana’s article was published. Unsurprisingly, Geoffrey commented that Google’s “response to me shows it isn’t taking accountability.” The article triggered 10 US Senators to send a letter to the CEO of Google in May 2023. I detailed Geoffrey’s and Johana’s article in this blog post entitled “Google Still Collecting and Retaining Abortion-Related Searches.” The blog post has some screenshots of my research on this issue.

This retention of data is a concern because some states have enacted laws (e.g., Idaho) or considering passing laws that restrict out-of-state travel for some abortion seekers. For example, this data stored by Google can be subpoenaed if a resident of Idaho assists a minor in getting an abortion in Washington (e.g., searching for abortion-related keywords and getting directions to the clinic on Google Maps while in Idaho). Another illustration of this is that Mississippi Attorney General Lynn Fitch told the Biden administration in a June 16 letter that “Mississippi authorities need access to information about residents who obtain abortions or gender-affirming care in other states.” [July 17, 2023]

Page 31 — The Markup is on a roll in 2023, finding additional examples of Meta Pixel hoovering up sensitive personal information. For example, on June 30, 2023, it published a report that “twelve of the largest drug stores in the U.S. sent shoppers’ sensitive health information to Facebook.” Shopping cart items sent to Meta included Plan B, prenatal vitamins, HIV test, and pregnancy test, along with cookies and IP addresses that could be used to identify an individual. This is not just a problem with Meta but was also found with Bing, Twitter, Snapchat, and Pinterest, as well as Google and Nextdoor. Meta "did not respond to questions about whether it considered any of the information KFF Health News and The Markup found retailers sending to be “sensitive information.” The Markup had separately found that many suicide hotline websites tied to the national mental health crisis hotline “transmitted information on visitors through the Meta Pixel.”

Furthermore, based on The Markup’s findings that tax preparers were sending sensitive taxpayer data to Meta, a congressional report was released in July 2023 that confirmed that tax prep companies shared private taxpayer data not only with Meta but Google as well. Based on the report, seven members of Congress wrote the Justice Department “urging criminal charges against the tax companies for violating laws that prevent tax preparers from sharing their clients’ personal information.” I cover The Markup’s findings in a blog post on the Meta Pixel and how it continues to hoover up our sensitive data. [July 12, 2023]

Page 43 — during the writing of the book I wrote a lengthy section on the different types of data brokers, but in the end I left that section on the cutting room floor. I re-purposed that material in a blog post entitled “A Look at the Different Types of Data Brokers.” It has actually become one of my more popular blog posts. [July 1, 2023]

Page 48 — The Massachusetts legislature is considering as of July 2023 a bill that would ban the sale of residents’ mobile location data. Furthermore, the Massachusetts Location Shield Act would also require a search warrant for law enforcement to access user location data and also block law enforcement from purchasing location data from data brokers. [July 12, 2023]

Page 49 — on the topic of “segmenting,” researchers in 2023 found a spreadsheet on ad platform Xandr’s website that, per The Markup, “revealed a massive collection of “audience segments” used to target consumers based on highly specific, sometimes intimate information and inferences.”  Their analysis of this database of 650,000 audience segments showed that

The trove of data indicates that advertisers could also target people based on sensitive information like being “heavy purchasers” of pregnancy test kits, having an interest in brain tumors, being prone to depression, visiting places of worship, or feeling “easily deflated” or that they “get a raw deal out of life.” Many of the Xandr ad categories are more prosaic, classifying people as “Affluent Millennials,” for example, or as “Dunkin Donuts Visitors.”

Note Xandr is owned by Microsoft, thus further proof of what I said on page 27 that Microsoft is fully in the business of collecting personal and behavioral data on hundreds of millions of consumers. The Markup further noted that “exposure of a collection of audience segments this size offers consumers an unusual look at how they and their families are packaged, described, and categorized by ad companies.” As noted by privacy researcher Wolfie Christl: “I think it’s the largest piece of evidence I’ve ever seen that provides information about what I call today’s ‘distributed surveillance economy’.” [July 8, 2023]

Page 50 — I wrote a blog post that discusses all the common threads that connect the threats associated with data brokers. [July 9, 2023]

Page 54 — The Wall Street Journal reported in May 2023 that an antiabortion group based in Wisconsin used cellphone data to target ads to Planned Parenthood visitors. [July 8, 2023]

Page 55 — An internal Office of the Director of National Intelligence report released on June 9, 2023, revealed that numerous US Federal government agencies have been purchasing “vast amounts” of U.S. citizens’ personal information from data brokers. As noted by Wired

the report states that the government believes it can “persistently” track the phones of “millions of Americans” without a warrant, so long as it pays for the information. Were the government to simply demand access to a device's location instead, it would be considered a Fourth Amendment “search” and would require a judge's sign-off. But because companies are willing to sell the information—not only to the US government but to other companies as well—the government considers it “publicly available” and therefore asserts that it “can purchase it.”

The report also noted it was trivial “to deanonymize and identify individuals” from data collected by data brokers by combining data sources together or tracking location data to people’s “bed downs.” Finally, the report noted that this data in the wrong hands could be used to “facilitate blackmail, stalking, harassment, and public shaming.” [July 6, 2023]

Page 56 — as I documented in this blog post, Texas became the third state to pass a data broker registry law in June 2023. I advised the group behind this bill (Texas Appleseed). Oregon’s legislature passed a data broker registry bill that was signed into law in late July 2023, making Oregon the 4th state with a data broker registry law. [September 2, 2023]

Page 57 — The California Delete Act aka California Senate Bill 362, which I proposed and co-drafted, was signed into law by Governor Newsom on October 10, 2023. I am interviewed in this article on its significance. [October 30, 2023]

Page 58 — the Fourth Amendment is Not for Sale Act was reintroduced in the 2023 legislative session and in mid-July passed its first test by passing through the House Judiciary Committee. This bill would prevent government agencies from buying phone location data and other sensitive data from data brokers and thus circumventing the need to get a warrant. [July 20, 2023]

Page 58 — Senators Ossoff and Cassidy re-introduced the DELETE Act in June 2023. This blog post goes into more detail on the data broker registry provisions in the DELETE Act and ADPPA.[July 8, 2023]

Page 59 — Wired reported on July 5, 2023, that an amendment to the National Defense Authorization Act (NDAA) would “forbid government entities from buying Americans’ search histories, location data, and more.” As further noted by Wired:

Introduction of the amendment follows a report declassified by the Office of the Director of National Intelligence—the nation’s top spy—which last month revealed that intelligence and law enforcement agencies have been buying up data on Americans that the government’s own experts described as “the same type” of information the US Supreme Court in 2018 sought to shield against warrantless searches and seizures.

We should know by the end of 2023 whether this amendment makes its way through the legislative sausage-making process, but would go a long way in addressing the “legal loophole” that allows government agencies to circumvent the Fourth Amendment and track people without court oversight. [July 6, 2023]

Page 65 —The lawsuit filed by the District of Columbia against Mark Zuckerberg and Meta was dismissed on June 1, 2023. The New York Times reported that the DC Attorney General “had accused the company of deceiving consumers by improperly sharing their data with third parties, including the British political consulting firm Cambridge Analytica.” It also noted that this represented  “a rare victory for Meta, which owns Facebook and Instagram, as it battles lawsuits filed by the federal government, states, foreign regulators and consumers in privacy, antitrust and consumer protection disputes.” [July 9, 2023]

Page 70 — The New York Times reported in May 2023 that employees of TikTok regularly posted end-user information on an internal messaging and collaboration tool called Lark, including driver’s licenses, addresses, and photos. The Times further noted

The profusion of user data on Lark alarmed some TikTok employees, especially since ByteDance workers in China and elsewhere could easily see the material, according to internal reports and four current and former employees.

TikTok did not respond to questions if the data was stored in China. [July 13, 2023]

Page 71 — Amazon paid $5.8 million to the Federal Trade Commission (FTC) over accusations that it let employees and contractors of its Ring doorbell unit spy on consumers. [June 29, 2023]

Page 78 — different regulators and organizations define AI differently. The latest definition of AI in the EU AI Act is this:

a machine-based system that is designed to operate with varying levels of autonomy and that can, for explicit or implicit objectives, generate outputs such as predictions, recommendations, or decisions that influence physical or virtual environments.

The California Privacy Protection Agency as part of its rule-making process for the California Privacy Rights Act does not use the term “AI” but instead uses “automated decision-making” and has proposed this definition of automated decision-making as of July 2023:

“Automated Decision-making Technology” (“ADMT”) means any system, software, or process—including one derived from machine learning, statistics, or other data processing or artificial intelligence techniques—that processes personal information and uses computation as whole or part of a system to make or execute a decision or facilitate human decision-making. ADMT includes profiling.

A catalog of other organizations’ definitions of AI can be found in this blog post from Holistic AI (disclosure: I am an angel investor in Holistic AI). [July 8, 2023]

Page 86 — a section in the book on AI Ethics and Trustworthy AI ended up on the cutting room floor, but I reproduced this content in a blog post entitled “An Overview of AI Ethics and Trustworthy AI.” [July 1, 2023]

Page 86 — Nina Jankowicz, the former head of the Department of Homeland Security’s Disinformation Governance Board, gives a first-person account of being the subject of deepfake pornography and a widespread online harassment campaign. In other words, deepfake pornography being generated by AI is real. [July 7, 2023]

Page 87 — The Federal Trade Commission (FTC) as of 2023 is going after firms that utilize dark patterns. Per the New York Times, Publishers Clearing House paid $18.5 million in June 2023 in a “dark patterns” lawsuit filed by the FTC. The company had been accused of using dark patterns to “trick customers into paying for products or giving up their data.”[July 6, 2023]

Page 88 — for brevity purposes, I cut back the original detailed write-up of the EU AI Act, but posted that content as a blog post entitled “A Look at AI Legislation in Europe.” In June 2023, the EU AI Act passed through the European Parliament with a large majority and will require another vote in the coming months. Per this write-up, the EU AI Act takes “a risk-based approach to regulation, systems are classed as posing minimal, limited, high or an unacceptable level of risk, with obligations proportionate to the system’s classification.” [July 8, 2023]

Page 88 — The European Union in April 2023 identified 19 tech platforms that must report algorithmic risks under this Digital Services Act (DSA). These 19 tech platforms are considered “very large online platforms” and will have more far-reach regulations under the DSA than other tech products. All 5 Big Tech firms had platforms in this “very large” designation. Per TechCrunch, these 19 platforms must “be proactive about analyzing and reporting potential issues related to the operation of technologies like content ranking tools and recommender systems.” They will also be scrutinized for vulnerabilities with respect to having illegal goods on their platforms. [July 16, 2023]

Page 89 — a comprehensive AI bill was proposed in California in the 2023 legislative season, but was killed in the legislative process due to strong objections from the tech industry. Per this analysis of Assembly Bill 331, if passed it would have required

companies developing “consequential” AI products (related to employment, education, housing, and the like) to conduct impact assessments; provide notice and opt-out rights to California residents; and implement a governance program that contains reasonable administrative and technical safeguards to address the reasonably foreseeable risks for algorithmic discrimination potentially associated with the AI tool. 

The bill is likely to resurface in some form in the 2024 California legislative season. [July 17, 2023]

Page 89 — I provide more details on the Algorithmic Accountability Act (AAA) of 2022 and state AI proposals in the blog post “A Look at AI Legislation in the United States.” This blog post has a good overview of how state privacy laws are applicable to AI as of mid-2023. [July 8, 2023]

Page 91 — I like this quote in a Tweet about AI accountability:  "If generative AI is as powerful and transformative as its proponents say, then it should be held to at least the same standards of honesty and transparency as a pack of gum." [June 29, 2023]

Page 111 — Similar to the experiment that the Wall Street Journal did for TikTok in 2021 that pushed kids’ accounts to “endless spools of adult content,” researchers in 2023 found that Google’s YouTube algorithm sent gun videos to kids as young as 9. [July 9, 2023]

Page 113 — The US Surgeon General Dr. Vivik Murthy released an advisory report in May 2023 that warned that social media may harm children. The advisory called on tech companies to "enforce minimum age limits and to create default settings for children with high safety and privacy standards" and further recommended that the government "create age-appropriate health and safety standards for technology platforms." [July 3, 2023]

Page 114 — Echoing the Washington Post report that there is widespread spying in kids' apps, Common Sense Media published a report in June 2023 that found after analyzing the privacy practices of over 200 apps, “nearly three-quarters (73%) are still monetizing kids’ and families’ personal information in some way, such as tracking behavior and sharing that data with advertisers.” [July 2, 2023]

Page 120 — a great profile of Baroness Beeban Kidron and how she and her 5Rights Foundation are shaping US tech laws for kids was published in Politico in June 2023. The Baroness was also kind enough to provide a supporting quote that appears on the back cover of my book which I am very grateful for. [July 9, 2023]

Page 120 — A two-year investigation by The Guardian “suggests that the tech giant Meta is struggling to prevent criminals from using its platforms to buy and sell children for sex.” [July 6, 2023]

Page 121 — A Wall Street Journal report published in June 2023 documented how “Instagram connects and promotes accounts that are openly dedicated to the purchasing and selling of child sexual abuse materials.“ It further noted that Meta’s “systems for fostering communities have guided users to child-sex content” and that Meta “says it is improving internal controls.” The Washington Post further reported

A Meta spokesperson acknowledged to the Wall Street Journal that the company had received reports of child sexual abuse material (CSAM)  on Instagram “and failed to act on them,” according to the Journal report. The company also said it actively seeks to remove such accounts and that the platform in January disabled 490,000 accounts that violated its child safety policies. 

Note that Meta paused the development of an Instagram for kids mobile app in 2021 given the pushback from policymakers and child welfare advocates. [July 10, 2023]

Page 123 — Per Agency France-Presse, France approved a new law in June 2023 that requires “social media platforms like TikTok to verify users' ages and obtain parental consent for those under 15 years in an effort to protect children online.” [July 1, 2023]

Page 124 — Utah in March 2023 became the first state to "pass a law prohibiting social media services from allowing users under 18 to have accounts without the explicit consent of a parent or guardian." Louisiana and Arkansas have subsequently joined Utah in passing comparable legislation. [July 5, 2023]

Page 124 — attempts to pass Age-Appropriate Design Code (AADC) bills in Maryland and Minnesota failed in 2023 in those two states. Unsurprisingly, the push to pass AADC in other states besides California “has faced broad opposition from tech trade groups representing some of the United States’ biggest digital platforms, who have blitzed statehouses around the country in an effort to stymie the bills.” As The Tech Oversight Project noted:

Tech groups including NetChoice, CCIA and the Chamber of Progress have fired off letters warning about the potentially catastrophic impact of the bills on user privacy and free speech online, deployed lobbyists to meet with key state officials and sent their leaders to testify in opposition to the efforts in Maryland, Minnesota and Nevada, among other states — part of a widespread campaign to neutralize the budding regulatory push.

I mention NetChoice on page 124 and Chamber of Progress on page 163 of the book. [July 8, 2023]

Page 125 — The FTC fined Microsoft $20 million in June 2023 for violations of the Children’s Online Privacy Protection Act (COPPA) because Microsoft allegedly collected personal information from children who signed up for Microsoft's Xbox gaming system without notifying their parents or obtaining their parents’ consent. Microsoft was also accused of illegally retaining children’s personal information. In May 2023 it was announced that Amazon agreed to pay $25 million after the FTC found that it had retained sensitive data, including voice recordings of children, for years. [June 29, 2023]

Page 126 — The Kids Online Safety Act (KOSA) was reintroduced in May 2023 by Senators Blackburn and Blumenthal. The Protecting Kids on Social Media Act was introduced in April 2023 by a partisan group of US Senators that would "establish a national minimum age for social media use and require tech companies to get parents’ consent before creating accounts for teens." Other proposed federal legislation in 2023 includes the Making Age Verification Technology Uniform, Robust, and Effective (MATURE) Act, and the Social Media Child Protection Act. Per this analysis, all these proposals would "restrict children on social media and require platforms to verify the ages of all users." [July 5, 2023]