Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Google collects face data now – what it means and how to opt out (cnet.com)
278 points by lelf on Sept 12, 2019 | hide | past | favorite | 150 comments


No mention of Illinois, which is the state with the only biometric privacy law with teeth.

>The Biometric Information Privacy Act (BIPA) was passed by the Illinois General Assembly on October 3, 2008. Codified as 740 ILCS/14 and Public Act 095-994, the BIPA guards against the unlawful collection and storing of biometric information.[1] When Illinois passed the law in 2008, it became the first state to regulate the collection of biometric information.[2] Washington and Texas have since passed similar laws.[3] However, the BIPA remains the only law that allows private individuals to file a lawsuit for damages stemming from a violation

https://en.wikipedia.org/wiki/Biometric_Information_Privacy_...

Edit: my conspiracy theory is that the tech industry's lobbyists are pushing for legislation on privacy at the federal level because they know such a law would be more watered down than what states would pass.

And almost certainly much weaker than IL's current laws in protecting privacy in this regard.


Google won against Illinois in a recent case: https://www.courthousenews.com/judge-oks-google-facial-recog...


> "But a ruling issued by U.S. District Judge Edmond Chang on Saturday found that the law cannot be used to protect users from the non-consensual collection of information about what many consider to be private"

If the law can't be used to protect us what measures remain available? Storming Google's data centers by force? The legal system is supposed to be the acceptable option so mobs and violence aren't all we have. Eliminate legal recourse and what's left?


This is "the law" as in "this specific law" not "the legal system".


> If the law can't be used to protect us what measures remain available?

"Google" is not an entity -- it's composed of people, who make decisions and enable the things that Google does.

Don't hire them. Don't associate with them.

They're working for a company that, at this point, is obviously doing harm to the world. That's a choice they have the freedom to make. We have the freedom not to associate with people who make that choice.

Note that this advice is specific to non-visa-limited people in high-demand occupations, like other software engineers. They have a choice.


> "Google" is not an entity

It is. It's a legal entity called a corporation

> Don't hire them. Don't associate with them.

You no longer have a choice to opt out of google invading your privacy. The websites you visit everyday are letting google track you. The websites I use for my work are tracking me via google. My employer also requires chrome for some tasks which allows google to track what I do. I've even seen government websites using google trackers. You just can't escape google on the internet. Google is so pervasive even ARIN is allowing google to track people who go to their site.

Google is quickly intruding on offline public spaces as well.

When a user-hostile company becomes impossible to escape the only option left is to regulate it to limit the damage, but Illinois made a solid effort to do just that and it made zero difference


You do have a choice. You are allowing them to track you. Use protection.


Well, you pass better laws.


How should the law have been written to resolve the problems with Article III standing?


The law apparently says that hoarding biometric data is not protected -- only abusing it for harm is. Until a harm is artiulated, no foul. The law could be changed to overturn the longstanding precedent that facial data is not private.

The simple fact is that the digital world is a new world, and we need new law. Old law simply doesn't extrapolate.


read the law: http://www.ilga.gov/legislation/publicacts/95/095-0994.htm

It's short and pretty clear. the words harm, injury, abuse etc are nowhere to be found. Google violated the law as written but the judge didn't even address that because he decided they had no right to complain in the first place.

It reminds me of the case journalists made against the US government after it came to light that they were illegally wiretapping them. The fact that the government's mass surveillance program was exposed wasn't enough for the courts who decided that because the journalists who took it to court couldn't prove that specific instances of wiretapping occurred (information they couldn't possibly have because it's secret) they had no right to sue and the fact that wiretaps were put in place without a warrant wasn't even addressed.


The constitution can also be amended. I’m not saying it would be easy, but legal recourse is not ”eliminated”, nor are mobs and violence the only alternatives left.


Strong evidence of how amazing the human condition is these days: we're talking about mobs and violence because some somebody knows what your face looks like.


The CEO of Google can keep a photo of me on his bedside table for all I care, but if the laws passed by our elected officials will be ignored any time they threaten the growing surveillance state we're living under it would certainly say a lot about the human condition these days


Heads they win tails you lose. So the IL law supposedly prevents the collection and retention of data but the judge dismissed the case because collecting and storing the data isn't enough to sue them on its own without farther proof of damages...


Apparently the IL Supreme Court issued a ruling contradictory to the District Court's Google Photos ruling, a month later: https://www.skadden.com/insights/publications/2019/01/illino...

There are legal technicalities about if the Google case is appealable on that basis, and what the result of the next similar lawsuit will be.


Whether this is opt-in/opt-out is not clear. What bothers me, though, is how Google won't delete your images used for training automatically.

https://support.google.com/googlenest/answer/9320885?hl=en

> Note: Disabling Face Match will delete your face model from your device but it will not delete the enrollment images used to create your face model. To delete Face Match enrollment images, visit myactivity.google.com.

So, the real question is, why do we have to be aware of some gotcha that's deeply embedded somewhere in some support page that majority of us won't look at? This is the case with most of Google's opt-out strategies.


This is the only basis that tech co’s have been convinced to provide ways to opt out and appear to care for your privacy. They make it difficult so the majority don’t do it. In my opinion laws should be in place to ensure stuff like this is OPT IN only. The current situation is madness.


GDPR was supposed to do that.

Sadly looking at reality it is too watered down.


It's clear that there is no way to opt out of this bullshit:

> Can I opt out of all of these as well?

> Unfortunately, not very easily. With Google Photos, you can choose not to run the facial recognition tool on your own photos, but you can't control what other people who may have uploaded photos of you decide to do.


Yup. This is equivalent to people disclosing all of my contact information without my consent, just by the virtue of being part of their network.


If I don't have a Nest or the Google Home app, can I still opt-out or is this even enabled?


https://myaccount.google.com/activitycontrols

This is a handy link to check from time to time. Note that some of these include degraded experience on Google's services, so I definitely wouldn't recommend turning them all off (or "pausing them", as Google puts it) without understanding what they actually do.


Ok, nothing there about face data. Only thing enabled is youtube history and everything works fine.


You can delete current data here [0], but I haven't seen any "opt out" anywhere.

[0] https://myactivity.google.com/page?page=match_enrollment


"Hey, Google, use every discernible iota of my personal information to build the foundation of a Chinese-style, authoritarian, digital dystopia, because I'm too lazy to learn basic, self-managed organizational skills."


Pretty much this. I think users today are extremely lazy and are unwilling to learn anything. It's to the point where they are the ones being used instead of doing the using.


"Once men turned their thinking over to machines in the hope that this would set them free. But that only permitted other men with machines to enslave them."


Only at the margins are other people with machines enslaving anyone.

I think it's mostly an emergent phenomena enslaving everyone into some cultural and behavioral paradigm that nobody intends or particularly wants.

But the costs of shutting down all these incentivizing/nudging/conditioning/addicting technologies would kill most of the tech sector (by market cap), and therefore can't be seriously entertained.


> But the costs of shutting down all these incentivizing/nudging/conditioning/addicting technologies would kill most of the tech sector (by market cap)

I couldn't care less if predatory companies collapse. None of the tech itself is inherently evil, its only being used against us instead of working for us. If google were disbanded or broken up today new companies would rise up continue to do what they do now under more responsible terms. Those companies can continue to provide cell phones and email accounts without using those things to build dossiers on the people who just want to communicate with friends and family.

Many people today think it's impossible to offer anything if you aren't abusing your users because that's all they know, but I remember when there were hundreds of free email providers long before it became technically feasible to read every last email stored on the server to spy on users.


As someone working on the problem of "how do we have a hugely popular free product that doesn't make money off user data or selling information to advertisers" - the reason why there used to be a bunch of free email programs and most people now use Google is that it's incredibly hard to scale free technology without doing it in a way that isn't creepy (or being acquired by a company that will eventually insist on creepiness). Hopefully not an impossible problem.


>new companies would rise up continue to do what they do now under more responsible terms.

I think that's a naive position to take. People are people, and human nature really is hard to fight. It's a virtual certainty that anything replacing google, will be violating your security and privacy. Especially if it's "free".


I think it'd end up like what happened when Ma Bell was broken up. Over time the companies have merged back into just a few and not everything got better, and tech evolved rapidly which complicates direct comparisons but at the same time, I've got several phones in my home and none of them have "property of AT&T" engraved into them. Some things improved.

Companies are amoral monsters who care about nothing but making money and there will always be a struggle with regulation followed by deregulation followed by more regulation as people push back against abuse, but that cycle has kept things in relative order. Companies have gotten very good at inserting themselves into government, directly and indirectly, to stand in the way and prevent the people from keeping them in line, but I don't think it's entirely hopeless yet.


> "But the costs of shutting down all these incentivizing/nudging/conditioning/addicting technologies would kill most of the tech sector (by market cap), and therefore can't be seriously entertained."

So the industry is too big to fail?


Google is doing this on purpose.


"Thou shalt not make a machine in the likeness of a man's mind."

Given that a Butlerian Jihad seems unlikely, what are our options? If we can't stop it, maybe we need to keep pace with it instead. If this is a Red Queen Race, then we need to give people the tools needed to compete.


Unfortunately the machines can easily be turned against the men that think they have control over the machines.


Who are you quoting?


Users today are users yesterday and tomorrow. People will be people. Betting against human nature comes with very, very, very long odds. Far better to organise a system by accepting human nature and working with it than against it. Safe by default, opt in, privacy protecting by default, etc, etc.

People care, they do, but the feedback loop from shiny feature to creeping authoritarianism is too long for monkey brains to grasp. What you call lazy, I call dopamine. You can't expect us naked apes to just ignore that hit. Change the game instead.

It's easy to blame it on "people". But if we put ourselves in a situation where we rely on us fallible beings swimming upstream day after day, on snowflakes feeling responsible for the avalanche, do we then really have anyone to blame but ourselves?


I have a half-baked theory... one which is not mine to bring to fruition alone, should it even be of value: the relationship between referees and players is probably the best analogy to a functional world order plausible.

The players can't have a say on the rulings, and the refs shouldn't have an opinion on the winners. In other words, you're either in the game, or out, but never both.

I imagine a world where there's a very clear delineation between people who are currently in and currently out. When you're in, you go with the flow. You follow your heart, sing, dance, try to be happy, be creative. And when you're out, that shits a no go. You remember what it was like to be emotional, you empathize, but decisions must be strictly non-impulsive.

People take turns going from one side to the other. Too long on either side and you'd lose sight, ruin the game.

It's also kind of analogous to trip-sitters.


> You remember what it was like to be emotional, you empathize, but decisions must be strictly non-impulsive.

Bruce Sterling called that group "Zen Serotonin" in his novel Schismatreix[1] about posthuman ideologies. They enforced their "strictly non-impulsive" zen-like calm with biomonitor-regulated sci-fi drugs. They advocated strongly for social order and slowing the rate of social change.

My username ("pdkl95") is based on the opposite ideology. It is another sci-fi drug from Schismatrix, used by another ideological faction to force (often destructively, as brain damage) a change in perspective; it forces someone out of the comfortably familiar paradigm that Zen Serotonin tried to maintain.

This "clear delineation" between groups will eventually happen. All species eventually fracture into separate daughter-species. Instead of finding different ecological niches, human will speciate into different ideological niches.

[1] https://en.wikipedia.org/wiki/Schismatrix#Ideologies


According to Lao Tzu:

    “The best leaders are those the people hardly know exist.
    The next best is a leader who is loved and praised.
    Next comes the one who is feared.
    The worst one is the leader that is despised.
     

    If you don't trust the people,
    they will become untrustworthy.

    The best leaders value their words, and use them sparingly.
    When she has accomplished her task,
    the people say, "Amazing:
    we did it, all by ourselves!"


So we deserve it then?


As long as 1940's Nazis are monsters and the very concept of "conspiring" is considered crazy talk, yes.

I bring these two up because: 1. Saying 1940's Nazis are monsters exemplifies a lack of empathy. They did monstrous things, no doubt, but the vast majority of the army was young men, doing a duty, during a depression, while under one of the first and strongest propaganda campaigns ever. They as people were very little different than us now. It's a prime example of how the road to hell can be paved with good intentions.

2. The way that every single time anyone implicates to even the slightest degree that maybe powerful people might be smart enough to do something subversive and tricky, people jump over each-other trying to be the first to make a tin-foil hat joke... that shit is annoying.

In conclusion, a society which managed to miss the whole "empathy" message of WW2 and actively undermines any attempt to pass blame towards the people in power is being extremely irresponsible, and the odds of things going badly are stacked against.


Wholly off-topic. The issue at hand is whether other people can do that blah blah blah with your data, if you don't operate under perfect opsec all the time to conceall all information about you.


"Apple doesn't earn revenue by selling targeted ads"

Apple earns billions yearly from their search deal with Google. Apple earns billions from sales of targeted ads.


I don't think it's crystal clear how much Google makes from targeted vs honest classic "contextual" ads, though they're certainly plowing ahead with the former.

I'm dearly hoping this targeted stuff gets enough backlash / blockage that adtech companies give up on it, or that DuckDuckGo and other more privacy-respecting companies end up winning in the end.


False.

Apple does not earn millions from the sales of targeted ads. Google does.

Apple earns millions from selling a link to Google.

They also want to provide their customers with access to the best search engine. I’m sure they’d prefer that not to come with ads, but that option is not for sale.

Claiming Apple earns the money from targeted ads is like saying Herman Miller or PG&E make money from targeted ads because they sell something to Google.

Obvious bad reasoning.


So if there wasn't ads on Google, Apple would totally still be earning billions on this deal? It's fairly obvious where the cash flows from.


The advertising is Google’s business model - not Apple’s.

Google could make its money a different way.

It’s true that if they did so they might not be a monopolist.

Who knows what the bidding for the default search spot would look like in that case, but it is their choice.


Just because you buy something from someone outside your company does not mean you're not benefiting from their business model. Companies don't operate in a vacuum.

To put an extreme example, just because Apple pays Foxconn does not mean they don't benefit from what's effectively slave labour. They're not removed from the effects of their transaction. The principal works in reverse too.


Sure - but Apple doesn’t control Google’s business model any more than I do.

I dislike Google’s business model but I use google search amongst others because they have a monopoly.

If a competitor arose that Apple’s customers were happy with, I’m sure they’d prefer to choose a different company.


Apple knows exactly where their money is coming from and is complicit. They don't care, because Google has the best user experience, and their users that do care are power users that can opt-out. As much as Apple cares about privacy, nothing matches Google in search quality.

Steve Jobs once said in an interview with Wired:

> When you're young, you look at television and think, there's a conspiracy. The networks have conspired to dumb us down. But when you get a little older, you realize that's not true. The networks are in business to give people exactly what they want.

Sadly, I think that quote applies a lot to Google as well. I think a lot of people, and at least anecdotally almost everyone I talk to, just don't/doesn't care about (or maybe understand the threat of) the collection that is happening. In the case of Google, they just want to find stuff on the internet without trying multiple times or adding additional keywords to their search.


Apple didn’t design Google’s business model.


They chose to associate themselves with it.


Google Search itself may have a high marketshare, but that doesn't stop you from using Bing or DuckDuckGo does it?


It stops Apple from putting another search engine first if they want to deliver the best results by default.

Apple’s business model is about providing the best experience to their users.


Is the difference the use of unique identifiable info?


I am suspicious of the IR/depth capabilities that will allegedly be on the new Pixel 4 for this reason. There's not a huge user demand for depth data, but there are great reasons Google might want to collect and process that data from its users.

This, along with the previous changes to make the photo capability be a short video capture that gets sent to Google, make me very suspicious about what they are doing with all of that data.

Things like the facial action coding system for microexpression analysis have been around for decades for anyone with a college library card. It's just been very difficult for software to parse from video. I can definitely see the camera changes making this a lot easier.


Can we please change the article title in a way that stops implying that Google does that without consent? You need to explicitly enable and train the feature when setting up the device.


You also explicitly enable and train FaceID on an iPhone, yet Apple does not collect or store any biometric data anywhere but on your phone.

The issue here is the collection, storage, and potential use of the data by Google. Google should allow you to opt-in to them collecting that data anywhere off-device, but for now they do not.


Why should they? Don't use it if you don't like the terms.


What sort of patterns are used when setting up the device? Does it 'encourage' enabling of this?


The good old opt out. In order for us to not hold your face we need to hold all sorts of information to identify you as the opter outer. Either way we have to know who you are.


Anyone else find it somewhat ironically humorous that a big popup promoting Alexa comes up as you scroll down the page? https://i.imgur.com/guKdbFA.png


I visited the Amazon Go store on Market St. in SF. I really enjoyed the convenience of not waiting in line.

With that said, the Richard Stallman in me still regrets giving Amazon the opportunity to capture HD video of me in meatspace that is linked to my customer profile.


My local supermarket has recently rolled out scan-and-go (is that the proper name?), where you carry a scanner around the store with you and at the checkout just return it and pay. It's funny because at peak times there is a queue of people at the self-service checkouts (which were supposed to make shopping quicker), but with this you can walk straight past them and pay. I just pick something off the shelf (and weigh loose produce), scan it, and put it straight in my bag.

I'm surprised it has taken this long to roll out, as I remember in the mid 90s one supermarket trialed it, but then they abandoned it, and twenty years later it's back.

IMO this gives most of the benefits (admittedly theft may be easier, but it's no different than regular shopping), but non of the they-are-tracking-everything-I-look-at privacy issues.


> "self-service checkouts (which were supposed to make shopping quicker),"

I don't see how that could ever have been the case. Self-service replaces skilled labor (employee cashier) with unskilled labor (customer cashier.) Why would that ever be more efficient? When you throw in matters like needing to wait for an employee every time somebody buys liquor or cough syrup, it's clear self-service is doomed to be much slower.

It seems to me, self-service is actually designed to reduce labor costs for the store.


Well when they first came out very few people used them, so it was usually quicker to go there :D Plus you can fit more self service checkouts in the same area (3x - 6x), so maybe it's not quicker for the individual but the overall rate is.


Self service checkout does not speed up the time it takes you to check out, but it can (and usually does IME) dramatically reduce the amount of time you wait in line to begin checking out.


When a store has a single full-service line staffed and four self-service lines open, the presence of those self-service lines certainly seems to improve the situation, vs a single full-service line. But what if it were instead compared to five full-service lines? The five full-service lines would doubtlessly be the fastest.


Sure, but the supermarket would have to pay to staff those other four lines, and they've decided they'd rather pay to maintain self-service machines instead.


I'd consider using those machines if they gave me a discount. But as it is, they're slower, exploit my labor, and are used to suppress the wages stores pay out to members of the community (making regional wealth extraction more efficient.) And worse than any of that, the machines are pedantic and finicky.

I see no conceivable upside. I totally get why companies are installing them; it's plain old greed. There is nothing complicated about that. But knowing that doesn't make me want to use them.


A little easier? Seems to me it would make theft a lot easier; it removes the requirement that everything you're buying has to come out of the bag and in front of a cashier.

Self-checkout still requires things to come out of your bag, so the person who's there for when a self-checkout machine inevitably needs cashier assistance can be keeping an eye on several stations at a time.

With scan-and-go, those eyes need to be moved to the shelves, which is a much larger area and won't all be in one person's line-of-sight at once (and the person can easily obscure vision of the shelf).


Also makes accidental theft much easier. I grocery shop with my kids, and I pretty regularly end up handing something weird or an unexpected bag of candy back to the checkout person.


If the store is in a community where theft is not that common you can combat it well enough using heuristics, random checks and strong punishments.


I'm surprised it has taken this long to roll out

Apple Stores have had this since 2011. I'm not sure why it's taken so long for other stores to get on board.

Maybe the delay for supermarkets is that they operate on such small margins that upgrading technology takes a long time.


That's how they lure you in. convenience. Instant gratification. Sort of like a drug. Little by little people exchange some convenience for a form of corporate bondage.


The idea behind the GDPR is that you should be able to enjoy that service without giving Amazon any exploitation rights to that footage for purposes beyond your checkout. And yes, I know, there is a wide gap between theory and practice.


> Apple... acknowledges that it shares some facial data with third-party developers.

So much for apple keeping data private.


That’s some inflammatory wording there - what Apple does is allow people to write apps that can use the front camera and a limited depth map - after asking the users permission. How else could a 3rd party app take selfies or use depth mapped filters (Snapchat anyone)?

This is completely different from what the article implies - that Apple shares FaceID enrollment data with anyone who asks.

If Apple restricted access to that hardware, the internet would flip out and cry foul. So they allow it, with a lot of limitations, and people still try to make an issue of it.. sigh....


Honest question. Why do we always need to opt out of something that we may or may not have signed up? Shouldn't these organizations be asking us to opt in? I'm beginning to think more and more that we need a data privacy bill of rights.

https://epic.org/privacy/white_house_consumer_privacy_.html Note. I don't know how i feel about EPIC so buyer beware. Yet sounds interesting.


The article title is misleading - Face Match feature isn't enabled unless you opt into it and train your face explicitly.


EPIC is much better on privacy than the EFF is, who only has sharp words for government surveillance but otherwise acts as the tech industry's lobbyist.

https://slate.com/technology/2018/04/why-arent-privacy-group...


people love to pick on EFF but forget life as we live it would be very different without them.

your critic is more a matter of focus than agenda.

EFF is more focused on protocols and crypto and software per se. while usability, end user abuse etc is not high on it's priorities.


When you buy a Fitbit, do you want to opt-in to it checking your heart rate?

Serious question.

I don't know how you draw the line between what would have to be opt-in and what would have to be opt-out.


That's a straw man.

The underlying issue is that companies are shipping products that do a bunch of extra shit that nobody expects or can predict.

The solution is for companies to be transparent and open about what their products are actually doing, and then users can decide for themselves if they want to use them or not.


False question. Checking my heart rate for me isn't my privacy issue. Sharing my heart rate is.


That would be ideal to me. Devices and services should be very clear on what personal information they are collecting and how it's being shared, and all data collection should be opt out by default.


Yes, absolutely. It's super easy with a yes/no popup when starting or when trying to use that function.


Not your parent commenter.

Yes, I want to opt-in explicitly, even for heart rate when I buy Fitbit. The default should be do not track, do not do anything without explicit permission from user. This includes even harmless features and core features of a product (like heart rate monitor for fitbit).

This wouldn't be the case if companies played nice. We are well past that now. We can't believe pretty much any company online, not to sell data, mess with their users' privacy etc.

Explicitly opting in is a minor inconvenience compared to destroying everyone's privacy.


Agreed! This is a quick checklist in the setup of the device. Worth the 30 seconds.


No, but I want to opt-in to fitbit storing, sharing, and in any way having access to my heart rate.


Yes. If a corporation wants access to my health data, they need to ask for permission.


Based on the article, it seems that this is actually an opt-in service despite the title.


For a second I thought it was about the medical software (epic). Which would have been really curious if the medical data storage was opt-in :p


Defaults matter. Fundamentally speaking, the vast majority of everyone will use whatever is the default. That's why Google pays Apple billions to be default on iPhone. That's why Google made Android and Chrome. Google isn't the top search engine because of how well it searches, it's the top search engine because it's the default search engine. A large part of why Bing has the market share is the same: It's the default on Windows devices and most people won't change it. (I mean, let's be honest, "I want to switch my search to Bing" was said by nobody ever who lives outside Redmond.)

Defaults matter. So when you want to use everyone's data, and you make it opt in, you only get a little bit of everyone's data, whereas if you make it opt out, you get most everyone's data. And unfortunately, legal regulation is the only way we can override tech companies desire to default to the best answer for them.


I swear, we need many more people and orgs creating privacy-preserving products like Reflectacles: https://www.reflectacles.com/

I'm not at all affiliated with Reflectacles, but when i first heard of them (on HN) I loved the idea! Where else beyond Reflectacles can i throw my money at in order to preserve my privacy?


I like the idea of Reflectacles but it's ironic that you can't even view the contents to their site without allowing scripts to run from companies like squarespace and adobe (typekit) which track users and share that data with others.


Well, currently you're not throwing any money at Reflectacles because they aren't expected to ship until next year.


Acknowledged...

I meant: what other projects exist like Reflectacles that i could (either now or soon) happily pay money for (in order to help preserve privacy)?? For me, privacy is no longer a "nice to have" feature, but rather, a top-most feature for products/services that i pay for.


Librem 5

Your own server (physically in your home) running your own services. Enables you to access your data from your phone/laptop/desktop while retaining control.


Yep, librem 5 - and other similar products - is exactly what we need more of.

As far as my own server, yep, I'm already running services like nextcloud, etc. My challenge is more on the hardware and other non-digital products/services.

But thanks for bringing up librem 5 - kudos!


Is it really hard to beat them when they only cover one's eyes?


What's really scary is that anyone can be collecting your info from publicly available sources. Tools like this make it really easy https://github.com/Greenwolf/social_mapper.

The age of privacy is over.


Yikes, my guess is that the linked project most likely isn’t being used for good.


"now"?

What is Google photos? Isn't half the purpose of Google photos to be food for machine learning?


It is, I have been using it because it's very convenient to find specific photos if you have a huge archive. You can type basically any object, name or name + object and you'll get the relevant photos.

I am thinking about stopping it because I'm uncomfortable with Google having all that data. I'm going to look into any local and/or open source solutions in this space.


I wanted to show a friend a picture of our cat sitting on top of our TV (which is hanging on the wall). I spent a few minutes scrolling through my photos unable to find it. Ended up searching for "TV cat" and it came up right away. Wish I had started with that.

I just don't trust myself enough to not fuck up and lose all my photos if I self hosted something that was equal. I run a small home lab and I never store anything on it I cannot afford to lose.


I do such searches on my iPhone all the time. Especially cat photos. According to the Photos app, my recent searches include "cowboys," "april 2019," "colorado," "trains," "canyons," and "cat."

The iPhone was able to complete all of those searches without sending my data to Apple. When companies like Google say they have to have a copy of your pictures, they are lying.


That's only useful if all of the photos that I want to search are already on my iPhone. I can't search from a different device, and I can't search the hundreds of GB of photos from years ago because they don't fit.

> When companies like Google say they have to have a copy of your pictures, they are lying.

Did Google actually say that? I think they just built a product with different trade-offs than Apple Photos.


If I need to search hundreds of GB of photos, I can with an iPhone, too.

The phone automatically offloads the full-resolution images to iCloud while retaining thumbnails and metadata. The photos on iCloud are encrypted so that even Apple can't see them.

Moving the goalposts doesn't change the fact that everything you want can be done on-device, with none of the privacy-destroying methods that Google has imposed on the world.


And you used to be able to find stuff on Lycos too, but the search quality between Lycos, Altavista, and Google were dramatically different.


Google Photos can tag individual pets, it does facial recognition of animals!

Blew my mind when I first saw they had added it.

You have to tag your pets (I think it'll prompt you at some point, or IIRC you can tap your pet's face) and name them, but after that it'll also create an auto-category (label? album? Whatever) for each pet.

Super cool stuff.


My favorite piece of this is how it tracks my kid across all of their ages. My kids look nothing like what they looked like as infants, and when they were infants, they looked very similar, but I can choose a kid and it shows me photos of them going back to their birth, and it doesn't confuse the kids at all.


I self host, but then back that up to Wasabi [1] every night using rclone [2].

1. https://wasabi.com/

2. https://rclone.org/


> I'm going to look into any local and/or open source solutions in this space.

Share if you find anything. The only other solutions I've found so far are:

Apple Photos - requires having Apple devices

Plex - meets neither the 'local' nor 'open source' requirement as it sends your photos to some other random cloud provider to scan

If you can find anything, or if anyone else does know, please do share!


I'm building that right now, and an looking for more beta testers. https://blog.photostructure.com/introducing-photostructure/

Your photos and videos remain on hardware that you own (or rent). It's designed to scale to millions of photos and videos on limited hardware (I run it for my family on a raspberry pi with a big external hard drive that sits next to my router). The browsing experience is fun, both on a 4k display and on my iPhone SE

The only cloud service I run is my licensing storefront, and delegate error reporting to Sentry, which you can opt out of.

Disclaimer: I'm the founder and developer.


This looks great. Do you support Live Photos? (JPG + MOV with the same name, with a still photo part and a motion video part)


Currently I import both the mp4 and jpg as separate assets, but I will absolutely fix the presentation to be autoplay-video-then-show-image, as it should be.


For those with a Synology, their Photos app has some of this search ability, but Google is much further ahead.


> Welcome to the era of living publicly and naked. Enjoy.

You could always just...not use/buy their products


Without knowing the specifics about how this product works on the engineering side, do you think the following is true:

If I, random delivery man, walk up to a Nest user's home, and his camera scans my face to compare to the data stored for facial confirmation, that this information is not used/stored by the recognition software?

The system is always on/scanning. It's using my face somehow, and I'm not using or buying their product, I'm just a person going about my day.


Hey, now. Everyone knows that in a liberty-focused society -- especially one in which we finally get rid of all burdensome regulation which would keep the free enterprise system from ushering in a market-guided utopia -- you are perfectly free to tell anyone whose house you're going to that you will not go anywhere that has a doorbell camera.

Or to a business with a security camera.

And as for the delivery man angle... sure, that may seem like compulsion, but for one thing, the delivery man can always quit his job (especially in an optimally functioning market which will of course increase labor opportunities and will definitely not reduce wages for labor to its marginal production costs), plus eventually they'll have to quit because we're going to automate delivery anyway.


you are perfectly free to tell anyone whose house you're going to that you will not go anywhere that has a doorbell camera.

Doorbell cameras give perfectly adequate views of many places other than people's porches.

If Google wants to put a data-collecting robot on the street with a big sign reading "We're scanning your face to sell to advertisers!" there's nothing I can do about it, but at least it's honest.

Google using Nest cameras to scan the activities of people just walking down a nearby street is not cool.


I believe OP was being sarcastic. We're all on team "FOH Nest" in this thread so far.


Confirmed. I was hoping phrases like "market-guided utopia" would give it away, but I do realize Poe's law can make it hard.


That, and I was trying to read while on a train, so my attention wasn't fully on the task at hand.


How about if someone does not use or buy their products? Do they not have reasonable expectation of privacy indoors just because it's someone else's home?


> Face Match, introduced on the Google Nest Hub Max

If I remember correctly, Nest is a thermostat. Not sure what a camera is for in my thermostat, but so Google is indexing your face only if you bought a device of theirs with a camera and installed it in your home? Not that that makes it much better (imagine your Google Play Services suddenly figured this would be helpful to you and makes it opt-out), but the current title implies it indexes all faces on image search or maybe pictures on their file upload system or something.


The Nest Hub Max is not a thermostat. It's basically a Google Home with a big speaker, a camera for video chat and a screen.

In one comment you made an incorrect assumption about what the product is, what Google is doing, proposed an imaginary situation about them doing something even worse and then drew a wild inference based on the title of the article.


Goes to show how accurate the title is, which was my point.


Well, I can type my daughters name into photos and find her photos, so yes I would agree.


Funny that on cnet you get an opt out screen for their tracking that is totally unresponsive on my phone. And they worry about google.


Reminds of FaceApp. Simple channel to collect Americans face pictures for later use in who knows what...


I like how the pop up I got on this story offers to let me “Do More With Alexa” if I subscribe


TL;DR: Can't opt out.

Can I opt out of all of these as well? Unfortunately, not very easily. With Google Photos, you can choose not to run the facial recognition tool on your own photos, but you can't control what other people who may have uploaded photos of you decide to do.

Facebook just recently switched to an opt-in setting for allowing its software to suggest friends tag you in their photo posts, meaning the social network will no longer make such suggestions by default. But that doesn't mean Facebook isn't scanning or processing your image, only that it won't share that information with other users unless you choose to allow it.

Welcome to the era of living publicly and naked. Enjoy.


This is what pisses me off the most about companies like Facebook and Google.

I can spend all the energy I want to not use their products or limit the amount of data that I have, but the second someone else uses it (that I communicate with, has photos of me, etc) and gives them unlimited access they know more about me than I consent to.


How do you realistically expect to prevent a company (that uses facial recognition for perhaps useful features e.g. tagging) from scanning your face? For it to know that the pixels it sees is your face, it has to have a model of your face somewhere. I guess there is no good solution to this problem.


For me, I have less issue with the fact that the technology exists.

My biggest issue comes from where the processing is being done. If it was 100% on device I would be more ok with it. Same for processing photos and anything else that needs to be done with my data.

But most companies instead ship all of your (and other people's data you happen to have) to their servers.


That is not possible on every device given memory and battery restrictions.


If there's no good way for these companies to respect individual privacy then they should be prohibited from applying these technologies at scale.


No one is forcing you to buy.


Untrue. When my neighbor is filming the street with his facial recognition doorbell, my family keep cloud-connected audio recorders in their homes, and my friends and acquaintances are uploading their contact lists for analysis, my privacy is systematically violated and I am subject to the surveillance network beyond any choice of my own.

It is simply ignorant to tell me I can vote with my wallet, I would have to cut social ties and move into the wilderness to escape these abusive information-gathering practices.


Doesn't that mean you have to go after your neighbour, your family, and you friends?

HN has no protection to stop me from putting my friend's email here (see@example.com) and you don't go after HN for that. You'd go after me for sharing your details.


What about mail via USPS ? USPS now knows your address.


At one point sharing home wifi with friends was a nice way to save them bandwidth. These days its a nice way for surveillance capitalism to figure out your home IP, and if they take pictures, associate it with individuals.


Ah ah, no need to go to the extra length of sharing your Wi-Fi for that, your friends' phones already know where they are by scanning nearby WiFi access points, cellular towers and using GPS.


Can I opt out of all of these as well? Unfortunately, not very easily. With Google Photos, you can choose not to run the facial recognition tool on your own photos, but you can't control what other people who may have uploaded photos of you decide to do.

For Google Photos, what can other people who have uploaded photos of me do by enabling facial recognition on them? How is that facial recognition data used by Google?

I don't understand why these articles don't even bother with a slightly more in-depth reporting, instead of just pivoting to the next bugaboo, namely Facebook.


This is a fucking cool feature. In house, opt-in. I love it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: