1
00:00:00,000 --> 00:00:04,100
Privacy is not an add-on. You want to design for privacy from the ground up.

2
00:00:04,940 --> 00:00:08,860
First off, who's this weirdo? I'm a privacy and security engineer.

3
00:00:09,040 --> 00:00:14,220
I've worked at large international companies and small startups and kind of everything in between.

4
00:00:15,000 --> 00:00:18,320
I protect user data for a living. That is what I do.

5
00:00:18,740 --> 00:00:21,080
Come see me on Twitter, Alicia Clock.

6
00:00:23,660 --> 00:00:28,640
So now the important stuff. Let's start with what is user privacy?

7
00:00:30,000 --> 00:00:35,640
User privacy involves the right or mandate of personal privacy concerning storing or purchasing provisions, third parties, and blah, blah, blah, blah, blah.

8
00:00:37,860 --> 00:00:41,540
Let's try that again. What is good user privacy?

9
00:00:42,980 --> 00:00:48,880
User privacy, sometimes referred to as data protection, but I'm going to use user privacy for the most part in this talk,

10
00:00:49,880 --> 00:00:55,080
is when privacy is done right, it makes users happy, and it helps companies thrive.

11
00:00:56,760 --> 00:00:58,600
So what does that mean for users?

12
00:01:01,760 --> 00:01:03,620
My slide will go. There they go.

13
00:01:04,420 --> 00:01:07,020
For users, it means choice and control.

14
00:01:07,440 --> 00:01:09,900
Users need to have meaningful privacy choices.

15
00:01:10,340 --> 00:01:17,700
So that means something other than accept all of our invasion of your privacy or don't use our product.

16
00:01:17,800 --> 00:01:18,860
That's not a meaningful choice.

17
00:01:20,800 --> 00:01:26,520
Tech products, tech software and services are such an integral part of people's daily lives now.

18
00:01:26,580 --> 00:01:29,780
So think LinkedIn, Facebook, Twitter, WhatsApp.

19
00:01:30,000 --> 00:01:33,200
All of those. That's how people stay in touch with friends and family.

20
00:01:33,260 --> 00:01:36,060
That's how they find jobs. It's not really an option to not use it.

21
00:01:36,140 --> 00:01:42,020
So it's not a meaningful choice to say, if you don't like our privacy policies, don't use our product.

22
00:01:42,360 --> 00:01:49,760
So you need to make sure that users have meaningful privacy choices about what they share, when they share it, and how they share it, and to whom.

23
00:01:50,140 --> 00:01:53,840
And so closely related to that is users should have control.

24
00:01:54,100 --> 00:01:56,500
And that means meaningful control over their privacy settings.

25
00:01:56,540 --> 00:01:59,460
So again, not just like one toggle that doesn't really do anything.

26
00:02:00,000 --> 00:02:01,720
You know, protect my privacy on.

27
00:02:01,940 --> 00:02:03,900
Okay, that's not meaningful control.

28
00:02:04,060 --> 00:02:04,820
I don't know what that means.

29
00:02:04,900 --> 00:02:05,740
I don't know what that does.

30
00:02:05,840 --> 00:02:12,060
So users should have meaningful control over what they're sharing, when they're sharing it, and with whom.

31
00:02:13,500 --> 00:02:18,000
For companies, good user privacy means trust.

32
00:02:18,260 --> 00:02:22,740
Users will trust your company's products when you demonstrate that you respect their privacy.

33
00:02:23,440 --> 00:02:27,560
It means risk reduction because when you are properly managing user data,

34
00:02:28,220 --> 00:02:29,920
there's a lower chance.

35
00:02:30,000 --> 00:02:34,420
There's a lower chance of something bad happening to that user's data under your watch, and then you being on the hook for it.

36
00:02:34,780 --> 00:02:37,900
Obviously, nothing can guarantee that, you know, no bad things will happen.

37
00:02:38,080 --> 00:02:39,400
But, you know, this is DEF CON.

38
00:02:39,560 --> 00:02:42,360
You know, one of the things about this is taking sensible steps to protect yourself.

39
00:02:43,480 --> 00:02:45,400
And finally, data usage.

40
00:02:45,740 --> 00:02:49,800
If you properly manage user data and protect users' privacy correctly,

41
00:02:50,580 --> 00:02:58,600
it'll actually support your company's ability to collect and use the data that you need in order to provide your products and features and to develop cool new things.

42
00:03:00,940 --> 00:03:06,580
So, let's dive into that a little, maybe.

43
00:03:07,120 --> 00:03:07,660
Come on.

44
00:03:07,800 --> 00:03:08,240
Okay.

45
00:03:10,800 --> 00:03:11,700
TACT on privacy.

46
00:03:11,980 --> 00:03:20,960
So, when you do privacy as an add-on, just slapping a toggle on at the very end, like, oh, shit, we're launching in an hour, let's put a toggle on here.

47
00:03:21,220 --> 00:03:23,740
That doesn't provide meaningful choice or control for users.

48
00:03:24,020 --> 00:03:25,700
It can't at that level.

49
00:03:25,820 --> 00:03:27,380
Because you've already built everything.

50
00:03:27,660 --> 00:03:29,600
You've already designed how things are going to work.

51
00:03:30,000 --> 00:03:35,800
So, if slapping a toggle on top isn't going at that late stage, you can't do anything meaningful with that toggle.

52
00:03:35,900 --> 00:03:38,060
Not without going back and undoing a whole lot of other work.

53
00:03:39,260 --> 00:03:46,040
And then for companies, again, when you just treat privacy as an add-on, that last minute toggle, your data's not going to be well managed.

54
00:03:46,280 --> 00:03:47,640
You're going to have that increased risk.

55
00:03:47,800 --> 00:03:49,540
You're going to have data going where you don't expect it.

56
00:03:49,580 --> 00:03:51,800
It's going to show up in weird places, be uncontrolled.

57
00:03:52,560 --> 00:03:56,580
And you're not going to really use it when you don't know where it is, when you don't have good control over it.

58
00:03:56,740 --> 00:03:59,280
And it means that users won't trust the company's products.

59
00:03:59,280 --> 00:04:02,660
Users can tell when privacy is just an afterthought.

60
00:04:03,420 --> 00:04:07,200
You know, think about all those, like, various toggles and all the social media you use.

61
00:04:07,220 --> 00:04:19,940
I'm not going to name names, but I'm pretty sure, you know, you can all think of one or two or ten examples where, you know, you go in and you see a toggle that's just, you know, I don't want to share my data.

62
00:04:20,160 --> 00:04:22,120
And you're like, okay, that's not, that doesn't help me.

63
00:04:23,320 --> 00:04:23,920
Users know.

64
00:04:25,360 --> 00:04:26,720
And they won't trust you.

65
00:04:26,720 --> 00:04:32,340
If they can tell that you're just tacking on privacy because somebody at the last minute told you to.

66
00:04:33,760 --> 00:04:35,620
So how do we build in privacy early?

67
00:04:36,760 --> 00:04:40,860
There's five stages where you want to build your privacy in.

68
00:04:40,980 --> 00:04:49,720
Data collection, data storage, data access, feature design and the controls for the features, and then your policies and procedures.

69
00:04:49,760 --> 00:04:54,480
So your software development life cycle, your internal policies, and your employee education.

70
00:04:55,740 --> 00:04:58,900
For data collection, there's one rule.

71
00:04:59,880 --> 00:05:00,760
One rule.

72
00:05:01,060 --> 00:05:03,280
This is the one thing that I want you to take away from this talk.

73
00:05:03,420 --> 00:05:05,740
If you take away one thing, this is it.

74
00:05:05,900 --> 00:05:08,240
Only collect the data that you need.

75
00:05:08,500 --> 00:05:10,740
I have this argument with engineers all the time.

76
00:05:11,360 --> 00:05:13,420
Only collect the data that you need.

77
00:05:13,520 --> 00:05:14,400
Do not test me.

78
00:05:14,980 --> 00:05:16,080
I will hunt you down.

79
00:05:18,420 --> 00:05:24,460
So the reason that I emphasize this one so strongly is because the more data you collect, the more data you collect.

80
00:05:24,480 --> 00:05:25,920
The more data you have.

81
00:05:26,000 --> 00:05:27,740
The more data you have to manage.

82
00:05:28,020 --> 00:05:29,560
The more data you have to protect.

83
00:05:31,580 --> 00:05:32,580
Don't do that to yourself.

84
00:05:32,920 --> 00:05:34,480
If you don't need it, don't collect it.

85
00:05:35,500 --> 00:05:36,280
Limited collection.

86
00:05:36,420 --> 00:05:38,340
Again, back to the user's understanding.

87
00:05:38,560 --> 00:05:41,020
They know when you're collecting data that you don't need.

88
00:05:41,160 --> 00:05:49,000
The exaggerated example would be the notorious flashlight app that wants your location and your contacts and all of that.

89
00:05:49,840 --> 00:05:52,420
Users know that you don't need that for a flashlight app.

90
00:05:52,560 --> 00:05:54,360
And maybe the flashlight developer was thinking innocent.

91
00:05:54,480 --> 00:05:59,400
Of something like, well, maybe in the future I can develop a really cool feature off this data.

92
00:05:59,600 --> 00:06:03,160
But in the present, it just looks like you're trying to scam the user.

93
00:06:03,460 --> 00:06:04,160
Don't do that.

94
00:06:04,300 --> 00:06:05,220
Save yourself a headache.

95
00:06:09,100 --> 00:06:11,920
So once you've collected the data, now you're storing it.

96
00:06:12,160 --> 00:06:17,760
So when you store your sensitive data, the obvious one is it should be stored separately from your non-sensitive data.

97
00:06:18,660 --> 00:06:19,280
That's a given.

98
00:06:19,800 --> 00:06:22,200
And then in access-controlled storage systems.

99
00:06:22,200 --> 00:06:26,560
So not in a storage system that everybody in the company has access to.

100
00:06:27,580 --> 00:06:31,360
And despite everybody in the company thinking they need access to user data, they don't.

101
00:06:31,400 --> 00:06:32,360
We'll talk about that in a second.

102
00:06:32,580 --> 00:06:35,360
So in access-controlled storage systems.

103
00:06:36,880 --> 00:06:42,600
And then the least obvious one is in separate partitions or systems based on usage.

104
00:06:42,860 --> 00:06:47,340
So this is where you want to know what data you're collecting and know what you're using it for.

105
00:06:47,640 --> 00:06:52,180
Because a high-level example would be your customer support line might be using your data.

106
00:06:52,180 --> 00:06:58,880
You might need to see users' names, addresses, phone numbers, and credit card data in order to provide billing support.

107
00:06:59,300 --> 00:07:08,220
And your engineers need to access messages or account content in order to test or debug or fix things.

108
00:07:09,500 --> 00:07:11,920
Engineers shouldn't have access to credit card data.

109
00:07:12,060 --> 00:07:14,220
And customer support people shouldn't have access to messages.

110
00:07:14,660 --> 00:07:20,660
So look at your high-level use cases and partition out your data in a way that...

111
00:07:20,660 --> 00:07:27,640
An engineer poking around in the data to try and solve a bug isn't accidentally going to come across the credit card numbers that he doesn't need.

112
00:07:27,800 --> 00:07:28,380
And vice versa.

113
00:07:31,440 --> 00:07:33,680
Now I mentioned we're going to talk more about data access.

114
00:07:33,960 --> 00:07:35,100
So access to sensitive data.

115
00:07:35,520 --> 00:07:37,100
Probably, again, some of this is obvious.

116
00:07:37,240 --> 00:07:38,840
It should be role-based.

117
00:07:39,160 --> 00:07:45,140
So people who need the data to do their jobs are the only ones who have access to it.

118
00:07:45,200 --> 00:07:48,260
If they don't need it, tell them they don't need it.

119
00:07:49,060 --> 00:07:50,640
And because I want it or because I want it.

120
00:07:50,660 --> 00:07:52,380
Because I think it might help me is not a reason.

121
00:07:53,640 --> 00:07:57,500
Only those who need the data to do their jobs should have access to it.

122
00:07:57,780 --> 00:07:59,760
And then, again, back to the partitioning thing.

123
00:07:59,960 --> 00:08:02,740
They should only have access to the data that they need.

124
00:08:03,020 --> 00:08:05,060
So you don't want your data.

125
00:08:05,200 --> 00:08:06,580
Here's all of my sensitive data.

126
00:08:06,780 --> 00:08:08,340
Here's all of my non-sensitive data.

127
00:08:08,740 --> 00:08:14,000
Everybody with access to sensitive data can access all of the sensitive data regardless of what it is or what they need.

128
00:08:14,180 --> 00:08:15,380
Split that out further.

129
00:08:15,500 --> 00:08:20,480
Make sure that people can't inadvertently or maliciously access data that they have no need for.

130
00:08:21,980 --> 00:08:23,160
Obviously, logged and monitored.

131
00:08:23,260 --> 00:08:25,340
Again, that's kind of a given.

132
00:08:25,800 --> 00:08:28,240
And then automatically updated based on personnel changes.

133
00:08:28,480 --> 00:08:31,600
So if you have somebody who moves from engineering up to management,

134
00:08:31,720 --> 00:08:35,420
they probably don't need an engineer's level of access to the data anymore.

135
00:08:35,700 --> 00:08:38,260
So make sure that that gets taken away and done automatically.

136
00:08:38,440 --> 00:08:41,040
You don't want to have to be every five years somebody thinks,

137
00:08:41,120 --> 00:08:43,640
oh, shit, we should maybe review our data access policies.

138
00:08:43,680 --> 00:08:48,620
And then you find out that this manager has been just casually accessing X's account for the last five years.

139
00:08:51,480 --> 00:08:53,620
Once you've got your backend system set up,

140
00:08:53,660 --> 00:08:55,740
now you need to look at your development process.

141
00:08:56,480 --> 00:08:59,280
I'll talk a little bit more about the software development lifecycle in a second,

142
00:08:59,340 --> 00:09:03,860
but we're going to dive more into strictly designing your features and controls.

143
00:09:04,280 --> 00:09:06,520
So there's a bunch of questions you want to ask yourself,

144
00:09:06,700 --> 00:09:11,460
starting with how am I going to get users to give me the data?

145
00:09:11,640 --> 00:09:13,600
And this shouldn't be a malicious thing.

146
00:09:13,720 --> 00:09:15,780
Again, only collect the data that you need.

147
00:09:16,220 --> 00:09:19,060
So think about how you're going to

148
00:09:20,660 --> 00:09:21,820
turn on the feature for users.

149
00:09:22,160 --> 00:09:23,340
Auto opt-in is not a thing.

150
00:09:23,440 --> 00:09:24,320
Do not use that phrase.

151
00:09:24,640 --> 00:09:25,560
I will fight you.

152
00:09:25,680 --> 00:09:27,920
Do not make me get the roll-up newspaper and bop you on the nose.

153
00:09:28,040 --> 00:09:28,720
That is not a thing.

154
00:09:30,040 --> 00:09:33,840
Opt-out is a valid option, but call it opt-out.

155
00:09:34,440 --> 00:09:36,840
Again, users know when you're trying to deceive them,

156
00:09:36,920 --> 00:09:40,340
and saying something like auto opt-in instantly will lose you some user trust.

157
00:09:41,820 --> 00:09:43,600
And then it should go without saying,

158
00:09:44,380 --> 00:09:46,620
never sneakily turn on a privacy-sensitive feature.

159
00:09:47,020 --> 00:09:48,580
Again, users will find out,

160
00:09:48,620 --> 00:09:50,620
and they will not like you for it.

161
00:09:52,460 --> 00:09:55,480
So now, how do we get users to turn on this feature

162
00:09:55,480 --> 00:09:58,940
if we're using opt-in or we're not sneakily turning things on on them?

163
00:09:59,620 --> 00:10:02,240
You need to think about how you're going to explain your feature.

164
00:10:02,420 --> 00:10:04,380
And this is where you want to loop in your publicity team,

165
00:10:04,420 --> 00:10:05,040
your marketing team.

166
00:10:05,120 --> 00:10:07,000
You say, this is the thing that I want to do.

167
00:10:07,120 --> 00:10:09,100
This is the benefit that it's going to give users.

168
00:10:09,160 --> 00:10:10,860
Because if you're not giving users a benefit,

169
00:10:11,060 --> 00:10:13,220
then you probably have a problem.

170
00:10:13,320 --> 00:10:14,980
Even if the benefit is just as simple as

171
00:10:14,980 --> 00:10:17,680
we're making the product run more smoothly for you,

172
00:10:17,780 --> 00:10:19,540
but you need to be able to tell them

173
00:10:19,540 --> 00:10:21,440
what they are getting out of giving you this data.

174
00:10:22,240 --> 00:10:24,060
You need to sell them on your feature.

175
00:10:24,180 --> 00:10:27,100
They need to understand why they're giving you the data.

176
00:10:27,260 --> 00:10:28,760
And that goes back to that choice and control.

177
00:10:28,980 --> 00:10:33,360
Users need to understand what you're going to use the data for,

178
00:10:33,460 --> 00:10:34,580
what they get out of it.

179
00:10:35,720 --> 00:10:38,020
You also need to consider your legally required notifications.

180
00:10:38,020 --> 00:10:41,100
So, you know, GRDP mandates, any mandates your company's under,

181
00:10:41,220 --> 00:10:43,260
any other laws in the countries that you're operating in.

182
00:10:44,180 --> 00:10:45,540
Talk to your lawyers about those.

183
00:10:45,600 --> 00:10:46,580
Make sure that you have those in.

184
00:10:46,700 --> 00:10:48,660
But the primary thing that you want to do is,

185
00:10:49,540 --> 00:10:50,320
give your feature to your users.

186
00:10:50,520 --> 00:10:53,940
And then secondarily, provide information on how to turn it off.

187
00:10:54,720 --> 00:10:56,760
Nobody likes to think about users turning off

188
00:10:56,760 --> 00:10:58,480
this really awesome new feature that they've created.

189
00:10:59,260 --> 00:11:01,500
But users do have valid reasons for doing that.

190
00:11:03,000 --> 00:11:04,880
So, once they have revoked consent,

191
00:11:05,120 --> 00:11:06,460
or don't give it in the first place,

192
00:11:06,620 --> 00:11:07,640
you need to think about this.

193
00:11:08,140 --> 00:11:09,120
What happens then?

194
00:11:09,620 --> 00:11:11,260
Do you stop collecting the data?

195
00:11:11,420 --> 00:11:12,740
If not, why not?

196
00:11:13,120 --> 00:11:14,280
What do you do with it?

197
00:11:15,220 --> 00:11:17,580
How long do you keep data that you've already collected?

198
00:11:17,720 --> 00:11:18,160
Is it forever?

199
00:11:18,160 --> 00:11:21,540
Is it, you know, for a week after they've turned it off?

200
00:11:21,660 --> 00:11:22,700
Because that's how your system, you know.

201
00:11:22,920 --> 00:11:24,420
There's not a wrong answer here,

202
00:11:24,520 --> 00:11:25,900
but you need to have an answer.

203
00:11:26,900 --> 00:11:28,420
Because in some cases, like,

204
00:11:28,780 --> 00:11:30,440
collected data might need to be kept indefinitely.

205
00:11:30,720 --> 00:11:33,180
Because some legal thing or other.

206
00:11:33,280 --> 00:11:34,180
Again, talk to your lawyers.

207
00:11:34,280 --> 00:11:35,620
They'll be able to tell you more about that.

208
00:11:36,720 --> 00:11:38,020
But there's not a wrong answer.

209
00:11:38,120 --> 00:11:40,220
You just need an answer here.

210
00:11:42,280 --> 00:11:44,600
A little bit more about why users might turn it off.

211
00:11:44,680 --> 00:11:46,040
Because a lot of people don't think about this.

212
00:11:46,120 --> 00:11:47,880
And I've talked to engineers who, like,

213
00:11:48,160 --> 00:11:51,140
when I give them a story about why a user might turn things off,

214
00:11:51,240 --> 00:11:51,620
they kind of,

215
00:11:52,100 --> 00:11:53,180
I never thought about that.

216
00:11:54,020 --> 00:11:55,200
So there was an example.

217
00:11:55,700 --> 00:11:56,900
When I was working at Google,

218
00:11:58,320 --> 00:11:59,840
Google was linking people's accounts.

219
00:12:00,140 --> 00:12:01,540
They were like, oh, we're going to be really helpful.

220
00:12:01,640 --> 00:12:02,460
Because, you know, everybody's like,

221
00:12:02,540 --> 00:12:04,920
they set up, like, this old Gmail from when they were in high school,

222
00:12:04,960 --> 00:12:06,780
and they set up a different one for their professional life.

223
00:12:06,860 --> 00:12:08,060
We're going to start, like, linking all these accounts

224
00:12:08,060 --> 00:12:09,940
and making it really easy for you to manage all your accounts.

225
00:12:11,460 --> 00:12:14,480
Well, there was a user who was trans.

226
00:12:15,120 --> 00:12:16,820
And they were trans in their personal,

227
00:12:16,820 --> 00:12:18,620
they were out in their personal life,

228
00:12:18,760 --> 00:12:20,620
and they were not out in their work life.

229
00:12:20,960 --> 00:12:22,320
Google linked those accounts,

230
00:12:24,020 --> 00:12:28,120
and suddenly this user was outed to all of their coworkers

231
00:12:28,120 --> 00:12:30,480
and professional contacts against their will.

232
00:12:30,840 --> 00:12:33,240
So that user should have been given the option

233
00:12:33,240 --> 00:12:35,060
to not link their accounts before it was done.

234
00:12:35,380 --> 00:12:36,820
And again, this was nothing malicious.

235
00:12:36,920 --> 00:12:39,040
Google was genuinely trying to help.

236
00:12:39,180 --> 00:12:41,820
They thought that everybody wanted their accounts linked.

237
00:12:42,340 --> 00:12:46,520
They forget that not everybody is one single unit of person in Meetspace.

238
00:12:46,820 --> 00:12:48,080
People have multiple identities,

239
00:12:48,300 --> 00:12:50,160
and they deliberately maintain these multiple identities.

240
00:12:51,060 --> 00:12:53,040
So think about these kinds of use cases

241
00:12:53,040 --> 00:12:55,320
where people might want or need to turn your feature off

242
00:12:55,320 --> 00:12:56,100
for their own safety.

243
00:12:56,320 --> 00:12:57,920
Or even just personal preference,

244
00:12:58,060 --> 00:12:59,200
because that is also a valid reason.

245
00:12:59,280 --> 00:13:00,040
But think about that,

246
00:13:00,160 --> 00:13:01,920
and make sure that you have a plan

247
00:13:01,920 --> 00:13:03,800
for when users turn a feature off.

248
00:13:07,720 --> 00:13:09,500
Finally, on the feature design side,

249
00:13:09,700 --> 00:13:12,320
this is the other thing that I want you to remember from this.

250
00:13:13,140 --> 00:13:15,200
When you're designing a feature, ask yourself,

251
00:13:16,060 --> 00:13:18,940
does your feature pass the New York Times headline test?

252
00:13:19,080 --> 00:13:20,720
How many of you have heard of that already?

253
00:13:21,100 --> 00:13:21,840
Okay, some hands.

254
00:13:21,900 --> 00:13:22,900
So the New York Times headline test.

255
00:13:23,580 --> 00:13:26,460
How many of you are familiar with how much J. Jonah Jameson hates Spider-Man?

256
00:13:27,160 --> 00:13:28,240
You know about that? Okay.

257
00:13:28,480 --> 00:13:31,240
J. Jonah Jameson hates Spider-Man

258
00:13:31,240 --> 00:13:32,640
to the point where everything he will do,

259
00:13:32,720 --> 00:13:34,320
every positive article, he will twist.

260
00:13:34,560 --> 00:13:37,540
He will turn it around and make it about how evil Spider-Man is

261
00:13:37,540 --> 00:13:39,180
and how he's a menace and ought to be locked up.

262
00:13:39,420 --> 00:13:41,840
So now imagine that your feature is Spider-Man,

263
00:13:41,900 --> 00:13:44,680
and J. Jonah Jameson is writing an article about it in the New York Times.

264
00:13:45,200 --> 00:13:46,720
How well will your feature hold up?

265
00:13:47,040 --> 00:13:48,100
Will you be embarrassed?

266
00:13:48,440 --> 00:13:51,640
Will it be a black mark on your company's record

267
00:13:51,640 --> 00:13:53,560
to have this New York Times article out there?

268
00:13:53,840 --> 00:13:56,100
Or will you be able to stand up and proudly say,

269
00:13:56,300 --> 00:13:58,360
yes, we are collecting this data.

270
00:13:58,460 --> 00:13:59,720
This is what we're doing with it.

271
00:13:59,800 --> 00:14:01,100
This is what it gives the user.

272
00:14:01,280 --> 00:14:02,580
Here's how we're protecting it.

273
00:14:03,220 --> 00:14:05,860
Because if you can say that, if you have a really good story

274
00:14:05,860 --> 00:14:10,180
and you can explain why users might want to give you this data

275
00:14:10,180 --> 00:14:11,480
and then how you're protecting it,

276
00:14:11,520 --> 00:14:13,140
how you're respecting their choice and control,

277
00:14:13,540 --> 00:14:14,460
then you're good to go.

278
00:14:15,200 --> 00:14:16,140
But if you're going to be embarrassed,

279
00:14:16,280 --> 00:14:17,460
if that comes out in the New York Times,

280
00:14:17,920 --> 00:14:19,540
maybe you should rethink what you're doing.

281
00:14:21,940 --> 00:14:25,440
User trust is really, really, really hard to earn

282
00:14:25,440 --> 00:14:27,420
and really, really, really easy to lose.

283
00:14:28,640 --> 00:14:30,740
Bad handling can kill the best intention feature.

284
00:14:31,080 --> 00:14:32,760
So how many of you remember Beacon?

285
00:14:33,260 --> 00:14:33,860
Facebook's Beacon?

286
00:14:35,080 --> 00:14:35,980
Not enough hands here.

287
00:14:36,100 --> 00:14:36,280
Okay.

288
00:14:36,380 --> 00:14:37,900
The Beacon thing was basically

289
00:14:38,820 --> 00:14:41,280
Facebook would put little beacons on like Amazon pages

290
00:14:41,280 --> 00:14:42,480
and other web stores.

291
00:14:42,580 --> 00:14:43,660
And so then when you bought a thing,

292
00:14:43,660 --> 00:14:46,220
it would automatically post to your Facebook timeline,

293
00:14:46,420 --> 00:14:49,560
hey, you know, so and so just bought like this thing.

294
00:14:49,820 --> 00:14:51,180
Well, all of a sudden,

295
00:14:51,200 --> 00:14:53,820
people buying surprise birthday presents,

296
00:14:53,940 --> 00:14:55,000
engagement rings,

297
00:14:56,280 --> 00:14:58,480
you know, maybe adult toys

298
00:14:58,480 --> 00:15:00,340
that they didn't really want their mom to know about

299
00:15:00,960 --> 00:15:02,140
were getting outed.

300
00:15:02,260 --> 00:15:03,920
So Facebook had a good intention,

301
00:15:04,460 --> 00:15:05,820
but they didn't handle it well.

302
00:15:05,960 --> 00:15:07,200
They didn't provide choice.

303
00:15:07,340 --> 00:15:08,320
They didn't provide control.

304
00:15:10,340 --> 00:15:12,040
Good handling, on the other hand,

305
00:15:12,040 --> 00:15:13,140
can push a feature above

306
00:15:13,140 --> 00:15:13,800
and beyond.

307
00:15:14,200 --> 00:15:15,120
How many of you remember

308
00:15:15,120 --> 00:15:17,320
when Google Now launched a while back?

309
00:15:18,020 --> 00:15:19,700
Because one of the things that struck me

310
00:15:19,700 --> 00:15:20,940
about the Google Now launch

311
00:15:20,940 --> 00:15:22,980
was that on its face,

312
00:15:23,060 --> 00:15:24,640
Google Now looks really, really invasive.

313
00:15:24,880 --> 00:15:25,480
They basically say,

314
00:15:25,540 --> 00:15:26,520
we want to scrape your email,

315
00:15:26,600 --> 00:15:27,740
we want to scrape everything on your phone,

316
00:15:27,840 --> 00:15:29,200
we want to scrape everything in your Google account,

317
00:15:29,820 --> 00:15:30,800
but we're going to provide you

318
00:15:30,800 --> 00:15:33,700
all these really, really, really useful services for it.

319
00:15:34,040 --> 00:15:35,440
And we're going to respect your privacy.

320
00:15:35,640 --> 00:15:37,000
Here's all of the controls that you'll have

321
00:15:37,000 --> 00:15:38,000
over what you're giving us.

322
00:15:38,140 --> 00:15:39,940
You can turn off now at any time.

323
00:15:40,100 --> 00:15:41,560
You know, we won't retain your data,

324
00:15:41,560 --> 00:15:42,660
so on and so forth.

325
00:15:42,880 --> 00:15:45,760
And I was seeing on even the really tinfoil hat

326
00:15:46,400 --> 00:15:48,000
subreddits and forums where people were saying,

327
00:15:48,100 --> 00:15:48,420
you know what,

328
00:15:48,600 --> 00:15:50,540
I normally wouldn't go for anything like this,

329
00:15:50,540 --> 00:15:51,580
but this is actually pretty cool.

330
00:15:51,820 --> 00:15:53,440
And Google Now is so integrated.

331
00:15:53,620 --> 00:15:54,340
It's not even now anymore.

332
00:15:54,420 --> 00:15:55,060
It's just the Google app

333
00:15:55,060 --> 00:15:56,240
and it lives in all the Android phones.

334
00:15:56,500 --> 00:15:57,840
That's how well it was handled,

335
00:15:57,920 --> 00:15:59,840
even though on its surface,

336
00:15:59,920 --> 00:16:00,820
it's really scary.

337
00:16:04,360 --> 00:16:07,340
So let's talk about policies

338
00:16:07,340 --> 00:16:09,140
and processes and education.

339
00:16:10,240 --> 00:16:11,540
So we went into this

340
00:16:11,560 --> 00:16:12,420
and we looked at the questions

341
00:16:12,420 --> 00:16:14,260
you should ask yourself during development,

342
00:16:14,360 --> 00:16:15,440
but that's not the only thing

343
00:16:15,440 --> 00:16:16,160
you should be doing

344
00:16:16,640 --> 00:16:17,820
during the development stage

345
00:16:17,820 --> 00:16:19,040
of your software development lifecycle.

346
00:16:20,160 --> 00:16:22,840
You want to engage your program managers,

347
00:16:22,980 --> 00:16:23,720
your product managers,

348
00:16:23,880 --> 00:16:25,620
and your engineers very, very early.

349
00:16:25,780 --> 00:16:28,880
You do not, do not want to come in late

350
00:16:28,880 --> 00:16:32,440
and say, oh, you're launching in three days?

351
00:16:32,600 --> 00:16:33,940
Well, you need to do this, this, this, this,

352
00:16:34,040 --> 00:16:34,640
and this, and this, and this.

353
00:16:34,880 --> 00:16:35,940
They're going to hate you

354
00:16:35,940 --> 00:16:37,480
and they're not going to do it.

355
00:16:38,740 --> 00:16:40,940
Or, you know, it's going to just be bad

356
00:16:41,560 --> 00:16:41,660
for everybody.

357
00:16:41,780 --> 00:16:43,000
So engage early,

358
00:16:43,220 --> 00:16:44,260
as early as you can.

359
00:16:45,160 --> 00:16:46,200
You also want to make friends

360
00:16:46,200 --> 00:16:46,780
with your lawyers.

361
00:16:47,120 --> 00:16:48,540
Every lawyer that I've ever met

362
00:16:48,540 --> 00:16:49,540
has been perfectly willing

363
00:16:49,540 --> 00:16:50,540
to be the bad guy

364
00:16:50,540 --> 00:16:51,580
when you need them,

365
00:16:51,680 --> 00:16:53,160
which is really, really helpful.

366
00:16:53,980 --> 00:16:54,860
But they also,

367
00:16:55,520 --> 00:16:56,620
they're your lawyers.

368
00:16:56,720 --> 00:16:57,600
They're your company's lawyers.

369
00:16:57,720 --> 00:16:58,620
They want you to succeed.

370
00:16:59,320 --> 00:17:00,880
So if you get them in early,

371
00:17:01,100 --> 00:17:02,000
they'll be able to say,

372
00:17:02,140 --> 00:17:03,960
okay, well, there's a, you know,

373
00:17:03,980 --> 00:17:05,940
this law says you can't do it this way,

374
00:17:06,120 --> 00:17:08,340
but you can do this other thing over here

375
00:17:08,340 --> 00:17:09,880
and that'll get you the same thing

376
00:17:09,880 --> 00:17:10,860
that you're trying to do

377
00:17:10,860 --> 00:17:11,840
and we won't be, you know,

378
00:17:11,840 --> 00:17:12,840
doing anything to get in trouble.

379
00:17:14,360 --> 00:17:15,660
So make friends with your lawyers.

380
00:17:15,920 --> 00:17:17,480
Recruit advocates as well.

381
00:17:17,620 --> 00:17:18,840
And advocates are people,

382
00:17:19,040 --> 00:17:20,820
they're any part of the company,

383
00:17:20,960 --> 00:17:23,360
engineers, PMs, support people,

384
00:17:23,580 --> 00:17:24,540
managers, anybody,

385
00:17:27,220 --> 00:17:28,800
who believes in privacy.

386
00:17:29,380 --> 00:17:30,540
Because they might not be

387
00:17:30,540 --> 00:17:31,580
on your privacy team,

388
00:17:31,780 --> 00:17:33,500
but they will advocate for you.

389
00:17:33,540 --> 00:17:34,180
They will, you know,

390
00:17:34,180 --> 00:17:35,040
speak up in meetings

391
00:17:35,040 --> 00:17:36,160
and they'll be the ones

392
00:17:36,160 --> 00:17:37,700
to call out those use cases,

393
00:17:37,740 --> 00:17:38,760
like, you know,

394
00:17:38,760 --> 00:17:40,560
what happens if a person

395
00:17:40,560 --> 00:17:40,840
in a job

396
00:17:40,860 --> 00:17:41,720
in a domestic violence shelter

397
00:17:41,720 --> 00:17:42,900
is using this?

398
00:17:43,220 --> 00:17:44,040
Like, how do we, you know,

399
00:17:44,080 --> 00:17:44,760
how do we protect that?

400
00:17:44,900 --> 00:17:46,920
So recruit your advocates.

401
00:17:47,180 --> 00:17:48,480
Make sure that you support them.

402
00:17:48,820 --> 00:17:49,600
Let them know

403
00:17:49,600 --> 00:17:50,540
that they're appreciated,

404
00:17:50,820 --> 00:17:52,240
that you, you know,

405
00:17:52,260 --> 00:17:53,140
you're grateful for the work

406
00:17:53,140 --> 00:17:53,580
that they're doing

407
00:17:53,580 --> 00:17:55,140
and that you trust them

408
00:17:55,140 --> 00:17:56,820
and to, you know,

409
00:17:56,840 --> 00:17:57,640
represent privacy

410
00:17:58,280 --> 00:17:59,120
through the company.

411
00:17:59,680 --> 00:18:00,940
And then I touched on this

412
00:18:00,940 --> 00:18:02,740
a little bit in previous slides,

413
00:18:02,900 --> 00:18:04,440
but just in general,

414
00:18:04,580 --> 00:18:05,600
you want to engage

415
00:18:05,600 --> 00:18:06,460
all your other teams

416
00:18:06,460 --> 00:18:07,260
really early too.

417
00:18:07,360 --> 00:18:08,100
So we talked about legal.

418
00:18:08,300 --> 00:18:09,240
We talked a little bit

419
00:18:09,240 --> 00:18:10,020
about publicity

420
00:18:10,620 --> 00:18:12,120
in terms of how, you know,

421
00:18:12,120 --> 00:18:12,860
how you're going to sell

422
00:18:12,860 --> 00:18:13,440
your feature

423
00:18:13,440 --> 00:18:16,140
and sell the, like,

424
00:18:16,280 --> 00:18:17,200
the data collection.

425
00:18:18,080 --> 00:18:19,000
But you also want to engage

426
00:18:19,000 --> 00:18:19,760
customer support.

427
00:18:20,400 --> 00:18:21,480
I've seen a lot of times

428
00:18:21,480 --> 00:18:22,960
where a product team

429
00:18:22,960 --> 00:18:23,740
will push a new product

430
00:18:23,740 --> 00:18:25,240
and then the customer support line

431
00:18:25,240 --> 00:18:26,120
gets flooded with calls

432
00:18:26,120 --> 00:18:27,140
and the customer support people

433
00:18:27,140 --> 00:18:27,400
are like,

434
00:18:27,500 --> 00:18:28,220
we don't know.

435
00:18:28,260 --> 00:18:29,140
We got it at the same time

436
00:18:29,140 --> 00:18:29,420
you did.

437
00:18:29,480 --> 00:18:30,020
We have no idea

438
00:18:30,020 --> 00:18:30,640
what's going on.

439
00:18:30,900 --> 00:18:31,880
That's not a good experience

440
00:18:31,880 --> 00:18:32,500
for your users.

441
00:18:32,640 --> 00:18:33,420
They're not going to trust you

442
00:18:33,420 --> 00:18:34,360
when that happens.

443
00:18:34,460 --> 00:18:34,840
It's like, okay,

444
00:18:34,900 --> 00:18:35,240
if you don't,

445
00:18:35,240 --> 00:18:35,840
you're like,

446
00:18:36,240 --> 00:18:37,560
what is going on here?

447
00:18:37,680 --> 00:18:38,260
If you can't even tell

448
00:18:38,260 --> 00:18:39,160
your customer support people

449
00:18:39,160 --> 00:18:40,040
how to support me

450
00:18:40,040 --> 00:18:41,260
in this creepy new feature.

451
00:18:41,520 --> 00:18:42,820
So engage your customer support.

452
00:18:43,020 --> 00:18:43,940
Make sure they understand

453
00:18:44,400 --> 00:18:45,340
what the feature does.

454
00:18:45,460 --> 00:18:46,260
Make sure they can answer

455
00:18:46,260 --> 00:18:46,900
the common questions.

456
00:18:47,020 --> 00:18:47,840
How do I turn it off?

457
00:18:47,960 --> 00:18:48,820
What data does it collect?

458
00:18:48,980 --> 00:18:49,860
What happens to my data?

459
00:18:50,060 --> 00:18:51,620
So engage them early as well.

460
00:18:53,680 --> 00:18:54,640
Once you've developed

461
00:18:54,640 --> 00:18:55,120
your product,

462
00:18:56,040 --> 00:18:56,800
probably it's going

463
00:18:56,800 --> 00:18:57,320
to go to test.

464
00:18:57,420 --> 00:18:58,080
Hopefully it's going

465
00:18:58,080 --> 00:18:58,620
to go to test

466
00:18:58,620 --> 00:18:59,400
and not just directly

467
00:18:59,400 --> 00:19:00,060
to prod.

468
00:19:01,080 --> 00:19:02,280
Keep privacy in mind.

469
00:19:02,380 --> 00:19:03,940
Test users don't give up privacy

470
00:19:03,940 --> 00:19:05,020
just because they're test users.

471
00:19:05,140 --> 00:19:05,220
So, you know,

472
00:19:06,640 --> 00:19:08,020
the level of privacy

473
00:19:08,020 --> 00:19:08,660
may be different.

474
00:19:08,760 --> 00:19:10,080
That's what testing is for.

475
00:19:10,300 --> 00:19:11,300
But this goes back

476
00:19:11,300 --> 00:19:12,300
to making sure your users,

477
00:19:12,540 --> 00:19:13,160
test users,

478
00:19:13,320 --> 00:19:16,080
understand what they're giving up,

479
00:19:16,160 --> 00:19:17,420
what data they're giving up,

480
00:19:17,500 --> 00:19:18,640
and what's going to happen

481
00:19:18,640 --> 00:19:19,160
to that data.

482
00:19:19,360 --> 00:19:21,380
So have your data retention plan.

483
00:19:22,100 --> 00:19:22,760
And again,

484
00:19:22,920 --> 00:19:24,640
there's not a wrong answer

485
00:19:24,640 --> 00:19:25,360
for a data retention

486
00:19:25,360 --> 00:19:26,140
and deletion plan

487
00:19:26,140 --> 00:19:27,220
because the answer might be

488
00:19:27,220 --> 00:19:28,620
we can't legally delete it.

489
00:19:28,940 --> 00:19:29,820
But you need to know

490
00:19:29,820 --> 00:19:30,300
what it is

491
00:19:30,300 --> 00:19:31,080
so that when people ask,

492
00:19:31,200 --> 00:19:31,740
you can tell them

493
00:19:31,740 --> 00:19:32,460
and you can tell them why.

494
00:19:34,160 --> 00:19:35,220
And test your product

495
00:19:35,240 --> 00:19:35,800
has privacy controls.

496
00:19:36,220 --> 00:19:36,380
You know,

497
00:19:36,380 --> 00:19:37,540
find that person

498
00:19:37,540 --> 00:19:38,000
that you know

499
00:19:38,000 --> 00:19:40,580
that is like all about privacy

500
00:19:40,580 --> 00:19:42,160
and like wants to,

501
00:19:42,300 --> 00:19:42,600
you know,

502
00:19:42,600 --> 00:19:43,340
they will toggle

503
00:19:43,340 --> 00:19:44,040
all the privacy.

504
00:19:44,140 --> 00:19:45,060
Find them and give it to them

505
00:19:45,060 --> 00:19:45,520
and test it

506
00:19:45,520 --> 00:19:46,260
and make sure that it works

507
00:19:46,260 --> 00:19:47,560
and passes muster.

508
00:19:52,060 --> 00:19:53,220
And just like privacy

509
00:19:53,220 --> 00:19:54,380
doesn't stop at test,

510
00:19:54,620 --> 00:19:56,120
it doesn't stop at launch either.

511
00:19:56,220 --> 00:19:57,340
You can't just chuck product

512
00:19:57,340 --> 00:19:58,140
out into the wild

513
00:19:58,140 --> 00:19:59,140
and be like,

514
00:19:59,200 --> 00:19:59,900
hey, there it is.

515
00:19:59,940 --> 00:20:00,420
You know, we're done.

516
00:20:00,560 --> 00:20:01,060
Moving on.

517
00:20:01,140 --> 00:20:01,680
Next project.

518
00:20:02,820 --> 00:20:03,660
Doesn't work that way.

519
00:20:03,820 --> 00:20:04,940
You need to check in

520
00:20:05,240 --> 00:20:06,820
regularly with your product teams.

521
00:20:07,240 --> 00:20:09,240
Make sure that they're still

522
00:20:09,780 --> 00:20:11,420
respecting the privacy controls

523
00:20:11,420 --> 00:20:12,120
that you put in place

524
00:20:12,120 --> 00:20:13,180
that they aren't changing things

525
00:20:13,180 --> 00:20:14,280
on the back end

526
00:20:14,280 --> 00:20:16,320
as new things come up.

527
00:20:16,780 --> 00:20:17,460
And then,

528
00:20:18,000 --> 00:20:19,200
as new things come up

529
00:20:19,200 --> 00:20:19,800
on your side,

530
00:20:20,380 --> 00:20:21,600
work with the product teams

531
00:20:21,600 --> 00:20:22,140
to integrate them.

532
00:20:22,240 --> 00:20:23,300
So maybe you've developed

533
00:20:23,300 --> 00:20:24,300
a new encryption scheme.

534
00:20:24,600 --> 00:20:26,280
Go back to all those product teams

535
00:20:26,280 --> 00:20:27,300
and say, hey,

536
00:20:27,340 --> 00:20:28,720
we need to upgrade your product

537
00:20:28,720 --> 00:20:30,660
to include this new privacy tool

538
00:20:30,660 --> 00:20:31,540
on our back end.

539
00:20:36,280 --> 00:20:37,820
A lot of this comes in

540
00:20:37,820 --> 00:20:39,100
from internal policies

541
00:20:39,100 --> 00:20:39,580
and procedures,

542
00:20:39,720 --> 00:20:40,400
getting all of this

543
00:20:40,400 --> 00:20:41,360
through the development lifecycle,

544
00:20:41,580 --> 00:20:42,980
having people work with you on this.

545
00:20:43,140 --> 00:20:43,880
So you need to make sure

546
00:20:43,880 --> 00:20:45,620
you have policies and procedures

547
00:20:45,620 --> 00:20:47,920
in place to support all of this.

548
00:20:49,000 --> 00:20:50,200
Getting C-suite support,

549
00:20:50,420 --> 00:20:51,580
your chiefs of staff,

550
00:20:52,240 --> 00:20:53,440
is super important.

551
00:20:53,780 --> 00:20:54,720
They're probably not going

552
00:20:54,720 --> 00:20:55,860
to do a whole lot,

553
00:20:55,860 --> 00:20:56,580
unless you're really lucky,

554
00:20:56,640 --> 00:20:57,120
they're not going to do

555
00:20:57,120 --> 00:20:58,220
a whole lot more than issue

556
00:20:58,220 --> 00:20:59,380
a blanket statement like,

557
00:20:59,520 --> 00:21:00,700
we support privacy

558
00:21:00,700 --> 00:21:01,320
at this company.

559
00:21:01,560 --> 00:21:03,720
But even that is enough

560
00:21:03,720 --> 00:21:05,220
to then make sure

561
00:21:05,220 --> 00:21:06,340
you get the mid-level managers

562
00:21:06,340 --> 00:21:08,340
to start issuing actual policies

563
00:21:08,340 --> 00:21:08,840
with teeth.

564
00:21:10,880 --> 00:21:12,140
Once you have a policy,

565
00:21:12,300 --> 00:21:13,020
you need to make it

566
00:21:13,020 --> 00:21:13,940
just the done thing.

567
00:21:14,140 --> 00:21:14,920
Because you don't want to

568
00:21:14,920 --> 00:21:16,340
constantly going back

569
00:21:16,340 --> 00:21:17,160
and fighting with people

570
00:21:17,160 --> 00:21:18,460
about, this is the policy,

571
00:21:18,680 --> 00:21:19,700
but I need to do with this.

572
00:21:19,740 --> 00:21:20,500
No, this is the policy,

573
00:21:20,620 --> 00:21:21,640
but you don't want that.

574
00:21:22,000 --> 00:21:24,220
So make it the done thing.

575
00:21:24,440 --> 00:21:25,160
And a really sneaky

576
00:21:25,160 --> 00:21:26,280
and easy way to do this

577
00:21:26,280 --> 00:21:27,840
is teach your new hires.

578
00:21:28,800 --> 00:21:29,700
Especially if you're

579
00:21:29,700 --> 00:21:30,340
a growing company

580
00:21:31,580 --> 00:21:32,860
and your new hires

581
00:21:32,860 --> 00:21:33,820
tend to outnumber

582
00:21:34,380 --> 00:21:35,200
your old guys,

583
00:21:35,220 --> 00:21:35,240
that's really hard.

584
00:21:36,800 --> 00:21:37,760
Teach the new hires

585
00:21:37,760 --> 00:21:38,860
and just tell them

586
00:21:38,860 --> 00:21:39,740
that's how things are done.

587
00:21:39,940 --> 00:21:40,960
They don't know any better

588
00:21:40,960 --> 00:21:42,260
and they'll just start doing it

589
00:21:42,260 --> 00:21:43,520
and eventually

590
00:21:44,060 --> 00:21:44,960
it will propagate enough

591
00:21:44,960 --> 00:21:45,940
that it does become

592
00:21:45,940 --> 00:21:46,520
the done thing.

593
00:21:47,720 --> 00:21:48,620
And then finally,

594
00:21:48,680 --> 00:21:49,840
okay, we've got all these policies

595
00:21:49,840 --> 00:21:50,280
and procedures,

596
00:21:50,440 --> 00:21:50,980
that's great,

597
00:21:51,260 --> 00:21:52,100
and now we're getting

598
00:21:52,100 --> 00:21:52,840
kind of bogged down.

599
00:21:53,240 --> 00:21:54,240
Don't let that happen.

600
00:21:55,080 --> 00:21:56,240
Make sure that your procedures

601
00:21:56,240 --> 00:21:57,020
are as simple

602
00:21:57,020 --> 00:21:57,720
and as integrated

603
00:21:57,720 --> 00:21:58,840
as you can make it.

604
00:21:59,560 --> 00:22:00,740
Again, you don't want to be

605
00:22:00,740 --> 00:22:01,940
the team of no.

606
00:22:02,120 --> 00:22:03,440
You don't want to be a gate

607
00:22:03,440 --> 00:22:05,660
on teams getting to do cool stuff.

608
00:22:06,100 --> 00:22:07,920
So you want to make privacy

609
00:22:08,480 --> 00:22:09,840
as integrated and seamless

610
00:22:09,840 --> 00:22:10,600
as possible.

611
00:22:10,800 --> 00:22:11,360
And this goes back

612
00:22:11,360 --> 00:22:11,980
to what I was saying

613
00:22:11,980 --> 00:22:13,500
about get other teams in early.

614
00:22:14,140 --> 00:22:15,540
Engage with product teams early.

615
00:22:15,640 --> 00:22:16,680
Get publicity and legal

616
00:22:16,680 --> 00:22:18,820
and customer support early.

617
00:22:18,940 --> 00:22:19,640
Because the earlier

618
00:22:19,640 --> 00:22:20,860
you do all of this,

619
00:22:20,980 --> 00:22:22,400
the more you are steering

620
00:22:22,400 --> 00:22:24,240
instead of saying no.

621
00:22:26,420 --> 00:22:27,880
Because if you can steer,

622
00:22:28,060 --> 00:22:29,020
if they have two choices

623
00:22:29,020 --> 00:22:30,120
and one of them is privacy good

624
00:22:30,120 --> 00:22:31,260
and one of them is privacy bad,

625
00:22:31,380 --> 00:22:32,480
or even privacy neutral,

626
00:22:32,480 --> 00:22:34,540
if you can catch them

627
00:22:34,540 --> 00:22:35,640
before they've made that choice,

628
00:22:36,260 --> 00:22:37,540
then you can just steer them

629
00:22:37,540 --> 00:22:39,460
and it isn't an issue.

630
00:22:39,640 --> 00:22:40,600
They're just using

631
00:22:40,600 --> 00:22:41,860
the correct privacy thing.

632
00:22:42,220 --> 00:22:43,060
If you get to them

633
00:22:43,060 --> 00:22:44,100
after they've made the choice

634
00:22:44,100 --> 00:22:44,640
and they've gone

635
00:22:44,640 --> 00:22:45,840
to the privacy bad side,

636
00:22:46,180 --> 00:22:47,220
well now you have to undo

637
00:22:47,220 --> 00:22:47,920
all of that work,

638
00:22:48,040 --> 00:22:48,940
bring them back here,

639
00:22:49,100 --> 00:22:50,340
and send them out again.

640
00:22:50,520 --> 00:22:51,860
So get them as early as you can.

641
00:22:54,000 --> 00:22:56,280
And finally, education

642
00:22:56,280 --> 00:22:58,280
is super, super important.

643
00:22:58,620 --> 00:22:59,440
Teach your employees

644
00:22:59,440 --> 00:23:00,400
the value of privacy.

645
00:23:00,600 --> 00:23:02,200
This isn't just like,

646
00:23:02,480 --> 00:23:04,080
have an orientation thing

647
00:23:04,080 --> 00:23:04,900
where you have a slide up

648
00:23:04,900 --> 00:23:05,140
that says,

649
00:23:05,160 --> 00:23:06,400
our company values user privacy.

650
00:23:06,540 --> 00:23:07,000
It's important.

651
00:23:07,140 --> 00:23:07,480
Rah, rah.

652
00:23:08,840 --> 00:23:10,120
Help them understand

653
00:23:10,120 --> 00:23:11,920
why privacy is important.

654
00:23:12,160 --> 00:23:12,820
So again, the things

655
00:23:12,820 --> 00:23:13,600
we've talked about here.

656
00:23:14,080 --> 00:23:15,540
Privacy makes for better products.

657
00:23:16,480 --> 00:23:18,140
Privacy improves user trust.

658
00:23:18,320 --> 00:23:19,220
It makes your company stronger

659
00:23:19,220 --> 00:23:20,240
by giving you data

660
00:23:20,240 --> 00:23:21,120
that you can use.

661
00:23:21,880 --> 00:23:23,440
And by having customers

662
00:23:23,440 --> 00:23:24,380
that respect you.

663
00:23:25,800 --> 00:23:27,120
And then also,

664
00:23:27,340 --> 00:23:28,720
especially teach your

665
00:23:28,720 --> 00:23:29,720
non-privacy engineers

666
00:23:30,290 --> 00:23:31,640
how to engineer for privacy.

667
00:23:31,820 --> 00:23:32,460
This relates to

668
00:23:32,480 --> 00:23:34,440
it being the done thing.

669
00:23:35,660 --> 00:23:36,880
You want your engineers

670
00:23:36,880 --> 00:23:37,700
to just,

671
00:23:38,060 --> 00:23:39,480
the first thing that they think of

672
00:23:39,480 --> 00:23:40,020
when they think,

673
00:23:40,140 --> 00:23:42,280
I need to deal with PII,

674
00:23:42,420 --> 00:23:43,600
is okay,

675
00:23:43,700 --> 00:23:44,420
well that means it goes

676
00:23:44,420 --> 00:23:45,120
into this system

677
00:23:45,120 --> 00:23:46,540
and it's handled in this way.

678
00:23:46,860 --> 00:23:47,480
You don't want them

679
00:23:47,480 --> 00:23:49,760
to have to do it

680
00:23:49,760 --> 00:23:50,840
in whatever other way

681
00:23:50,840 --> 00:23:51,300
they've learned.

682
00:23:51,380 --> 00:23:52,240
You want them to do it your way.

683
00:23:52,320 --> 00:23:53,380
So teach them that way.

684
00:23:53,740 --> 00:23:55,000
Teach them how to do it right

685
00:23:55,000 --> 00:23:55,920
from the very beginning.

686
00:23:56,400 --> 00:23:57,800
Because the more they do,

687
00:23:57,940 --> 00:23:58,960
the less you have to do.

688
00:24:02,440 --> 00:24:04,160
But that does all sound

689
00:24:04,160 --> 00:24:04,880
like a lot of work.

690
00:24:04,980 --> 00:24:06,380
Like all of this backend stuff

691
00:24:06,380 --> 00:24:07,180
and all this education

692
00:24:07,180 --> 00:24:08,040
and all these policies

693
00:24:08,040 --> 00:24:09,260
and all these development questions.

694
00:24:10,340 --> 00:24:11,360
Okay, yes.

695
00:24:11,580 --> 00:24:12,500
It's a lot of work.

696
00:24:12,620 --> 00:24:14,260
But it's worth it.

697
00:24:15,140 --> 00:24:16,180
Good user privacy,

698
00:24:16,380 --> 00:24:17,560
it makes users happy.

699
00:24:17,720 --> 00:24:19,220
Happy users will buy more products.

700
00:24:19,300 --> 00:24:20,160
They will see more ads.

701
00:24:20,520 --> 00:24:22,160
Happy users are brand ambassadors.

702
00:24:22,720 --> 00:24:24,020
I'm going to pick on Uber here

703
00:24:24,020 --> 00:24:24,540
for a second

704
00:24:24,540 --> 00:24:25,380
because they're just

705
00:24:25,380 --> 00:24:27,300
a really good example right now.

706
00:24:27,660 --> 00:24:28,940
They had a lot of

707
00:24:28,940 --> 00:24:30,940
negative press around,

708
00:24:31,140 --> 00:24:32,320
among other things,

709
00:24:32,840 --> 00:24:34,240
their privacy practices.

710
00:24:34,620 --> 00:24:36,000
And a lot of people

711
00:24:36,000 --> 00:24:39,080
jumped ship to Lyft.

712
00:24:40,440 --> 00:24:41,780
Because people would say,

713
00:24:41,900 --> 00:24:42,340
hey, you know,

714
00:24:42,420 --> 00:24:43,120
I've tried Lyft

715
00:24:43,120 --> 00:24:43,960
and they don't do that.

716
00:24:44,220 --> 00:24:46,100
You should come over to Lyft.

717
00:24:46,320 --> 00:24:47,020
And similarly,

718
00:24:47,800 --> 00:24:49,200
you want to be that company.

719
00:24:49,420 --> 00:24:50,120
You want to be the company

720
00:24:50,120 --> 00:24:50,620
that people say,

721
00:24:51,180 --> 00:24:52,320
come to this company,

722
00:24:52,460 --> 00:24:53,340
they respect your privacy.

723
00:24:55,020 --> 00:24:56,420
Get those brand ambassadors,

724
00:24:56,720 --> 00:24:57,120
teach people,

725
00:24:57,400 --> 00:24:58,920
show your users

726
00:24:58,920 --> 00:25:00,300
that you are the one

727
00:25:00,300 --> 00:25:01,100
that they can trust.

728
00:25:02,080 --> 00:25:03,480
And then once you've done that,

729
00:25:03,700 --> 00:25:06,140
your own company will thrive

730
00:25:06,140 --> 00:25:08,160
because you're taking on less risk,

731
00:25:08,200 --> 00:25:09,040
which is always a good thing.

732
00:25:09,260 --> 00:25:12,180
Your user data is better,

733
00:25:12,360 --> 00:25:13,340
more useful to you.

734
00:25:13,400 --> 00:25:14,220
It's better managed

735
00:25:14,880 --> 00:25:16,560
so that you can do more with it.

736
00:25:17,180 --> 00:25:18,660
And then you are earning

737
00:25:18,660 --> 00:25:19,520
your users' trust.

738
00:25:19,880 --> 00:25:20,560
And again,

739
00:25:21,160 --> 00:25:22,300
users who trust you

740
00:25:22,300 --> 00:25:23,820
are users who use your products,

741
00:25:23,880 --> 00:25:24,520
who give you money.

742
00:25:24,860 --> 00:25:26,940
So do privacy right.

743
00:25:27,120 --> 00:25:28,300
Earn your users' trust.

744
00:25:29,480 --> 00:25:29,880
Questions?

745
00:25:31,860 --> 00:25:32,260
Microphone.

746
00:25:32,660 --> 00:25:33,540
I guess I'll use your mic.

747
00:25:33,820 --> 00:25:34,380
Yes, please.

748
00:25:35,940 --> 00:25:37,000
It works this time.

749
00:25:37,920 --> 00:25:38,800
So number one,

750
00:25:38,820 --> 00:25:39,680
I just wanted to say thank you

751
00:25:39,680 --> 00:25:40,340
for giving this talk.

752
00:25:40,500 --> 00:25:41,000
As an engineer,

753
00:25:41,200 --> 00:25:42,820
sometimes you get really gung-ho

754
00:25:42,820 --> 00:25:44,640
and driven to build a new feature

755
00:25:44,640 --> 00:25:45,920
which leverages all this data.

756
00:25:46,260 --> 00:25:48,020
But that doesn't really compare

757
00:25:48,020 --> 00:25:49,400
when you have the considerations

758
00:25:49,400 --> 00:25:50,720
of normal human beings in mind.

759
00:25:50,800 --> 00:25:51,960
So I think you're probably

760
00:25:51,960 --> 00:25:52,500
making a difference.

761
00:25:53,860 --> 00:25:54,900
So then you're developing

762
00:25:54,900 --> 00:25:55,440
an application

763
00:25:55,440 --> 00:25:56,880
and you're already sort of

764
00:25:56,880 --> 00:25:57,960
harvesting the minimum

765
00:25:57,960 --> 00:25:58,280
amount of data

766
00:25:58,300 --> 00:26:00,280
you need to carry on

767
00:26:00,280 --> 00:26:00,980
your value proposition

768
00:26:00,980 --> 00:26:01,880
and ultimately take

769
00:26:01,880 --> 00:26:02,360
a good function.

770
00:26:02,820 --> 00:26:03,060
Mm-hmm.

771
00:26:04,080 --> 00:26:05,300
If you can't afford

772
00:26:05,300 --> 00:26:06,020
the technical debt

773
00:26:06,020 --> 00:26:07,000
of launching beta testing

774
00:26:07,000 --> 00:26:07,620
or A-B testing,

775
00:26:08,360 --> 00:26:09,280
how do you suggest

776
00:26:09,280 --> 00:26:10,680
that you inform your users

777
00:26:10,680 --> 00:26:11,360
that you need to

778
00:26:11,360 --> 00:26:12,680
gather a data set

779
00:26:12,680 --> 00:26:13,380
for the same future?

780
00:26:15,240 --> 00:26:16,280
This would go back

781
00:26:16,280 --> 00:26:17,500
to very careful messaging.

782
00:26:17,660 --> 00:26:18,720
And I strongly suggest

783
00:26:18,720 --> 00:26:20,000
engaging your marketing team

784
00:26:20,000 --> 00:26:20,600
because that's literally

785
00:26:20,600 --> 00:26:21,140
their job.

786
00:26:21,760 --> 00:26:22,820
In some cases,

787
00:26:23,000 --> 00:26:23,360
like,

788
00:26:23,380 --> 00:26:24,520
if your company

789
00:26:24,520 --> 00:26:25,080
is just known

790
00:26:25,080 --> 00:26:26,360
for doing kinds of

791
00:26:26,360 --> 00:26:26,840
A-B testing,

792
00:26:26,920 --> 00:26:27,420
Google gets away

793
00:26:27,420 --> 00:26:27,800
with a lot

794
00:26:27,800 --> 00:26:28,280
because, like,

795
00:26:28,300 --> 00:26:29,240
there was that whole thing

796
00:26:29,240 --> 00:26:29,840
about they're testing,

797
00:26:29,900 --> 00:26:30,660
like, 60 different

798
00:26:30,660 --> 00:26:31,300
shades of blue

799
00:26:31,300 --> 00:26:32,320
or whatever it was

800
00:26:32,320 --> 00:26:32,960
a few years back.

801
00:26:33,260 --> 00:26:35,600
So if your company

802
00:26:35,600 --> 00:26:36,300
just has a reputation

803
00:26:36,300 --> 00:26:37,600
for doing all kinds

804
00:26:37,600 --> 00:26:38,420
of A-B testing,

805
00:26:39,120 --> 00:26:40,440
then that users

806
00:26:40,440 --> 00:26:41,280
have the automatic

807
00:26:41,280 --> 00:26:41,780
understanding

808
00:26:41,780 --> 00:26:42,180
that this is

809
00:26:42,180 --> 00:26:42,700
what you're doing.

810
00:26:42,980 --> 00:26:44,040
If you don't have that

811
00:26:44,040 --> 00:26:45,000
or you need to build it up,

812
00:26:45,180 --> 00:26:46,920
then this is

813
00:26:46,920 --> 00:26:47,420
where individuals,

814
00:26:47,560 --> 00:26:48,060
so, like,

815
00:26:48,080 --> 00:26:48,960
if you have two

816
00:26:48,960 --> 00:26:49,940
different sets of toggles,

817
00:26:49,960 --> 00:26:50,500
you might have two

818
00:26:50,500 --> 00:26:51,240
different sets of

819
00:26:51,240 --> 00:26:52,280
explanations for it,

820
00:26:52,320 --> 00:26:52,580
you know,

821
00:26:52,580 --> 00:26:53,400
depending on what they do.

822
00:26:53,980 --> 00:26:55,040
And just, like,

823
00:26:55,100 --> 00:26:56,320
treat it like any other

824
00:26:56,760 --> 00:26:57,880
privacy control, really.

825
00:26:58,560 --> 00:26:59,440
What's going on,

826
00:26:59,560 --> 00:27:00,720
what it's being used for,

827
00:27:00,860 --> 00:27:01,360
you know,

828
00:27:01,360 --> 00:27:01,760
and it might be

829
00:27:01,760 --> 00:27:02,620
as simple as

830
00:27:02,620 --> 00:27:03,260
we're trying to

831
00:27:03,260 --> 00:27:04,640
improve our products

832
00:27:04,640 --> 00:27:06,040
and, therefore,

833
00:27:06,500 --> 00:27:07,240
this feature.

834
00:27:07,640 --> 00:27:08,460
Because improving

835
00:27:08,460 --> 00:27:08,900
your products

836
00:27:08,900 --> 00:27:09,680
is a valid,

837
00:27:09,820 --> 00:27:10,360
you know,

838
00:27:10,360 --> 00:27:10,960
use case.

839
00:27:11,160 --> 00:27:12,040
Users understand that.

840
00:27:12,080 --> 00:27:12,980
They want better products.

841
00:27:13,080 --> 00:27:13,960
Like, everybody wants

842
00:27:13,960 --> 00:27:14,960
the products that they use

843
00:27:14,960 --> 00:27:15,640
to be cooler

844
00:27:15,640 --> 00:27:16,900
and do more for them.

845
00:27:17,200 --> 00:27:18,300
So, you know,

846
00:27:18,300 --> 00:27:18,920
it doesn't have to be

847
00:27:18,920 --> 00:27:19,880
a long technical explanation

848
00:27:19,880 --> 00:27:20,500
about, okay,

849
00:27:20,520 --> 00:27:21,120
we're A-B testing

850
00:27:21,120 --> 00:27:21,580
this and that

851
00:27:21,580 --> 00:27:22,660
and we're going to run

852
00:27:22,660 --> 00:27:23,360
the test for this long

853
00:27:23,360 --> 00:27:23,640
or whatever.

854
00:27:23,740 --> 00:27:24,800
It's just we're improving

855
00:27:29,100 --> 00:27:29,820
our products.

856
00:27:29,820 --> 00:27:30,140
Thank you.

857
00:27:30,280 --> 00:27:30,600
Mm-hmm.

858
00:27:31,960 --> 00:27:32,320
Mike?

859
00:27:34,960 --> 00:27:35,960
So, like Kim,

860
00:27:36,020 --> 00:27:36,720
I'd like to thank you

861
00:27:36,720 --> 00:27:37,580
for taking the talk.

862
00:27:37,660 --> 00:27:38,320
It's got some really

863
00:27:38,320 --> 00:27:38,720
good points

864
00:27:38,720 --> 00:27:40,140
and I'd like to address,

865
00:27:40,240 --> 00:27:40,460
like,

866
00:27:40,460 --> 00:27:41,140
the main point

867
00:27:41,140 --> 00:27:41,820
that you said

868
00:27:41,820 --> 00:27:42,400
that we should take away

869
00:27:42,400 --> 00:27:42,720
from it.

870
00:27:42,840 --> 00:27:43,020
Mm-hmm.

871
00:27:43,340 --> 00:27:44,280
Which is don't take

872
00:27:44,280 --> 00:27:45,340
more than you need.

873
00:27:45,620 --> 00:27:45,920
Mm-hmm.

874
00:27:47,580 --> 00:27:48,620
So, I'd like to use

875
00:27:48,620 --> 00:27:49,140
one of the examples

876
00:27:49,140 --> 00:27:50,040
that you used

877
00:27:50,040 --> 00:27:51,120
in your talk,

878
00:27:51,120 --> 00:27:52,020
which is the Flashlight app.

879
00:27:52,200 --> 00:27:52,420
Sure.

880
00:27:52,460 --> 00:27:53,800
So, right now,

881
00:27:53,800 --> 00:27:55,500
when you download

882
00:27:55,500 --> 00:27:56,200
a Flashlight app,

883
00:27:56,800 --> 00:27:57,300
you know,

884
00:27:57,300 --> 00:27:58,220
there's very little

885
00:27:58,300 --> 00:27:59,180
transparency into

886
00:27:59,180 --> 00:28:00,020
what they're actually

887
00:28:00,020 --> 00:28:00,500
asking for.

888
00:28:00,640 --> 00:28:00,900
In fact,

889
00:28:00,960 --> 00:28:01,260
you actually,

890
00:28:01,380 --> 00:28:02,760
on Android,

891
00:28:02,880 --> 00:28:03,420
you actually have to

892
00:28:03,420 --> 00:28:03,940
scroll down

893
00:28:03,940 --> 00:28:05,240
and click on the button

894
00:28:05,240 --> 00:28:06,240
to see what they're

895
00:28:06,240 --> 00:28:07,180
actually asking for.

896
00:28:07,360 --> 00:28:07,640
Mm-hmm.

897
00:28:07,640 --> 00:28:08,220
And a lot of times,

898
00:28:08,220 --> 00:28:08,720
they don't even

899
00:28:09,280 --> 00:28:10,560
give you the option

900
00:28:10,560 --> 00:28:11,680
when you start the app

901
00:28:11,680 --> 00:28:13,360
to opt in or opt out.

902
00:28:13,420 --> 00:28:13,620
Mm-hmm.

903
00:28:13,640 --> 00:28:14,480
They just turn it on

904
00:28:14,480 --> 00:28:14,920
by default.

905
00:28:15,080 --> 00:28:17,460
So, with that in mind,

906
00:28:17,620 --> 00:28:18,100
where do you,

907
00:28:18,240 --> 00:28:20,400
or how do you see

908
00:28:20,400 --> 00:28:20,920
a solution

909
00:28:20,920 --> 00:28:21,620
to that problem

910
00:28:21,620 --> 00:28:22,440
actually coming

911
00:28:22,440 --> 00:28:23,300
into play,

912
00:28:23,380 --> 00:28:24,880
specifically with things

913
00:28:24,880 --> 00:28:25,960
like the Android apps

914
00:28:25,960 --> 00:28:27,160
or the iOS apps

915
00:28:28,300 --> 00:28:28,980
or things like

916
00:28:28,980 --> 00:28:29,660
single sign-on

917
00:28:29,660 --> 00:28:30,040
with, like,

918
00:28:30,040 --> 00:28:30,780
Facebook credentials

919
00:28:30,780 --> 00:28:31,860
or something like that

920
00:28:31,860 --> 00:28:33,100
where people are asking

921
00:28:33,100 --> 00:28:33,860
for your birthday

922
00:28:33,860 --> 00:28:34,540
or whatever

923
00:28:34,540 --> 00:28:36,820
with no real indication

924
00:28:36,820 --> 00:28:38,700
that, you know,

925
00:28:38,720 --> 00:28:39,440
we need this birthday

926
00:28:39,440 --> 00:28:40,360
to serve you content

927
00:28:40,360 --> 00:28:41,100
or whatever?

928
00:28:41,660 --> 00:28:42,060
Mm-hmm.

929
00:28:42,180 --> 00:28:42,580
So,

930
00:28:42,760 --> 00:28:43,660
on-demand

931
00:28:43,660 --> 00:28:44,660
data requesting.

932
00:28:45,180 --> 00:28:46,340
iOS does this already,

933
00:28:46,500 --> 00:28:47,420
so instead of presenting you,

934
00:28:47,460 --> 00:28:48,400
when you download an app,

935
00:28:48,480 --> 00:28:49,160
instead of presenting you

936
00:28:49,160 --> 00:28:49,820
with a list of things

937
00:28:49,820 --> 00:28:50,220
that it wants

938
00:28:50,220 --> 00:28:50,900
right off the bat,

939
00:28:51,060 --> 00:28:52,200
it waits until you try

940
00:28:52,200 --> 00:28:52,860
and do a thing.

941
00:28:53,040 --> 00:28:53,360
So, like,

942
00:28:53,360 --> 00:28:54,460
if the app wants access

943
00:28:54,460 --> 00:28:55,040
to your camera,

944
00:28:55,660 --> 00:28:56,680
it'll wait until you try

945
00:28:56,680 --> 00:28:57,360
and do whatever

946
00:28:57,360 --> 00:28:58,040
in the app

947
00:28:58,040 --> 00:28:58,820
that needs the camera,

948
00:28:58,940 --> 00:28:59,480
and then it'll say,

949
00:29:00,000 --> 00:29:01,200
this app needs permission

950
00:29:01,200 --> 00:29:02,060
to access the camera.

951
00:29:03,600 --> 00:29:04,780
That puts it in context

952
00:29:04,780 --> 00:29:05,340
for the user

953
00:29:05,340 --> 00:29:05,820
because they're like,

954
00:29:05,920 --> 00:29:06,500
oh, I was trying

955
00:29:06,500 --> 00:29:07,020
to do this thing,

956
00:29:07,080 --> 00:29:08,080
clearly that needs the camera,

957
00:29:08,260 --> 00:29:09,100
I understand why

958
00:29:09,100 --> 00:29:10,120
I need the camera app,

959
00:29:10,280 --> 00:29:10,440
all right,

960
00:29:10,480 --> 00:29:11,140
I'm gonna grant permission.

961
00:29:11,960 --> 00:29:13,300
Or they might change their mind,

962
00:29:13,420 --> 00:29:14,240
which is a valid option,

963
00:29:14,360 --> 00:29:15,100
but they understand.

964
00:29:15,460 --> 00:29:16,100
So this goes back

965
00:29:16,100 --> 00:29:17,140
to having that meaningful choice

966
00:29:17,140 --> 00:29:17,960
and meaningful control

967
00:29:17,960 --> 00:29:18,840
because they understand

968
00:29:18,840 --> 00:29:19,620
why they're asking

969
00:29:19,620 --> 00:29:20,080
for permission.

970
00:29:20,960 --> 00:29:21,320
Android,

971
00:29:22,000 --> 00:29:22,900
in previous versions

972
00:29:22,900 --> 00:29:23,580
of Android,

973
00:29:25,040 --> 00:29:25,260
is what you say

974
00:29:25,260 --> 00:29:25,940
where they just kind of

975
00:29:25,940 --> 00:29:26,740
give you all of the things

976
00:29:26,740 --> 00:29:27,120
up front

977
00:29:27,120 --> 00:29:27,960
and you accept them

978
00:29:27,960 --> 00:29:28,440
or you don't

979
00:29:28,440 --> 00:29:29,380
and you're just kind of

980
00:29:29,380 --> 00:29:29,900
stuck with it.

981
00:29:30,360 --> 00:29:31,740
I think Android M

982
00:29:31,740 --> 00:29:32,880
is the one

983
00:29:32,880 --> 00:29:34,320
that started doing

984
00:29:34,320 --> 00:29:36,060
the on-demand permissions model.

985
00:29:36,420 --> 00:29:37,200
They still have to,

986
00:29:37,300 --> 00:29:37,540
like,

987
00:29:37,600 --> 00:29:38,120
older apps

988
00:29:38,120 --> 00:29:38,980
that haven't been updated

989
00:29:38,980 --> 00:29:39,760
still, unfortunately,

990
00:29:39,940 --> 00:29:41,340
run off the older

991
00:29:41,340 --> 00:29:42,000
permissions model,

992
00:29:42,180 --> 00:29:42,920
but, like,

993
00:29:42,960 --> 00:29:43,580
that is a problem

994
00:29:43,580 --> 00:29:44,360
that Google is specifically

995
00:29:44,360 --> 00:29:45,040
aware of

996
00:29:45,040 --> 00:29:46,400
and are working to fix

997
00:29:46,400 --> 00:29:49,340
because that is

998
00:29:49,340 --> 00:29:50,300
the worst way,

999
00:29:51,040 --> 00:29:51,480
like,

1000
00:29:51,500 --> 00:29:51,920
studies,

1001
00:29:52,140 --> 00:29:53,400
the worst way

1002
00:29:53,400 --> 00:29:54,200
to get users

1003
00:29:55,040 --> 00:29:55,620
is by dumping them

1004
00:29:55,620 --> 00:29:56,040
all up front

1005
00:29:56,040 --> 00:29:57,280
because you're asking them,

1006
00:29:57,740 --> 00:29:58,060
basically,

1007
00:29:58,940 --> 00:30:01,300
it's a reward thing,

1008
00:30:01,460 --> 00:30:02,720
so the user is trying

1009
00:30:02,720 --> 00:30:03,340
to take an action,

1010
00:30:03,420 --> 00:30:03,920
get an app.

1011
00:30:04,060 --> 00:30:04,820
You're putting a thing

1012
00:30:04,820 --> 00:30:05,340
in front of them

1013
00:30:05,340 --> 00:30:05,920
that is blocking

1014
00:30:05,920 --> 00:30:06,440
their ability

1015
00:30:06,440 --> 00:30:07,200
to do the thing.

1016
00:30:07,420 --> 00:30:08,000
So, of course,

1017
00:30:08,000 --> 00:30:08,380
they're going to say,

1018
00:30:08,420 --> 00:30:08,940
yes, I don't care,

1019
00:30:09,020 --> 00:30:09,180
whatever,

1020
00:30:09,300 --> 00:30:10,000
give me the thing.

1021
00:30:10,100 --> 00:30:10,680
I want the reward

1022
00:30:10,680 --> 00:30:11,520
that I'm trying to get.

1023
00:30:12,360 --> 00:30:13,220
So they don't,

1024
00:30:13,240 --> 00:30:13,520
like,

1025
00:30:13,540 --> 00:30:14,680
that is the worst time.

1026
00:30:14,840 --> 00:30:15,460
They're not going to pay

1027
00:30:15,460 --> 00:30:16,500
any attention to it

1028
00:30:16,500 --> 00:30:16,980
and that is where

1029
00:30:16,980 --> 00:30:18,020
you get those scam apps

1030
00:30:18,020 --> 00:30:19,040
that just take everything

1031
00:30:19,040 --> 00:30:20,000
because users don't see

1032
00:30:20,000 --> 00:30:21,060
and they take advantage of that.

1033
00:30:21,680 --> 00:30:23,080
So on-demand permission model

1034
00:30:23,080 --> 00:30:25,100
where you put the request

1035
00:30:25,100 --> 00:30:26,440
for permission,

1036
00:30:26,720 --> 00:30:27,540
request for data,

1037
00:30:27,680 --> 00:30:28,380
in the context

1038
00:30:28,380 --> 00:30:29,020
of what the user

1039
00:30:29,020 --> 00:30:29,800
is trying to do

1040
00:30:29,800 --> 00:30:31,400
because then they can understand

1041
00:30:32,260 --> 00:30:33,120
what it's for.

1042
00:30:33,300 --> 00:30:34,360
It makes sense to them.

1043
00:30:34,460 --> 00:30:35,700
They know why you're asking

1044
00:30:35,700 --> 00:30:37,660
and it's a logical next step

1045
00:30:37,660 --> 00:30:38,440
for them to say,

1046
00:30:38,600 --> 00:30:40,180
I want to do the thing.

1047
00:30:40,340 --> 00:30:41,820
I understand why it's asking

1048
00:30:41,820 --> 00:30:42,440
for this permission.

1049
00:30:42,540 --> 00:30:43,220
It's so that I can

1050
00:30:43,220 --> 00:30:43,780
do the thing.

1051
00:30:43,880 --> 00:30:44,320
Okay.

1052
00:30:48,020 --> 00:30:48,740
Follow up.

1053
00:30:49,340 --> 00:30:49,740
So,

1054
00:30:51,460 --> 00:30:52,380
the mobile model

1055
00:30:52,380 --> 00:30:52,880
for privacy

1056
00:30:52,880 --> 00:30:53,480
is really good.

1057
00:30:53,780 --> 00:30:54,600
Do you foresee

1058
00:30:54,600 --> 00:30:55,280
or, like,

1059
00:30:55,280 --> 00:30:55,940
see any hope

1060
00:30:55,940 --> 00:30:56,600
in the future

1061
00:30:56,600 --> 00:30:57,740
that modern web browsers

1062
00:30:57,740 --> 00:30:58,900
will also adopt that model

1063
00:30:58,900 --> 00:30:59,680
instead of just,

1064
00:30:59,740 --> 00:30:59,840
like,

1065
00:30:59,840 --> 00:31:00,480
walking everything,

1066
00:31:00,680 --> 00:31:01,340
giving you,

1067
00:31:01,360 --> 00:31:01,600
sort of,

1068
00:31:01,620 --> 00:31:01,940
the choice?

1069
00:31:03,700 --> 00:31:05,040
I think web browsers

1070
00:31:05,040 --> 00:31:05,360
could ever,

1071
00:31:05,440 --> 00:31:05,640
like,

1072
00:31:05,640 --> 00:31:07,520
agree on actual standards

1073
00:31:07,520 --> 00:31:09,000
and actually implement them.

1074
00:31:11,840 --> 00:31:13,100
There's miniature versions

1075
00:31:13,100 --> 00:31:13,580
of this.

1076
00:31:13,620 --> 00:31:13,740
Like,

1077
00:31:13,760 --> 00:31:14,380
every once in a while,

1078
00:31:14,500 --> 00:31:14,680
you know,

1079
00:31:14,700 --> 00:31:15,160
you'll get asked,

1080
00:31:15,300 --> 00:31:16,140
such and such website

1081
00:31:16,140 --> 00:31:17,300
wants to use your location,

1082
00:31:19,040 --> 00:31:19,140
okay,

1083
00:31:19,180 --> 00:31:19,440
I'm on,

1084
00:31:19,560 --> 00:31:20,000
like,

1085
00:31:20,120 --> 00:31:20,460
I'm,

1086
00:31:20,500 --> 00:31:21,200
for whatever reason,

1087
00:31:21,220 --> 00:31:22,440
using maps inside Chrome.

1088
00:31:22,640 --> 00:31:22,920
I don't know.

1089
00:31:23,560 --> 00:31:24,040
That makes,

1090
00:31:24,160 --> 00:31:24,360
okay,

1091
00:31:24,480 --> 00:31:25,660
I guess you can use my location.

1092
00:31:25,940 --> 00:31:26,240
Or, like,

1093
00:31:26,260 --> 00:31:26,940
it's a news site

1094
00:31:26,940 --> 00:31:27,720
and it wants to know,

1095
00:31:27,740 --> 00:31:27,940
you know,

1096
00:31:27,980 --> 00:31:28,460
where I'm at

1097
00:31:28,460 --> 00:31:29,420
so it can give me local news.

1098
00:31:29,520 --> 00:31:29,660
Okay,

1099
00:31:29,740 --> 00:31:30,260
that makes sense.

1100
00:31:30,280 --> 00:31:30,600
I'll allow.

1101
00:31:30,760 --> 00:31:30,900
So,

1102
00:31:30,980 --> 00:31:31,180
like,

1103
00:31:31,840 --> 00:31:32,400
they're trying,

1104
00:31:32,560 --> 00:31:33,160
I think,

1105
00:31:33,260 --> 00:31:34,440
but they're hampered

1106
00:31:34,440 --> 00:31:34,740
by,

1107
00:31:35,180 --> 00:31:35,460
like,

1108
00:31:35,500 --> 00:31:36,720
the lack of standards

1109
00:31:36,720 --> 00:31:37,180
and the,

1110
00:31:37,180 --> 00:31:37,300
like,

1111
00:31:37,400 --> 00:31:38,020
because you have to get

1112
00:31:38,020 --> 00:31:39,420
every website on the internet

1113
00:31:39,420 --> 00:31:40,440
to comply with that as well

1114
00:31:40,440 --> 00:31:42,800
and we're a really long way

1115
00:31:42,800 --> 00:31:43,080
from that.

1116
00:31:45,760 --> 00:31:46,660
Any other questions?

1117
00:31:49,300 --> 00:31:49,840
All right.

1118
00:31:49,940 --> 00:31:50,440
Thank you.

1119
00:31:51,460 --> 00:31:51,820
.

1120
00:31:53,780 --> 00:31:54,140
.

1121
00:31:54,140 --> 00:31:54,540
.

1122
00:31:54,540 --> 00:31:54,580
.

1123
00:31:56,960 --> 00:31:57,320
.

1124
00:31:58,740 --> 00:31:59,100
.

1125
00:31:59,100 --> 00:31:59,420
.

1126
00:31:59,420 --> 00:31:59,540
.

1127
00:31:59,540 --> 00:31:59,620
.

1128
00:31:59,620 --> 00:31:59,740
.

1129
00:31:59,740 --> 00:31:59,820
.