Thread by @SuVergnolle

🧵As a legal scholar, I'm not knowledgable to talk about viruses, nor #COVIDー19.
But as an increasing number of people are turning to online socializing tools like @houseparty, I took a look at their privacy policy (houseparty.com/privacy/#house…).
Below are some of my findings.

👇

By calling themselves "House Party" they are setting the privacy expectations of a house party. But don't be mistaken, their house is full of recording microphones 🎤and cameras 🎥.

House Party is claiming ownership on everything you do on their services. The validity of this assumption is far from certain (especially if we apply intellectual property laws), but I would advise you not to share that secret Coca-Cola recipe or that secretive start-up idea.

In many privacy policies, we find this declaration. It would be more transparent (and sometimes important) to know who are their business partners...
The only thing you should keep in mind is that they can share your personal data with their partners.

This is one of my favorite parts of the privacy policy. House Party declares that your activities on their service might be qualified as "non personal data" (sic...) and your opt-out has no value.

First, one person's activities on a service are, under GDPR, considered as "personal data". It's hard to imagine what activities could not be qualified as such.
Second, the determination of the effectiveness of advertising looks like a processing under GDPR.

Then, they discuss Do Not Track technologies.
Looks great, right?
Don't get to excited because they declare they don't take it into account and keeps tracking you.

How do they track you?
They use the usual tracking tools, including cookies, Pixel tags / web beacons, analytics tools...
If you want to "opt-out" from Google Analytics, you'll need to download a "Browser add-on" from Google and hope for the best.

House Party tracks you by default.
If you don't want to be tracked, you can "opt-out".
For many reasons this doesn't look compliant with GDPR. One of them is that, since they rely on consent for the processing of your data, they have to get "explicit" consent for every purpose.

You can ask for deletion of your data. But they can do whatever they want: erase it or not.
They seem to have trouble erasing data from archived or backup copies...
Not sure how this complies with article 17 of GDPR.

Another great sentence from their privacy policy!
The "méchant" (bad) Internet could collect your personal data.
House Party doesn't take responsibility for securing its information systems. Regardless, such declaration is unenforceable under GDPR.

House Party declares that California law applies to their privacy policy and their services.
All privacy experts know that such declaration are plainly useless. For personal data collected in the EU, GDPR applies.

No matter how bad this privacy policy seems to you, it doesn't give you excuse NOT to stay home.
You can always consider more privacy preserving and open-source software.
#StayAtHome