Remote View

1y ago

Thomas 🔭✨ (@thomasfuchs@hachyderm.io) 23andMe just sent out an email trying to trick customers into accepting a TOS change that will prevent you from suing them after they literally lost your genome

hachyderm.io Thomas 🔭✨ (@thomasfuchs@hachyderm.io)

Attached: 1 image ⚠️ 23andMe just sent out an email trying to trick customers into accepting a TOS change that will prevent you from suing them after they literally lost your genome ro thieves. Do what it says in the email and email arbitrationoptout@23andme.com that you do not agree with the new ...

23andMe just sent out an email trying to trick customers into accepting a TOS change that will prevent you from suing them after they literally lost your genome ro thieves.

Do what it says in the email and email arbitrationoptout@23andme.com that you do not agree with the new terms of service and opt out of arbitration.

If you have an account with them, do this right now.

Here’s an email template for what to write: https://www.patreon.com/posts/94164861

144 comments

I don't see how an email that has no proof of delivery (could have ended in spam for example) would be legally binding.
Accepting a ToS update simply by virtue of no action is also questionable unless provisions permitting that were in the ToS you've accepted and even then it would not work in the European Union, because that's listed in the forbidden clauses registry.
- I thought the same thing when my Disney+ rate went up a couple months ago and I couldn't find the email warning about it in my inbox or spam folders.
  Why do we let these companies get away with everything? If the rates are going up, show me in the app/ui. Make it opt in. Disable my ability to watch anything until I approve the increase in spend. It should be illegal to just change the terms of a contract and say "I sent you an email."
  
  You most likely did not officially consent to the changes and have a prolonged right to terminate the contract without the need of upholding the contract duration.
  It’s probably mich cheaper just to deal with the few that complain rather than sending out hundreds of thousands of paper letters or having them confirm the changes electronically and terminating the contracts of those who did not accept.
- Accepting a ToS update simply by virtue of no action is also questionable
  Even it being "questionable" is a fucking outrage -- it should be so blatantly, obviously, disallowed that a lawyer should lose their license just for proposing it!
  The entire concept is a goddamn farce.
  
  Nope. The silent consent concept is a nice thing, it solve a lof of problems both for companies and private citizens. I could offer plenty of examples of the correct use of the concept that solve problems.
  23andMe is just doing a big dick move trying to avoid to be sued for the leak.
- It's not, and TOS are not legally binding either
  By viewing this post, you agree to gift 50% of all after tax future earnings to PersnickityPenguin. Additionally, your entire Steam Library of games is hereby under sole ownership of PersnickityPenguin. All games and/or steam account login and password must be provided to PersnickityPenguin.
  Failure to transfer all financial and virtual property within (30) days is considered a breach of contract. Each incident of a breach of contract will result in a $500,000 penalty per incident. Viewer agrees to these terms of service. Any dispute or breach of contract will result in additional legal fees to be paid by the viewer entering into this contract pursuant to paragraph (A).
  
  damn. I lost. Give me your bank details to send you your money.
- My ISP, phone company, bank, insurance company and everyone else send me TOS related messages from time to time. Usually, the message is something along the lines of: “We’re altering the deal. Pray we don’t alter it any further”
  It doesn’t seem fair to me, but since everyone is doing it, there probably isn’t a law against it.
  
  You'd think that, but you know those "don't remove or warranty is void" stickers on stuff? They're illegal.
  
  Every time an ISP does that around here they send you a notification via certified mail with a prepaid return envelope and a service cancellation form included - you can decide to not continue using the service without any early cancellations fees etc.
  If they fail to do that they get fined by consumer protection agency, are required to return any fees they charged based on the change and they get to start over - send a notification that follows the rules resetting the clock for those who opt to cancel
- Why would you need proof of delivery? The original email gives instructions. You follow those instructions and can prove you did so with date and timestamps. I don't see the issue.
  
  https://en.m.wikipedia.org/wiki/Non-repudiation
  Legally you have to be able to prove someone received a thing. It's why you get served when you're sued. An agent physically hands you the complaint (or whatever they're called). If the papers were put in the mail the person being sued could say they never received them.
  
  You can't prove that person ever saw that email.

"But they clicked the imaginary button, your Honor. How can they still have rights ?"
- This just blows my fucking mind. Same thing happened with Crunchyroll, apparently I could have been part of a class action lawsuit when it was found out that they were selling users data. But I didn't hear about it, didn't get any letters and didn't see the email. The date came and went. Because I didn't "take action" in time I apparently forfeit my right to my piece of the settlement AND to sue.
  HOW THE FUCK IS THAT LEGAL. How can you make the least amount of effort to notify someone after illegally fucking up their life, then when they don't respond (because they didn't see the notification or whatever), say, "well legally that means they're ok with it, and can't do anything in the future"
  What the fuck
  
  It depends, it may not be. TOS are not as ironclad as they appear.
  
  Send their legal team an email telling them you're going to update the terms unless you hear from them.
  Also, send a bunch of irrelevant shit about what your doing and thinking about and video games you're playing first, they'll probably block your email address and then wont see the legally important email.
  
  The class actions I've been part of have said that if I want to retain the right to sue then I have to opt out of the class action. I don't think it's possible to be force-opted in, and in that case you should retain the ability to sue.
  I've only been in 3 or 4 though, so I don't know if that's representative of all class actions.
  
  Damn I forgot about that Crunchyroll class action. Thanks for reminding me. I got those emails too but I have until the 12th. It's only $30 but that's like two Five Guys meals so...
  
  Technically a contract can have anything in it that both parties agree to, unless some are all of those provisions are actively illegal. I would agree that assumed agreement should be illegal. You could probably fight this in court, make the argument that this is a material change to the contract what you did not agree to and would not have agreed to had you been aware of it. But that costs money and lawyers and time.

"They lost my genome" is certainly a 2023 phrase.
- It's only useful to US assurance companies.

If anyone wants my genetic information just come to my door and I'll supply it to you directly 😏
- 🍆💦
  
  Saw this in my inbox and totally thought it was for this comment lol
  https://lemmy.world/comment/5851431

I feel like the TOS you are subject to is the one you signed when you first used the service. Unless you have been constantly using their service, I can't see how a new TOS would affect you. I could be WAAY off here because IANAL, but a company can't just retroactively change the TOS for customers without some kind of action taken by the customers under the new TOS.
- I once successfully defended myself from a lawsuit by invoking a previous TOS. The court allowed me to choose any version of the TOS that benefited me the most. It was akin the doctrine in contract law that ambiguity is always found to be detrimental to the drafter of the contract.
  
  🦆 yeah! That's awesome! Kudos to you for prevailing.
  
  the doctrine in contract law that ambiguity is always found to be detrimental to the drafter of the contract.
  Anywhere to read more about this?
- IANAL too, buddy, IANAL too
  
  I just LOVE that the standard acronym for a lack of legal license sounds like an Isaac Asimov porn parody 😆
- Even that's rather iffy too. If it's been made so long that a reasonable person cannot be expected to read or understand it, it likely won't hold up.
  Of the courts decide to say, fuck it then it won't hold up.
  If this goes to a class action suit, I expect the judge to not let this change of TOS affect who is covered under the class action suit.
  This is just a way to make the customer THINK they can't sue.

Isn't this illegal?
- Of course, and in some places a TOS isn't even legally binding.
- No, but that doesn't mean it's legally enforceable.
  You can't sign away negligence in a contract.
- Yes but they'll just outspend the average person in court. It's a fucked design

The real question is why would you put your genome into the hands of a company without a compelling reason beyond "This sounds cool"
- A lot of people didn't, but their relatives did and now theyre implicated.
  
  If my uncle did this, how would they get my information and genome over him? I read the Wikipedia article but still don't understand how this works.
- So I can prove that I'm 3% black and get my word pass. /s
- It being cool is a compelling reason.
- https://forums.escapistmagazine.com/threads/facebook-ceo-people-who-trust-me-are-dumb-f-cks.48899/
- "I use discord cos It is so cool"...
- How else are you going to get it?

I had them destroy my sample and delete my data the week they went public, so I'm glad we've finally reached the "I told you so" phase of this.
- How can you be sure they did what you requested? How can you verify?
  
  If I was that guy I would dig for the leak and search through it. If I would find even a shred of my data, that's a lawsuit.

Nobody's genome was lost. What happened was, users with weak passwords had their accounts compromised, something like less than 2,000 of them, and from those accounts, bad actors were able to access and download family tree data for something like 6.5 million accounts.
I don't really see how the data lost is actionable in any way except for the spoofed "Hey gramma! It's me! I'm in jail and I need bail money!" phone calls.
- From what I understand - the first action the bad actors are taking are releasing the family trees to "out" anyone with Jewish relatives.
  So, just hate crimes to start.
- One of the typical arguments is selling ancestry history to insurance companies, effectively handing them health data which could lead to up-pricing or rejections for customers with bad health history.
  
  That's 23andMe's end game anyways
  
  That is a whole different can of worms and should be illegal as well
  
  But at least the second one isn't allowed anymore. I'm not sure if the ACA addresses the first point.
- Yes, and if my genome was stolen I'd probably be dead.
  
  There needs to be a c/Literally lol
  
  We can rebuild you. We have the technology.
- I don't really see how the data lost is actionable in any way
  Agreed unfortunately. An important thing in US law that people often don't know is that in most cases, you need to prove that you were damaged in some way. Unless the company broke a specific law, you probably just have to accept it until you have problems relating to identity theft. And even when that happens, you'd still need to prove that the the attacker used the lost 23andMe data.
  I personally don't understand why people use these services in the first place. Let's all let some private company that we know nothing about build an absolutely massive database of people's DNA. And let's voluntarily do it and even pay them for that "service". Sure, that sounds like a good idea. What could possibly go wrong? Hope your minor curiosity was worth the massive privacy invasion.
  
  I personally don't understand why people use these services in the first place.
  In my case, I went through 23 and Me because 75% of my DNA comes from sources unknown. No idea who my father was or my maternal grandfather. So being able to fill in those gaps as well as helping to determine medical risk has been very useful.
  
  Building a massive collection of DNA is a really good thing from a research standpoint. Plus, it's helping solve a bunch of murder cold cases.

They didn't lose it, they know exactly where it went
- Piracy is theft in the eyes of the law. So because the hackers copied it, your data was lost and you should be compensated for the loss.

So, our main interactions happened in the past, your fault and abuse of me happened in the past, and now, in the present, you can slip a little "go out of your way or the legal terms governing our interactions in the past will be altered" clause in an email, and it's all legal?
(Hold on, let me try applying a rule of thumb that helps me answer legal questions like this: Would this help the rich and powerful maintain riches and power?... Yes. I think the answer to my question above is yes.)
I'd argue the the interactions and faults of the past should be governed by the agreement we had in the past.

Did they lose anyone's genome? That's not what's been reported. They certainly lost customer information and this is definitely a super shitty move to trick you into waiving some rights, but I've seen no reporting that says they lost full DNA information.
- They have disabled the download data button and refuse to provide customers with a copy of their own data. I have been trying to get a copy of my data for over a month and they just tell me they'll consider re-enabling the button in the future.
- I would bet money (not much, relax) that they got their shit hacked and locked down by ransomware at least, if not also extracted for sale by the same black hat.
  
  I was under the impression that it was compromised logins of users that were used to get into accounts, afaik they weren't actually hacked.

Thanks for sharing this

bruh

Wow, that's dirty. The email you need to opt out at is different from what they link. If you don't respond, you automatically agree to their new TOS which bars you from taking class action against them. Shady af.

Ok but is fuchs a real last name lol
- It's literally just "Fox" in German.
- Yes. My mother had a teacher named Mrs. Fuchs. And she told me, "you can guess what we all called her." And that was in the 1950s!

Then it should have been upvoted for reality.

If you were dumb enough to pay someone to take your genome for profit, a second grift is just icing on the cake.

I'd pass this around if the writer knew another adverb. I'm tired of 'litchally' people.

How is this a trick?
- They sent an email that seems standard and claims to be beneficial. I would have ignored it if I wasn't aware of the current situation
  
  Wew, ignoring emails is a trick now?
- What would you call it, unmitigated benevolence?
  Ok now that I have that out of my system, let's see...
  trick /'trik/ noun
  a cunning or skillful act or scheme intended to deceive or outwit someone.
  scheme /ˈskēm/ noun
  a plan or program of action
  especially : a crafty or secret one
  outwit /au̇t-ˈwit/ verb
  to get the better of by superior cleverness : outsmart
  What we have, in the immediate wake of a massive security breach, mind you, is an attempt to benefit the company by getting the better of the customers, writ large, by altering how disputes are handled. By taking the unusual step of requiring explicit opt-out from the new TOS within a short timeframe, they make it more likely that customers will "accept" the TOS without even realizing it and be in a worse position as a result.
  That qualifies as an act intended to outwit customers.
  Or, to put it another way, if they had contacted customers and asked for an opt in for the new TOS, nobody would consider that an attempt to outwit.
  So, yeah, this is a trick to further fuck over customers who are already victims of the company's poor security practices.
  
  that customers will “accept” the TOS without even realizing it
  Somebody -- preferably a goddamn judge -- really needs to start explaining to all these sociopathic corporate lawyers that...
- It is a legit question. Usually you don't have to pro-actively inform anyone that you disagree with anything, TOS included. That's just what companies want you to believe since it benefits them greatly.
  No idea though how things in the U.S. are handled and if there are differences in certain states. It would surprise me though if that was actually an enforcable legal principle.
- I don't get why it's a trick either. That's the catchy headline right? But no word on if the changes apply into the past or it's just lawyers trying to protect themselves for next time. It's an email with new TOS and the ability to opt out.
  No it's not good for users and yes it's a shitty 30 day notice in an email even I didn't read yet because I'm so irritated with them.
  But reading the patron post didn't tell me how it was a trick and neither did the mastodon link. However the replies were good and helped fill me in on some details I wasn't aware of yet on the actual breach. https://hachyderm.io/@thomasfuchs/111531294441702837
  Not sure why the down votes on a perfectly acceptable question.
  
  Asking users to Opt out as a method to replace an Opt in TOS is a trick because they are hoping users won't see it. If they sent an email asking users to click a link to Opt in to the new TOS, that would be OK.

144 comments