Comment by greyface-

3 years ago

It's not. Federal regulations require "affirmative, express consent" for CPNI release approval to count as "opt-in". https://www.govinfo.gov/content/pkg/CFR-2018-title47-vol3/xm...

11 comments

greyface-

Reply
tguvot  3 years ago

well, i guess this email constitutes "affirmative, express consent" unless user clicks on opt-out. at least this is conclusion of google legal department.

  • seanhunter  3 years ago

    Affirmative means the user has to take an action to consent. Not doing something for 30 days isn't an affirmative action - it's known as "implicit consent" which is the opposite of "affirmative consent"[1]

    Express means they have to specifically consent and can't be implied to consent or consent passively somehow.[2]

    This is neither affirmative nor express consent. Also notice that literally nothing that Google (or any company) can do gives affirmative, express consent from the user. The user themselves has to do something for Google to obtain that consent - that's literally the whole point of the wording of "affirmative, express".

    I'd be very surprised if google's legal thinks this is actually consent or ok. I think most likely they said it probably wouldn't stand up to challenge and the McKinsey types who run google decided they probably wouldn't be challenged and it was worth the risk.

    [1] https://iapp.org/resources/article/consent-2/

    [2] https://www.wilsonlaw.com/blog/difference-between-express-an...

    • tguvot  3 years ago

      >I'd be very surprised if google's legal thinks this is actually consent or ok. I think most likely they said it probably wouldn't stand up to challenge and the McKinsey types who run google decided they probably wouldn't be challenged and it was worth the risk.

      many of (ex)googler posts mention that legal needs to sign off on everything and looped into everything and they find it frustrating and slowing things down

      change of such proportions can't be executed without involvement of multiple legal departments that both approved this decision and scrutinized every letter of this letter.

      edit: from cpni itself " Use of opt-out and opt-in approval processes. A telecommunications carrier may, subject to opt-out approval or opt-in approval, use its customer's individually identifiable CPNI for the purpose of marketing communications-related services to that customer. A telecommunications carrier may, subject to opt-out approval or opt-in approval, disclose its customer's individually identifiable CPNI, for the purpose of marketing communications-related services to that customer, to its agents and its affiliates that provide communications-related services. A telecommunications carrier may also permit such persons or entities to obtain access to such CPNI for such purposes."

      or in general 64.2007 and 64.2008 describe that it's ok

  • schiffern  3 years ago

    >this email constitutes "affirmative, express consent" unless user clicks on opt-out.

    No. That would be (by definition) negative, implicit consent.

    Federal law specifically demands "affirmative, express" consent.

  • vel0city  3 years ago

    It's not as there's no guarantee the subscriber ever actually received the email much less made it past their spam filter or that they opened it and read it.

    I can't see any way this is "opt-in".

    • tguvot  3 years ago

      there is no guarantee to make sure that subscriber actually delivered notification outside of personal delivery with ID verification.

      i guess google legal decided that this is about "reasonable" effort and given that this email sent from google it's above reasonable that it's past spam filter and sufficiently reasonable effort in general.

      1 reply →

  • dee-bee  3 years ago

    The parallel on a website would require a clickwrap, I think they're just being bold and hoping nobody notices and/or they want the suit.