Comment by majormajor

2 hours ago

This has not been the case at any of my past employers in B2C...

There was a fair amount of scrambling to get GDPR/CCPA compliant, but even that was done largely with a prevailing "ah, this is a defensible thing to store, make sure you can annonymize it or scrub it if needed" vs "stop storing this."

Starting with the ones that are most popular in the US, "Big Tech" usually includes:

- Google - Gmail and Maps contain massive amount of PII, Photos contains all sorts of other sensitive stuff, and they have not treated those aspects of those products like radioactive waste

- Meta - Facebook has a real names required policy even. Not a lot more needs to be said there, I think.

- Amazon - Nothing I've seen about trying to move away from how they need your name/address/payment info and all. If anything, more and more geographic targeting and such.

- Microsoft - Now you need to tie your local Windows install to their cloud services, not moving away from collecting user info. Also moving towards subscriptions which means PII and payment info.

- Apple - cloud accounts + email + payments + subscriptions all here too. Getting into banking-type services, that's leaning into PII...

- Netflix - more and more PII (IP tracking and geolocation combined with things like email and name) to fight account sharing...