kids – Ben Edelman

Teen Safety, Uber’s Protests, and the Democratic Process

Benjamin Edelman — Sun, 22 Dec 2024 07:07:50 +0000

Uber this week emailed San Francisco users of Uber Teen (a service that transports kids ages 13-17) both to announce that it is suspending that service in California, and to blame new California Public Utilities Commission rules for that closure. Uber claims CPUC made “new and onerous changes” which left the company “no choice” except to suspend service. I emphatically disagree. The problem, such as it is, is of Uber’s own creation — and Uber had and has a viable path forward.

Narrowly: Nothing forces Uber to suspend service. Uber could comply with the CPUC’s requirement and continue service by implementing reasonable driver registration precautions, in fact the same precautions that competitor HopSkipDrive has used for years. The words “no choice” have literal meaning, and that’s just not the situation here. The real issue is that Uber disagrees with CPUC’s requirement that it check driver fingerprints, arguing that its background checks suffice. But that disagreement does not compel Uber to discontinue service. Many people and companies disagree with many laws and regulations. The normal process is to submit comments in a legislative or rulemaking process, to sue if you think the rule is so broken that (say) it’s unconstitutional, to invoke political remedies such as replacing whoever imposed the rule, and ultimately to honor the democratic process by complying. Win some, lose some, and hope to win more than you lose. In contrast, Uber’s approach is a threat: Either the regulation goes Uber’s way, or Uber will cease service.

Broadly: Uber suggests that CPUC’s regulation is ill-advised. To evaluate, start with the rationale according to CPUC:

When an adult is being tasked to provide a service to a minor, the adult is placed in a position of trust, responsibility, and control over California’s most vulnerable citizenry—children. Not conducting a fingerprint-based background check to identify adults with disqualifying arrests or criminal records would place the unaccompanied minor in a potentially dangerous, if not life-threatening situation. That is why California Assembly Bill 506 … requir[es] that administrators, employees, or regular volunteers of youth service organizations undergo a background check that includes fingerprinting.

In response, Uber claims that its background checks work well and are sufficient. Who’s right? Consider the broader context. Uber’s background checks rightly deny accounts to drivers with bad driving records, prior ejections from Uber’s platform, or no documentation establishing right to work. But if a driver can’t pass those checks, the standard strategy is to “borrow” an account from someone who can. Many people tolerate a certain amount of this for ordinary adult rides. As the CPUC explains above, the stakes are higher when transporting minors unaccompanied. In that special context, higher standards are no surprise.

If fingerprinting drivers were massively costly, it might nonetheless be an unwise investment — a cost exceeding plausible benefits. For all its protestations to CPUC and to users, Uber never quite explains why it’s (supposedly) so difficult to do what CPUC specifies. If I had to implement CPUC’s requirement, I’d collect driver fingerprints through smartphones or at the inspection centers that check drivers’ vehicles. This sounds like software plus business operations — some work, but proportional to the business opportunity of the Uber Teen service. It feels particularly reasonable because fingerprint security is increasingly common. While an employee at Microsoft, I had to present my fingerprint to my phone’s Authenticator app to activate two-factor authentication to access company resources. CPUC similarly seeks fingerprint security for drivers transporting unaccompanied minors. Why should a minor’s safety get less protection than a company’s secrets?

In a filing before the CPUC, Uber argued that higher registration requirements for Uber Teen drivers would reduce the number of drivers, hence increasing prices to passengers. But if Uber Teen rides pay drivers materially more than regular rides, drivers have corresponding incentive to get registered. The only sustainable price gap is the result of the time or difficulty of registration, but by all indications that’s minimal. If a driver’s registration burden is small, as it should be, the price gap should also be small. Supply and demand.

The most charitable reading of Uber’s message to users is that Uber would like to comply with CPUC’s requirements, but had too little time. Yet here too, Uber’s position is in tension with the facts. Uber had long known CPUC took a dim view of its service to teens, including correspondence with CPUC staff as early as January 5, 2024. On March 14, 2024, Uber filed a motion seeking approval of its service for teens. CPUC’s rulemaking was published on October 30, 2024, giving Uber a further 30 days to come into compliance. And Uber says it intends to continue service for teens until December 23, 2024. That marks 353 days since Uber was on notice of the disagreement, and 54 days between CPUC’s rulemaking and Uber’s scheduled withdrawal of service. If Uber had used those 54 days effectively, not to mention those 353, there’s every indication it could have met CPUC’s requirements. If Uber needed additional time, it could have explained how long and why. Nothing about CPUC’s approach or timetable compelled Uber to withdraw its service for teens.

Any Uber complaint about too little time to comply is further undermined by CPUC’s 2016 guidance and Uber’s reply. In particular, CPUC specifically put Uber on notice that it would need an additional approval to launch service for minors, and Uber promised to discuss with CPUC before launching any such service. So any new urgency is of Uber’s creation.

Enlisting users in its fight against CPUC

Nothing could be more fundamental to the Democratic process than informed constituents making their views heard. And the CPUC did solicit comments, though for whatever reason none were received.

But what Uber envisions now is something quite different than informed public comments. Instead, Uber provides its users with, at most, a portion of the information they would need to evaluate the disagreement. Consider: Uber’s email to users claims “new rules requiring significant changes to Teen accounts” but doesn’t say a word about what those rules are or what changes would be required. (In fact by all indications the changes are only to driver verifications, not to user accounts.) While CPUC posted a detailed rulemaking with discussion of rationale and alternatives, Uber doesn’t mention any such document available — not a link, not even the title of the proceeding. Uber’s email asks users to “let the CPUC know” “if teen rides are important to your family”, but the question before CPUC isn’t whether teen rides are important, but rather what verifications are appropriate to provide sufficient safety for those rides.

When Uber delivers user comments to CPUC, will it deliver them all? Or just those that support its position? There’s reason to suspect shenanigans: In 2015, Uber delivered 8 boxes of supposed user petitions to regulators in St. Louis, but the boxes turned out to contain only water bottles.

Uber’s attempt to turn users against CPUC is reminiscent of the company’s infamous 2015 “De Blasio mode” which mobilized users against proposed New York regulations. There, as here, Uber treated users like pawns in an astroturf operation — giving users incomplete information designed to prompt an immediate forceful response. Uber plainly hopes to flood CPUC with complaints about regulation supposedly causing suspension of Uber Teen. But users might have second thoughts if they knew the full picture. Users surely value the low prices Uber emphasizes, but for transporting unaccompanied minors, safety is bound to be a priority too. Ultimately Uber gave users no way to judge whether its protections are sufficient or whether CPUC’s requirements would actually be useful. With the limited context Uber provides, what can a user usefully tell CPUC? At a minimum, Uber should have linked to the CPUC rules at issue, should have summarized what it saw as most objectionable, and should have offered a specific alternative. A better approach, to give users a full sense of the debate, would have summarized the rationale CPUC offered for its approach, fairly and evenhandedly, so users would be closer to deciding for themselves. Predictably, Uber did none of this.

These days, Uber seeks to portray itself as kinder and gentler, supposedly reformed from its scandalous peak of 2015-2017. Uber now sponsors NPR. Chief Legal Officer Tony West is Kamala Harris’s brother-in-law and campaign advisor. But has the leopard really changed its stripes? Tellingly, Uber’s terms of service still require users with disputes to file arbitrations (not lawsuits) before an arbiter Uber chooses, and ban users from filing class actions so a single set of lawyers can efficiently pursue the claim for everyone affected. Suppose Uber gets its way and returns to transporting unaccompanied minors without the fingerprints CPUC requires. If something terrible happens — a kidnapping, assault, or worse — Uber’s terms says passengers cannot even sue. This episode smacks of the Uber of a decade ago. I’ve added it to Uberscandals.org in lobbying, regulators, and safety.

Refunds for Minors, Parents, and Guardians for Purchases of Facebook Credits

Benjamin Edelman — Tue, 12 Jul 2016 04:00:00 +0000

On May 26, 2016, the U.S. District Court for the Northern District of California approved the settlement of a class action against Facebook involving in-app purchases of Facebook Credits by minor children. The case was maintained on behalf of a class of children who were Facebook users (“child users”) below the age of 18 from whose Facebook accounts Facebook Credits were purchased. The case was filed by two minor children through their parents on February 23, 2012. The two children and the class were represented by attorneys Brooks Cutter and John R. Parker of the Cutter Law Firm in Sacramento, California; Daniel B. Edelman of the firm of Katz, Marshall & Banks in Washington, D.C.; and Benjamin Edelman, an associate professor at the Harvard Business School. On March 10, 2015, the Court certified the case as a class action for purposes of declaratory and injunctive relief on behalf of all minor children who were users of Facebook from whose Facebook accounts Facebook Credits were purchased at any time between February 23, 2008 and the date of the certification order, March 10, 2015. At the same time, the Court declined to certify a class action for purposes of class-wide monetary relief.

During the period covered by the suit, hundreds of thousands of child users purchased Facebook Credits for use in playing Facebook-based games and applications. To make such purchases, child users generally used credit cards, debit cards or other payment instruments that belonged to their parents or other responsible adults. Facebook made a practice of retaining the payment information provided at the time of the child user’s initial purchase for easy use in later purchases. Facebook advised that purchases by children were to be made only with the permission of the parent or guardian. Facebook did not, however, require evidence that any of the purchases was actually authorized by the parent, guardian or owner of the payment instrument. In many instances, the child user did not have authorization to use the card or other payment instrument to purchase Facebook Credits. Facebook specified in its terms of use that all transactions are “final”. It later stated that all transactions are “final except as otherwise required by law”.

Facebook’s Terms of Use state that purchase transactions are governed by the law of California. The Family Code of California provides that contracts with minors are voidable by the minor at any time before attaining the age of 18 or within a reasonable time thereafter. The court applied that principle to this case: “The law shields minors from their lack of judgment and experience and under certain conditions vests in them the right to disaffirm their contracts. Although in many instances such disaffirmance may be a hardship upon those who deal with an infant, the right to avoid his contracts is conferred by law upon a minor for his protection against his own improvidence and the designs of others. It is the policy of the law to protect a minor against himself and his indiscretions and immaturity as well as against the machinations of other people and to discourage adults from contracting with an infant.” (MTD decision, October 25, 2012, at pp. 11-12.) The court continued: “[O]ne who provides a minor with goods and services does so at her own risk.” (Id. at p.12.)

Facebook defended the claims in part by arguing that kids had received and used the electronic goods they paid for. The court specifically rejected this reasoning, finding that kids are entitled to refunds even for items they used. “Under California law, a minor may disaffirm all obligations under a contract, even for services previously rendered, without restoring consideration or the value of services rendered to the other party.” (MTD Decision at p.14, internal quotation marks omitted)

Prior to the settlement, Facebook provided an online procedure for refund requests in various specific circumstances such as fraudulent use of a user’s account by a third-party. Facebook’s refund procedure did not include an option to request a refund on the ground that the purchase was made when the user was a minor.

The settlement requires Facebook to apply refund practices and policies with respect to U.S. minors that comply with the California Family Code.

The settlement further requires Facebook to “add to its refund request form for In-App Purchases for U.S. users a checkbox or substantially similar functionality with accompanying text such that users are able to indicate that the In-App Purchases for which they are seeking a refund was made when the user was minor.”

The settlement additionally requires Facebook to “implement a dedicated queue within Facebook to address refund requests in In-App Purchases, made by U.S. Minors subject to verification of minority. The employees staffing the dedicated queue will receive further training regarding how to analyze and process such refund requests in accordance with applicable law.”

If you or your minor child were charged for Facebook credits purchased from an account belonging to someone age 17 or younger, you may be entitled to obtain refunds for such purchases through the use of the dedicated queue established by Facebook as a result of the settlement. Both minor account holders and the parents and guardians of such minors are entitled to claim such refunds. Claim refunds via the Facebook refund tool.

Free access to selected case documents via Archive.org.

Apple in-app purchase litigation

Benjamin Edelman — Wed, 13 Apr 2011 04:00:09 +0000

I served as cocounsel in class action litigation challenging Apple charging users for purchases made by kids, refusing refunds to such users, and allowing purchases (and charging users’ credit cards) without users reentering their passwords to authorize the purchases. In response, Apple agreed to grant refunds to customers who so requested.

In Re In-App Purchase Litigation, Case No. 5:11-CV-01758-EJD (N.D. Cal.)

Case docket including consolidated class action complaint

Current Ask Toolbar Practices

Benjamin Edelman — Mon, 16 Oct 2006 04:00:00 +0000

Last year I documented Ask toolbars installing without consent as well as installing by targeting kids. Ask staff admitted both practices are unacceptable, and Ask promised to make them stop. Unfortunately, Ask has not succeeded.

In today’s post, I report notable current Ask practices. I show Ask ads running on kids sites and in various noxious spyware, specifically contrary to Ask’s prior promises. I document yet another installation of Ask’s toolbar that occurs without user notice or consent. I point out why Ask’s toolbar is inherently objectionable — especially its rearrangement of users’ browsers and its excessive pay-per-click ads to the effective exclusion of ordinary organic links. I compare Ask’s practices with its staff’s promises and with governing law — especially “deceptive door opener” FTC precedent, prohibiting misleading initial statements even where clarified by subsequent statements.

Details:

Current Practices of IAC/Ask Toolbars

180’s Newest Installation Practices

Benjamin Edelman — Mon, 09 Jan 2006 05:00:00 +0000

I’ve previously covered a variety of misleading and/or nonconsensual installations by 180solutions. I’ve recorded numerous installations through exploits (1, 2, 3, 4, 5) — without any user consent at all. I’ve found installations in poorly-disclosed bundles — for example, disclosing 180’s inclusion, but only if users happen to scroll to page 16 of a 54-page license. I’ve even documented deceptive installations at kids sites, where 180 installs without showing or mentioning a license agreement.

The Doll Idol site, which encourages users to install 180 software without a frank disclosure of 180’s true effects.

180 has cleaned up some of these practices, but the core deception remains. 180 still installs its software in circumstances where reasonable users wouldn’t expect to receive such software — including web sites that substantially cater to kids. And users still aren’t fairly told what they’re slated to receive. 180 says that it shows “advertising,” but no on-screen text warns users that these ads appear in much-hated pop-ups. 180 systematically downplays the privacy consequences of installing its software — prominently telling users what the software won’t do, but failing to disclose what the software does track and transmit. All told, users may have to press a button before 180 installs on their computer, but users can’t reasonably be claimed to understand what they’re purportedly accepting.

Screenshots and detailed analysis:

180solutions’s Misleading Installation Methods – Dollidol.com

What’s So Hot About Hotbar?

Benjamin Edelman — Mon, 16 May 2005 04:00:00 +0000

Last week Sunbelt announced that Hotbar sent Sunbelt a Cease and Desist letter, apparently demanding that Sunbelt stop detecting Hotbar software and offering users an option to remove it. I immediately updated my Threats page. But then I started wondering: How does Hotbar get onto users’ PCs? And what does Hotbar do once installed?

My new Hotbar Installs via Banner Ads at Kids Sites shows a variety of unsavory Hotbar practices: Promoting Hotbar advertising software at sites targeting kids, using banners with smiley faces but without mention of ads. Failing to affirmatively show a license agreement, and burying advertising terms so many screens into the license and below such counterintuitively-labeled section headings that users cannot reasonably find the key provisions. First affirmatively mentioning advertising on a screen that offers no Cancel button for users to decline the installation. And ultimately bombarding users with ads in pop-ups, web browser toolbars, Windows Explorer toolbars, auto-opening sidebars, and even desktop icons.

Meanwhile, Hotbar’s C&D indicates that their software is no longer detected by Microsoft Anti-Spyware, Lavasoft Ad-Aware, or McAfee. Why not? Consider Microsoft’s policy statement: “Windows AntiSpyware (Beta) alerts the user to the presence of any automatic pop-up advertising appearing outside the context of the program they are currently using.” This certainly describes Hotbar’s pop-up ads. Yet somehow Hotbar has caused — convinced? persuaded? threatened? — Microsoft not to detect their program.

Of course Hotbar is not the only party to blame. Hotbar’s ads arrive at kids sites through ads syndicated by Fastclick (NASDAQ: FSTC). As a publicly-traded company, surely Fastclick could find a better business than foisting advertising software onto unsuspecting kids.

I’ve recently received a copy of the Cease and Desist letter (PDF) Hotbar sent to Sunbelt. Sunbelt says they’ll be responding shortly, and I’m looking forward to reading their response. Meanwhile, some inaccuracies in the letter are so egregious that I feel obliged to note them immediately.

Hotbar claims to provide its users with “explicit explanations” of its services, and Hotbar therefore claims that users “provide … full conscious consent to each and every aspect of Hotbar software.” That’s not what I’ve seen when I’ve tested Hotbar. Rather, I have observed Hotbar install without even mentioning the word “ads” until a screen at which users aren’t given a “cancel” button. And nowhere does Hotbar affirmatively show users any mention of its numerous forms of ads (pop-ups, pop-unders, toolbar ads, auto-opening sidebars, and even desktop icons). To say Hotbar users “consent to each and every aspect” is truly a puzzling misstatement of the facts — that’s not what I’ve observed, nor is it what I’ve chronicled in screenshots and videos.

Hotbar then claims that Sunbelt “misrepresent[s]” Hotbar when it calls “Hotbar” adware. I don’t get it. How else is Sunbelt supposed to describe a program that tracks users’ online activities and shows ads, including pop-up ads? If Claria is adware — and even Claria says it is! — then surely Hotbar is properly called adware too. Perhaps reasonable people could disagree about the propriety of calling Hotbar spyware. But “adware”? No.

Does Jeeves Ask for Permission?

Benjamin Edelman — Mon, 02 May 2005 04:00:00 +0000

I continue my misleading installation series with a look at installation practices of Ask Jeeves. My new Ask Jeeves Toolbar Installs via Banner Ads at Kids Sites shows a misleading banner ad particularly likely to target kids. When users click on this banner, AJ neither shows nor references any license agreement. And AJ uses euphemisms like “accessible directly from your browser” rather than explicitly admitting that it will install a web browser toolbar.

But that’s not the worst of AJ’s practices. Over the past six months, I’ve captured a series of videos showing Ask Jeeves’ MyWay and MySearch software installed through security holes — without notice, disclosure, or consent. For example, in a video I made on March 12, I received more than a dozen different programs including the Ask Jeeves MySearch toolbar — without me ever requesting anything, and without me ever clicking “Yes” or “Accept” in any dialog box. Watch the video and see for yourself. Warning: The video is 16+ minutes long. Security exploit occurs at 6:00, and Ask Jeeves MySearch software is first seen at 15:50. In this same testing, I also received installation of 180solutions, multiple programs from eXact Advertising, the IBIS WebSearch toolbar, PeopleOnPage, ShopAtHomeSelect, SurfSideKick, WindUpdates, and many more. The underlying network transmissions show that the security exploit at issue was syndicated through the targetnet.com ad network — Mamma Media, publicly-traded on Nasdaq Small Cap.

I have other videos available upon request, including nonconsensual AJ installations dating back to November 2004. See also my November 2004 exploit video.

I’m surprised that Ask Jeeves allows these nonconsensual installations. Ask Jeeves is a publicly-traded company with a 10-digit valuation (slated to be acquired by InterActiveCorp for $1.85 billion). If Ask Jeeves staff made a serious effort to screen and supervise their distribution partners, they could prevent this kind of mess.

The biggest news last week was a lawsuit filed by the New York Attorney General’s office against Intermix Media, whose KeenValue, IncrediFind, and other programs show popup ads, add extra browser toolbars, and intercept error messages. These practices are objectionable in and of themselves, but the complaint focuses on the programs’ misleading installations. Sometimes the programs install with no notice at all, the complaint says, and sometimes only with hidden or misleading disclosures users are unlikely to notice or understand.

I have the sense that this suit is the first of many. There are certainly plenty of similar offenders, even big companies with major venture capital funding. I have often written about software from 180solutions, Direct Revenue, and eXact Advertising installing through security holes, practices I’ve continued to observe (including in the video linked above). And Claria’s tricky installations share many of the deceptive characteristics the AG attributes to Intermix, like hiding key terms in “lengthy, legalistic license agreements” and using “vague, incomplete” disclosure text. (See NYAG complaint (PDF), paragraph 9.) So I doubt the NY AG’s office would approve of the Ask Jeeves practices I’m documenting today, nor the other misleading tactics on my spyware installation methods index.

Misleading Installations of the Week: PacerD, and Claria’s Dope Wars

Benjamin Edelman — Mon, 25 Apr 2005 04:00:00 +0000

It’s Monday morning, so time for more misleading installations. Just like last week, I couldn’t stop at only a single example; again I’m providing two.

PacerD’s misleading pop-ups ask users to “please click yes” to accept “free browser enhancements.” In fact what PacerD offers is an unusually large bundle of a dozen different programs, only some of them disclosed in fine print in PacerD’s mislabeled (apparent, purported) license agreement, which in turn is only shown at a user’s specific request. But click “Yes” once, and your computer will take a turn for the worse, with no subsequent opportunity to cancel.

The PacerD Installation Bundle

As usual, Claria’s approach is somewhat more subtle. When Claria bundles its advertising software with the “Dope Wars” video game, Claria prominently tells users that it will deliver advertising. But Claria mentions effects on privacy only midway through a 43-page license agreement, that begins with three tedious pages of all-caps text. My sense is that few “Dope Wars” players are likely to wade through this lengthy license. So if Dope Wars users install Claria, they’ll do so without first understanding what Claria will do to their PCs.

Claria’s Misleading Installation Methods – Dope Wars

On some level, these two installations could hardly be more different. PacerD installs a dozen programs from numerous different companies; Claria installs just one. PacerD shows a popup while users are just trying to surf the web; Claria’s interruption comes as users are trying to install software they actually want. But in relevant respects, I think these installations are surprisingly similar. For one, both seek to convert users’ computers into advertising channels — tracking what users do, and showing extra advertising. Also, both installations tell users something about the programs they are asked to accept, and both give savvy users an opportunity to learn more, but in each case the prominent on-screen text omits important facts users need to know in order to make sensible choices.

Misleading Installations of the Week: Claria and 180 at Kids Sites

Benjamin Edelman — Mon, 18 Apr 2005 04:00:00 +0000

“Adware” companies say their businesses are predicated on user consent. (Claria: “… consumers who agree … “; 180: “permission-based … opt-in”). Notwithstanding, companies’ claims, there’s no doubt that this kind of advertising software is sometimes installed without consent. See the video I posted last year.

But what about those users who supposedly do consent to receive extra pop-ups? Why did they agree to receive extra advertising that so many other users seem to despise? My sense is that users often don’t understand what they’re getting — due to serious deficiencies in installation disclosures. In two new articles, I examine and analyze the installation procedures of Claria and 180, raising doubts as to whether users reasonably knew what would happen when they “accepted” these programs.

Can we say that a user “consents” to an installation if the installation occurred after a user was presented with a misleading advertisement that looked like a Windows dialog box? If that advertisement was embedded within a site substantially catering to children? If that advertisement offered a feature known to be duplicative with software the user already has? If “authorizing” the installation required only that the user click on an ad, then click “Yes” once? If the program’s license agreement was shown to the user only after the user pressed “Yes”? These are the facts of recent installations of Claria software from ads at games site Ezone.com.

Details: Claria’s Misleading Installation Methods – Ezone.com

Turning to 180: Can we say that a user consents to an installation of advertising-display software where that installation is prominently described as removing advertisements? Where the installation description uses euphemisms like “show … sponsor websites” but never explicitly states that the program will show advertisements or pop-ups? Where the installation procedure never shows or even references a license agreement? And where all this occurs at sites catering to children?

Details: 180solutions’s Misleading Installation Methods – Ezone.com

Lots of companies want to take advantage of users who may be a bit confused, a bit naive, or a bit too quick to click yes. But where users are recruited at sites catering to children, where ads look like Windows messages, or where installation requests resort to misleading euphemisms, I’m not inclined to say that consumers “consent” to the resulting ads and to the resulting transmission of personal information.

Benjamin Edelman v. N2H2, Inc.

Benjamin Edelman — Mon, 07 Apr 2003 04:00:08 +0000

I sought to research and document sites categorized and restricted by Internet blocking program N2H2. N2H2’s block site list is protected by technical measures including an encryption system, but I sought to write software that would nonetheless allow me to access, analyze, and report its contents. However, I feared that conducting this work might expose me to liability for violation of the N2H2 License, of the Copyright Act of 1976, and of the Digital Millennium Copyright Act, as well as for misappropriation of N2H2’s trade secrets. With representation by the ACLU, I therefore sought from federal court a declaratory judgement that I could conduct this research and publication without fear of liability.

Case details including litigation documents