Unroll.me, Unravelled

Yesterday, Mike Isaac of The New York Times wrote a profile on Uber C.E.O. Travis Kalanick and his drive to turn Uber into a winning machine, regardless the cost. It’s a fascinating piece, and you should make time to read it.

But in Mr. Isaac’s digging, he unearthed some unsettling information about another company, Unroll.me. Owned by Slice Intelligence, Unroll.me labels itself as a way to “clean up your inbox”, by intercepting and archiving your email, and then sending you a simple summary of all your receipts and newsletters. As reported by Mr. Isaac’s, however, Unroll.me was selling aggregated, “anonymized” email message data to whoever wanted to buy; in this case, Uber. Mr. Isaac:

Uber devoted teams to so-called competitive intelligence, purchasing data from an analytics service called Slice Intelligence. Using an email digest service it owns named Unroll.me, Slice collected its customers’ emailed Lyft receipts from their inboxes and sold the anonymized data to Uber. Uber used the data as a proxy for the health of Lyft’s business. (Lyft, too, operates a competitive intelligence team.)

Slice confirmed that it sells anonymized data (meaning that customers’ names are not attached) based on ride receipts from Uber and Lyft, but declined to disclose who buys the information.

Following this story, Unroll.me’s CEO and founder Jojo Hedaya wrote the following apology:

Our users are the heart of our company and service. So it was heartbreaking to see that some of our users were upset to learn about how we monetize our free service. 

And while we try our best to be open about our business model, recent customer feedback tells me we weren’t explicit enough. 

Sure we have a Terms of Service Agreement and a plain-English Privacy Policy that our users agree they have read and understand before they even sign up, but the reality is most of us - myself included - don’t take the time to thoroughly review them.

This apology blog post has made its way around the internet, but I found most takes or tweets to be surprisingly harsh. Sidestepping the tone deaf “it was heartbreaking” and Mr. Hedaya’s bizarre admission of not thoroughly reviewing his own company’s documents, we’re left with an unassailable fact: There is an Unroll.me privacy policy, and every Unroll.me user agreed to it. And in that policy, which at nearly 2,500 words is not short yet reasonably formatted and readable, right under “Our Collection and Use of Non-Personal Information”, is the money quote:

We also collect non-personal information − data in a form that does not permit direct association with any specific individual. We may collect, use, transfer, sell, and disclose non-personal information for any purpose.

Plain English to me.

That said, we need to separate and articulate the different issues at play here, which I see boiling down to three different arguments:

1. Uber has been conducting a masterclass in how to alienate the average, decent person. From their toxic culture — full of sexism and bullying — to the Uber executives’ visit to a Seoul “escort bar”, the company, led by a flame-throwing C.E.O., is both massively valuable and morally bankrupt. Uber employees looking for new jobs have to defend themselves to recruiters, and in the current climate, anything associated with Uber is prequalified for scrutiny.
2. Slice’s selling of aggregated and “anonymized” email data is a scummy thing to do to its users. Additionally, the premise that stripping out a user’s name ensures reasonable anonymity is ridiculous. Remember, this data isn’t being combed through by humans, it’s being dumped into machines that are designed to pick out patterns. Word usage, locale, time of day. With enough data and context, your emails will point to you, even if they don’t explicitly include your name. Unroll.me should have been more upfront about how they used their users’ data.
3. We forget that using free online services almost guarantees our information is being sold to help pay the bills. Email, social networks, news sites. They all sell the same thing, often to advertisers: us. We need to be more conscientious about what companies we let use our data.

When you combine #1 with #2, the revelation that Slice was selling user data to Uber created a perfect storm. The internet jumped, and the narrative was largely about how despicable Unroll.me’s behavior was. However, when you add in #3, the following two points have to be acknowledged:

1. For a large number of free online services, the practice of selling user data to advertisers — or whoever is willing to pay — is common practice. I don’t like it, nor do I support it as a route to keep the lights on (I’d rather pay a few dollars a month), but we can’t treat Slice as some exception to the norm.
2. Unroll.me was unlucky and hit doubly hard because they appeared in an article with Uber. Unroll.me wasn’t caught red-handed, common sense and the privacy policy clearly outline the possibility of selling user data, but the fact the data went to Uber made things worse.

Mr. Isaac’s story highlighted an unfortunate side effect of free online services. If that makes you uncomfortable, go delete Unroll.me’s access to your email. In fact, now’s a great time to go review any apps that you’ve granted access to your email or social accounts.¹

But Slice’s participation in an industry practice, despite their business dealing with Uber, doesn’t grant us clemency in this story. Ultimately, the blame for our data being sold is on us. We agreed to Unroll.me’s privacy policy. We’ve agreed to terms and conditions without reading a single word. Many of us know, deep down, how these free sites and services make a living, but when we choose to care is often arbitrary.

There’s this classic scene in “Casablanca”, where nightclub and gambling den owner Rick Blaine gets confronted by corrupt police officer Captain Louis Renault, who has come to shut down Blaine’s operation:

Blaine: How can you close me up? On what grounds?

Captain Renault: I’m shocked, shocked to find that gambling is going on in here!

A croupier hands Renault a pile of money.

Croupier: Your winnings, sir.

Captain Renault: Oh, thank you very much.

We’re allowed to be upset we didn’t read Unroll.me’s privacy policy or that it wasn’t presented more visibly; we can even revoke Unroll.me’s access to our email and never use any of their parent company’s services in the future; but after years of using free email, free social networks, and free news sites where our data is routinely sold to the highest bidder, how are we shocked?

Monday, 24 April 2017