Hacker News new | past | comments | ask | show | jobs | submit login

This is called Level 3 data, and any merchant can choose to provide it for a reduction in the transaction fees they pay.

Here's a small comment thread from a few months back: https://news.ycombinator.com/item?id=41213632






So in essence the merchant pays with my data?

In theory you’re already paying the merchant fee in the “price”. So merchant found a way to improve margins and credit card companies found a new revenue source

Yes, though people also welcome the extra cash back or other card benefits.

Apple Card does not sell this data, IIRC. But offers a lower cash back than many other cards.


True, while Google sees roughly 85% of all American cardholder swipes and doesn't need to sell it since they're making the ad market...

> while Google sees roughly 85% of all American cardholder swipe

I'm probably not reading this properly, can you say that a different way?


Google buys transaction data from credit card companies (Visa, Mastercard, etc). They almost certainly know what you spend money on

For every 20 Americans with a credit card, 17 have all their purchases sent to Google.

How on earth is this legal

Things that aren't explicitly made illegal are legal. Who would invest the resources necessary to get a law banning this passed?

Corporations are people, too.

Or phrased less inflammatory manner: "Corporations can enter into contracts and engage in legal action just like people can". Even the much maligned Citizens United v. FEC basically boils down to "groups of people (corporations or labor unions) don't lose first amendment protections just because they decided to group up".

Except not everyone in a corporation has the right to speech. I'm prohibited by my employer to say anything on the company's behalf, but the C-suite and board are able to speak on my behalf. So, the company's leadership has a right to free speech, I don't.

You still have that right; you simply entered into a voluntary agreement with your employer not to exercise it in exchange for money. Happens all the time.

Let's bring back indentured servitude, you have a right to not be a slave but you should still be able to enter into a voluntary agreement not to exercise that right.

That’s a facetious reply and you know it. Agreeing not to say certain things is practically a universal requirement of employment, for example, to preserve trade secrets. And indentured servitude is illegal.

Cut it out.


> you simply entered into a voluntary agreement with

Let's stop you right there.

Having a job is rarely truly voluntary. It's almost always obligatory instead.


That's just life. Modern society obligates us to do things like feed, clothe, and house ourselves; they aren't just going to result because you exist. Getting a job is an sacrifice we make to fulfill those other basic obligations.

To discuss further would require us to go into the rabbit hole to debate whether capitalism is the right structure for society, but so far, everything else that's been tried has been worse.


>Except not everyone in a corporation has the right to speech. I'm prohibited by my employer to say anything on the company's behalf,

Yeah, that's how organizations typically work? You might have "freedom of movement", but that doesn't mean you can work in your CEO's office. Organizations also limit who has access to its bank accounts, but that doesn't mean it's suddenly illegitimate for companies to engage in transactions.


This comment is quoting Mitt Romney

This is the real reason why they can afford to give you cash back.

It’s honestly crazy that we allow companies to sell our data — and even financially incentivize companies to share our data like this.

The problem is that to you it seems like your data but to Walgreens they see it as theirs. They generated it with their point of sale system.

The data is about a transaction that you made, but they generated all of it.

Until we have agreement as a society about what “my data” means, this kind of stuff is going to run rampant.


>what “my data” means

It makes me wonder, if everyone 'owned' their own data, I wonder if it could be used as a form of UBI. Everyone has data from using services, everyone owns it, everyone can sell it to make a living just doing whatever they are doing everyday.

This is only just a shower thought I had the other day though, there are probably many pitfalls when it comes to such an idea.


Like adverts in general the value of your data or your attention is tiny.

The average American spends $200 (via higher costs for products) for TV each year and receives how many hundreds of hours of adverts in return?

The superbowl for example gets $5 for every viewer, for about an hour of adverts. What’s the average hour of time worth?

Facebook might suck up your data and flog it for a few cents, you’ve probably got more cash down the back of the sofa.


If my attention is so cheap I would definitely like to pay $5/ year to not have to see ads.

...what about paying $5/year to "not" see ads, and also still see advertisements targeted to you?

Unlikely. I'd think the most valuable data is generally the type that can be used to extract money from you. Targeted ads and such. So, your data's value would increase in proportion with your spending power.

This idea is the subject of the 2013 book "Who Owns the Future?" By Jaron Lanier.

I don't support UBI but that's a fascinating idea. Unfortunately the data is worth micropennies in the individual, so only worth something in aggregate, like a class action settlement where you end up with a cheque for $0.34 for damages which makes it not even worth your time, it'd only be good as the backdrop for a science fiction novel or as an experiment by a YouTube video by a well known creator to see how little money it would make. I would read the hell out of that book and watch that video tho!

Connecting information to that kind of personal gains sounds dangerous. There is probably non-negligible abuse potential, like college kids legally printing money at weird scale.

You will never generate enough money from information about your consumption to fund your consumption. Obviously there's other data, but you get the point.

UBI isn’t meant to fully fund consumption. It’s “basic” income such as rent or groceries. I will accept that consumption data doesn’t cover consumption and that the value is already priced in but I don’t accept that it has no value or that UBI is meant as complete income replacement.

I guess I was responding to this:

> everyone can sell it to make a living just doing whatever they are doing everyday


Honestly the path to "UBI" is probably just socialized/subsidized basic needs.

Build masses of government housing, make a healthcare public option with sliding-scale costs, and you're 90% of the way there - food and decent low-end broadband are frankly already cheap enough for the government to cover with maybe some "Don't gouge Uncle Sam or else" clauses and that's about everything.


IDK, I think almost all interesting data has no obvious single owner, because it gets created as a side effect of an interaction between two or more parties.

Take the transaction information from example above. The record of you buying products X, Y, Z for total t=x+y+z at time T, with card C - both you and the store could argue they're entitled to it. It's about you and money you spent and products you received, but it's also about them and the money they received and the products that were taken off their inventory. Then the card issuer will interject saying, "hey, the customer uses a card we provide as a service, so we're at least entitled to know which card was use to pay, to whom, when, an what the total amount was!". Then both yours and stores' banks will chime in, and behind them, also the POS terminal provider.

Truth is, they all have a point. We like to think that paying for groceries with our watch is like a medieval peasant paying for fruit with metal coins at a town market. It's not. Electronic payments always involve multiple steps handled automatically, in the background, by half a dozen service providers linked by their own contracts and with their own legal reporting requirements, and each of them really do need to know at least some details about the payment they're participating in.

A simpler example: this comment. It's obviously mine. It's also a response to you, and it only makes sense in context of the whole subthread. Should anyone reply to it, they'll gain a stake in it, too - and then, arguably, everyone following this discussion have a right to read it, now and in the future. After I hit the "Reply" button, I can't in good conscience claim this comment is mine and only mine. This is why I'm personally against the practice of unilaterally mass-deleting of comments on open discussion boards, like e.g. plenty of people do on Reddit, forever ruining useful discussions for the public.

(It's also why I like HN's approach to GDPR, which is, you can get your account disassociated from your comments, and you can request potentially identifying content be removed, but the site won't just mass-delete your comments automatically.)


>to you it seems like your data but to Walgreens they see it as theirs

the value of this data comes from what did I buy, what else do I buy, where am I, who I am, etc.

to your point, Walgreens does not sell to their competitor CVS data about what they sell, when, and where.

so if that really is their argument, it's refutable.


This is fairly easily answered through legislation like the GDPR which classes this data as personal data if it’s associated with an identified or identifiable person.

A legislative body writing something down doesn’t mean society has agreed to it.

If someone journals and writes down everyone they met with locations and dates, they will laugh you out of the room if you tell them they are violating GDPR.

This also leads to stupid shit like people not being sure if they can point a camera at their driveway to catch vehicle break-ins.

Finally, classifying something as “personal data” because it’s about me still doesn’t make it “my data”.

Health data in the US is strictly regulated, very personal, but is definitely not mine. I cannot remove things from it or prevent it from being shared between healthcare institutions.


You seem not to know much of anything about the laws regarding personal information in the US or Europe.

It’s amazing how little control we have over information that is the most personal essence of our lives.

Why do we have zero insight, no control. Nothing.

I hate it so much.


Thanks for the details.

> choose to provide it for a reduction in the transaction fees they pay.

That would explain why I can use my credit card for rent without a transaction fee! No free lunch!


Who is Level 3 data shared with, ie who is the aggregator? Is it the credit card bank then aggregates and sells it?

Is there any documentation on this to read further? I.e. what the different levels contain and how much on average is the cost reduction for the merchant.

Here is implementation documentation from Mastercard about l3: https://na-gateway.mastercard.com/api/documentation/integrat...

The cost reduction is very small, it’s applied to interchange fees. I’ve been directly responsible for implementing this functionality on payment gateways for multiple processors because it helps reduce fraud holds as well.


Separate question, what are your ethics around the surveillance of Americans' economic activities by private actors? What "rights" are relevant in this space and which do you subscribe to?

I'm not going to debate you about anything, I just don't get the chance to ask insiders any of these questions.


Do you think there are different ethical concerns when dealing with non Americans?

Also a great question.

My ethics are “this is unequivocally wrong without consent”.

Thankfully my work was on payment products that serviced businesses and government entities, so I did not really have to deal with that moral quandary.

However it gets muddier in other spaces as well. There are types of cards, like HSA/FSA that require something similar to level 3 data called IIAS that is used to determine what parts of your purchase are eligible. In the parts of the systems I have worked with, this is covered by HIPAA, but I have no idea if there are “clever” methods to sneak that data out of the chain elsewhere.


Is this data requestable via a GDPR takeout?

searching for “mastercard level 3 data takeout” and such bring up the same 5 pages that are not relevant.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: