Definitely gross that companies are using forced arbitration to avoid liability for their breaches (first 23andme, now Roku). Call your congressperson. Also, if you are impacted/have standing, consider an FTC complaint [2] and contacting your state’s attorney general.
I'm sure that after my phone call, my congressperson will drop all the things he is being paid thousands of lobbying dollars to do on behalf of his donors to get right on this. Sorry for the snark, but normal people are powerless to do anything about these shenanigans.
- while a total lockdown on exposure control of your personal data is basically impossible, proactive choices do limit it shouldn't be dismissed out of hand
- a working knowledge and practice of bushcraft can be a useful skill, a fulfilling hobby, and can be practiced without feeding money to whatever the flavor of the week is
- conversely, if you do get into that, be prepared for profiteers in that field to push into your attention. Going all bushcrafty is no protection on its own.
The article cites these two sources[1][2] which say
> Unauthorized individuals using account credentials believed to have been obtained from third-party source(s) were used to access individual customer accounts
[1] https://apps.web.maine.gov/online/aeviewer/ME/40/e9cc298b-37...
[2] https://oag.ca.gov/system/files/Template%20Notification%203-...
Odd that Roku singles out the 0.5% of users affected within the state of Maine. Must be related to some sort of Maine data breach law? I didn't dig too deeply, but not seeing anything explicitly called out in their statutes [0].
[0] https://legislature.maine.gov/legis/statutes/10/title10sec13...
It could also be targeted credential stuffing given recent events. An interesting tactic to create problems for a company.
I'm not saying Roku is a good company, but this isn't really a data breach but poor credential management by customers.
Roku is also taking heat for using forced arbitration at all, which some argue can have one-sided benefits. In a similar move in December, for example, 23andMe said users had 30 days to opt out of its new dispute resolution terms, which included mass arbitration rules (the genetics firm let customers opt out via email, though). The changes came after 23andMe user data was stolen in a cyberattack. Forced arbitration clauses are frequently used by large companies to avoid being sued by fed-up customers.
https://arstechnica.com/gadgets/2024/03/disgraceful-messy-to...
I wonder how Roku would react if every Roku user filed an arbitration case since your data was at risk.
The new terms have language that say that if enough people enter arbitration at the same time, they have to do one big "mass arbitration."
Twitter, in relation to arbitration with employees it terminated? https://arstechnica.com/tech-policy/2023/07/twitter-refuses-...
> Judge Breyer suggested at the Dec. 17 hearing on the proposed class action settlement that Intuit has only itself to blame for its mass arbitration predicament. “You knew what the rules of arbitration were. You knew all these things. And you elected - you elected to go to arbitration. And you fought fairly, vigorously, and it turns out correctly, that you had this right to insist on arbitration,” the judge told Intuit counsel Rodger Cole of Fenwick & West. “Now you come in, when you see how it is unfolding, and say: ‘Not so fast … Now we want to turn and do something else.’”
https://www.reuters.com/article/legal-us-otc-intuit/judge-br...
There is a 30-day window after agreeing where you can mail them a letter opting out of the new arbitration agreement.
https://cordcuttersnews.com/roku-issues-a-mandatory-terms-of...
You're thinking like an engineer given the problem of "get people's consent" instead of like a businessman with the goal of "altering the deal."
Forced arbitration? Much better than an expensive lawsuit.
Except when hundreds to thousands of people want arbitration and since the company wanted arbitration, we have to foot the bill... Yikes.
Hmmm. Fix the arbitration scaling problem by changing to forced mass arbitration. But the users will have to send in a letter to opt out of the new agreement.
Roku has 80 million+ accounts.
What happens when even one percent of those account opt out? Put on your "grudgingly-pay-the-outrageous-fine-with-pennies" hat and I'm sure you can come up with ways to increase the difficulty level of receiving many letters opting out of this new agreement.
People rolled their eyes when I suggested that this was intentional, but these recent revelations strongly suggest that Roku is very comfortable exploiting the hell out of dark patterns.
If we don't enact stronger consumer protections, everything will work this way.
Don't misunderstand me: it's 100% atrocious that any device bootloops if some ad network 403s, but on the spectrum of "spit into one hand..." and nginx in the other ...
Days after forcing it's users into mandatory arbitrations this comes out.
Would be awesome if holding someone's TV hostage until they agree to not sue you was illegal.
Also, the breach happened while people were receiving services under the old TOS, not the new one. I wonder if that could impact things?
https://news.ycombinator.com/item?id=39503941 (2024-02-25)
Card won’t be charged during the free trial? Don’t need another copy out there!
how limited and what subs
Of course you can't guarantee that your data will actually be purged, or that it hasn't already been compromised from these places - but less exposure is better than more exposure, right?
