grok_mctanys

So if you want to pick up some Covid tests these days, you need a "collect code" [sic].

If you have the NHS app on your Android or iOS smartphone, that's apparently pretty easy. Alternatively, if you're weary of battling countless stupid apps that ask for permissions they have no business needing and are just done with the "there's an app for that" mindset, and therefore don't have it; or if you have an independent (e.g. PinePhone, Librem 5, etc...) smartphone that the NHS app doesn't support; or if you only have a feature phone; or if you don't have a mobile phone at all - that's not going to work for you.

Alternatively, there's the Get a collect code to pick up coronavirus (COVID-19) rapid lateral flow tests web page. (Great page title there, devs. Very snappy.) From this page, the process to get a "collect code" requires you to enter at least your name and date of birth. You may well have to enter more personal information than this. I don't know, I didn't get any further.

Anyway, at the bottom of each page in this process - on a healthcare-based website where you enter a bunch of personal information - it says:

This service is protected by reCAPTCHA and the Google privacy policy and terms of service apply.

Those documents are, at the time of writing, 8,127 and 4,013 words long respectively. And you want me to read, understand, and agree to those terms, in order to pick up some Covid tests? Which already involve a fair amount of inconvenience and discomfort on my part?

That's not even looking at the contents of those terms, some of which could be considered objectionable. For example, in their Privacy Policy, under "Information we collect as you use our services" / "Your Activity", there is:

The activity information we collect may include: [...] Activity on third-party sites and apps that use our services

So, in order to use the UK government site for getting hold of tests to help prevent the spread of Covid-19, you are asked to actively agree letting a US company - whose core business model involves collecting as much information as it can about everyone on the planet in order to target them with advertising so they can maximise shareholder value - monitor and track your activity across all the other websites on the internet that they monitor. Which is, like, a lot.

Are you kidding me? Like, whoever thought that this would be an acceptable way to run this site?

Oh, and as a final option to get a "collect code" you can call the phone number "119". Except that the IVR menu you get gives you the choice of "1 - The Test and Trace service", "2 - The Covid-19 vaccination booking service", "3 - The NHS Covid pass service", and "4 - Report an issue with your Covid vaccination record". So, nothing about requesting a "collect code" then. Great. Stellar work there everyone.

I guess I'm not getting any regular testing from now on then.

FFS

A friend of mine WINODW recently invited me to participate with them in the Round Sheffield Run this summer.

To enter the RSR, you have to register with a website called SiEntries, who appear to handle registrations for a bunch of these kind of events, in order to then sign up for RSR itself.

So I started to fill out the registration process, and got to the checkboxes asking me to read and consent to the Terms of Use (ToU) and Privacy Policy (PP). Which I did, because I'm that kind of idiot.

First, note that the ToU § "Other Applicable Terms", states:

These terms of use refer to the following additional terms [...] Our Privacy Policy

.

Then, look at the ToU § "Changes to These Terms" and see:

We may revise these terms of use at any time by amending this page.

Please check this page from time to time to take notice of any changes we made, as they are binding on you.

So, you agree that they can change the terms any time they want, without informing you of the change, and to be bound by whatever changes they decide to make without seeing those changes‽‽‽

Are you fucking kidding me? That is utter, utter bullshit, and should be totally unacceptable to anyone. Like, absolutely anyone, anywhere.

First, it makes the entire rest of the document pointless. Absolutely pointless. Whatever assurances or guarantees are given in the ToU are entirely worthless, because SiEntries can change them whenever they like to whatever they like, and you've already agree to be bound by those changes. Also note that because that term also refers to the Privacy Policy (see above), all the assurances they give there are equally worthless, for exactly the same reason.

SiEntries could change the ToU requiring registrants to sacrifice their first-born son to Cthulu, and literally claim that all existing registrants had voluntarily agreed to be bound by that.

Secondly, the data they already collect (PP § "The Data We Collect About You") and sell/make available to third parties (PP § "Disclosures of Your Personal Data") gives me the creeps, even without considering that they can decide to change those rules to e.g whatever makes them the most money, whenever they like.

Seriously, avoid these assholes like the bloody plague.

So, if you're wondering about the relationship between "fun" apps on social media, the companies that create them, and the business models behind them, as well as how to check and revoke the permissions you give not only to those companies, but the permissions you give to your friends to give data about you to those companies, the excellent Computerphile has just released a good straightforward run-down of the basics - Social Media Data.