Monetization of anonymized usage data

[thulle]

Just got the google docs questionnaire popup.

It's a bit weird to just have a yes/no answer with no explanation of what data is to be sold and how it's supposed to be anonymized.

[avi12]

I'm not going to collect/sell myself, but rather partner with a company that is interested in the anonymous data
In addition, those companies are only interested in Chrome users
One of the reasons I created the form is that they typically want me to include their content script that runs on all sites (<all_urls>), which would not only intimidate users but also make the extension disabled for all of them

[avi12]

I dislike the idea of including <all_urls>, but that's what they demand, so I'd rather play it safe and conduct the survey than lose at least half the user base

[Akronymus-git]

I'm not going to collect/sell myself, but rather partner with a company that is interested in the anonymous data
including <all_urls>

Yeah, that's an uninstall from me. Having all urls is a dealbreaker.

[martixy]

Keep in mind having <all_urls> effectively turns it into malware.

[thulle]

How is this anonymization be accomplished? Who is doing the anonymization? Exactly what data do they want to collect? Will their content script be added to the repo for scrutinization? Where is this data to be exported to and stored? How will we reach this actor with GDPR requests?

With all the knowledge we have about how data can be deanonymized it seems trivial to correlate the incoming data with tracking data from other sources to be extremely intrusive into peoples browsing habits.
The <all_urls> seem to align very much with the ongoing trend of extremely shady actors buying up addons with large userbases and slowly data mining them to a degree that no-one actually would agree to it if they got it explained to them what was actually happening, thus relying on the user base being lazy enough not take the time to read up on what's going on, check the settings, and/or find an alternative.

I'm a bit stunned it's even a consideration, but maybe I'm not as representative for the user base of the plugin as I might think.

For me the mere function is a red flag, and <all_urls> is a total no-go, but others might want some answers to the questions above to make a different cost/benefit tradeoff.

I don't use youtube too much, but I enjoy the plugin when I do, so I want to take the opportunity to thank you for your work! It's sad that it doesn't work out economically, but that's an industry wide issue that's hard to fix unfortunately. I really appreciate the heads up on the possible changes!

[avi12]

How is this anonymization be accomplished?

Supposedly the content script collects data (the script is minified so I cannot know for sure what's going on), it's sent to their server, and since they're required to comply with the GDPR, they remove any PII before storing in the database

Who is doing the anonymization?

The company I will partner with (I have a couple to choose from)

Exactly what data do they want to collect?

I don't know for sure, but that includes stuff like geo data via IP, though as this video explains, IP often doesn't refer to a single user
I'd love to take a deep dive into a script's source code, but no company would let a partner analyze the source code since it's their intellectual property; I know it since I asked many companies to do just that
The next best option is to try to reverse engineer the minified script, but it's beyond my skillset

Will their content script be added to the repo for scrutinization?

Yes, everything regarding the file structure will be in the repo

Where is this data to be exported to and stored?

In the database of the company I will partner with

How will we reach this actor with GDPR requests?

AFAIK GDPR doesn't cover anonymized data since you cannot target a specific user to delete his data
Regarding reaching in general, I will obviously link to the company's website both in the repository and my site

I'm a bit stunned it's even a consideration

I totally understand you, though in my mind I'd rather use a free product with my data being collected than use a paid product
In browser extensions this is even more true, since users expect extensions to be completely free

The <all_urls> seem to align very much with the ongoing trend of extremely shady actors buying up addons with large userbases and slowly data mining them to a degree that no-one actually would agree to it

I agree, which is why I conducted the survey instead of going into action and losing both my users and my reputation
FYI, the way I will prevent the content script from collecting data is by prepending a line like this:

const { isCollectData } = await chrome.storage.sync.get("isCollectData");
if (!isCollectData) {
  return;
}

// if isCollectData isn't "true", it'll simply not continue the script execution

Although <all_urls> is indeed dangerous permission, it's actually better than alternatives
You see, the alternative is to have a dynamically-changing domains list, which would result in the extension being constantly disabled, leading in a worse user experience

I could technically include <all_urls> as optional permission, but I don't think my users would bother enabling it

It's sad that it doesn't work out economically,

If I keep relying on donations, at some point I'll worry about finances

I want to take the opportunity to thank you for your work!

Thank you for using my extension! I love knowing how I have a positive impact on the world 😁

[Akronymus-git]

"Supposedly the content script collects data (the script is minified so I cannot know for sure what's going on), it's sent to their server, and since they're required to comply with the GDPR, they remove any PII before storing in the database"

So its essentially backdooring your extension/our computers

[avi12]

Not quite. Although I can only know for sure what the company tells me about the script, I can still prevent the script execution if that's what the user desires

[Akronymus-git]

To me, there mere possibility of inclusion is already a backdoor too far. I am assuming the default is being enabled. Along with that, I am sure they want the JS served from their servers, which enables them to change it at any time.

[avi12]

Nope, the Manifest V3 specification doesn't allow including remote scripts
I.e. all the scripts must be included with the extension, no remote ones

[Auron-FFX]

I've been using this extension for quite a while but I would suggest a toggle for the data collection so people can opt out. I will be uninstalling. Privacy is a serious issue, I'm sad to see this extension go. I really don't want to uninstall it but if it's going to be putting crap on my computer that's going to track me/violate my privacy......

[Auron-FFX]

i'm not exactly code savy.... but other extensions have a toggle

I will be using Youtube Enhancer from now on.

[avi12]

I'll obviously add a toggle that when is on, will prevent the script to run

I'm sad to see this extension go.

I get you. In the past few years, a number of companies have reached out to attempt to monetize the extension
I knew that if I say yes, users will hate it and I will lose my reputation, so I was like "only if it doesn't violate their privacy"
So far, most companies I talked to require the extension to run on all domains, which I hate; I asked if it could run on a fixed number of domains instead, but it's not quite feasible
So right now I'm exploring options, how to both make money out of 100K+ users and make users happy

I will be using Youtube Enhancer from now on.

Use whatever extension that will do the right job 🙏

[GREK643]

i'm uninstalling the addon and simply use the vanilla yt
edit: i was surprised in a bad way when this form showed up from nowhere on my screen

[avi12]

i was surprised in a bad way when this form showed up from nowhere on my screen

I totally agree
The reason I did so is that I have no real way to reach the majority of the users
Not many of them follow me on Twitter, so if I ran a poll there, only a fraction of them would respond, because of which I wouldn't get a broad picture

[milankragujevic]

I am going to uninstall the addon.

[avi12]

I'm sorry to see you go. Do whatever feels right

[EB-Plum]

thank you for your honesty, considering a lot of things that usually go without notices.
But, I don't think I would allow 'youtube' extension on all pages.

[avi12]

But, I don't think I would allow 'youtube' extension on all pages.

There will be a toggle to disable the anonymous data collection
Plus, you can always adjust domain permissions on the Chrome extension setting

[rossysaurus]

As soon as it requires permission away from youtube I'll uninstall it. I don't mind you selling info about how people are using YOUR service, but I do mind when you use YOUR application to sell information about how I'm using anything else.

[WhiteWolf369]

I think the same

[Bison700]

I couldn’t have said it better. Agree 100 % and will uninstall the extension as soon as it requires permissions other than youtube URLs.

I do not mind paying a bit for some features, but I do not use Youtube often enough to accept this and have no problem with deleting it.

[Rodrigo-Ayam]

Think about the same that was said before, about the programming part know nothing about but doesn't seem safe the way the companies are demanding you to put it, as a autonomous programmer I trust you but not big companies at all so if they are the one who says which data you will deliver also don't fell good about it.

[APELipke]

I'm not an expert but generally act with the assumption tracking is taking place anyway.
I don't trust anonymization. Even when I know a best effort is made and some protection is afforded it can be circumvented.
It's a discouragement like a lock.
I expect for the majority of users what ever decision you make by default to be what will exist in practice.
I'm more likely to pay a small subscription than leave something with known information gathering installed unless I find it essential.
I appreciate your extension as a convenience. The burden and trade off come down to how much I value data control, Which I do.

I'm unsure of the effort involved in maintenance so I don't know the costs of operating that are incurred.
You should be turning a profit on your time and we should be contributing up to the value we see.
You need to do what might make it sustainable.

That said as a paid YouTube subscriber I believe this functionality should be basic to the paid platform.

[KentaigaIBE]

I'm surprised nobody has asked yet, but assuming you introduce a paywall instead of selling user data, how much were money you thinking? Also, people are probably gonna shit on you for even considering this, but thank you for hosting this extension for free for the time you have, and thank you for actually encouraging discussion about the product's future rather than just moving forward with the data selling without telling anyone like 99% of products do.

[avi12]

how much were money you thinking?

Not much, since the core features will stay free, and instead I will only charge for new, non-essential features
To even get to that point I need to figure out how to charge money from an extension, which is technically challenging, especially in my country

[bray18]

I'm moving here since it only accesses youtube.com. For a service that has several other free alternatives, I'm not sure why this decision came about.

[oakif]

I hope you realize that you can prevent any extension from accessing all sites in Chrome's settings.

[oakif]

It's kind of sad to see most people here expecting something for free to remain free despite the work put into it. I really appreciate your transparency in all of this.

[avi12]

As far as I can tell society, people generally want stuff to be free or to cost as little as possible
This is even more true regarding internet services where in the past 20 years or so we've been used to companies like Google offering great products for free
In browser extensions it is even more problematic - users expect the extension to be free and work perfectly
However, there are some extensions with paid subscription models, like Grammarly, Wordtune, LastPass, Hola, and other VPNs

[DerpyChap]

One of the reasons I created the form is that they typically want me to include their content script that runs on all sites (<all_urls>), which would not only intimidate users but also make the extension disabled for all of them

Unacceptable for multiple reasons (which have been well articulated by others in this post already). Why is this even being considered? I also do not like it when an extension just opens up a Google Form out of nowhere.

The extension is great and works well, but the push towards data collection, especially when it involves tracking across all domains, is just ridiculous. I understand that you would like to be paid for your work, but this is not a route I would go down. Providing paid access to new features would be much preferred, and feels far less ethically questionable. Ideally, this would be a one-time purchase rather than a subscription, as I feel as though too many apps push premium features through a subscription, and it quickly becomes far less financially viable for many people to support these app developers as a result.

As it stands, I'm considering uninstalling the extension altogether due to this.

[avi12]

As it stands, I'm considering uninstalling the extension altogether due to this.

I see. Do whatever feels right to you

[hydraulix93]

I appreciate the notice, and am sad to see so many people leaving just for having gotten the notice at all. I think putting it up was the honorable thing to do, and that's exactly what the community needs.

With that said, I will immediately uninstall if it's tracking on all sites. Even though you've gained some trust in my eyes by not doing this in secret, I still don't trust a toggle to keep another company's invasive code away from my data.

I would not particularly like a subscription either, but I understand you should be able to profit from good work and would be much more likely to do that (at a reasonable price) than keep it around with trackers. A one-time premium upgrade would be better.

[avi12]

I still don't trust a toggle to keep another company's invasive code away from my data.

Since the extension is open source, nothing is hidden from the user and you'll see that the toggle does its job

[fmdcarvalho]

I appreciate and respect the honesty and the notice. And I do understand that you want to monetize your hard work.
Still I don't think selling your user's data is the best way to go.
Seeing what other people are sayings, having the all_urls permission will make the attentive users drop this extension and only users who won't pay attention, or don't understand the meaning behind the permission, will remain. Wouldn't the data collection end up only targeting this last group that might not even know their data is being collected?
I would much prefer to see a premium version of the extension than selling script space to some unknown company with no way of confirming what are they using the data for, or if they are truly anonymizing it like they say.

Either way you decide to go, I think you did the right thing calling the userbase to this discussion and I would like to thank you for providing your work to so many people for free.

[rossysaurus]

Out of curiosity, how much would you be making a month by selling our data?

[sudosu0]

Just uninstall this and move

[jerryasher]

I greatly appreciate your survey, but if I understand <all_urls> to mean it runs in all tabs, not just youtube tabs, then I would be uninstalling it.

[brasky]

Seems like there are people upset about the fact that the form popped up at all? I think that was reasonable and appreciate the transparency in the discussion.

Here are my rough thoughts on monetization:

• What are the costs of operating the extension? How many hours a week on average do you need to spend to ensure that the extension is functional and listed on all the add-on web stores? I think if you made it clear your time/money investment to operate the extension people might be more understanding.
• It definitely does not make sense for a youtube related extension to track all urls. Is it possible to default the extension to only have permission to youtube? I noticed mine was not set to only youtube, but upon switching it to only certain sites, I got a pop-up asking if I wanted to add just a few google related domains. Does this setting override the partner's "all urls" request?
• Personally, I'd prefer artificial paywall over selling data to a 3rd party. You could also do both if the paid version automatically turns off the data collection.

Without seeing the numbers it's hard to know what makes sense for you. I wouldn't expect to get more than .5% of users paying a fee, and only if the fee unlocks some interesting feature, let's say they're willing to spend $20/year, then you've got $10k per year. How does that compare to the data collection company?

[pmarks-net]

If you proceed with this plan, Google will probably ban your extension.

https://developer.chrome.com/docs/webstore/program-policies/quality-guidelines/
"An extension must have a single purpose that is narrow and easy to understand. Do not create an extension that requires users to accept bundles of unrelated functionality."

https://developer.chrome.com/docs/webstore/program-policies/limited-use/
"Only transfer user data to third parties ... if necessary to providing or improving your single purpose"

[thulle]

Maybe more notably:

3. Collection and use of web browsing activity is prohibited, except to the extent required for a user-facing feature described prominently in the Product's Chrome Web Store page and in the Product's user interface.

[avi12]

If you proceed with this plan, Google will probably ban your extension.

https://developer.chrome.com/docs/webstore/program-policies/quality-guidelines/ "An extension must have a single purpose that is narrow and easy to understand. Do not create an extension that requires users to accept bundles of unrelated functionality."

Interesting, I didn't know that
Thanks so much for the heads up!

[robaxx]

Hi, may as well provide some feedback.

I was once involved in the development of an open source ecommerce store application. That took a lot of daily effort to code and support and was essentially without appreciation and ultimately a complete waste of my time. It only benefitted others who sold the store to clients. It was however educational for me and served as a demonstration of my own work. In the end I opted to cease involvement and spend time on other things.

The key point is that everyone involved spent a lot of time working on it. I've had a look at the commits for this extension and it's just a few items a year. It's a very lightweight project and if it is not benefitting you in any way, not even as a coding portfolio item, then I would drop it. I'm not a huge privacy nutter myself but I wouldn't give my data away for this. It would have to be something much more substantial and valuable. It's a nice-to-have extension, but not a must-have. Make a decision based on its existing value to you, not on the value of selling data that the extension doesn't create or own.

You could try a donations page on each update similar to what adblock does, but that may just add more time to the development than it's worth. I've had a donation button on a web site of technical servicing material I published over 20 years ago and have only received two donations in the entire period, one for 10 and one for 5 Dollars. I also once read a story about the Winrar developer that was similar.

But otherwise, thanks for the extension. It is appreciated.

[avi12]

Thank you for your story, I will keep that in mind

[ounrequitedo]

do this or the paywall option and i will uninstall. this is an extension of convenience, not one i'd ever be willing to pay for through selling my data or a paywall. there are also other extensions which do the same and i'm assuming more would be created if you were to monetize this one. but cheers to you all the same, and thanks for the convenience as long as i've been using it so far.

[avi12]

I won't paywall existing features but only new ones that I find not essential, like #5

[tunelessly]

Hi. I'm going to add my two cents:

I appreciate the work you put in, and back when I first installed it it solved a real issue I was having.

I uninstalled the extension, however, because I neither expected nor welcomed a google form popping up randomly. On top of that it made me aware that the purpose for which I'd initially installed the extension was void.

I'll echo what @robaxx said: because of the project's light weight, drop it if it's not benefiting you in any way. What I'd do is not add any more features past the description on the extension download page, and consider whether any future change to the extension to keep it working exceeds an arbitrary threshold of effort, dropping it if it does.

On having my data sold: no, never, especially on an extension of such limited scope.

Good luck, and thank you again.

[ounrequitedo]

I hadn't even considered until @tunelessly brought up the survey link which was auto-opened. @avi12 can you force open ANY url on our machines that you choose? How exactly was this survey opened on my machine?

[ounrequitedo]

Your open candor and discussion in this thread gives me no reason to doubt you. I just hadn't realized that a malicious takeover of a popular extension could let's say have 10M+ people all open a crypto cpu mining webpage or virus / cookie gatherer, etc. without their prior knowledge. Kinda bad guardrails if you expect an extension to only work on a particular website but the extension can bump Elon's onlyfans views for example. ^_^

[avi12]

I mean, if an extension does such a malicious behavior, it can be reported

[avi12]

Theoretically, an extension could include a script that mines cryptocurrency(ies)
In practice, CWS bans them as they violate a policy

[oakif]

@ounrequitedo Any extension can do this. You'll see plenty of extensions on the Chrome store which open web pages. If this were a serious security threat, it wouldn't be an allowed feature for extensions in Chromium

[avi12]

@oakif I only partially agree with you.
When it comes to browser extensions, you're right, but when it comes to web development, I disagree with you
Consider push notifications: often malicious sites that push advertisements (e.g. AdFly) require from the user to allow push notifications, after which he will get spammed every now and then, and unless he's tech savvy, he won't know why it is like that

[avi12]

@thulle @Auron-FFX @GREK643 @milankragujevic @EB-Plum @rossysaurus @Rodrigo-Ayam @APELipke @KentaigaIBE @bray18 @oakif @DerpyChap @hydraulix93 @martixy @olithraz @fmdcarvalho @sudosu0 @jerryasher @brasky @pmarks-net @robaxx @ounrequitedo @tunelessly
Despite the chart showing that the majority of users (data combined from some Chrome, Firefox & Opera users) are ok with their data being collected anonymously:

I will either not do it or do it as an opt-in
Even though it means I will get far less revenue, at least it's much safer for the users and my reputation

[oakif]

It seems like the most disgruntled users are also the most vocal.

Personally I don't see what the big deal is. If you don't like it, opt out, prevent the extension from accessing other URLs, and move on. This guy has been more transparent than 95% of other software developers

[tunelessly]

I will either not do it or do it as an opt-in Even though it means I will get far less revenue, at least it's much safer for the users and my reputation

Thanks for sharing. For what it's worth if you're going to spend the effort in doing this, this is the right way to go.

[martixy]

It seems like the most disgruntled users are also the most vocal.

Have you considered that not everyone will understand the scope of this change? That not everyone clicked on this discussion and saw the exact details? That they might (quite reasonably) be assuming they will only be tracked on youtube (the site for which this extension functions) and not ALL OVER THE INTERNET?

Did you consider that those most disgruntled are also most vocal because they most understand the scope of this change?

I will either not do it or do it as an opt-in

Thank you for considering your users' safety and privacy.

[Acre9000]

Hi, @avi12, thanks for the work done here, also cheers for bringing discussion into this type of changes. You say that this extension is free and that you rely on donations for maintaining it, yet I can't see anything around the extension to support you. What services are you using right now for receiving support? Is the google extensions system allowing for a "pay what you want" type of support? In case is not, I can recommend utilising Kofi as gate for receiving small donations. And a recommendation is to have the options for people to support you being as visible as possible. Even using the pay what you want step of pages like kofi or gumroad (set your price even if it is 0) can help users consider helping you. If I get to know where I can do this, I'll be happy to send a small donation.

Good luck, I definitely prefer a paywall for luxury features rather than selling user data in bulk.

[avi12]

Thanks a lot!
Right now I receive donations via PayPal, and it's obvious in the extension ("Support developer" section):

The issue with donations is that I believe that if the user will open the popup page, it will only be upon the extension installation

By the end of January, I released an update that injects a temporary donation section on YouTube (temporary as in closing it will keep it closed permanently)
While it did increase the donations rate by a small margin, some users frowned upon it as it seems like an ad

I definitely prefer a paywall for luxury features

The issue is that I believe that the core features of the extension need to be free, so I can only paywall non-essential features (like #5)

[Acre9000]

Shit, of course you have cared about this, amazing. Sending small donation for the work!

…

________________________________ From: avi12 ***@***.***> Sent: Wednesday, February 8, 2023 12:13 PM To: avi12/youtube-auto-hd ***@***.***> Cc: Acre9000 ***@***.***>; Comment ***@***.***> Subject: Re: [avi12/youtube-auto-hd] Monetization of anonymized usage data (Discussion #68) Thanks a lot! Right now I receive donations via PayPal<https://paypal.me/avi12>, and it's obvious in the extension ("Support developer" section): [image]<https://user-images.githubusercontent.com/6422804/217513560-47096529-8cbe-4832-b026-2cfc58260554.png> I definitely prefer a paywall for luxury features The issue is that I believe that the core features of the extension need to be free, so I can only paywall non-essential features (like #5<#5>) — Reply to this email directly, view it on GitHub<#68 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AKZWWCBRTEMN7MBJDZEFX4TWWN5VDANCNFSM6AAAAAAUROPIYE>. You are receiving this because you commented.Message ID: ***@***.***>

[avi12]

Thanks a lot!

[Sliickk]

Thx for all your hard work, extension works great! I'd prob prefer a paywall type change. Something like the free version only allows 720p or 1080p, and then users can pay x amount to unlock all resolutions or $1 per resolution option or something along those lines. Maybe free version only allows x amount of videos per day for free. That would keep it free for casual users, while most people who view a ton of vids per day will most likely pay to unlock the unlimited use.

[avi12]

That business model sounds interesting, but considering that even YouTube has bailed out off paywalling 4K, I don't think it's gonna work in my case either

[RubenLungu]

While I do respect the fact that you made the effort to let us know about this change, and didn't try to push it silently, you have already lost my trust for even considering it. "they typically want me to include their content script that runs on all sites ", I can't be the only one to realize how ridiculous this sounds. This change would turn this extension into malware, no matter how you sugarcoat it. The majority of users are ok with their data being collected and sold because they don't know or understand what it means.
I wish you good luck with your endeavor, but I'm uninstalling already.
Also, I don't appreciate random Google Forms popping up on my browser. I understand the reasoning for it, but like I said, the fact that this is a matter of discussion is already concerning enough to make me remove the extension.

[avi12]

@RubenLungu I understand your concern
From my point of view, I put some work into the extension and now 100,000 users use it for free
On one hand, it is such a surreal experience as I'm making a positive impact on 100,000 user experiences
But on the other hand, I might worry about finances at some point, which I wanted to avoid, and including a script that users could opt out of could've been an option - as it would have generated a steady income

However, in practice, if I were to push such an update, the extension would've automatically been disabled on all browsers and I would've likely lost at least half the users
Thus, instead I decided to run the poll to see what is the situation amongst the users, and I decided to switch courses and I will either not generate a revenue or do it as an opt-in