Score one for the GDPR

Every so often, the law actually works

So, it took a minute, but a little over a week after I posted my ‘One Weird Trick’ post on how to object to Substack’s ‘Scan For AI’ feature, under the GDPR’s Right to Object, I’m happy to report that it worked!

If you missed it…

NGL, I had middling hopes that they’d actually respond, but after I started to hear from others (including Marion Pandora) that objecting was yielding results, I sent them a follow-up message today, and received confirmation that Substack had, in fact, disabled Pangram from my account.

In their email, which came from Substack’s Standards & Enforcement Team, the company implemented the following technical fixes:

• They configured my account so that requests to scan through the Scan for AI text feature are no longer processed.

• This applied retroactively— “Existing AI detection labels associated with your content have been removed, and readers are no longer able to initiate new scans of your existing or future posts, notes, or comments through this feature.” Instead, readers see ‘This detection has been removed’. Note that this message exists regardless of whether the AI detection is enabled or not.
  

But they also shared details on how Substack currently uses Pangram AI detection for posts.

Substack does not currently use these results to create or maintain an account-level assessment of a publisher, assign a cumulative score to a publisher, or characterize a publisher based on prior scan results. The feature is not intended to assess a publisher’s conduct, credibility, reliability, or working methods.
The feature also does not provide the reader with access to content that the reader could not otherwise view. It may be used only in relation to content already accessible to the reader initiating the scan. …

Scan for AI text is an informational feature. Pangram results are not currently used as inputs into: content ranking, recommendations, feed placement, or search visibility; monetization, payment processing, revenue-sharing, or promotional-program decisions; moderation, enforcement, or account-level actions; or cumulative or repeat-flag assessments of publishers.

Substack does not currently maintain operational policies or decision-making workflows that rely on Pangram results when making decisions concerning publishers, their accounts, or the distribution of their content. Accordingly, the feature does not make solely automated decisions producing legal or similarly significant effects concerning publishers.

Now, I’ve written data subject responses in the past, and I know that every word choice matters. You don’t want to be vague to the point of giving a non-answer (people will complain). But you also don’t want to bind the company into perpetuity. So I get why they used the does not currently language.

What struck me is all the enumerated ways that the teams had thought of to use this data, and how none of these features were explicitly ruled out.

I was also disappointed that Substack refused to share even the basic legitimate interests assessment logic with me. Had this been used for actual automated decision-making/profiling within scope of Article 22 GDPR, Substack would have been obligated to share at least an explanation of how the profiling occurred, as well as a right to challenge.

---

However, it still bugs me that the reason this weird trick worked was because I’m in the EU. We all should have data protection rights. Privacy and data protection laws should be universal and consistently applied, because these are human rights, and we’re all humans.

But instead, we’ve got a patchwork system. Inside the EU / EEA, there are rights. For everyone else, bar a small number of countries like South Korea, Japan, and Brazil, there’s bupkis.

Substack could, if it respected its users, give everyone the right to object in settings. I hope that maybe one day, they will.

But until then, score one for the overregulated EU.