Definitely gross that companies are using forced arbitration to avoid liability for their breaches (first 23andme, now Roku). Call your congressperson. Also, if you are impacted/have standing, consider an FTC complaint [2] and contacting your state’s attorney general.
I'm sure that after my phone call, my congressperson will drop all the things he is being paid thousands of lobbying dollars to do on behalf of his donors to get right on this. Sorry for the snark, but normal people are powerless to do anything about these shenanigans.
The article cites these two sources[1][2] which say
> Unauthorized individuals using account credentials believed to have been obtained from third-party source(s) were used to access individual customer accounts
[1] https://apps.web.maine.gov/online/aeviewer/ME/40/e9cc298b-37...
[2] https://oag.ca.gov/system/files/Template%20Notification%203-...
Odd that Roku singles out the 0.5% of users affected within the state of Maine. Must be related to some sort of Maine data breach law? I didn't dig too deeply, but not seeing anything explicitly called out in their statutes [0].
[0] https://legislature.maine.gov/legis/statutes/10/title10sec13...
It could also be targeted credential stuffing given recent events. An interesting tactic to create problems for a company.
I'm not saying Roku is a good company, but this isn't really a data breach but poor credential management by customers.
Roku is also taking heat for using forced arbitration at all, which some argue can have one-sided benefits. In a similar move in December, for example, 23andMe said users had 30 days to opt out of its new dispute resolution terms, which included mass arbitration rules (the genetics firm let customers opt out via email, though). The changes came after 23andMe user data was stolen in a cyberattack. Forced arbitration clauses are frequently used by large companies to avoid being sued by fed-up customers.
https://arstechnica.com/gadgets/2024/03/disgraceful-messy-to...
I wonder how Roku would react if every Roku user filed an arbitration case since your data was at risk.
The new terms have language that say that if enough people enter arbitration at the same time, they have to do one big "mass arbitration."
Twitter, in relation to arbitration with employees it terminated? https://arstechnica.com/tech-policy/2023/07/twitter-refuses-...
There is a 30-day window after agreeing where you can mail them a letter opting out of the new arbitration agreement.
https://cordcuttersnews.com/roku-issues-a-mandatory-terms-of...
You're thinking like an engineer given the problem of "get people's consent" instead of like a businessman with the goal of "altering the deal."
Forced arbitration? Much better than an expensive lawsuit.
Except when hundreds to thousands of people want arbitration and since the company wanted arbitration, we have to foot the bill... Yikes.
Hmmm. Fix the arbitration scaling problem by changing to forced mass arbitration. But the users will have to send in a letter to opt out of the new agreement.
Roku has 80 million+ accounts.
What happens when even one percent of those account opt out? Put on your "grudgingly-pay-the-outrageous-fine-with-pennies" hat and I'm sure you can come up with ways to increase the difficulty level of receiving many letters opting out of this new agreement.
People rolled their eyes when I suggested that this was intentional, but these recent revelations strongly suggest that Roku is very comfortable exploiting the hell out of dark patterns.
If we don't enact stronger consumer protections, everything will work this way.
Don't misunderstand me: it's 100% atrocious that any device bootloops if some ad network 403s, but on the spectrum of "spit into one hand..." and nginx in the other ...
Days after forcing it's users into mandatory arbitrations this comes out.
Would be awesome if holding someone's TV hostage until they agree to not sue you was illegal.
Also, the breach happened while people were receiving services under the old TOS, not the new one. I wonder if that could impact things?
https://news.ycombinator.com/item?id=39503941 (2024-02-25)
Card won’t be charged during the free trial? Don’t need another copy out there!
how limited and what subs
Of course you can't guarantee that your data will actually be purged, or that it hasn't already been compromised from these places - but less exposure is better than more exposure, right?
