Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Context: After careful research our organization preferred a European partner with good central privacy controls. We landed on Mistral, after being disappointed that the Pro tier was opt-in to training on prompts by default we switched up to the Team tier which provides an organization dashboard with some relevant settings. As we did that Mistral changed these options and the Team tier was now also opt-in by default and at the same time seemed to have lost the ability to centrally disable training on prompts for your entire organization. This even caused some of our (testing) prompts to be used for training (which Mistral removed after we expressed our disappointment).

For some time these pages conflicted with what our users reported (they said that in contrast to what I stated to our management they found they were opted into training on prompts by default as per their own privacy page). Mistral just now corrected their docs. I'm not sure how long the conflicting situation has lasted, but at least for several days.

For contrast: Claude disables training on prompts for organizations starting from the 18 euro tier [0]. As a European I'm disappointed.

[0] https://claude.com/pricing#team-&-enterprise



> and at the same time seemed to have lost the ability to centrally disable training on prompts for your entire organization

There is a toggle on https://admin.mistral.ai that allows you to disable training for both Vibe and Console/API for your entire organisation. And I'm not on the enterprise plan. I've disabled training the first time I created an account, and it has remained that way.

You story is also very confusing due to the wording around "opt-in by default" and "disappointed [about] opt-in to training" (most people would be disappointed about an opt-out) and probably conveys the wrong message to most people.


I don't have that toggle (but could indeed have sworn I saw it earlier).

Sorry, I have always thought that "opting in" is, "opting for the presented option" and opting out is "opting out of it", so opting out [of sharing prompts for training] is choosing to not share, but apparently I was wrong my whole life. I'm not a native speaker, and I think most people here (in my country) would interpret this the way I do? Weird but TIL.


FWIW I don’t find what you wrote confusing, but I do think it is following a sort of… bad convention that some companies have been pushing.

Opt-in and opt-out describe the nature of the choice that you make. “Opt” means to choose (apparently it is a French word we stole). Opt-in means you have to proactively choose to be in. Opt-out means you have to proactively choose to be out. “Opt-in by default” is an overly verbose way of saying “opt-out.”

In either case it describes the choice that you need to proactively make to override the default behavior.

Edit: I should also say that it is a “known point of contention” where pro-privacy people have been pushing back on this phrasing. So, you have probably accidentally stumbled into an ongoing discussion, which is why some of the comments might be unexpectedly prickly.


>Edit: I should also say that it is a “known point of contention” where pro-privacy people have been pushing back on this phrasing. So, you have probably accidentally stumbled into an ongoing discussion, which is why some of the comments might be unexpectedly prickly.

Yes, because people will say that something should be opt-in, meaning off by default, and then someone makes it on by default and says 'oh, it's opt-in, you're just opted in by default!'


I 100% agree that “opt-in by default” is bad and that “opted” in that sense is a bullshit incoherent phrase. Unfortunately this “opting as a thing that happens to you instead of a choice” idea has evidently been promoted well, so we have to expect that people will unknowingly use it.


“Opt-in” means to agree to something. If something is “opt-in by default”, it means that it is opt-out and someone is using weasel wording and contract inducements to force you into something you didn’t actually agree to. Any “disagreement” is just people trying to advocate for what they wished it meant.


And suddenly we have laws directing AI companies to report bad behavior or potential rival candidates.


And some shadowy departments do this without needing any laws at all.


If you opt in it means that by default you're not in and you chose that option. So if you're now included in training by default, then it's an opt-out feature as in you can opt out of it.


Idk, feels like my brain does not have the model for this, this does not exist in my language afaik haha.


Opt-in = "we assume you are out unless you tell us you want to be in"

Opt-out = "we assume you are in unless you tell us you want to be out"


Just remember, good company’s leave them off by default. Bad companies will turn them on for you.


Replace opt with its equivalent “choose” and it becomes choose-(tobe-)in and choose-(tobe-)out.


> I don't have that toggle (but could indeed have sworn I saw it earlier).

You don't see "Allow the use of your interactions with Vibe to train Mistral’s AI models" at https://admin.mistral.ai/vibe/privacy ?

And "Allow the use of your API calls to train Mistral’s AI models" at https://admin.mistral.ai/plateforme/privacy ?


The toggles I see

at https://admin.mistral.ai/vibe/privacy:

Allow public sharing of chats content

Allow user feedback on model responses

Chat Retention Policy

At https://admin.mistral.ai/plateforme/privacy I see

Allow the use of your API calls to train Mistral’s AI models.

Enable Labs models

So indeed, no "Allow the use of your interactions with Vibe to train Mistral’s AI models". I only see that setting here: https://chat.mistral.ai/chat?profile_dialog=privacy And I have to ask every user in my org to go and turn it off.


Mistral support just confirmed that the org-wide toggle was removed from the Team plan earlier this year and made exclusive to the enterprise tier. I bet that if you signed up earlier, they didn't remove it from your account, but it's not there for new customers. Which explains some of the confusion here.

Also explains that the community support in Discord insisted that the toggle should be there, moreover they told me the individual toggles on the user's pages wouldn't do anything because it defaulted to "off" for any organization, as per their docs until 2 days ago. But that changed.


Ok it (org wide toggle) just (24h after posting this) returned and the docs were changed again! They now include the text:

"Vibe (Teams): Administrators can disable data training usage for the entire organization."

That’s nice! Except that it was on for my entire org so I’ll be checking if they didn’t store anything first thing tomorrow. I wonder what changed their minds.


No you're not wrong, but while I can't speak for this specific instance, in many other cases, this language is intentionally confusing in order to dark-pattern users into agreeing to the thing they don't want to. Similar is using ambiguous language next to a switch/checkbox that makes it difficult to tell exactly what each state means.


I think there is a simple, unambiguous way to describe this, which is to use the passive voice or an explicit subject with the past tense to clarify that you didn't do the opting in.

Saying "we were disappointed to be opted in to training by default" clarifies the point you're trying to make, which is that the toggle (whatever it may be called) was set to training by someone else, not you.

Actually in your case you'd say "...after being disappointed that the Pro tier opted us in to training on prompts by default", which gives an explicit subject ("the [Mistral] Pro tier"). No one will confuse that with the opposite "the Pro tier opted us out of training on prompts by default".


I think the trouble with "opted in to training by default" is that there was no "opting", i.e. no choosing. I can't come up with a better suggestion off the top of my head though!


Imho, legally, one should always be 'opted out' of 'forced mingling of your ideas' without deliberately opting in. Same as for advertising, click-through tracking, and sociopsycho/marketing metrics. Like the old firewall rule (easier to handle opt-in/out that way than firewalls; like, how many people can run a firewall that way now?). Users should have it right in front of their face when they install something or register, too, not hidden among options. It might take the user five or ten more minutes to get to use the app but worth it.


You said it correctly, there’s no confusion.


Downvoted for knowing how to read


My native-US-English speaker read:

“disappointed that the Pro tier was opted-in to training on prompts by default” [and required manually opting out]

“the Team tier was now also opted-in by default” [and required manually opting out]

In context of each sentence and the larger comment, read smoothly here.

Also - have seen more than one lively discussion on these phrases, since defaults can stick 95% of the time and Big Tech has done their best to be abusive about what they automatically enable for users by default for some time.


It's understandable but it is technically inconsistent and dilutes the meaning of opt-in. Opt implies an active choice, so you never are opting for the default.


It's also simply bad writing regardless of what meaning the reader takes from it. "Enabled by default" or "Allowed by default" are much clearer and more natural phrasings without any connotations of the user having taken an action to express a choice.


I also have these toggles, while being on a free plan. I must have set them to disabled at setup because that's how they are now.


"For contrast: Claude disables training on prompts for organizations starting from the 18 euro tier "

In theory also for individuals?

At least I have that toggle to deactivate that. But how would I ever know if they actually respect that?


If you don’t trust the company to keep their promise, don’t use their products.


I don't trust any company with their word on anything. Luckily, privacy policies are legally binding.


> Luckily, privacy policies are legally binding.

Companies violate them all the time and massive leaks happen a lot.

The punishments are trivial.


GPDR fines in the EU are NOT trivial.


> Luckily, privacy policies are legally binding.

Laws are violated all the time. The graveyard is full of people who had the right-of-way at a crosswalk ...


Why does that matter? Legally binding just means "slightly more expensive when we get caught"


How can you trust any company?

The only company you could think of trusting is one where an external , independent auditor is doing its work.


> If you don’t trust the company to keep their promise, don’t use their products.

Your comment is perplexing. No company on earth meets your requirement. What are you expected to do? Move to a hut in the woods?


> Move to a hut in the woods?

I'm so burned out on the bullshit companies that succeed in tech forcing their will upon us serfs that I'm actively looking into that very thing at this time. Tech used to be fun. Now it's just depressing. I'm ready to go back and take the blue pill.


Been there. Nice and peaceful, but can get lonely, though.


That is ridiculous. Vote to ensure products have to be legally private and make it a crime to share or reuse your data for anything. This should be the norm that people vote for. The idea that we have to give up privacy so some nerdy pervert can be a billionaire off the backs of people who do the work is absurd.

Criminalize failure to keep private data private. Arrest CEOs and executives. Put them in jail when it happens.


What company do you trust to keep their promise?


My 20 EUR Claude (individual) had the training on by default.


Yes, individual indeed (used to different but changed about a year ago, see [0] among others].

For the Team and Enterprise plans de default is "not sharing prompts for training" (which I mistakenly referred to as opted out of sharing prompts for training.) [1]

[0] https://news.ycombinator.com/item?id=45076274

[1] https://claude.com/pricing#team-&-enterprise


This post is only about the defaults, and expectations therefore for Team and Enterprise plans and their organizational controls.


How do you know an LLM provider does not kill puppies every time you send a prompt longer than 14 words?


Because they have no incentive as a company to do that? But do have a strong incentive to learn from user input. (Most cutting edge features are developed private - very valuable to get that into your tool)

And getting the data is not hard, they already have it. Risky is indeed a bit making use of that data, as that requires at least some humans (as potential whistleblowers). But you don't even have to tell them, where the data came from.

Whether they do it? No idea, I assume not, but I see a risk.


We can easily make it a crime to collect the data and another crime to share it or store it in a way that allows someone else to copy it, authorized or not.

People always want to overcomplicate everything to benefit 5 super rich people that got rich taking wages from workers and ripping off retail investors. Please stop the pandering. Vote for yourself and your neighbors, don't vote to eliminate privacy so a rich pervert gets to exploit you.


And what would my vote change about the situation?

Local hosting will be a solution, once the hardware becomes affordable.


Vote for people who want to restore the 1950s federal tax rates that we already had in the 1950s. I find so sad that people ignore history and act like solutions don't already exist.

The 90% tax bracket in the 1950s capped CEO and investor yearly income to the 2026 equivalent of 5mil a year. Use that imaginative brain that likes to speculate instead of learning history to image how our entire society changes if no individual can earn more than 5mil a year in all income sources. We also banned stock buybacks and had more regulations put in place after the 1929 collapse and great depression. Those things were removed slowly over the 60s and 70s until a lot was gutted all at once in the 80s. The final blows came in the 00s.

All the problems that existed leading up to and during the great depression are back because we reverted all the laws and policies that were put in place to prevent it from happening again.

None of this is complicated. Stop worrying about culture nonsense or right wing nonsense. Start voting to tax rich like we did in the 1950s.

Why did we have so many local and regional stores back then, but only a handful of conglomerates today? There is no incentive to merge companies by CEOs when it turns two 5mil a year CEO jobs into one 5mil a year CEO job. In that environment, merging is due to actual company need, not CEO enrichment.

CEOs will also stop cutting wages, under staffing, and outsourcing. It all stops because they no longer get paid more doing it. This is actual US history, the country boomed economically because of those tax rates and financial regs. This is not something anyone gets to deny, it already happened.

Voting against a proven solution is madness.


Always assume and act as they won’t honor it.


“Opt in by default” would mean that it is not enabled by default. Do you mean opt out?


Yes, I found this comment very hard to understand until I realised they were talking about it being opt-out with no setting to change it. (At first I thought it was opt-in by default, and the "by default" implies that there is a setting to change the opt-in/opt-out setting)


You are "opting in to sharing your prompts for training", by default in this case. My slider says: "Allow the use of your interactions with Vibe to train Mistral's AI models.", it is on by default for everyone on the Team plan, the admin can't centrally turn it off anymore, and any user can toggle it when they want to. This all changed last week.

I know I'm naive but I expect that when I pay, this stuff is simply off, so I was already surprised by the Pro plan. But I did look out for it there, because Anthropic made this switch some time ago.


> You are "opting in to sharing your prompts for training", by default in this case.

The English term for that is "opt out" not "opt in." To opt is to choose. If something is on by default, you have not opted in. You were forced in, and turning it off means you must opt out. (I.e., choose to be out.)

normally I wouldn't care about a mistake like this, except that opt in/out are very important concepts in software development and hacker culture. And it reversed the meaning of the original comment in a highly confusing, relevant way.


as another non-native speaker, i think that while the person you're answering to didn't use the default way of expressing this in the english-speaking world, i did understand what they meant, i think they do know what opting means and i think the reasoning is this: when they say data collection is "opt in" by default they mean that by choosing to use a product, you are opting into your data being collected (at the same time). on the other hand, native speakers saying something is "opt out" describes the options or toggles one has available in the default case - when something is toggled "true", you (only) have the choice to toggle it of. so english speakers talk about the controls one has to CHANGE the status quo.


As another non-native speaker, I misunderstood what the person meant.


They said "opt in to training on prompts by default," which is coherent English and perfectly fine. The phrases "opt in" and "opt out" will always be contextual based on what is being opted, so it really falls to the reader to pay attention to that context. Please don't give English language advice as though you are an authority; there is not a rule of the English language that would make their usage unacceptable.


Since the whole idea of ‘opt in’ is choosing to do something, the only reasonable interpretation of ‘opt in by default’ is that the default state requires you to make the choice yourself. However I try to bend my brain, sing the term ‘opt in’ for the exact opposite makes no sense whatsoever.

Note that I’m not using English grammar as my argument; human language (and English especially) has plenty of exceptions and expressions which make little sense, and if people were to adopt this phrasing en masse, it would naturally become a part of the language, whether it makes sense or not. My argument is that adopting this phrasing is a terrible, user-hostile decision and in my honest opinion we really, really, really ought to avoid it.


I read it as though he was trying to say '[you are] opt[ed] in by default'.

Now granted, he did not say that, and I only reached that conclusion by the rest of this conversation, but I think to have meant that and said '... was now also opt-in by default...' isn't unreasonable.

Just sharing since you mentioned you couldn't see how using that term for the opposite would make sense.


Thank you. However, assuming you mean ‘an affirmative choice is made for you’ when you say ’you are opted in’, that use really takes the ‘opt’ out of the ’opt-in’. You can opt in, but you can’t have someone else ‘opt you in’ for you; that seems to go against the very core meaning of ‘opt-in’ (i.e. having to explicitly choose something yourself).

In other words, you can explicitly choose something by yourself, but if other people (in this case companies, service providers) choose something for you, it’s no longer your explicit decision made by yourself. Hence why I believe we can’t consider that ‘opting in’.


Even read this way, it doesn't make logical sense. It's a great example of newspeak - corporations know people use "opt-in" as a purchasing signal, so they're trying to redefine the word by abusing it enough times.

"Opting someone else in" is essentially the same category of error as "consenting for someone else". People can only consent for others in specific circumstances and even then only for specific people (e.g. legal guardians), trying to argue "but I consented for them!" in front of a judge usually ain't gonna work.


Here's the dictionary: https://en.wiktionary.org/wiki/opt-in

> The property of having to choose *explicitly* to join or permit something; a decision having the *default option being exclusion or avoidance*; used particularly with regard to mailing lists and advertising.

You're just using the term wrong. That's okay, I've used words wrong before, and it just means you've been presented an opportunity for learning a new fact.

But there's no argument to be had except with the dictionary.


My use seems to be perfectly in line with the given dictionary definition, though? Did you perhaps mean to address a different comment?


I find the usage bizarre and confusing, as others also clearly do. There’s nothing wrong with pointing this out.


> They said "opt in to training on prompts by default," which is coherent English and perfectly fine.

No, it's really not. It should read "opted in to training on prompts by default".

"Opt in" means "you have to affirmatively turn this thing on". "Opted in" means "the thing is currently enabled".

Which is why it's probably better to write it as "enabled by default". Much harder to misinterpret.


> They said "opt in to training on prompts by default," which is coherent English and perfectly fine

"Opt in" and "by default" are contradictory phrases. They mean literally the opposite of each other. The only reason it's coherent is that most native speakers will elect to believe "by default" was used correctly because it's the easier to use term.

> there is not a rule of the English language that would make their usage unacceptable

I think you're using emotionally inflammatory language, possibly unintentionally. no one is refusing to accept what they wrote.

That being said, the way they used "opt in" is categorically wrong. It's the opposite of the dictionary definition.

https://en.wiktionary.org/wiki/opt-in

> The property of having to choose explicitly to join or permit something; a decision having the default option being exclusion or avoidance; used particularly with regard to mailing lists and advertising.


> You are "opting in to sharing your prompts for training", by default in this case.

I understand what you're saying here, but maybe "turned on by default" is less confusing for everyone.


> opt-in by default

That's called opt-out.


Yeah, it was confusing to read the parent before I realised they got the terms the wrong way around.

To those wondering, "opt" means to choose. "Opt in by default" makes no sense because you didn't choose; this is just "in by default". If they give you an option then it's called opt out. Opt in would be "out by default" with the option to go in.


I don't trust any of these companies with my data, and I assume that whatever data they've got is going to be used, one way or another, no matter what they tell you. It would be nice if you could stick a sentinel in your data that if it ever shows up in the models you know they've broken the rules for sure.


Yeah. Unfortunately they know you can't catch them on this so they feel absolutely free to do whatever they please

If such a data sentinel did exist then we might see them change their behavior


Buried by the distraction of the semantics of "opt in" vs "opt out", the more interesting conflict isn't addressed in the sibling threads.

> and at the same time seemed to have lost the ability to centrally disable training on prompts for your entire organization

vs

> Vibe (Teams): Administrators can disable data training usage for the entire organization.

Is the document out of date? Or did Mistral reinstate this ability after the fact? What's the story here? Others seem to be stating they have and have had the ability to opt out of training centrally for a long time.

EDIT: Oh, it is addressed just a bit hard to find with all the opt in/out explanations: https://news.ycombinator.com/item?id=49549102


You are right! They must have just now switched this back, I also have the toggle now! It was turned on sadly but it’s something.


Just now the sentence:

“Vibe (Teams): Administrators can disable data training usage for the entire organization.”

Was added to tfa. And I now see an org wide toggle where there was none before! Sadly it was on so I hope no users submitted stuff in the mean time, but it’s something!


Today I registered a free account with Grok, because I simply was curious. Man, training is "off" by default even with the free tier. I was positively surprised. As a European I'm disappointed too.


Grok has possibly the worst ToS of any of the AI providers. They are probably different in the EU, but:

> In choosing to submit, create, generate, record, post, or display Inputs on or through the Service, you grant an irrevocable, perpetual, transferable, sublicensable, royalty-free, and worldwide right to SpaceXAI to use, copy, store, modify, process, adapt, transmit, distribute, reproduce, publish, upload, download, display in public forums, list information regarding, make derivative works of, and distribute such Content, including anything referenced therein, in any and all media or distribution methods now known or later developed, for any purpose, and to aggregate your User Content and derivative works thereof for any purpose, including but not limited to: (i) maintain and provide the Service; (ii) improve our products and the Service and for our other business purposes, such as data analysis, customer and market research, developing new products or features, or identifying or displaying usage or User Content trends; and (iii) perform such other actions to enforce these Terms, comply with our Privacy Policy, comply with applicable law or governmental, court, and law enforcement requests or requirements or keep our Service safe.

> To the extent the User Content includes a person’s image, likeness, voice, or other similar attributes, you grant SpaceXAI the same rights to use those attributes as part of the User Content as described above. You represent and warrant that you have obtained all rights, licenses, notices, permissions, and consents necessary for SpaceXAI to use that User Content.

https://x.ai/legal/terms-of-service


Lol, I'm fully expecting in 6 months time:

"A bug in our portal had the setting for training inverted. This means that when you expected us not to be training on your data, we actually were. We know this adversely impacts the trust our users invested in us, so as of today we are crediting all affected accounts with $200 to use on our latest models".


One can expect a lot what happens in 6 months. Maybe the earth will turn clockwise then! Think about it. :-D


Lol. I would have thought it depended more on your relative position to the equator than on the season.


Until the risk of large financial penalties or long jail times is high enough, the CEOs of there companies operate using the "It's Better to Ask for Forgiveness Than Permission" model.


  > opt-in by default
Sorry to nitpick but the scheme you’re referring to is called “opt-out.”


> being disappointed that the Pro tier was opt-in to training on prompts by default

"Opt-in" means that the default is non-participation, for example, not training on your prompts. Is it possible that you intended to say "opt-out", which means that the default is participation? That's what the context seems to suggest.

See, for example, https://termly.io/resources/articles/opt-in-vs-opt-out/:

> Data privacy laws like the GDPR and CCPA give individuals the right to opt in or out of different data processing activities.

> · Opt in consent means the user takes an action to show they agree to something,

> · Opt out consent is when they take an action to say no.

Or https://bigid.com/blog/opt-in-vs-opt-out-consent/:

> • Opt-in consent requires users to actively agree before data collection or processing.

> • Opt-out consent allows data collection by default unless the user declines.

This is an important distinction, because confusing the two (as you seem to be doing) can lead you both into unethical fraud and legal liability.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: