I'm pretty sure that's illegal under GDPR.
> When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
Facebook might declare otherwise, but since SMS and IRC both stand as counterexamples of successful text chat services that do not inherently depend on tracking, they would likely lose their case.
i.e. Without this tracking, the quality of Messenger is affected, and therefore, by definition, the service cannot be provided without it.
As such, trackers in 3rd-party advertising network code probably won't count as necessary; it's necessary for the ad network, but it is not necessary for the website displaying the advertisements, as proven by ad-blockers.
Likewise, the facebook like button and other "plugin" components aren't "necessary", they merely add value to the existing content / features, and must therefor be entirely opt-in.
At least, that's my understanding, which is entirely too facile to be taken as legal advice.
EDIT: As petercooper pointed out below, in addition to proving necessity, you must still also prove in court that you have balanced the necessity against users' rights and interests. As such, I no longer feel confident to say I even have a clue as to what is legal and what is not, for FB or for anyone else, until there's a big enough court case to set precedent.
when I was a child I stole a toy from Wal-Mart. Wal-Mart is still around. Therefore, Wal-Mart's entire existence as a store does not depend on any kind of anti-theft measures, and it should be illegal for them to film my entrance and exit.
1) Laws don't exist in isolation
2) Long standing law says theft is illegal and stores can take steps to limit it.
3) This new law (GDPR) says you can't take users details and use them unless necessary to provide your service.
With this new GDPR law it's the little guy, the user, that get protection from something of value being taken from them and exploited - their personal details.
So, extending the above counter-argument it is also true to say that like Walmart, the singular 'theft' of personal details might not be terminal for the user. But just like the law recognises the theft of material goods and it's potential harm (even in the case of a singal instance), it now recognises the 'taking' of personal data as harmful (also even a single instance).
Extending the argument further, the GDPR takes the stance that one entity has been taking something of value from another without true compensation for the value of that something.
When we realise that what has been taken from users has value and that users haven't been fairly compensated for that value, it becomes obvious that a set of entities have based a business model on profiting off another set without fair compensation.
The GDPR now limits that behaviour and business model to return balance to the 'contract' between the two parties. Users get to use a service by providing the minimum needed for that service to be provided.
Further, some stores put locks on items and displays that others do not. These are also required for the store to continue offering such services.
You, as an individual, may not have undermined the store. However, you, as an individual among many, may be the reason why certain stores are not able to function as other stores do.
EDIT: to clarify my point, I don't think the GDPR takes how revenue is obtained into account. The revenue model itself must still conform to user consent. The analogy of Walmart to ad-blockers is interesting, though slightly off when one behavior is illegal and the other is not.
This actually makes more sense finically for Facebook, if they did the first thing people would only have to buy data once, and worse they could resell the data to third parties decreasing Facebook’s control of the market. Instead by retaining control of the data Facebook can charge an advertiser for every ad they show, making more money. Ironically this also better protects peoples privacy because Facebook isn’t actually giving the data away.
It's certainly not a complete profile, and may have ranges of categorizations (i.e. 18-24 years old) BUT as an advertiser, I probably wouldn't need or want data more specific than that anyway.
You can of course though collect them if people actually click on them and come to your website! This is also the case for non targeted ads mind you as it’s simply how the web works
It would be interesting to see revenue as a necessity be tested in court, since there are open-source social networks that don't rely on user tracking or data sales to the extent that Facebook does it.
However, they need to pass two other tests, a "necessity" test that determines that the processing of information is necessary to serve the interest, and, most crucially, a "balancing" test which balances the commercial interest against the user's interests, rights, and freedoms. It's this latter part where more onerous advertising practices will falter.
https://ico.org.uk/for-organisations/guide-to-the-general-da...
Also, does Facebook's ad network really constitute "direct marketing"? I had imagined that to be more of an email blast about a new FB feature, rather than collect-your-usage-data-and-sell-marketing-slots-to-you.
Now that I type that out, I guess it does make more sense. However, I really am not a big fan of the common-law approach to the "balancing" test. Basically, whoever has the most money and faces the most lenient judge wins. Everyone else is left guessing what the hell is legal and what isn't, when a clear set of rules would be much easier to fairly apply to everyone.
Vote me down all you like, but it doesn't affect what is actual legal fact :-)
I'm pretty sure Facebook has the resources to have hired competent lawyers to advise them on that, and the money to afford preparation and execution of a strong court presentation of their viewpoint.
And Facebook probably had more information on what is necessary for the system Facebook provides to work than people trying to guess that from the outside.
It is, of course, possible, and, perhaps even likely, that a court will disagree with what they argue, and force a change—but it may be, from a PR perspective, worth the cost of non-compliance sanctions to have any decrease in utility resulting from changes they will be compelled to make to be very visibly forced on them by orders that they vigorously fought rather than self-initiated, so that European authorities and the GDPR get the blame for any reduced quality.
You could say that about any of the resource-rich people and companies that have subsequently had their arse handed to them in court.
No such thing as a free lunch.
What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...
Are you saying they should be forced by law to block you?
> What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...
That is a flat-fee/pricing issue, just like someone binge watching Netflix might be using more resources than they generate in revenue. It isn't relevant to the discussion.
Also illegal.
(b) isn't applicable because it only applies when it's directly necessary to provide for that particular user (like processing a CC number when paying for a product). That you business model generally needs it is not enough (see the ICO FAQ on the issue[1]).
(a) Consent is valid, but it must be freely given, that is, the provision on the service can't be conditional on the consent (article 7 (4)).
[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...
> just that not every avenue of funding is allowed
Funding by targeted ads isn't illegal last time I checked.
"The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests."
https://ico.org.uk/for-organisations/guide-to-the-general-da...
> Funding by targeted ads isn't illegal last time I checked.
It is if you don't get consent. And you can't make that consent required to provide a service, since then it won't be "freely given", as per Article 7.
If this is correct, this is a major blow for US industries.
I hope the US follows suit with Europe rather than attempting to start another trade war.
"Avoid making consent to processing a precondition of a service (...) If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."
https://ico.org.uk/for-organisations/guide-to-the-general-da...
> No such thing as a free lunch.
Please square that with the fact (which I already pointed out) that they already provide their free service without targeting, based on user settings.
They can't using tracking to "pay the costs of providing this free service" without ad targeting (unless they're selling the tracking data, which they publicly deny).
I'm making an educated guess that mere declarations of necessity tracking are not sufficient legal justification for it in the EU.
Next up: the US targets Germany's auto industry - a backbone to their economy - with tariffs or other import restrictions, seeking to damage BMW, Mercedes, and Volkswagen in any and all ways possible. Easy cover: Germany having the world's largest current account surplus, at 8% of GDP. Recourse after that: more restrictions, regulations, targeting of US tech giants in the EU, and tariffs on various US products.
France says: Germany and its trade policies are a problem, seeks to reduce German dominance while trying to remain more neutral with the US:
https://www.politico.eu/article/emmanuel-macron-says-german-...
It's going to be a very interesting year or two.
I'd love it if Facebook were nationalized (or destroyed), but none of the coverage of the GDPR made it sound like it was going in that direction. I thought it was just another stupid "click here to acknowledge our cookies" rule that was going to spam up the internet.
Since they are being selective on the users they accept based on being tracked, they are now on track for another EU fine.
Or do you foresee this being like drug prices, where the US subsidizes drug development for the world?
Is that typical, for the EU to get that involved in business decisions?
But yes, the EU does get involved in plenty of business decisions, just like governments everywhere. Usually when an industry is misbehaving and violating what is established (e.g. by the ECHR) as the rights of individuals.
Obviously. But that's not what I meant.
They did not say "tracking is illegal", they said "it's illegal if not necessary".
Are they then say: "It's not necessary because if you completely restructured your business you wouldn't need to track."
That's the part I meant - do they really go to that level of detail?
I think the key point is being clear about the trade. I think FORCING all websites to only be paid for by cash is bad; you should be able to trade your own data for access to a service.
Because "In the EU, personal information cannot be conceived as a mere economic asset: according to the case law of the European Court of Human Rights, the processing of personal data requires protection to ensure a person's enjoyment of the right to respect for private life and freedom of expression and association".
https://edps.europa.eu/sites/edp/files/publication/16-09-23_...
We can agree on intent and disagree on practice. I disagree with the GDPR in practice, but agree with its intent. I think there are many other ways to tackle these problems, and this is probably the worst one (especially to start with assuming this is the first really enforced one).
I don’t think it’s ironic that you like this law, I think it’s understandable that you would if you have privacy concerns and, given T. May’s choices over the years, you were unlikely to get it without membership to the EU.
Regardless of whether this is for the "greater good", this is deeply unsettling territory.
I guess I'd agree that if someone wrote a 5 page paper describing all the ways that Facebook harvests their data and what might be done with it afterwards then they should be allowed to do what they want? But I suspect most people would be like "uhhh, I think they, um, know what pages I liked? And maybe they use that for ads?"
"Clear consent", in my mind, would be something along the lines of "we use tracking cookies and tracking on widgets third-party websites embed, as well as the data you provide to us in terms of posts, comments, photos and other content to personalize the ads you see". If you accept those terms, well, then you certainly can't be surprised when Facebook — or whoever — does precisely that.
Based on my interpretation, the GDPR simply precludes that possibility.
The official goal of Facebook is not "buying your data" but "providing a social network". Thus, targeted ads are not strictly necessary for providing that service.
There's a ton of stuff you can't do, even with clear consent, because otherwise people who lack the means to understand the compromises or afford the safer choices will suffer.
But, hey. Why should I care, if I'm not getting charged those rates, right?
We’re getting pretty off-topic though, so if you’d like to talk more, go ahead and shoot me an email (r at ovao dot la).
Should ad companies be able to model someone's mental illness and show them ads for gambling sites, or whatever, when their brain is acutely more susceptible to them?
This is nothing more than a digital drug law: “You can’t choose what services you consume because we are determined to protect you from yourself, like it or not.”
I'm a big proponent of user control, and a similarly big proponent of businesses taking much greater responsibility for the data they collect (my data was part of the Equifax breach, so I certainly get it). I am, however, leery about laws that essentially bind a business's hands in terms of how they can and cannot monetize on users, even when as there's A) clarity and B) honest, plain and upfront disclosure about how they do that.
If a business tells me to agree to onerous terms to which I could never agree or to go pound sand, I'll gladly go pound sand. As a consumer, I lose no power there whatsoever.
I've told Facebook to pound sand for roughly their entire existence - never had an account even though I had the chance right after they expand beyond Harvard - and am considering whether life circumstances will increasingly force me (in practical rather than literal terms) to sign up.
A company in that semi-mandatory position deserves lots of binding rules to protect the rights of unwilling users, just as is true for electric companies since you rarely have much choice there.
Plus, I don't think Facebook's massive wall of several huge interlinked policies with soft-pedaled descriptions of what they do meets either of your A and B criteria, especially not when it's modally interrupting the user.
What? Yes it has.
"I am, however, leery about laws that essentially bind a business's hands in terms of how they can and cannot monetize on users, even when as there's A) clarity and B) honest, plain and upfront disclosure about how they do that."
I'm not, mainly because business has been shown that they absolutely cannot be trusted with that. They have abused the privilege, and so they had their toy taken away. If you want to be upset at someone for that, blame the businesses for not reigning in themselves, not the governments for doing what their populaces wanted.
Not to mention, A and B almost never, ever exist.
"If a business tells me to agree to onerous terms to which I could never agree or to go pound sand, I'll gladly go pound sand. As a consumer, I lose no power there whatsoever."
You've lost all power in that relationship, because you have no power to bargain. You have no power to negotiate. And while you'll gladly go pound sand, not everyone is in a position to do so.
Turn it around; why should Facebook be allowed to have "take it or leave it" terms? Why should we as a society allow that? And don't just say, "It's their business;" I don't find that to be a compelling reason. Why should users not have the control over their data that the GDPR brings?
I take issue with this specific stipulation that — even with clear and upfront user consent — a business simply cannot operate in ways that are A) not opposed to the safety or health of their users and B) potentially necessary to succeed in the markets in which they participate.
If you believe the only way they should be able to do that is to become a digital hermit, then you don't really believe that.
"When you say “no thanks”, that’s a user exercising control over their data, and is an action which necessarily involves no governmental body."
What about Facebook's shadow profiles?
"a business simply cannot operate in ways that are A) not opposed to the safety or health of their users"
There is nothing about the GDPR that opposes this. Not a one.
"B) potentially necessary to succeed in the markets in which they participate."
This most assuredly is not part of the GDPR. If the only reason your business has a chance of succeeding is by ignoring user privacy and ignoring the safety of user data, your business does not deserve to succeed.
I've been cordial to this point, but if cordiality isn't there on both sides, there's no point.
No we will not tell you what you did. You already know what you did.
Our automated systems found your policy violation and acted appropriately. They are beyond your comprehension or refutation.
You may not talk to a person regarding your dismissal. It is against policy to discuss active or closed issues.
You have no recourse other than social media or tech websites, and beg. And we still will likely not care.
--Care of US tech companies.
....So, you want to live with rules for companies that allow this kind of egregious and arbitrary actions? I sure as hell don't. Want to see what this stuff devolves to? Look no further than Comcast and ilk.
Where by "your" we mean "one's", i.e. effectively "our".
"Your" in that context was from the company to the user they wronged.
Car = Service
Seat belt = Tracking protection
At the end of the day this will need to be decided in courts.
I have no qualms with a competitor starting up to serve those denied by Facebook, but let's not muddy the water by equivocating a monopoly as a result of anti-competitive practices with one that forms simply because nobody wants to use anything else.
I don't think most of the people who find Facebook convenient for coordinating groups actually choose the tracking knowingly and willingly (at best begrudgingly), nor do they choose to exclude the people who object more proactively to those things even when that's the effect.
Society's legislative and regulatory choices have a valid role to fix negative externalities of what economic actors would otherwise naturally do. Natural monopolies/oligopolies like electric companies, highway operators, and Facebook are all worth regulating for roughly the same reasons - even according to Orthodox free-market undergraduate microeconomics 101.
I'm speaking more about "ought" than "is" here. I don't see any reason why Facebook should have to choose between serving everybody, regardless of the regulatory burden that it places on them, and taking a hike from the global market entirely. I'm not saying that they won't be forced to do so anyway.
> ...I don't think most of the people who find Facebook convenient for coordinating groups actually choose the tracking knowingly and willingly (at best begrudgingly)...
And yet, they've probably chosen it all the same. In the hypothetical scenario where somebody has a metaphorical (or literal) gun to somebody's head, forcing them to use Facebook, I don't see how Facebook themselves can be blamed for this, and simply chalking this sort of thing up as a "negative externality" and saddling Facebook with the burden seems to be weaselly way of making Facebook to the will of somebody who just can't bear to give it up.
You can't always get what you want. Some of us would do well to internalize this a bit.
It is a lot easier to find people like me who never had FB accounts and who can testify that not having one has not impacted my life.
The same can be said about google's search service. The search still works, but adsense and adwords won't work without your private info. And google can claim it doesn't sell search, they sell ads.
None of the tracking they do is essential to the service they ostensibly provide to their users, namely as a microblogging/discussion/sharing platform.
I bet that nobody would! Ranking is what makes these products work...and it requires data to do the ranking.
Sure, rank search results based on how many users a given group has, and put the most popular ones at the top. That doesn't require violating anyone's privacy.
The reason ranking is used left and right these days is because it makes products dramatically better.
E.g. allow them to either sign up to the tracking or pay 100$/month for access
Tracking would not be mandatory to access the service, as the alternative way (to pay for the service) is available
What you're looking for already exists; install WeChat.
Quite frequently, yes to both questions. Choice is key and many often feel more empowered to individually choose their company than their government.
When there isn't meaningful competition in a market, it's specious to point to the abstract possibility of competition as an argument for sucking it up and cozying up to the monopolist, who has structured your arrangement with them to limit your freedom and recourse as much as practicable.
A profit motive doesn't magically make the human foibles that the "Gubmint is baaad" crowd insists will lead to the end of human freedom — and puppies, too — more manageable, or less dangerous to the rest of us.
Oversight. If you want meaningful competition and don't have it due to harmful monopolization, that's the government's problem to solve. Nobody's asking for self-regulating companies here. It's very important to understand which forces can or cannot actually eliminate competition and choice. If there is a path towards choice, I'll take it. Often that path is unclear of course.
How's that working out for us?
Maybe my premises and categories blind me to that risk in some way; I'll certainly cede that possibility. I'd be curious to see people who think the way you're describing do the same, vis à vis theirs.
That's the trouble with articles of faith, though: for the people who hold them, they're axioms; for the rest of us, they're implicit, unsupported premises to someone else's argument.
Facebook doesn't have a right to track people in the EU without gaining their consent to it in a way that complies with EU law.
EU citizens have a legal right to expect that Facebook will comply with European consumer protection laws.
If Facebook doesn't want to properly comply with EU regulations, they're free to totally withdraw from the EU market. Otherwise, it can expect penalties for its willful noncompliance.
The only problem is: Facebooks terms of service isn't really reasonable, and most people won't understand the implications. As I understand the GDPR one of the goals is to give users a set of rights, in regards to their data. These right cannot, under any circumstances, be violated, just as you can't bond yourself into slavery or sign away your right to free speech.
Facebook and others are currently trying to find loophole, like with the cookie-law, except this time the EU did it's homework and companies won't get of with such simple solutions. Really if Facebook believe they can't do business in the EU after the 25th of May, due to the GDPR, then they shouldn't. Just close of all EU activities. Of cause I understand why they won't, the company would lose a good chunk of it's value, but it will anyway if it can't find a way to legally operate under the GDPR.