Hacker News Reader

Comment by okmaybeyesno | Hacker News Reader

Facebook will argue that the data is necessary.

I can't see that argument going well: Since they let users opt-out of targeted advertising, which is probably the only thing "tracking" is useful for, they tacitly admit that "tracking" is not necessary for them to providing their service.

"We require tracking to pay for the costs of providing this free service".

No such thing as a free lunch.

That would be interesting! That would probably mean they'd need to ban me, since I use an ad-blocker, right?

What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...

> That would probably mean they'd need to ban me, since I use an ad-blocker, right?

Are you saying they should be forced by law to block you?

> What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...

That is a flat-fee/pricing issue, just like someone binge watching Netflix might be using more resources than they generate in revenue. It isn't relevant to the discussion.

“We sell your credit card number on the black market to pay the costs of this free service”.

Also illegal.

Selling the credit card is illegal, serving targeted ads isn't.

Without user consent, it will be in soon in the EU.

Just because they chose a specific business model doesn't mean it's necessary. Nobody says the lunch must be free, just that not every avenue of funding is allowed.

Please read the GDPR text and then tell me where it says anything like this.

I'd have to quote too much. Essentially you only have six allowed reasons for processing personal data (article 6). The only ones that could apply are (a) consent or (b) necessary for performance of contract.

(b) isn't applicable because it only applies when it's directly necessary to provide for that particular user (like processing a CC number when paying for a product). That you business model generally needs it is not enough (see the ICO FAQ on the issue[1]).

(a) Consent is valid, but it must be freely given, that is, the provision on the service can't be conditional on the consent (article 7 (4)).

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

The GDPR talks about "executing a contract, which includes the provision of services" (not the exact wording, but something like that). So if you define "using the social network in return for having targeted ads displayed" as the contract, it is necessary.

> just that not every avenue of funding is allowed

Funding by targeted ads isn't illegal last time I checked.

Performance of the contract does not mean whatever they want it to mean. Here's the ICO FAQ on the GDPR (emphasis mine):

"The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

> Funding by targeted ads isn't illegal last time I checked.

It is if you don't get consent. And you can't make that consent required to provide a service, since then it won't be "freely given", as per Article 7.

I'm not a GDPR expert. My work around it has been very narrow.

If this is correct, this is a major blow for US industries.

I hope the US follows suit with Europe rather than attempting to start another trade war.

What does "freely given" mean in this context? Is GDPR forcing me to give access to my service for free if my business model is targeted ads?

Yes, I that's the way I read it (from Recital 43), and the ICO seems to agree:

"Avoid making consent to processing a precondition of a service (...) If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

> "We require tracking to pay for the costs of providing this free service".

> No such thing as a free lunch.

Please square that with the fact (which I already pointed out) that they already provide their free service without targeting, based on user settings.

They can't using tracking to "pay the costs of providing this free service" without ad targeting (unless they're selling the tracking data, which they publicly deny).

I'm making an educated guess that mere declarations of necessity tracking are not sufficient legal justification for it in the EU.

Reply on news.ycombinator.com