Hacker News Reader

Comment by ucaetano | Hacker News Reader

The GDPR talks about "executing a contract, which includes the provision of services" (not the exact wording, but something like that). So if you define "using the social network in return for having targeted ads displayed" as the contract, it is necessary.

> just that not every avenue of funding is allowed

Funding by targeted ads isn't illegal last time I checked.

View on HN

Performance of the contract does not mean whatever they want it to mean. Here's the ICO FAQ on the GDPR (emphasis mine):

"The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

> Funding by targeted ads isn't illegal last time I checked.

It is if you don't get consent. And you can't make that consent required to provide a service, since then it won't be "freely given", as per Article 7.

I'm not a GDPR expert. My work around it has been very narrow.

If this is correct, this is a major blow for US industries.

I hope the US follows suit with Europe rather than attempting to start another trade war.

What does "freely given" mean in this context? Is GDPR forcing me to give access to my service for free if my business model is targeted ads?

Yes, I that's the way I read it (from Recital 43), and the ICO seems to agree:

"Avoid making consent to processing a precondition of a service (...) If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Reply on news.ycombinator.com