Their choices are to either be GDPR-complient, or to completely bar all EU users from accessing Facebook. They cannot use tracking opt-in as a requirement for access.
In the specific case of Facebook, near-zero of the users actually understand either what they are giving or the full extent of what they are getting or not (especially since the latter changes constantly as FB alters their policies and algorithms etc). So, it's more like "give us stuff you don't understand with ramifications you haven't thought about, and you get a complex, somewhat unpredictable, changing service." This is nothing like the theoretical trade between two participants with equal power and complete information.
I have purchased a house, and used a mortgage to do so. In getting that mortgage, I was presented with reams and reams of paper that I had to agree to and sign. The basic facts of the loan, however, were mandated by the government that they be disclosed to me in as simple and straightforward terms as possible. That mandate for disclosure should be sufficient for a person to decide to do business with a service, regardless of the nature of what is being transacted. If what I read here is accurate, it's akin to me saying "No, I won't sign any of this. Now give me my keys."
The bank is not required to give you a mortgage. The regulation says that if they want to offer one, they can't include "No camera, no keys" as a condition.
Strava is a good example, it does not work without GPS position, otherwise it cannot track your bike routes.
But Facebook does not require tracking to work. It does not require you to give them any personal details at all in order to work. It would work just fine even if everyone gave them fake emails, phone numbers, birth dates and even fake names. Thus they cannot make giving up privacy a requirement for using their service.
Besides that, this ToS update thing is absolutely not GDPR compliant. It does not list the things personal data will be used for. It hides the opt-out (to the face tracking) behind a dark pattern small "options" text and makes the default action opt-in. The list goes on.
This is simply an effort from FB to muddy the waters and sow doubt about opt-in and GDPR consequences.
They will have to provide proper GDPR opt-in screens come the 25th, or they will be fined for non-compliance.
To connect to other users on a service, I don't need to know any personal details about them, only their chosen username, which can be completely random and have no relation to their identity.
The whole point of FB is for people to exchange data about themselves with their friends and family! If people don’t share any data or just fake data FB doesn’t work.
For them to offer their service they also have to make money, so they run ads to do that. And to make the ads useful to people they need data for targeting!
And now they allow users to either agree to this deal or download their data, delete Facebook and do whatever they want.
Simple as that
I can sign up with a fake date of birth and a throwaway email account, under a generic name (remove any identifying unique spelling or middle names, for instance) or a completely fake name. And I could still connect with friends and family, provided I know the names they've chosen to use on FB.
According to the GDPR, anything you share publicly is basically fair game. So if you post something in a public post on your public wall, anyone can view and use that data for whatever they want.
The issue is all of the secret data FB collects. They have disturbingly extensive profiles of every one of their users, including political standpoint, which phase of life they're in (eg. "stable established adult" or somesuch), their sexual preferences, sports teams, club memberships, medical history, the list goes on and on. They get this from your non-public account information and from tracking you across websites you visit.
That is the issue here, the tracking and storage of personal information that people want to keep private. FB's tracking and privacy violations are not vital to the service they provide. Their business model may depend on (targeted) ads and privacy violations, but that is not an excuse. You cannot base your business model on breaking laws and hoping to get away with it.
FB isn't "allowing" users to either agree to the ToS or go pound sand, they're basically saying "fuck you, we'll exploit your private information as much as we want, and you don't have a choice". They're doing this to muddy the waters and make people think "oh I already agreed to this, make it go away", when the actual GDPR consent form pops up after the 25th.
But users do have a choice. The GDPR very specifically says that you cannot make access to your service contingent on opting in to private data collection and tracking, because consent has to be given freely, ie. not under threat of access denial.
You can only do this if your service cannot possibly work without the collection of personal data. Something like Strava (which tracks bike rides via GPS) cannot function without collecting GPS locations. So they have a good argument that they cannot provide their service, if users do not opt in to location tracking. But they have to very clearly state what they will use this collected data for, and they cannot change it later without collecting new freely given consent from their users.
I also don't find any of the data that FB or Google have of me "disturbingly extensive" or that they have been "breaking laws" to get it.
I give them data so they can provide value to my life...it's as simple as that! If that deal doesn't work for you then you simply shouldn't use their products..nothing wrong with that.
I also personally prefer targeted ads over un-targeted ones btw. And I like using these services without having to pay for it...its a good deal!
I also want to add that, while you repeat popular believes, I have yet to see evidence for many/all of them and I would prefer you would either stay with the known facts or be more explicit about whats a personal opinion/internet myth. thanks
Have you downloaded FB's data dump of you? That is only the bare surface of what they collect. They do not give you access to the underlying profiling and the social graph they have built on your information. All you are getting is chat logs, uploaded photos/videos, a list of contacts/friends and some simple keywords. That's not even scratching the surface of the data model FB has on every single user.
The data you think you're giving them and the data they actually have are orders of magnitude apart.
The "well you can just choose not to use them" argument falls completely flat when you realize that many businesses and organizations have no internet presence outside of Facebook. They've set up a Facebook page because "everyone has Facebook, right?". If you cannot see the problem with that, then I'm not sure what to say.
Frankly I would argue that the ML models they create from usage data are theirs! Regardless of how useful they would be to me as a individual to download or not.
Now about the FB tracking pixels and the data they collect, I consented to those when I used the third parties websites they were in and accepted their TOS...and I have a choice to not use those sites or if I choose to block the pixel from firing via technical methods.
FB tracking pixels are on less then .1% of all websites...so I also don’t buy that arguments that Facebook follows anyone around, because it’s simply not true!
Update: so I was curious to see how this actually works and looked up the documentation: https://developers.facebook.com/docs/facebook-pixel/events-a...
So there is two ways to do it for third parties: get user consent before starting to use the website or use their advanced API and delay firing of the pixels until users have consentent later in the process...like for example on the checkout page!
There are hints of it though. I noticed in my most recent data dump there was a list of "contacts." Some of those were people who I was never Facebook friends with and included contact information (e.g. alternate emails) that I never had.
It seems like this data was built off of people's phone contact lists. It definitely seems like my contact list was the root of mine.
Isn't that "you pay with your data"?
Or do you mean it would allow things like "$5/month, or free if you consent"?
https://thinkgdpr.org/wp-content/uploads/2017/05/DIRECTIVE-E...