Hacker News Reader

Comment by digitalengineer | Hacker News Reader

Clicking the X means the tracking scripts won’t fire. GDPR forced the site to still be readable (no cookie walls allowed).

View on HN

This keeps coming up and people keep saying that's the way it is, but Belgium's biggest newspapers just GDPR-walled their websites. You can't read the paper unless you agree to data gathering, cookie setting and tailored advertising. Maybe what they're doing is against the rules. Maybe their interpration is different. I don't know, but it is what it is.

I'm not so concerned with one newspaper's interpretation of the law or the risk in not following it, what I'm more worried about is that I can't find a word about it in the law. The relevant clause is supposed to be article 7.4 I think:

> 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

So they have to sit in contemplation for a few hours before going right ahead with collecting data that is not functionally required? Utmost care was taken...

It seems like the interesting question here would be what happens if the thing conditional on consent isn't the provision of service but rather something like waiving payment of a fee.

The reason this hasn't been offered historically is economic. There aren't enough people willing to pay to justify the effort, and the people who are willing to pay are also the best advertising targets, which means the fee would have to be high enough that hardly anyone would choose it.

But what happens now if they put a box on the site that says "pay $75 for this article or consent to be tracked and get it for free"?

It's the data protection authority that would make this judgement.

Citation needed.

EDIT: Am I really being downvoted for requesting a citation to a claim that seems to have no apparent/straight-forward basis in the law? What has this site became?

Chapter 6 of the law is all about the powers of the supervisory authorities, which are tasked with enforcing it.

But this is taken out of article 7 (chapter 2).

But it doesn't say so.

It's implicit. Regulations only mean what ever the regulator decides they mean.

Uh, doesn't the judge judge such things, when company X thinks it's compliant and the regulator thinks it isn't?

In most countries, regulators are given broad authority to issue supplementary rules, explaining exactly what's required or forbidden to comply with the original law. The goal is that people who know a lot about data privacy, rather than random EU representatives, can figure out the specifics.

Utmost care needs to be documented.

The basic argument as I understand it is that products paid for by advertising and tracking require you to accept advertising and tracking in order to obtain them. In other words, you are explicitly agreeing to purchase the product in exchange for your privacy / attention. This argument will be settled in the courts. If it holds up, GDPR won't affect privacy much because I don't think most people will opt for privacy over convenience. If the courts rule against this reasoning, we'll see the rise of micropayments on the web.

I thought that was literally what the law was supposed to prevent. That is: viewers should not even be allowed to agree to data collection that is only used for tracking and not for the actual business.

A newspaper might argue that their business is tracking users so they can show ads and afford journalists, but it won’t hold up.

Of course sites will rather try to pull a stunt like this if the option is shutting down your business directly - but I sure hope regulators force sites to turn to paid content or shut down.

> A newspaper might argue that their business is tracking users so they can show ads and afford journalists, but it won’t hold up.

I think it will hold up. Newspapers are a big factor in European the courts would not risk anything against them. Especially not if they might loose a big chunk of revenue.

It’s certainly going to be a battle. Allowing “ad-walls” like agree in order to see content they are making GDPR pointless. The law text seems pretty clear on that I think.

Q is what will actually happen if the law is interpreted the way I want/think? Newspapers are doing quite poorly already.

They can always show the same ads as in the print edition, which are targeted to the demographic based on the content instead of targeted to a person based on their browsing history. It may not even be the case that they have less ad revenue.

> Allowing “ad-walls” like agree in order to see content they are making GDPR pointless.

Not at all: on the surface, it's the difference between "give me a dollar for a bar of candy" and "here, have a free bar of candy (and I'll help myself to a dollar (or two))".

Beneath the surface, it means that the ad-financed newspaper will have to aggregate their PII in-house (or with the help of carefully vetted partners) into targeting decisions instead of blindly throwing it over a wall to random third parties.

There's a difference, but the principle behind the GDPR is that "personal information cannot be conceived as a mere economic asset", and both those versions violate it.

You can't put forth accumulation as a legitimate use of data, as in "it might help our eventual value when the company is sold, therefore we sleep it all up" and neither would "we hand over the data, we get money, therefore it's our business" fly, but using PII in-house for running ads in a "registered, but not paying" service tier has all the trappings of legitimate interest.

Things like this don't really have a "point" until the courts give it one. And I think the courts are going to give serious consideration to the viability of the press.

The press is viable using ads, just not ads that are targeted by spying on people and selling their information. In the long run it also might be the only thing that reduces use of outright ad-blockers, which could kill industries.

But ads are not viable unless they are driven by information about the audience - down to the individual. However, I am also an advocate of returning to the "sponsorship" model - old-fashion ads, if you will. No tracking there - the sponsor just knows approx audience size and demographics.

But ads are not viable unless they are driven by information about the audience - down to the individual.

Oh totally! That’s why ads have never been a thing until the internet, and why there have never been print ads, television ads, and ads on the radio. No individual data, no ads, it all adds up.

(/s)

I didn't say "ads have never been a thing". I'm saying they are no longer viable. Sort of like horse-draw buggies were no longer viable after the arrival of the automobile.

If you’re going to claim that targeted ads are that kind of improvement over the alternative, you should present some evidence of their relative efficacy. From what I’ve seen, unless you rely solely on marketing claims, you won’t find it because the improvement is marginal at best.

They'll be fined, or will change their ways under a direct threat of being fined.

If I block JS, and the way they've implemented means that the site is readable and usable despite me never seeing or opting in, are they in violation, or is it on me for 'tampering' or whatever?

AFAIK, it's on them. They can't track you without explicit consent, and they can't force you to consent to improper tracking in order to use the service. By improper I mean something that's not literally required for the service to function; a newsletter obviously needs to know email addresses to work since that's the core operation of the service.

Isn’t revenue literally required for a service to function? Who pays for the server costs?

Nothing stops a site showing ads; they just have to think of creative ways to target them. It's a new opportunity, as all changes of environments are.

They are free to put up paywalls. GDPR legislates that personal information can't be used as currency - not that you can't ask for payment.

but it can. you just need consent.

You can't condition service on consent (if you only need the consent for revenue, not in order to provide actual service)

What is "the service"? Why can't personalized ads be part of my service? I can how selling personal data isn't part to the service, but the ad content displayed to a user is.

If you're a newspaper for example, personalized ads isn't part of your service which is to present news. So you can't make presenting the news conditional on accepting ad tracking.

You're free to have ad tracking as long as it is optional and by explicit consent only.

But you can use a paywall... So can you say 'pay, with either cash or personal information'?

I just said GDPR legislates that personal information is not a form of currency, so no, you can't ask for payment in the form of personal information.

Really? So you can no longer have opt-in ads, or a 'premium' ad-less version?

Perhaps you have a choice between a paid subscription and targeted advertising (?)

Would that be allowed by the GDPR?

That's the "€20M Or 4% of global revenue" question

Not true. Certain types of “tracking scripts” are necessary to function, so forcing consent for them is okay.

Forcing consent is never okay in the sense that it doesn't count as consent.

This is relevant to another discussion going on in society at the moment. And the same thing holds.

...and a “pay up or get tracked" model (vs "consent or no business") will go a long way for counting as not forced.

But "pay and agree to get tracked, or else your payment will get you nothing", that would be a surefire way to get in trouble.

Also unconsentable would be a carte blanche for passing on the data to undisclosed third parties for unrestricted use and redistribution. This is where many existing revenue models will still have to adapt and where a lot of bad actors will dwindle or shift from grey to deep, actionable black.

What tracking scripts are necessary for any functionality to function (except for tracking/data-mining/selling user behaviour)?

Anticheat software for games

giving every random game root access on my machine is what killed PC gaming for me.

I could play and encounter the ocasional cheatet. great f... deal. to this day I still play wii mario kart with some friends and there is still some loser spamming bombs all over the maps because nintendo screwed up (I wouldn't mind games havin root access to a console). we simply couldn't care less. yeah everyone will lose to the loser and switch servers asap, but we still had a good time.

while on the PC every crap you install from steam (which already have root access, expose network ports for who knows what, etc) will also install with root access for what? so people can't cheat on solitaire2000 mmo? I gladly would like all that crap software to run securely in a sandbox and find the ocasional cheater that I will lose to and then proceed to ignore.

heck a blocking list would be better than every single anti cheat code.

I don't even know where I am going with this rant. giving up your entire computer to every crap game is dumb. period.

But then, there would be no competitive gaming anymore. Or even non-competitive, but still matchmaked gaming.

It would just plain suck. Nobody would have fun, not even the cheaters, when they are going to play against eachother.

What about the millions of people who don't care about competitive gaming with strangers?

What about the millions of people that do?

The commenter's case was about removing or not allowing it at all, but de facto it's required.

I'm pretty sure non-matchmaked games don't have anticheat features -- it would be dumb, as it is an additional cost.

> What about the millions of people that do?

The commenter specifically complained about giving root access to games, which is a pretty insane idea, security-wise. If anticheating techniques really require root access, then people that care about competitive gaming should have an option to consider this trade-off and turn the anticheating pieces on if they think this has a better reward/risk ratio than not giving root access to a game. It definitely shouldn't be on by default and unconfigurable, though.

> If anticheating techniques really require root access, then people that care about competitive gaming should have an option to consider this trade-off and turn the anticheating pieces on if they think this has a better reward/risk ratio than not giving root access to a game.

In CounterStrike (Global Offensive) this is already the case. The official Valve anticheat is not as intrusive as the anticheat provided by external services like Esea or Faceit. If you choose to use such service they basicly take your system apart. It turns out that in order to get good results this is needed.

I think you underestimate the impact massive cheating can have on a game. Even casual players will leave games that have cheaters in every other lobby.

Please explain how anticheats are tracking people.

There was a piece of news lately about a gaming company tracking users and exfiltrating data about their web use to catch pirates. I'm afraid I don't have a link handy.

It was probably this: https://arstechnica.com/gaming/2018/02/flight-sim-devs-say-h...

Tho back then I missed their spin how they are supposedly only targeting "that one specific cracker", they must have come up with that a bit later because on their Reddit they mostly tried to argue "it's only affecting pirates".

What does this have to do with anti cheats in general?

Counting unique users. Counting the number of ads displayed, etc., etc.

Recaptcha

everything Google you mean.

recaptcha was fine without even having a server side confirmation, until google improved it.

Reply on news.ycombinator.com