Hacker News Reader

Comment by Tharkun | Hacker News Reader

This keeps coming up and people keep saying that's the way it is, but Belgium's biggest newspapers just GDPR-walled their websites. You can't read the paper unless you agree to data gathering, cookie setting and tailored advertising. Maybe what they're doing is against the rules. Maybe their interpration is different. I don't know, but it is what it is.

View on HN

I'm not so concerned with one newspaper's interpretation of the law or the risk in not following it, what I'm more worried about is that I can't find a word about it in the law. The relevant clause is supposed to be article 7.4 I think:

> 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

So they have to sit in contemplation for a few hours before going right ahead with collecting data that is not functionally required? Utmost care was taken...

It's the data protection authority that would make this judgement.

But it doesn't say so.

It's implicit. Regulations only mean what ever the regulator decides they mean.

Uh, doesn't the judge judge such things, when company X thinks it's compliant and the regulator thinks it isn't?

In most countries, regulators are given broad authority to issue supplementary rules, explaining exactly what's required or forbidden to comply with the original law. The goal is that people who know a lot about data privacy, rather than random EU representatives, can figure out the specifics.

Citation needed.

EDIT: Am I really being downvoted for requesting a citation to a claim that seems to have no apparent/straight-forward basis in the law? What has this site became?

Chapter 6 of the law is all about the powers of the supervisory authorities, which are tasked with enforcing it.

But this is taken out of article 7 (chapter 2).

Utmost care needs to be documented.

It seems like the interesting question here would be what happens if the thing conditional on consent isn't the provision of service but rather something like waiving payment of a fee.

The reason this hasn't been offered historically is economic. There aren't enough people willing to pay to justify the effort, and the people who are willing to pay are also the best advertising targets, which means the fee would have to be high enough that hardly anyone would choose it.

But what happens now if they put a box on the site that says "pay $75 for this article or consent to be tracked and get it for free"?

The basic argument as I understand it is that products paid for by advertising and tracking require you to accept advertising and tracking in order to obtain them. In other words, you are explicitly agreeing to purchase the product in exchange for your privacy / attention. This argument will be settled in the courts. If it holds up, GDPR won't affect privacy much because I don't think most people will opt for privacy over convenience. If the courts rule against this reasoning, we'll see the rise of micropayments on the web.

I thought that was literally what the law was supposed to prevent. That is: viewers should not even be allowed to agree to data collection that is only used for tracking and not for the actual business.

A newspaper might argue that their business is tracking users so they can show ads and afford journalists, but it won’t hold up.

Of course sites will rather try to pull a stunt like this if the option is shutting down your business directly - but I sure hope regulators force sites to turn to paid content or shut down.

> A newspaper might argue that their business is tracking users so they can show ads and afford journalists, but it won’t hold up.

I think it will hold up. Newspapers are a big factor in European the courts would not risk anything against them. Especially not if they might loose a big chunk of revenue.

It’s certainly going to be a battle. Allowing “ad-walls” like agree in order to see content they are making GDPR pointless. The law text seems pretty clear on that I think.

Q is what will actually happen if the law is interpreted the way I want/think? Newspapers are doing quite poorly already.

They'll be fined, or will change their ways under a direct threat of being fined.

> Allowing “ad-walls” like agree in order to see content they are making GDPR pointless.

Not at all: on the surface, it's the difference between "give me a dollar for a bar of candy" and "here, have a free bar of candy (and I'll help myself to a dollar (or two))".

Beneath the surface, it means that the ad-financed newspaper will have to aggregate their PII in-house (or with the help of carefully vetted partners) into targeting decisions instead of blindly throwing it over a wall to random third parties.

There's a difference, but the principle behind the GDPR is that "personal information cannot be conceived as a mere economic asset", and both those versions violate it.

You can't put forth accumulation as a legitimate use of data, as in "it might help our eventual value when the company is sold, therefore we sleep it all up" and neither would "we hand over the data, we get money, therefore it's our business" fly, but using PII in-house for running ads in a "registered, but not paying" service tier has all the trappings of legitimate interest.

Things like this don't really have a "point" until the courts give it one. And I think the courts are going to give serious consideration to the viability of the press.

The press is viable using ads, just not ads that are targeted by spying on people and selling their information. In the long run it also might be the only thing that reduces use of outright ad-blockers, which could kill industries.

But ads are not viable unless they are driven by information about the audience - down to the individual. However, I am also an advocate of returning to the "sponsorship" model - old-fashion ads, if you will. No tracking there - the sponsor just knows approx audience size and demographics.

But ads are not viable unless they are driven by information about the audience - down to the individual.

Oh totally! That’s why ads have never been a thing until the internet, and why there have never been print ads, television ads, and ads on the radio. No individual data, no ads, it all adds up.

(/s)

I didn't say "ads have never been a thing". I'm saying they are no longer viable. Sort of like horse-draw buggies were no longer viable after the arrival of the automobile.

If you’re going to claim that targeted ads are that kind of improvement over the alternative, you should present some evidence of their relative efficacy. From what I’ve seen, unless you rely solely on marketing claims, you won’t find it because the improvement is marginal at best.

They can always show the same ads as in the print edition, which are targeted to the demographic based on the content instead of targeted to a person based on their browsing history. It may not even be the case that they have less ad revenue.

If I block JS, and the way they've implemented means that the site is readable and usable despite me never seeing or opting in, are they in violation, or is it on me for 'tampering' or whatever?

AFAIK, it's on them. They can't track you without explicit consent, and they can't force you to consent to improper tracking in order to use the service. By improper I mean something that's not literally required for the service to function; a newsletter obviously needs to know email addresses to work since that's the core operation of the service.

Isn’t revenue literally required for a service to function? Who pays for the server costs?

Nothing stops a site showing ads; they just have to think of creative ways to target them. It's a new opportunity, as all changes of environments are.

They are free to put up paywalls. GDPR legislates that personal information can't be used as currency - not that you can't ask for payment.

but it can. you just need consent.

You can't condition service on consent (if you only need the consent for revenue, not in order to provide actual service)

What is "the service"? Why can't personalized ads be part of my service? I can how selling personal data isn't part to the service, but the ad content displayed to a user is.

If you're a newspaper for example, personalized ads isn't part of your service which is to present news. So you can't make presenting the news conditional on accepting ad tracking.

You're free to have ad tracking as long as it is optional and by explicit consent only.

But you can use a paywall... So can you say 'pay, with either cash or personal information'?

I just said GDPR legislates that personal information is not a form of currency, so no, you can't ask for payment in the form of personal information.

Really? So you can no longer have opt-in ads, or a 'premium' ad-less version?

Perhaps you have a choice between a paid subscription and targeted advertising (?)

Would that be allowed by the GDPR?

That's the "€20M Or 4% of global revenue" question

Reply on news.ycombinator.com