GDPR Complaint vs. Facebook [pdf] | Hacker News Reader

GDPR Complaint vs. Facebook [pdf]

noyb.eu

26 pointsedf1323 comments

Much of this is fair... especially the trick used to entice people to rush through the acceptance of the new terms by using false message & notification alerts.

But... a good proportion of this complaint is that the complainant wishes to continue to use Facebook without any penalty whilst still opting out of all data tracking. They state things such as it being a social connection to friends & family... similar to a telephone network.

What they appear to be missing is the fact that it is their data that is paying for this service... unlike a telephone network which is pay-per-use!

This is a very good point. Personally, I would love the opportunity to pay for facebook, in exchange for No ads, no data sharing outside of facebook. (I'm fine with opting in/out of product improvements).

Maybe GDPR will lead companies to put a finite value on my data. i.e. would they rather a fixed $5/month, or the potential that some family photo I share might lead them to send me an ad that I might click on?

I like the idea of paying for things but quite frankly, the Facebook product has long diverged from anything that I would want to pay for. Algorithmic news feeds and the feeling of sadness as everyone around me only post stuff to show off or post stupid political crap.

So do you still use it ? And if yes, why ?

It's a serious question.

Because if you think the product is that bad that you won't pay for it, why using it (you, in a general sense, not you goalieca personaly)

I don't use it at all. I went cold turkey about 3 years ago after having someone post some photos from my wedding and someone who wasn't a friend got all pissy they weren't invited and started harassing us.

The display of advertising is the payment, the data tracking is one potential mechanism by which advertising can be made more profitable. There are, I’d hope unsurprisingly, mechanisms by which advertising can be performed without data tracking.

GDPR is very clear on the fact that opt-in on your data being used for tracking or "relevant" ads shouldn't condition your access to the website (article 7, paragraph 3 [1])

[1] https://gdpr.algolia.com/gdpr-article-7

Only if the lawfulness for processing is based in consent rather than “the legitimate interests pursued by the controller or by a third party” - exactly what is considered a legitimate interest is only going to wind up being settled between Facebook/Google and a regulator in court.

Advertising is being used to pay for Facebook. Tracking is used to track userd and target ads based on that tracking, but that is not essential to Facebook's primary service of being a social network facilitator.

You can even go and turn off targeted ads yourself, proving that it is not essential.

I believe I remember seeing that the average annual benefit to Facebook of a user is something like $9. I would personally be ecstatic to be given the opportunity to subscribe to Facebook in exchange for control over my data and an absence of ads.

Eventually this is inevitable. Facebook is doing itself no favors by insisting that free-plus-we-own-you is the only possible model for the future.

For US users FB seems to make an average of around 20-25 USD per quarter[1], aka 80-100 USD per year or 6-8 USD per month. I wonder how much they make on users that say they are willing to pay to use it. My guess is that those customers probably are above average, since they (at least say they) have the disposable income to pay for FB, and hence are more valuable to show ads for [2].

It wouldn't surprise me if it would cost me 10-15 USD per month to cover the ad revenue FB is getting for me and my data, and the question is if I really would be willing to pay that.

[1]: https://medium.com/@mlvb_at/facebook-earnings-q1-2018-a-real... [2]: I'm not sure if this reasoning is sound, but it seems resonable. I wonder if there is data/estimations on the distribution of ad revenue per user.

Your reasoning does seem sound. I'm sure there is plenty of data to that effect - and I'm equally sure that nobody outside Facebook has access to it.

I think I might pony up $10 or $20 a month to know I was in control and to suppress all ads. I'm nearly certain I'm unusual in that regard, though.

I would like a Facebook-like service with a subscription model and without the large-scale data harvesting, but in the current market such a service cannot exist, even if it does everything right. Social networks have extremely strong network effect going on: the value of a social network to me is strongly dependent on who I can communicate with on that social network (i.e. how many of my friends or acquaintances have an account on the service).

The size of the network trumps all other factors. A service that is technically inferior in every way may still be more successful if it got to market a month earlier. More importantly, although barrier to entry is an important factor in the adoption of any technology, I don't think there's a sector where its effect is as extreme as in the social network sector. Even requiring a payment of 1 cent per year would probably turn away enough users to make your service unviable (because of the barrier of setting up an online payment).

So a paid-for competitor cannot exist. But in the meantime, Facebook has become the de facto standard for informal communication, much like e-mail is the standard for formal communication. And unlike e-mail, Facebook is not an open protocol where different vendors can provide their own implementation. You can avoid Facebook out of principle but you cannot replace it. Opting out of Facebook often means opting out of a significant chunk of social life. If you are not willing to make this sacrifice, this means that essentially you have no negotiating power over Facebook and will accept its terms and conditions no matter what they are.

We already view access to electricity and a telephone as basic rights in developed nations, and we increasingly view an internet connection as a basic right. I think access to social network services (which are actually used by other people) also belong in that list, which is why I think the request of the complainant is reasonable (even if I'm not sure how the social network market should be organized to support this).

Tangentially related: I've never signed up on Facebook, and never agreed to any of their privacy policies.

Does that mean that, if any PII of me is found on Facebook, they are in GDPR violation?

considering that a simple IP+timestamp can be PII, if you have ever seen anything from facebook's cdns , then maybe yes.

This is in practice a dup of https://news.ycombinator.com/item?id=17161211

I 'm not sure how well it will reflect in the court of public opinion if the EU's first ruling is that basically every website is not allowed to use ads to pay itself. There seem to be certain groups here in Europe who relish on this kind of "activism" . I m not sure how representative they are of public opinion, they are certainly very vocal.

Do we know how strict the Austrian DPA is ?

> their [EU] first ruling is that basically every website is not > allowed to use ads to pay itself.

Of course they won’t. This is absurd.

Advertising does not need to be targeted to a specific person to exist. Advertising has existed since the dawn of time without that ability, and frankly, marketing budgets are not going to wind up decreasing because companies can’t target individual people.

> to a specific person to exist

Advertising was always trying to find the right target. Technology allowed this to become a lot more efficient. As long as targeting is anonymous and certain limitations are set, i m fine with it, we don't need to kill the patient here.

Targeting is not anonymous because the amount of data that is used for targeting almost always amounts to personally identifiable information. Even just “company this person works at” + “job title” can be PII, and Facebook processes both of those things in targeting, along with many many others.

i dont believe facebook allows targetting by company and in general this shouldnt be allowed to targeted advertising.

The definition of anonymity you are using here is completely unhelpful. When someone knows how to recognize you as the person to apply certain stimuli to in order achieve a certain result based on previous observation of your behaviour (with increased probability), you are not in any meaningful way anonymous to them. At best, you could say that you are pseudonymous.

You don't need to know someone's legal name in order to abuse information about them to exercise power over them, and that is was data protection is about.

Reply on news.ycombinator.com