Wanted: Online Pubs Doing Real (and Therefore GDPR-Compliant) Advertising | Hacker News Reader

Wanted: Online Pubs Doing Real (and Therefore GDPR-Compliant) Advertising

blogs.harvard.edu

24 pointsrinze25 comments

Non tracking ads used to be the norm, but two things got in the way:

1. Any kind of even vaguely targeted advertising is better than none. It's common sport on HN to jeer about how badly the ads that people see are targeted towards them but non-targeted is so much worse. It's ads for restaurants that won't be in my area for decades (if ever). Male and female specific medicines, and on and on.

2. The rampant abuse and fraud on the part of the publishers. Much of the js and tracking on sites is not about _you_ so much as making sure that the site that the ads are embedded on isn't just a VPS that someone is flogging with bot traffic.

You really hit on something for me.

I want some level of targetting in my ads. But too much and it becomes obnoxious and frustrating. I wish I could just check off the boxes I want:

- Canadian - Lives in Ontario - Male - 30-39

Hmm yeah I think that's all I want you to use.

Instead they ask for nothing and seek to take everything. That's the part I can't tolerate.

Restaurants not in my area, maybe I tweet "When are we gonna get a <popular restaurant> I keep hearing so much about on <local radio station>?". Not an immediate return on investment but maybe a hint at where to build next. Medicines, or anything else that may not be for me? I know a bunch of other people that talk all day about things they need and problems they have. If I hear about a potential solution for them, I'm probably going to mention it next time I see them, maybe even shoot them a quick text right now.

My experience with targeted ads is either way off base or suggesting something I don't need because I literally _just_ bought it. But mostly I don't experience them because they're so easy to block. Then they don't even get the potential benefits of word of mouth.

As far as fraud, the roll of an online advertising company should be to ensure both parties are holding up their end of the deal, ensuring links go where they are supposed to and sites are presenting ads as agreed. That can be done with code the ad companies write for the advertiser and content providers to run on their own servers during the agreement. Pawning that off on the user machine doesn't solve the fraud issue, but apparently advertisers are convinced it does, for now. It does get you tracking, but only as long as users put up with it. It's lazy and, hopefully, it won't be a profitable solution much longer.

> It's ads for restaurants that won't be in my area for decades (if ever). Male and female specific medicines, and on and on.

But for a while I've had the worst of both: huge amounts of data slurping, combined with terribly targeted ads.

Don't forget language. In the EU this is a pretty important point and it's something you can't even estimate based on IP in some countries.

Accept-Language: en-GB,en

My systems have

  LANG=de_DE.UTF-8
  LC_MESSAGES=C

There is substantial disagreement among the programs that I use [1] whether this constitutes a German locale or an English locale.

[1] True, only those programs which are dumb enough to assume that locale is described by a single word like "German" or "English".

Getting system languages isn’t straightforward nor does it indicate the actual language of the user same goes for getting the language from the website. Not to mention that is unclear if you do that does it count as personal information or not since there are some wild cards in the GDPR.

Interesting that WaPo's free option seems to be in violation of GDPR. It has no option to reject personalized ads and third party trackers - you can simply accept and view the site, or go away:

http://prntscr.com/joqj3d

That seems to be in direct conflict with GDPR provisions that force web publishers to give people the option to reject personalized ads while still giving them the services they were trying to access. I'm sure that when regulators come calling, they'll claim "legitimate interest," but if this model is acceptable under GDPR, then almost nothing has actually changed under it.

That is only if you use consent as your lawful basis.

The reason why nearly everyone is using consent currently is because the other straightforward one which is:

(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

Is so vaguely defined as far as benchmarks go and no one is up for taking the risk of being at the mercy of the judgment of 28 different regulators and court systems.

I don't think it's necessarily the case that everyone's using consent currently. They just think (probably correctly) that regulators will be more favorable to a company that always makes disclosures and asks for permission up front.

The disclosure part is unrelated to the basis, you need to tell the user what you collect for what purpose and what is the lawful basis for it. Consent is no more lawful than interest however it’s less open to interpretation despite its likely not the most appropriate basis for many cases. Consent doesn’t enables you to do more or less all the lawful bases by definition are equal in their scope.

If it makes you anxious whether or not you are compliant, you're probably not. As a rule of thumb this goes pretty well with a lot of legislation.

That’s not how the real world works at all virtually all proper regulation has set of benchmarks and a defined compliance validation process.

> That seems to be in direct conflict with GDPR provisions that force web publishers to give people the option to reject personalized ads while still giving them the services they were trying to access.

Which part of the GDPR requires a site to give access to someone who doesn't agree to their terms?

On the off chance that you're not just trolling, this is one of the main points of the GDPR. If this is news to you, I invite you to read up on the subject.

Not an EU citizen or a lawyer (NEUCoLa) so, yeah, nothing leaped out at me (https://eur-lex.europa.eu/eli/reg/2016/679/oj) as requiring a site to give access to someone, regardless.

I think you should follow your own advice because what you said is completely untrue.

Lets see it is $6 with tracking ads or $9 with no ads. So with non-tracking ads, it will cost somewhere between the two. Is there really a need for that. Honestly if I was going to pay $6, I would just pay a little more and get no ads.

Eventually it becomes $9 with tracking ads. Do the world a favor and just nip it in the bud as soon as you start getting ads embedded in paid content. And do it loudly so they, their advertisers, and other customers know exactly why they're not getting any more of your money.

This 3 item selection is an advertising classic. People will by a large margin choose the item in the middle. So its very likely that the middle option has fatter margins than the upper choice.

https://officesnapshots.com here.

This describes us as we sell our own ads, self-host them, and only allow static jpg graphics.

After changing our MailChimp signup form and removing sharing button scripts I think the only 3rd party things we use are Google analytics (now with anonymous IP settings activated) and a google font and jquery cdn.

For me, the goal has been to create a site that attracts a specific audience and target the ads based on the content.

There are some missing steps between the idea that Post readers (at least say they) want non-tracking-based ads more and the idea that they're worth more. Readers may well be willing to pay some amount more for tracker-less ads, at least until they experience the joys of seeing that most ads are for things they can't use. That doesn't mean that they're willing to pay as much more as what those eyes are worth to advertisers.

I currently see no advertisements, for free. GDPR just passed, so they can't track me without my consent. Why would I consent, given I don't see the ads either way?

They can track you without your consent if they can justify it through one of the other 5 lawful bases for data processing, consent is just the easiest to some extent since it transfers the much of responsibility to the consenting party however it’s not without its own pitfalls.

Reply on news.ycombinator.com