Comment by Flammy | Hacker News Reader

Comment by Flammy | Hacker News Reader

Parent Full thread

No, the point is to collect enough info to link a user who launched the game to someone who clicked an ad.

The problem Red Shell is trying to solve is the "download divide" -- You can track clicks/users on the web before they download, and you can track them after they launch your product, but you can't easily connect the two.

As for why devs want this, if you know ad campaign 1 cost $1 and had 2000 clicks, and ad campaign 2 cost #1 had 1000 clicks, that is helpul but what you really want to know is "what is the lifetime value (LTV) vs cost of acquisition of users from campaign 1 vs 2" because if LTV is significantly different then despite higher cost it may clearly be worth it. But if you can't connect a user from before the download to after you can't do this sort of calculation.

Devs really don't care who the users are, we just want to know how effective a campaign is compared to one another.

Source: Was planning on integrating Red Shell ourselves before this (false) outrage made us cancel our plans.

While I agree that is what they officially say they do, the means employed go beyond that. From the article:

> "These are generally data points about the user’s device, such as its operating system, installed fonts, browsers (and versions) used, timezone, language, the user’s in-game ID, and screen resolution. This is what Red Shell calls a ‘fingerprint’, which can also be made on games consoles as well as PCs."

Such a fingerprint is very unique and can easily be connected to a person with very little effort down the line, even if now nobody does that (yeah, right).

Personally, I do not trust any company that collects such detailed information without my informed consent and without a clear (i.e. verifiable and legally enforceable) pledge to delete that information when the original purpose has been served. This is exactly the overshooting behaviour that was rightfully targeted by the Europeans with their recent data protection law.

edit: formatting

That is correct. Red Shell also specifies to devs you should configure it to report some of those and not all should be reported. It provides guidelines for how many to report based on how many unique users you have/are expecting.

All of these factors are available to web browsers (which is why they were chosen, so they can be matched up to web clicks). These are tracked in most web analytics suites today by default.

Based on my research I don't believe that these (even all of them together) are PII.

Okay, I get this, but then do services like Google Analytics get a free pass?

No, they don't, and they are just as subject to the GDPR as anybody else is, in fact, probably more given the EU decisions lately and because they're a huge big, fat target.

The distinction here is that they have been doing it a very long time, and user privacy actually is a core tenet of what they worry about at Google.

No, I don't trust Google either. But at least Google is somewhat open about the fact that they collect the data. I can have a look at it and I have settings to influence and even delete (probably) what is being collected.

That is vastly different from a spyware module installed clandestinely together with a software I paid for that sends data about me to somewhere and somebody then does something with it that I don't know about.

You can install browser extensions to block that kind of tracking, or you can go nuclear (as I have) by disabling JavaScript altogether. When I buy a game, I do not have this freedom.

How is this false outrage? Even if a particular dev doesn't care about who the users are, the data is being tracked and can be used by anyone with access to that data to track people. Consumers do not want to pay money for a product and then also have their data harvested to be used to make even more money off of them.

If you really think this is false outrage you need to work on seeing things from other people's viewpoints

Many reddit posts have outright stated that Red Shell was "spyware" with no indication that 1) they were misusing data 2) no data that is harmful was being collected.

> Consumers do not want to pay money for a product and then also have their data harvested to be used to make even more money off of them.

Agreed. And both the game devs and Red Shell as far as I can see aren't selling this data. The devs are spending money to use Red Shell to try to have better / more cost effective advertising campaigns.

> And both the game devs and Red Shell as far as I can see aren't selling this data.

Just collecting the data makes it vulnerable to abuse. What if there is a breach?

So somebody will know what timezone I have, what fonts I have installed and what browsers? Linked to my in-game ID?

I am struggling to think of how this affect my life.

The fact that the actors involved are not _currrently_ selling the data does not mean that can't change in an instant. Many other company's have pulled the "we're not selling your data" card only to switch later. Consumers do not trust companies to harvest this data anymore because as a class, company's have proven themselves untrustworthy.

They are outraged because the data is being collected at all, not what you are using it for

To be considered spyware, software needs only to collect data covertly. It doesn’t matter whether the data is used appropriately or not.

If you want better/more cost effective campaigns, do what was done in the past: just fucking ask!

The nature of marketing hasn't changed at all over the years. Show an impression, ask what the user was influenced by. Surreptitiously stealing data off of someone's computer as a means of answering the question is flat out the wrong way to do it.

targeting me with advertisements is data misuse. Sorry you can't see that.

You don't get to decide what data I need to share with you or your advertising partners, or what constitutes a misuse of my data. That's up to me. I get to make that decision.

If you take my personal data without my consent, I will consider that an intrusion upon my privacy.

Yes, but if you solve that problem, it implicitly means that you have a fingerprint of me that can be correlated across the web. So, next time I access a different game, someone can know that I'm the same person who bought the original, and perhaps try to persuade me based on that. Whether anyone does so or not is irrelevant - the only way I can try to ensure it doesn't happen is to try to never leak this data about myself.

Everything involved in targetted advertising is a social liability. Advertising companies owe nothing to consumers and disrespect them like it's their duty.so people rightfully hate intrusions by advertisers. Sorry your business model apparently depends on that but it's a shitty model of commerce that deserves to die.

If the value prop for end users is clear, why not offer it as a separate download, complete with an uninstaller?

It isn't false outrage. If you don't care that your users want you to stop you should get out of development.

Reply on news.ycombinator.com