Hacker News Reader

Comment by davidhyde | Hacker News Reader

The author of this article didn't bother to read even a summary of the GDPR law. It doesn't matter what the user consents to, you cannot use their personal data ad hoc. You need to justify its collection, storage and transfer to the regulator, not the user. This is in contrast to the ill thought out cookie law where websites could get away with it by irritating consent banners.

Sort of like, but not exactly the same as, those consent forms you sign when you go river rafting. They do not legally protect the rafting company from negligence. In fact, they're almost a waste of paper.

View on HN

> It doesn't matter what the user consents to

That's not entirely true. If a user really consents to being tracked for advertising purposes, the GDPR allows tracking. Whether the consent banners inform users honestly about the extent of tracking is another question. I think they don't.

What's worse is that Google still tracks users by default, even if they never visited an actual Google property, let alone have a Google account. That's an obvious violation of the GDPR but Google will probably try to shift the blame on publishers.

I think the biggest issue with GDPR so far is enforcement.

It's still early days, but many companies don't even follow GDPR as they're supposed to, including Google and Facebook. That will only be settled after an enforcement wave against both large and average-sized companies (GDPR is more lenient towards small companies).

Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?

GitLab seems to use the Cookiebot solution. I like that "Marketing" cookies are disabled by default, although they should be labeled as "Advertising". Also, even if you bother to read the purposes of all the 80 advertising cookies, the descriptions are incomplete and dishonest. For example:

Doubleclick cookie notice: "Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user."

Facebook cookie notice: "Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers."

These descriptions fail to mention that the collected data will be combined with information from thousands of other websites you visit which allows to create sophisticated user profiles. From these profiles, you can infer things like gender, age, socio-economic status, interests, or hobbies with relatively high accuracy. Even if you asked them, Google and Facebook couldn't tell which hidden categories their machine learning models can discover.

At GitLab we really care about transparency and it's one of our core values. Here you can find out more about Cookies policy https://docs.gitlab.com/cookies-policy/

I agree with what you’re saying; you’re proposing some ideal changes. But I think given where we were as a community or what has become the norm in tracking/social, this is a great step and is a big improvement over the past. It looks like someone from GitLab replied in a sibling to my comment, so maybe giving this extra feedback will bring about further changes.

Edit: and yes, I just checked and it looks like Cookiebot.

> If a user really consents to being tracked for advertising purposes, the GDPR allows tracking.

That's not exactly true either. For the consent to be valid, it must be freely given - that is:

1. The user must have a choice to give consent or not give it

2. The service provided should be the same regardless of #1, unless the consent is necessary for the service (e.g. consent to store address for delivery of goods - although in such case this shouldn't really be based on consent)

Unfortunately many sites either do not give opt out at all, or make it hard to find it - in such cases consent can't really be considered to be freely given.

That is not true you are confusing single purpose with a “valid” purpose from the users point of view which isn’t actually the case your business needs can be just as a valid reason under the GDPR as anything, you do not have to provide service to users who decline if say it affects your ad revenue the GDPR cannot force you to provide a “free” service to users.

Consent is just one lawful basis for data collection, business justification is another one and ad revenue is a perfectly valid reason in which case you don’t even need consent but just to inform the user.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

You can do what ever you want under “vital interests” as long as you feel comfortable explaining those to the regulator, not the user.

Consent is used often because the current interpretation of most legal experts is that it shifts the liability to the user however this has never been tested.

The parent was responding to a claim that consent works as a base of processing, and only talking about that base. That other bases can work is true (I'm personally really curious how this is going to play out for ad-financed services), but just because they didn't mention it they aren't "confused" about anything.

The parent is not correct however you can use consent as your lawful basis and deny services to users who do not consent under any business justification as long as you have one.

If targeted ads give you more revenue and you choose to use solely targeted ads because thats your business model GDPR does not forced you to provide a free service or a service that generate less revenue.

So no #2 doesn’t have to be as #1 this is confusing things with the single purpose clause in which case you can’t make X and Y being co dependent.

E.G. while I can perfectly refuse service if you do not accept ads I can’t refuse to sell you something for not wanting to join my mailing list.

Also not only that does nothing stopping you from having multiple bases for consent it’s actually the recommended approach.

This goes against what I've seen in regard to consent (generally warnings to not use it unless truly necessary - if you require something put it as legitimate interest or requirement to perform the contract, do not ask for consent since it sets wrong expectations).

I also don't think consent is the right basis to use all the time (however it's important to note that no lawful basis takes precedence over any other) and good vetted vital interests and a contractual agreement is preferable, however consent is the easy way out.

"This is what we do do you agree: yes/no" is much easier than to develop a valid vital 1st and 3rd party interest for each case and most online services don't require a contract.

However the idea that somehow you have to provide services to people who do not consent is simply false.

That you can't do is tie completely unrelated interests to a single consent for example:

I have a website that shows you local events and allows you to sign up for them, my business model is to sell your contact details to promoters. If you do not consent there is no reason under the GDPR to compel me to provide you with a service that costs me money to run while you refuse to participate in my revenu stream.

What I can't do is say if I run a ticket website to refuse to sell you a ticket if you do not consent to me using the details you've put into in order to purchase them to be sold to promoters or in other words under the GDPR the information collected for the purpose of selling you a ticket cannot be used for another purpose selling your info to promoters.

It's also important to note that in some cases the "I agree" isn't actually used for consent it's just a UX quirk, you can still allow people to opt out even if you don't use consent as the lawful basis for example I can display you the following message:

"I collect the following information: XYZ, and issue the following tracking cookies: ZYX the lawful basis for this is the vital interest of my company and my business partners" I still technically need to give you a way to opt out, so the windows that says opt-out or agree isn't necessarily a consent window from a GDPR point of view.

And as previously mentioned I can deny a service to you if you opt-out because I can't monetize you in which case I can legally redirect you to a page that says you can't access by website until you agree to my terms, in this case again consent is not necessarily a lawful basis rather than you acknowledging the lawful basis i presented under my terms of service.

Your position will certainly be argued for in a court at some point.

So will the counter position that sending reader info to countless third parties isn't actually necessary to monetize, as plenty segmentation value comes from the readers' selection of the site itself.

It will be argued the marginal value of each additional exposure of the reader's private data does not outweigh the individual's right to privacy.

In the meantime, here is a reasonably neutral but in depth overview for site owners interested in learning more to better navigate GDPR:

https://dma.org.uk/uploads/misc/5ae1fbf5c60fd-gdpr-for-marke...

It doesn't need to be argued it's a perfectly valid reason (and has been reaffirmed by different DPAs), the GDPR does not define what a valid or a non valid legitimate interest is, it just has to be well defined and transparent.

I suggest you read the "legitimate Interests" part of the document you provided.

>It will be argued the marginal value of each additional exposure of the reader's private data does not outweigh the individual's right to privacy.

There is nothing in the GDPR that puts on legitimate interest over another including your so called right to privacy.

> There is nothing in the GDPR that puts on legitimate interest over another including your so called right to privacy.

In fact there is one exception which thankfully limits legitimate interests of data controllers:

"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."

It remains to be seen in practice how much data controllers' interests can be overridden by "interests or fundamental rights and freedoms of the data subject".

Google has introduced non-targeted ads for GDPR compliance. It sounds like a sizeable chunk of the market disagrees with you that you can force the use of data for targeting on users under GDPR.

https://www.marketingdive.com/news/google-will-support-non-t...

A sizeable chunk of the market doesn't disagree with me but rather get something than nothing.

If Google can generate the same ad revenue of close enough to it without having you to force your users to agree or opt-out into oblivion in which case you lose the revenue stream from all users that opt-out.

It's also important to note that Google's non-targeted ads server two functions as they both allow you to display ads to users who did not consent to data collection as well as potentially protects you as an advertiser from ensuring that your ads are delivered in a GDPR compliant manner.

Under the broader interpretation of the GDPR you as an advertiser might be liable if you buy spaces for targeted ads that are displayed unlawfully and this is because GDPR essentially mandates that you must ensure the compliance of your partners.

Please see GDPR Article 7, §4:

"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."

And then Recital 43:

"Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."

If:

1. You ask users for consent

2. The consent is not strictly necessary to provide the service

3. You deny the service to users who decline to give consent

Then the consent isn't freely given and therefore invalid.

> GDPR does not forced you to provide a free service or a service that generate less revenue.

True, but then consent isn't the right basis for processing of data. As you mentioned, business justification, or "legitimate interests" as GDPR puts it, is what you should be using.

Article 7 does not violate what i said this is a single purpose clause.

Meaning i can't force you to sign up to my mailing list or refuse to sell you items on my store, the current interpretation of most DPA is that it doesn't apply to single purpose processing.

Also again as stated below people confuse the "I agree" button to a GDPR consent, the fact that there is ok/opt-out UI for GDPR does not mean that they are seeking consent as their lawful bases but they still need to inform the user and allow them to opt-out (even if opt-out means that they opt-out of the service).

Only about half the GDPR popups I've seen were actually worded solely for seeking consent even tho they had the agree/opt-out buttons below the text itself stated the legitimate interests of both them and their partners in why they need the data for most things with maybe a handful of purposes relying on consent alone.

> It doesn't matter what the user consents to, you cannot use their personal data ad hoc. You need to justify its collection, storage and transfer to the regulator, not the user.

I think one of the points is that there are very few companies that have the financial resources to do that, one of those companies that can afford it being Google. The next retort is "but then those companies should stop using trackers all-together" which leaves most of those companies that don't have Google's financial resources without ad money, meaning they're most likely to go out of business, practically creating an oligopoly where a handful of companies control most of what's published on the Internet. Granted, we would have gotten there regardless, only that legislation like GDPR is accelerating this process.

>but then those companies should stop using trackers all-together

Yes, why do they have to track their users? Why don't use real targeted advertisement instead? If I go to a car forum, car related ads would be relevant for me. Using ML, tracking and profiling to give me ads for the fridge I did buy last week is not relevant

>Using ML, tracking and profiling to give me ads for the fridge I did buy last week is not relevant

Come on, that's not what they are trying to do and you know it. There's so many valid arguments you could make, why use a strawman?

But the answer to your first question, is because ads targeted to users pay more, get more clicks, and overall perform better than those that are targeted to the page.

patio11 had a great back of the envelope calculation awhile ago on this. Turns out showing ads for a fridge right after you just bought one might be highly successful.

Say the average person buys a fridge once every 10-20 years, the probability you're looking for a fridge this month is something like 1/120-1/240, call it .75 percent.

Some percentage of fridge purchases end up being returned. Let's say 2 percent of them. If you return a fridge, you pretty much are guaranteed to need a new one, so around 2 percent of people that just purchased a fridge are very likely to buy a new one.

That's over double the likelihood of someone that didn't just buy a fridge!

> ... might be highly successful.

Only in the context of the disastrous relevance of tracking.

Does tracking earn companies more than it costs users in added electricity? I doubt it.

I find that extremely unlikely, only because companies aren't entirely stupid, and if MANY companies have started doing that in this space, and since they started it their profits have gone up significantly, it points to this kind of tracking making a significant amount of money.

And most of the tracking happens on the server, the client really only keeping some tokens for state and sending them with the requests.

> only because companies aren't entirely stupid

[citation needed]

Cents per user is still a lot of money if you have a billion users.

Maybe the real value of tracking is the perceived value of tracking? It's a good way to combat competition as tracking requires that you already have a large presence.

Until one of us shows some kind of proof, we are both just guessing.

Now companies might do dumb stuff, but they don't just continue to grow and dominate by making exclusively bad decisions. Google is built on targeted advertising, and it's paid off for them very well, so it can't be a complete boondoggle.

The wikipedia article on targeted advertising says that targeted ads make about 2.7 more money than the alternative.

I don't have any numbers on material costs, but I can't imagine it costing users that much in electricity. Still, it is just a guess so if you have anything that shows otherwise I'd love to read it!

https://en.m.wikipedia.org/wiki/Targeted_advertising

I bet rafting consent forms are still useful in the sense that they discourage most people with trivial-to-moderate injuries from thinking about holding the company liable.

Same as 'Stay Back 500ft, Not responsible for damage' signs on the back of gravel trucks. Youd better bet they are 100% liable for anything that flies out. But it discourages the unmotivated and the uneducated from seeking their entitled legal relief.

As someone who leads outdoor trips, I've been told (not sure how true) that one of the supposed benefits is that it informs about dangers. So someone who suffers an injury--not through negligence on the part of the trip leader--would have a tougher case arguing that no one told them that the activity was other than completely safe and they wouldn't have done it had they known.

On the other hand, I've also been told by lawyers that the usual scrawl your signature at the bottom of a paper after a quick glance probably doesn't make much of a difference.

Reply on news.ycombinator.com