Hacker News Reader

Comment by breischl | Hacker News Reader

I have no particular love for FB or what they've done with data, but these I don't understand why either of those points is particularly controversial or even unusual.

> Facebook used data provided by the Israeli analytics firm Onavo to determine which other mobile apps were being downloaded and used by the public. It then used this knowledge to decide which apps to acquire or otherwise treat as a threat

Checking out your competition is pretty standard among all businesses, as is buying out the ones you can't beat.

> there was evidence that Facebook's refusal to share data with some apps caused them to fail

Sharing or not sharing data with another app is likewise not an unusual decision. FB is not a public utility - they can not work with other apps for any reason, or no reason at all. And this is a particularly ironic thing to point out, considering that the main thrust is complaining that they _did_ share data with other apps. So it's bad if they do share data, but also bad if they don't?

View on HN

> Sharing or not sharing data with another app is likewise not an unusual decision. FB is not a public utility - they can not work with other apps for any reason, or no reason at all. And this is a particularly ironic thing to point out, considering that the main thrust is complaining that they _did_ share data with other apps. So it's bad if they do share data, but also bad if they don't?

To me, this would be Facebook taking advantage of their stronghold on the market to continue to dominate the market.

Let's remember this is not Facebook's data, this is their users' data. It should be up to the User who they can share their data with, but they weren't given the choice to use their data with an app because Facebook decided they didn't like the way the other business competes with them in some aspect or how they aren't making money out of the third party app. An example is Facebook won't grant Influencer Marketing Companies access to their API even though the user (The Influencer) wants them to have the data so they can get paid based on the views, shares, comments, and likes of the posts they've been contracted for. User has a legit desire to share that data to the point where they will take screenshots, GDPR deletions, etc to fulfil the need for that data to be shared. Facebook's reason for not allowing them access is simple, they don't make any money out of the deal.

So if they refuse to allow you to share your data with people you want to share it with, that is bad. Sharing your data with companies you don't want to share with is also bad.

> is not Facebook's data

Look at the T&Cs sometime. Once you upload something, it's theirs. Once they sniff something off your phone, it's theirs. Once you look at something in another tab while FB is open, it's theirs.

GDPR, and even the former 1998 Data Protection Act disagrees. Ts&Cs can't override statute.

https://en.wikipedia.org/wiki/Data_Protection_Act_1998#Data_...

My understanding is that gdpr still doesn't say that it's your data and not Facebook's, it just gives you certain rights to that data such as the right to have it deleted.

Facebook is the Data Controller, not the owner of the data

I’m pretty sure Facebook has made a substantial investment in structuring their data flow & server locations with the specific intention of avoiding the reach/responsibilities of GDPR.

> I’m pretty sure Facebook has made a substantial investment in...avoiding the reach/responsibilities of GDPR

Because they’ve been so careful about following other laws?

Yes, and during so actually broke the law and didn't succeed either.

> Once you upload something, it's theirs. Once they sniff something off your phone, it's theirs. Once you look at something in another tab while FB is open, it's theirs.

According to Facebook TOS, you own the data but grant them an open-ended licence to use said data.

Ownership is a fuzzy word. Are we talking copyright? What do I sell if I sell you data?

I agree with your point overall, but we need to recognize here that the problem isn't Facebook being selective, it's Facebook being a monopoly.

Selectively using business intelligence data is what makes a company a 'monopoly' these days?

I suggest re-reading your parent comment because that's not what was said at all.

Facebook won't grant Influencer Marketing Companies access to their API even though the user (The Influencer) wants them to have the data so they can get paid based on the views, shares, comments, and likes of the posts they've been contracted for. User has a legit desire to share that data to the point where they will take screenshots, GDPR deletions, etc to fulfil the need for that data to be shared. Facebook's reason for not allowing them access is simple, they don't make any money out of the deal.

This seems so ludicrously backwards to me. How is my decision to upload my data to Facebook a meaningful claim that they should run their platform in a particular way for my convenience, even if there's no business justification?

Allow me a tortured metaphor :)

Imagine you own a very popular art museum and you let any artist display their work there for free. Visiting requires a free membership, but visitors must apply for it. Competing museums and galleries are always trying to get a membership so they can come through and scope out which artists are most popular and then woo them away. You reject those memberships.

How on earth is this unfair to anyone?

Now, letting those competing museums in is obviously better for the artist, but does that give them any right to demand it? You're providing this space for them for free! You're providing a huge audience to them, for free! What possible justification do they have for demanding that you let your competition come strolling through and hurt your business just so it'll make their life a little better? If you don't like it, you can pull your work from the museum at any time.

So many of the critiques of companies like Facebook and Apple come down to people wanting all the benefits that these platforms provide, but without any terms, inconvenience, restrictions, or tradeoffs. Ridiculous.

Your metaphor is good, but misses the part where this art museum has either bought or forced downsizing/closure on all other competitive museums. That forces artists to choose this museum or one that it owns if they want any recognition/income from the work they do (this museum certainly isn't paying them for the work).

That would be a fair concern if it were true. But Facebook is hardly the only way to build an audience. What about Twitter, or Snapchat, or just building and hosting your own site and using Facebook as just another promotion channel?

Let's go with the tortured metaphor.

Popular art museums generally run with allowing entry without requiring membership. They make up for that by collecting donations or entry fee, running a comparatively expensive cafe, and ensuring everyone leaves via the gift shop. They might heavily promote, and employ people to individually sell memberships, or give free membership in exchange for monthly gift shop and offers spam. One or two might be a little too heavy handed in promoting membership over visit.

They don't plant a bug in your pocket without knowledge, or consent to learn what other art museums and galleries you are visiting to assess if they are a worthy target of restriction or takeover. They don't insist on knowing your entire contact list and SMS history just to look at the pictures. They don't ban employees of other galleries and museums from visiting. Not least because 9 times out of 10 they would not know if they worked for a different city's gallery.

That's enough torturing. ;)

One of the above is a fair exchange, that can be freely and knowingly chosen. The other is using undisclosed and underhand methods to get extra leverage. That, by definition, cannot be fair. Turns out it's illegal too.

This is one of the very rare cases where I wish the UK had a little more of the US's litigious culture. In my 50 odd years it's the first and only case. Normally I wish for the reverse. :)

I added the membership bit just to make the whole "rejection of competitors" part make more sense.

They don't plant a bug in your pocket without knowledge, or consent to learn what other art museums and galleries you are visiting to assess if they are a worthy target of restriction or takeover. They don't insist on knowing your entire contact list and SMS history just to look at the pictures. They don't ban employees of other galleries and museums from visiting. Not least because 9 times out of 10 they would not know if they worked for a different city's gallery.

I'm not defending all of Facebook's practices. In particular, any surreptitious attempt to collect sensitive user data without permission, or in violation of permission, is terrible. We might differ on what constitutes "sensitive user data" or "permission" but whatever.

Regardless, that's not what we're actually talking about here, and if the museum in question did ask for user consent to a full cavity search before going through, I don't think that actually changes the calculus of what's fair for them to provide to their competitors.

If the museum waived the entry fees for users that opted into a having their info tracked and the data monetized there are probably people who would prefer to compensate the museum that way. It'd probably open up access to the museum to poorer people that couldn't afford the ticket. Heck, I'd probably do it. My contact info has almost certainly been collected already, so for me it's basically instant savings. Your main criticism is that the data collection is undisclosed. I'm sure there's debate to be had over whether Facebook was transparent about it's data collection, but they always did tell users about it in some capacity.

How much would Facebook cost if users has to pay cash? I think the Economist did a survey on this topic with Google search and the average price people were willing to pay was $1,500 a year. If Google switched from monetizing user data and advertising to charging money, how much human productivity would be lost because some people can't afford a good search engine? How much would this exacerbate academic difficulties of poorer student if we add the fact that their classmates can search online information more effectively because their parents can afford Google search?

The lack of tangibility of paying for products with personal data instead of money can be irksome, but it has created an unprecedented ability to build large, complex services while delivering them free of (monetary) cost to the end user.

That might be the average price Economist readers would pay. I suspect it would be a lot lower for most users.

That aside - FB never gave users that choice. Where many media services - including AOL, streaming media companies, and newspapers (and the Economist) survive by charging a subscription, FB has never attempted to use that business model.

Why? Because FB has always been a data harvesting and user monitoring/profiling operation that happens to operate a social media front, rather than vice versa.

Ditto Google for search.

And "telling users about it in some capacity" is very different to giving users a list of buyers and full details describing what their personal data was used for.

Realistically, no one outside the industry - and not that many people in the industry - understand where this data ends up and what it's used for.

Pretending otherwise is casuistry and special pleading. There is no way users can estimate the true value of their data, either individually or in aggregate - because the value is determined by buyers who remain hidden and unnamed, and neither FB nor the buyers are obliged to explain any part of the process.

There is no informed consent here. It's a perfect corporate asymmetry, and very much designed that way.

Facebook probably would charge users directly if it were acceptable to do so. Unfortunately (in my opinion) the optics around providing that choice would be even worse than not providing that choice at all. People would portray this as akin to racketeering, making users cough up the dough if they don't want to be tracked. Ironically, concern over Facebook's data collection inhibits their ability to explore direct monetization methods.

Also, the value of this information isn't secret: Google and Facebook are public companies and publish their revenue numbers, no? It's not hard to divide by the number of active users to get an average value per user.

I suspect that Facebook would continue to collect all the data, but just not show ads, if someone elected to pay a monthly subscription.

True, this is what was proposed last year. Essentially analogous to YouTube Red.

> Let's remember this is not Facebook's data, this is their users' data.

No, it's not - short of a change in law it is Facebook's data. Facebook collected, maintained , and analyzed the data. It's their data, the fact that their users allowed Facebook to collect it does not change that fact.

GDPR allows users to view the data Facebook collected about them. If users want manually request their data from Facebook and provide it to competing apps they can. But this is the user's prerogative, not Facebook's.

Seriously, it's mind-blowing to me that people can't make this distinction. I should be able to ask the library for a record of the books I've checked out. But that doesn't imply that they should hand those records out to whoever wants them, or that they need to make them available for anyone but me, even if I think it'd be more convenient for someone else to pick them up for me.

> If users want manually request their data from Facebook and provide it to competing apps they can.

Actually, for a lot of it they can't. The GDPR downloads are incomplete and are missing lots of data like many other GDPR downloads.

And in some cases these aren't competing, they just aren't making Facebook money so Facebook denies them access and tells them what they need to do to add Facebook to process so they can get access.

And if I can tell Facebook to delete something and they have to do it, they do not own it. Facebook are not in control of the data, they have access to it, but they can't share it without permission, they can't sell it without permission, they can't do alot of things. This, to me, means they do not own the data.

The requirement to make GDPR downloads available was never well thought out. For instance, say you requested a log of your Facebook chat logs. Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy. Especially for a service that is all about networking and sharing, it's difficult to walk the line between giving the user the data they requested, and respecting the privacy of other users.

The ability to tell Facebook to delete your data does not grant you ownership of that data. You do not have the right to tell Facebook to let some 3rd party to access it using Facebook's infrastructure (which seemed to be the claim made by the original comment I responded to). The fact that the government forces companies to abide by certain regulations does not mean that the company is not the owner of the things that are regulated. A company might have it's interview records audited to investigate discrimination. Does that mean the company does not actually own or possess these interview records?

>Should Facebook provide this without redaction of the recipients' identities? I'd say no, providing this data without that redaction is a violation of the recipients' privacy.

How is it a violation of privacy to tell a user with which other users they have communicated in the past?

Do you want your Facebook usage published because any one of the hundreds (thousands?) of the people you interacted with requested their data under GDPR?

It's not just telling the user. Once they info is published said user can turn around and tell it to the rest of the world. Some people have already published their requested data, it seems unlikely that people publishing said data face consequences.

Sure, nothing is stopping people from scrolling through chat logs screenshotting them. But that's difficult to do at scale, so there's de-facto limits on how much info can leak this way. Also consider the situation in which you unfriend someone, thus preventing them from seeing past chat logs - I think, I haven't used Facebook in a long time. If that person does a GDPR request should the company deliver data that the user is otherwise prohibited from viewing? If GDPR does mandate this it seems like a legally-mandated side channel attack.

And the downloads for people outside GDPR's reach (like Americans) are even more incomplete.

Facebook continues to play a game of "how much can we mislead them to get our way".

>> this is their users' data

> No, it's not - short of a change in law it is Facebook's data.

Er, actually it is. Under GDPR, and under previous data protection rules that lacked meaningful enforcement, users own their data. Companies at most get to "borrow" and/or keep it safe for them.

Alas, this fundamental fact seems to not have quite made it everywhere yet..

https://digitalguardian.com/blog/tackling-gdpr-challenge-1-e...

Does anyone have an explanation as to why parent is downvoted? Is the information they presented incorrect?

Possible reason: It is actually intentionally avoided to use the concept of "ownership", since those advocating for "data ownership" generally mean things like "if people own their data, that means they can give it to companies and then that company can do what it wants with the data, since it is its property", which is more or less the opposite of what the goal of this privacy regulation is. The term is used sometimes in more general material, but it is problematic framing. People have rights to their data and how it is used, but they don't derive from ownership.

So in that particular sense, it is even stronger than ownership, at least in terms of preventing facebook from ever becoming the owner. (Not in the sense of having all of the rights usually associated with ownership, which include selling)

The article linked doesn't back up the claim that GDPR makes the user the owner of the data companies collect. Being entitled to obtaining a copy of a company's records about the user is a very different thing than making the user the owner of that data.

What about data that Facebook generates about you, but you did not provide? Is that information required by the GDPR to be provided to you, or does the GDPR only state that any information you provided to them must be returned? There's no way I'm reading the GDPR nor would I even understand all of it if I did.

We know that FB makes connections between you and other users even if you've never made those connections yourself. We've heard about the shadow profiles, etc. These are all data points that FB generated on their own. It seems like this is the information that is valuable. Information gleaned from ML analysis of images posted would also be their own. That has way more value than the image itself would. FB is doing way more under the hood than just slurping in the data users posted, and then displaying it back to them.

It doesn't matter where the data came from - uploaded, downloaded, generated. If it is PI it is the property of the identified user, not Facebook's. If they slurp 100 images of my face then that data is mine and it is my right to have it deleted and told who they shared it with and for what.

I'm not finding where in the GDPR text the user is stated to be the owner. The text frequently refers to the user as the "data subject". Ownership is not mentioned. The article you link to claims that the EU resident owns the data, but never backs up this claim with references to the GDPR text.

Even if it was the User's data and not FB's (which is argued downthread a bit...) there's nothing that requires Facebook to make it accessible to other companies. There is real cost in creating an API, running it, managing it, etc.

One could also argue that the User already has all their own data, they just didn't collect it very well. So really they're trying to use FB as their data collection platform - which FB is free to do or not, as they choose.

As a Facebook user I'm glad they don't grant access to influencer marketing companies. Those companies drive the creation of trash content which would harm the Facebook user experience.

"Sharing or not sharing data with another app is likewise not an unusual decision. FB is not a public utility"

[the following paragraph does not assert that FB is a monopoly, it is agnostic]

The law says that a company with a monopoly needs to act a bit like a public utility. Recall what Microsoft did to Netscape -- was there anything wrong with that? Is a company allowed to take action against a competitor? The normal answer is "Yes". But different rules apply if the government can prove that a company has monopoly power in some market. Actions that are allowed among normal competitors are no longer allowed once a company has near monopoly powers. I think fast growing tech companies get into trouble because the founders doesn't realize how much the company has grown. Bill Gates could use aggressive tactics during the 1980s because Microsoft was still small. He got into trouble in 1994 because he didn't realize how much Microsoft had grown, and how much the rest of the world suddenly regarded it as a behemoth. Therefore he was no longer allowed to pursue the aggressive tactics that he'd previously been free to use.

Arguably, the same reality has now caught up with FaceBook.

> I don't understand why either of those points is particularly controversial or even unusual

Facebook is unusually large and lawless. Their favoring industry incumbents decreases the economy’s dynamism. If you want to compete with Airbnb, now, you must not only launch a better product. You must also curry favor with Facebook. That’s a lot of trust for society to put in a company with a track record of terrible judgement. (This is also why we regulate monopolies.)

Sharing or not sharing data with another app is likewise not an unusual decision. FB is not a public utility

I think this point is, at least partially, arguable. Take "political media." FB is so dominant and powerful in this arena that excluding individuals or parties is very close to denying people their rights to free speech and/or associon.

Idk if you can make that case about apps, because their app platform is not that important, but you could make it about Android or ios... maybe Aws.

> Checking out your competition is pretty standard among all businesses, as is buying out the ones you can't beat.

To be clear-- they marketed Onava as a VPN service to protect your personal data from spying and then they spied on your personal data to figure out what products you were using.

> So it's bad if they do share data, but also bad if they don't?

Yeah. I'm guessing they have a bad business model.

Agreed. Facebook purchased third-party data to guide their acquisition strategy. Any other company could hire this firm and made the same decisions.

The selective access to competing apps, based solely on this information, is antitrust though. If the apps violate rules that apply to everyone, that's different, but that doesn't appear to be the case?

Edit: turns out Onovo had access to specific, proprietary data, acquired through it's own shitty apps, which facebook acquired. This is pretty shady.

> Any other company could hire this firm and made the same decisions

Facebook bought Onavo in 2013 [1].

[1] https://techcrunch.com/2013/10/13/facebook-buys-mobile-analy...

Interesting, didn't know that. Did Onavo have access to data that other public BI firms don't?

> Did Onavo have access to data that other public BI firms don't?

Yes. Onavo built “consumer-facing apps to help optimise device and app performance and battery life on iOS and Android devices” [1] while piping their users’ data to Facebook.

[1] https://techcrunch.com/2013/10/13/facebook-buys-mobile-analy...

So they were basically the spamware apps like flashlight and other 'performance enhancers'? That makes this kind of worse, especially if they continued it after acquisition.

Not really, they built an actual data compression VPN for users with limited data plans and did traffic analysis on the data that went through that pipe.

I agree that the first point seems pretty routine, but the second one is a problem. Look at Microsoft in the late 90's. They changed their system API's and refused to publish the changes for the express purpose of killing netscape. That was later deemed to be illegal. Facebook using their market dominance to kill other apps seems to be very similar.

I think they were mostly using their market dominance to kill apps that decided to live on the Facebook platform in the first place.

If you build an app that relies solely on Facebook login and access to Facebook data as key parts of your business model then are you really a competitor?

Well, if you build an app that runs on Windows like Netscape did, are you really a competitor of Microsoft? Turns out, you might be, if Microsoft want to make their own app. Similarly, Facebook might want to introduce or change native functionality, or monetize their platform, in a way that competes with your app.

That's a good point of comparison but the difference I think is at the time Windows was a dominant OS, and most people's only option. For them to come out and compete with Netscape and prevent Netscape from operating on their OS would be a death sentence for Netscape because it is not reasonable for Netscape's response to be "Fine we'll make our own OS!".

There's a huge difference between "build your own OS" and "build your own website login".

It's not a very tall order to create a social website that doesn't use FB login. Social websites should not by default have a right to all of facebook's users. They should have to build that user base themselves.

Would you say Facebook has monopoly position in social networks?

Unless they're a monopoly...

Reply on news.ycombinator.com