Hacker News Reader

Comment by _nalply | Hacker News Reader

> I'm pretty sure that if you asked people whether they would prefer to pay for Facebook and Google with cash or by sharing data for ad targeting, most would choose the latter. The GDPR specifically forbids that option.

Do you have a source for that?

View on HN

Article 7 and Recital 43 of GDPR.

Permission must be freely given in order to be valid. It is not freely given, if access to a service requires the permission and that permission is not strictly necessary for the service.

However I believe it is good that such option is forbidden, after all the years of abuse of user data at the hands of Google, Facebook and other advertisement companies. Note that ads can still be shown without all the creepy targeting, and ads could still be used to pay for the service, without stealing user data (yes, I call it stealing, because these companies go to great lengths to trick the user into giving the permission). It remains to be shown if ads without tracking could be sustainable to keep services free.

Well since you can't make sharing of personal data a prerequisite for using a service unless it can be shown that data is actually necessary for the operation of the service it could be argued that this follows.

The question was if there is a source on the claim that most people would prefer intrusive ads to paying for a service.

Sorry, I had assumed the question was for a source on "The GDPR specifically forbids that option.", I didn't give the source, but an argument why it follows from the rules of the GDPR.

A service could offer an ad-free version for a fee.

If you provide a free service which is only accessible after you give permission to data processing, then that permission is not freely given and thus invalid (as long as such processing is not strictly necessary to provide the service) - see Article 7 and Recital 43.

That's not quite accurate. The law allows you to legitimately ask for permission to share the data for advertising purposes, but you have to be transparent with the details, and the advertiser has to have the same safeguards on the data as your company (they aren't allowed to re-sell it without the original company's knowledge, for example).

That's not fully accurate either. All that you wrote is true, but user's permission must be freely given - this means access to the service cannot be restricted if user refuses to give permission (as long as that permission isn't strictly required to provide the service itself, but then probably permission is not the right basis for processing data).

Agreed.

I used the word prerequisite for a reason - you can ask for permission, but you can't try to force permission by withholding the service.

Reply on news.ycombinator.com