Google’s GDPR Workaround
brave.com
brave.com
Below is the google_gid for different publishers, there is no proof of overlap, they have different google_gid for same person. Which is exactly what google describes. [1]
I don't understand what Brave claims.
d.agkn.com CAESEP-S3Zs5f0_kq11XTCZP_mE
id.rlcdn.com CAESEPpf2T4-2AsAR_4rer3RfNs
image6.pubmatic.com CAESEB9H3qdV26kxEiz-BJ_TY-M
pippio.com CAESEJyqG1Pg1j-_scqW8kDzTkg
token.rubiconproject.com CAESEE1DyZ245WggYaQZEWpQWI8
us-u.openx.net CAESEPIJ9jHcY2j4jK3-DPmfar4
now those are used to match a 3rd party id. you just need a gdpr_workaround schema in your data base with two columns user-id, google-random-id with N-1 records indexed both ways.
gdpr has restrictions on pin pointing a single person. this is effectively doing that, but claim it is not, because random ids. apple is just a little better with how device-advertiser-id works.
I don’t think we can have it both ways, or at least it is very difficult and we don’t have a great compromise solution.
There are other ways to get money to support your work, and if those ways are too painful right now, that's just an opportunity for disruption. Even better, it's an opportunity to prove that disruption doesn't have to be exploitative.
Not every website is the WSJ or Bloomberg, which cater to markets that are willing to pay for content.
But no. The internet enabled vast, invasive user tracking, therefore vast, invasive user tracking is the only conceivable way to sell advertising.
The cost of running a basic website to publish text is modest. Tools like [dat][] and [scuttlebutt][] make it completely free (once you have a computer and any internet connection) to distribute content to people who actually want it.
[dat]: https://dat.foundation/
[scuttlebutt]: https://www.scuttlebutt.nz/
On the other hand, if you want to make a living out of producing content (rather than wanting to publish the content purely for its merit), that is harder — the content has to be that much more valuable to enough people.
As long as individuals can publish stuff, and others can see it and choose whether to support it financially (all without 3rd parties mediating/filtering), then I'm content. Our distributed tools make that possible; we just need to make them easier and more ubiquitous.
I'm one of "those consumers" and I'm actively looking for sustainable ways to pay content producers.
Here's what I do currently:
- subscribe to two newspapers in addition to the mandatory payments to the national news broadcaster.
- donate to the Guardian
- buy on Blendle
If there was a way to pay for single pay-walled stories I would probably use it a few times a week in addition to my current subscriptions.
I'm not interested in any more subscriptions (unless they are all inclusive like Spotify so I can cancel my current subscriptions, and even then I'm not sure since I actually want to support those two papers and think I do so better through direct payments than through revenue sharing through a huge international tech company. )
AFAICT Brave's plan is to send a block of potential ads to the client and use a client-side machine learning algorithm to choose specific ads. So the claim is that none of client events, inferences from the algo, nor ad choices travel from the client to the ad networks. (But ad networks retain their crazy microtargetting which I guess is the selling point.)
Even if Brave were to choose the blocks of ads based on geolocation and other install-time/runtime data which they then sell to third parties, it's still significantly less data leaking from the client's browser compared to, say, a default Chrome install. But them storing/selling that would be a clear GDPR violation as well as going directly against all their explicit public claims so far.
What is your understanding of Brave's upcoming ad network that leads you to believe it requires a surreptitious GDPR violation?
[0] https://brave.com/wp-content/uploads/files_2019-9-2/sample_p...
BidRequest Data [0] and Request Time is already enough to fingerprint the user.
"Google prohibits multiple buyers from joining their match tables." part is not technical, it is contract based.
[0] Sample Data from Bid Request
ip: "F\303\006"
user_agent: "Mozilla/5.0 (Linux; Android 7.1.1; Pixel XL Build/NOF26V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36"
url: "http://www.myfitnesspal.com/food/calories/popeyes-buttermilk-biscuit-29980768"
cookie_version: 1
google_user_id: "CAESEIMlaNwMN-rtiDFzjwNIX6Y"
timezone_offset: -360
detected_content_label: 39
mobile { is_app: false 3: "android" 8: 1 12: "google" 13: "pixel xl" 14 { 1: 7 2: 1 3: 1 } 15: 412 16: 732 18: 70092 19: 3500 }
cookie_age_seconds: 12960000
geo_criteria_id: 9023221
device { device_type: HIGHEND_PHONE platform: "android" brand: "google" model: "pixel xl" os_version { major: 7 minor: 1 micro: 1 } carrier_id: 70092 screen_width: 412 screen_height: 732 screen_pixel_ratio_millis: 3500 }“there is no way for google to operate under the GDPR and provide targeted advertising” ?
i’m inclined to agree :/
Well there's absolutely a way: single-source JS and no CORS.
:/
It being technical impossible or infeasible does not give them license to not follow the law.
Either they comply with the law or they don't. I'm not a lawyer, but it certainly doesn't look like they're following the law here.
Couldn't each buyer get their own "auction ID" as well as their own "user ID"? Am I completely misunderstanding things?
Here's my understanding: Google runs real-time bidding ad auctions by sending anonymized profiles to marketers, who bid on those impressions. The anonymous id used in each auction was the same for each bidder, which is in violation of GDPR. If Google were to send different ids for each bidder, it would be ok? Is this correct?
Why would it matter that the bidders are able to match up the IDs with each other, aren't they all receiving the same profile anyway? Wouldn't privacy advocates consider the sending of the profiles at all an issue?
I would guess that yes, they're all receiving – _from Google_ – the "same profile" but they also are collecting additional info that they can then share with each other and, because they can match profiles exactly, they can access each other's info about specific people.
> Wouldn't privacy advocates consider the sending of the profiles at all an issue?
I'd imagine that the profile Google has and shares is by itself fairly anodyne, but I could be (very) wrong about that. The problem seems to be more (if not entirely) that different advertisers can share info using a common profile ID.
I'd imagine that even a single advertiser would be able to perform a similar 'attack' by, e.g. running multiple different campaigns, but I may be misunderstanding exactly what info is being shared. It's possible advertisers are able to match the Google profiles to specific unique identities and thus are sharing much more than just the info they're collecting directly from their ads.
If Google ceases to provide them the means of readily sharing info then all of those entities will no longer be violating the GDPR, in the scenario anyways.
There are companies that specialise in sharing user information. Some of them work by only sharing data with companies that first share data with them (an exchange).
If you got this Google ID, and you had a few other pieces of information about the user, you could share that data with an exchange, indicating that the Google ID is a unique identifier. Then, the exchange would check if it has a matching profile, add the information you provided to that profile, and then return all of the information they have for that profile to you.
So, let's say you're an online retailer, and you have Google IDs for your customers. You probably have some useful and sensitive customer information, like names, emails, addresses, and purchase histories. In order to better target your ads, you could participate in one of these exchanges, so that you can use the information you receive to suggest products that are as relevant as possible to each customer.
To participate, you send all this sensitive information, along with a Google ID, and receive similar information from other retailers, online services, video games, banks, credit card providers, insurers, mortgage brokers, service providers, and more! And now you know what sort of vehicles your customers drive, how much they make, whether they're married, how many kids they have, which websites they browse, etc. So useful! And not only do you get all these juicy private details, but you've also shared your customers sensitive purchase history with anyone else who is connected to the exchange.
Also, considering we largely do the same things every week and every day, I suspect a single day to give you at least 50% of a user's identifying data, and a week to give you at least 80%. That leaves a whole week of pretty accurate tracking.
I think you've made a pretty wild claim that 14 days isn't enough time to build a useful profile. Regardless, even if the usefulness of the data over two weeks is questionable, it's still illegal to share the data in this way. You wouldn't be too happy if someone broke into your house and "only" stole a single fork.
I wouldn't be surprised at all if 2-3 hours of active browsing was enough for this.
Some newer linux kernels (>2016) use random tcp timestamps offsets to prevent clock skew profiling.
That is a security feature, not the shit big tech is offering here.
But of course the mechanisms in question are suddenly implemented for fraud protection instead of user security. Yeah, bullshit.
> The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person
So PII that has been pseudonymized (mapped to a gid in this case) is protected in exactly the same way as if it had not been if the pseudonymized data could be mapped to a natural person by the use of additional data. The pseudonym (gid) is itself also considered PII under gdpr. [1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
I know of multiple systems that use a UID but throw away a user’s information, including the UID mapping, when the user leaves. This allows historic metrics to be retained without ever identifying a user who isn’t still using the system.
AFAICT, guids are a grey area.
Isn't that also a GDPR violation?
I get the impression that this structure would require an exchange: retailers would not trust each other otherwise.
Wouldn’t commercial pamphlets, interviews with salespeople, etc., from the exchange be obvious proof of illegal behaviour there? Google’s implementation is imperfect but, for the loophole to work, it would need coordination between several competitors and third party with a business model explicitly and almost exclusively about going around against GDPR.
If I can risk a comparison, that would be Google is like a chemical company selling fertilizer, and the exchange is selling bombs made from raw material bought by other people.
Am I missing the point? Shouldn’t this article be about those exchange and their clients, not Google?
The headline was enough to pique my curiosity to explore Brave's product offering. Unfortunately, actually reading the article had the exact opposite affect.
I didn't make it to the end, closed the tab and went over to HN comments for a summary.
The only thing Google did in regards to GPRR was limit the number of parties in RTB they're including by default for syncing to a "trusted set" of parties.
he diagrams in your link show a single hop for the 302, in my experience that can be many hops going between different advertisers. The same thing happens on non-google platforms, like TradeDesk and others.
The sync scenario can make it next to impossible to delete cookies when those cookies can be rebuilt using data from others.
I say this because I am in this position now. I have to figure out how to advertise my company's products and am torn on how to go about it.
However, it's all a whole lot more expensive and effortful than running some Google ads.
This is exactly how marketing worked before and how people can go about it now, as you describe, through traditional advertising markets.
I'd personally prefer it that way in general, but legislation is necessary for them to optimize on those restrictions.
The whole targeted advertising is to allow adtech companies to identify users of the "widget fans" site, and then advertise to the same people, but on another, cheaper site.
I'd love seeing this turned around though.
Imagine if you went back to say the 1920s, and you told a marketing director that you could install a one-way mirror room and back door into every household in the country, and staff them all with analysts who will secretly observe people in their homes 24 hours a day, 365 days a year. People would think you were crazy. In fact, I bet most people today would be completely against that idea, yet wouldn't realize that what companies like Google and Amazon are doing today is effectively the same thing, except _much more_ invasive.
It's definitely possible, but you're just doing everything manually that ad networks do for you. Whether that is worth your time (or worth it to hire someone to do this kind of thing for you...) is up to you.
You can still target adverts at content on a site, and have an aggregate system to make that easy and granular.
There could even be services which collected lists of websites and categorised them, and the rough demographics of their audience, and retailed slots.
Individual tracking is unnecessary financially, you can make as much revenue without. See example of the New York Time dropping tacking for EU readers for GDPR reasons, and continuing to grow ad revenue: https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut...
It's definitely possible for small websites to do ads directly, but it's a lot of work. Often more than is justified for a few thousand dollars a year in ads.
You've just explained how contexual ads used to work, which doesn't need all the invasive surveillance modern internet users have to put up with.
Personally I think the solution that lets us keep ad supported content and easy ad placement would be for Google to force companies to provide bots they could run internally so the profiles never leave Google's datacenters and strictly monitor the output so the buyer bots don't leak information back to the companies. I think that would do a lot to alleviate the privacy concerns and breaches and is honestly how I though ads were being sold for the longest time instead of profiles being sent to companies buying placement.
I'm not disputing the necessity of a central broker. Contexual ads based on search keywords or website content used to work fine without surveillance, and can perfectly be automated by a central broker.
Years ago, I didn't have much issue with online ads (with the exception of popups and spam emails). Nowadays, I'm forced to block them altogether to avoid the extensive surveillance by adtech. It doesn't have to be this way if adtech respected user privacy.
Honestly, that wouldn't do much to alleviate my privacy concerns, as it does nothing to protect my privacy from the likes of Google (or other ad-slingers).
Trade "print" media with an online presence. Online media that doesn't sell all their pixels to Google? Radio, depending on your audience and required reach? Forums specific to your audience that don't sell all their pixels to Google. Podcasts. Submarine articles in the trades? Open source ad networks that don't embed insanity or real-time bidding?
Mostly, I would try to target your initial audience as precisely as possible where they live, rather than with a wide net. Perhaps a Google search returns results for top websites dealing with your product - if they are not vendors, then perhaps you advertise on that site?
Disclaimer: I'm not a growth hacker, but I've thought about these things and run a couple of poor Facebook campaigns for a brick and mortar business.
I've personally never heard of a success story for what you describe that involves paying google. But maybe they exist and they're just keeping it quiet?
I've never needed to turn to Google or other ad-slingers. Instead, I've done things the old-fashioned way, by going to where my potential customers tend to congregate and engaging with them (this kickstarts word-of-mouth, which is still the best advertising you can get), hosting my own online forums for customers, going to trade shows as appropriate, and supplementing everything with a few direct-placement ads in carefully selected media.
Yes, it's more work -- what Google et. al. are actually selling you is convenience, after all. But the rewards in terms of of ROI as well as fostering a real community, complete with evangelists, are more than worth it to me.
Of course, ymmv.
> The evidence further reveals that Google allowed [...]
> Google has no control over what happens to these data once broadcast [...]
Is it possible that Google does have "control" over the data after broadcast, albeit legal control via contracts with advertisers (as opposed to technical control)?
Perhaps Google's GDPR compliance strategy relies on the participating advertisers to comply with their contract with Google. If that assumption is accurate, perhaps Google's advertisers are in breach of their contract with Google which makes it appear as though Google itself is in breach?
I could be off-base, the details in the article aren't incredibly clear to me.
(For the record, I don't like Google's business model and I don't like Google's pervasive tracking -- I'm playing devil's advocate to better understand the issue)
Now there's a claim only a court would buy!
A court probably would buy it, though.
Sigh.
I'm relatively sure that there's another part: it's data processing for the client (here: Google) and the data cannot be used for other purposes. In this case, they don't process data for Google, they process it in cooperation with Google for the ad-buyers. Google also doesn't name them as data processors (which it would have to if that were their relationship).
If some contract was all it took, what would stop hospitals from selling patient info to insurance companies, saying "hey, they are processing the data, and we have a business agreement, this is all fine".
1.) it might be stricter than you say.
2.) you (possibly like me? ;-) seems to have stronger views on what GDPR means than you can argue for.
Pretty much all examples for data processing I've read are similar in this regard: the data controller (DC) passes data to the data processor (DP) so the DP can perform a specific task for them (handle invoicing, do analytics, run a web server, mail packages etc). The DP must not use the data for anything else, must not share the data with anyone (except for sub-processing, which has strict rules, too). "Exchanging/Syncing PII of users so we can create better profiles, more efficiently track them and show ads to them that are more personalized" doesn't fit the bill at all from what I understand. Similarly, landlords cannot get together and share all the data on their tenants to figure out who was a pleasant renter and who sued because the heater broke in winter.
So, in my understanding, even if you and I used the same invoicing provider, they wouldn't be allowed to tell me if they've invoiced a certain person for you previously, because we're different entities using them as a data processor and our data is to be kept separate. If we wanted to do data sharing (or even share aggregate probabilities like credit check agencies), we'd need a different construct, explicit consent and a bunch of additional compliance requirements.
This is why nothing will be done about this. Sure, we might see a few smaller businesses fined, but the vast majority of sites using Google for ads will simply slip under the radar, while Google simply puts the blame on the site owners.
The GDPR has separate rules that effectively deal with whether you are the business with which the customer works or one of their contractors. I could imagine a world where google is the second party and needs a secure feature like this so the first party can perform (consented) tracking across multiple domains they own. This is just a devils advocate argument since I can’t guess intent.
Aka - you land on a site, it send your IP and whatever identifiers it has to 10,000+ companies who all then figure out if they want to bid on showing you an ad.
It is IMO just a mockery of the intent of the law and I wonder when this will be punished.
I personally think GDPR might be a bit strict, but adtech have practically been begging for this for years so acting surprised now doesn't cut it.
So I assume that eventually these performances of consent-gathering will be legally judged meaningless.
As I understand it, you're correct. The Data Controller (Google) is responsible for getting consent, and the Data Processors (the third parties in this case) don't have to get consent themselves.
However, assuming Google's legal basis for processing your personal data is based on consent (rather than fulfillment of a contract or one of the other legal bases), then Google is required to get your unambiguous, opt-in, and non-coerced consent for each specific way your personal data will be used.
It seems likely that Google is covering themselves by acting as a Data Processor, not Data Controller, and the web site using Google is the actual Data Controller. In that case, the web site, not Google, is the one responsible for getting consent.
That distinction is important. I’m happy that privacy advocates are realising that platforms having access to enforceable contracts is key–too many are quick to paint platforms as the source of the problem and not an agent who, with the right tools, could organise a market.
Facebook has suggested having an independent court what is acceptable content in their platform. Google could think about delegating the control of how its IDs are used to an independent entity with the power to audit its partners’ data practice properly.
I don't actually put much faith in such "control".
Is it enough that a RTB ID is pseudo-anonymous? (it always identifies the same person, but cannot be used to find that person's real information) - OR - is a RTB ID not even pseudo-anonymous?
A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII.
the ID would be pseudo-anonymous if one would need some extra data, to which they don't have access to, for linking the ID to one specific user in the whole dataset[2].
So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them.
[1] It's also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. https://www.lexico.com/en/definition/identifiable
[2] Definition of pseudonymisation, 5'th bullet-point: https://gdpr-info.eu/art-4-gdpr/ sheds some light on this.
(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
Until there is some sort of agreement among the relevant jurisdictions to greatly reduce the pain of this, direct micro-transactions with your site's visitors are likely to be a bureaucratic nightmare.
In the same vein, there may be engineers that enjoy working on this type of problem - how to identify someone that is actively avoiding you. The current iteration of Do Not Track mentality only makes the problem more interesting by putting up restrictions.
If they could, they would've already done so.
One of the things "the cleverest engineers to walk the planet" would probably need to do is to increase consumers willingness to pay for good content by a factor of ~10 for e.g. online newspapers with quality journalism to be profitable, which frankly sounds near-impossible.
Technical issues are mostly used as an excuse.
After more than two decades newspapers still haven't figured out that even though I want to pay for good journalism I cannot subscribe to every newspaper there is, and I am a user who actively wants to pay.
I already voluntarily pay for two newspapers and involuntarily pay for the national news-and-a-little-propaganda service. Oh, and I donate to the Guardian half the time I visit them.
If more papers allowed me to pay per view I would likely spend more money on journalism.
But I'm not going to have another subscription right now, thanks.
New ways of building things is the province of engineering.
New ways of making money is the province of MBAs.
Not that really matters; I doubt you will succeed in replacing ads with something "better".
See their release note (15 April 2013); https://developers.google.com/authorized-buyers/rtb/relnotes
“Starting in mid-April, we will begin assigning a URL-safe string value to the google_push parameter in our pixel match requests and we will expect that same URL-safe string to be returned in the google_push parameter you set. This change will help us with our latency troubleshooting efforts and improve our pixel match efficiency.”
====
Page View #1:
- Acorp: google_gid=qwerty, google_push=foo
- Bcorp: google_gid=asdfgh, google_push=foo
- Ccorp: google_gid=zxcvbn, google_push=foo
By exchanging their `google_gid` values corresponding to the page load with shared `google_push` value foo, Acorp, Bcorp, and Ccorp can identify you as user qwerty-asdfgh-zxcvbn.
====
Page View #2:
- Acorp: google_gid=qwerty, google_push=bar
- Bcorp: google_gid=asdfgh, google_push=bar
- Ccorp: google_gid=zxcvbn, google_push=bar
By exchanging their `google_gid` values corresponding to the page load with shared `google_push` value bar, Acorp, Bcorp, and Ccorp can still identify you as user qwerty-asdfgh-zxcvbn, even though the `google_push` value has changed.
Having worked in adtech, I can tell you the adtech providers probably don’t do that, for those reasons: 1) those adtech providers are usually competitors 2) if they work together, they can already sync their user ids directly together (so using google id is not necessary).
So I don’t think Google intentions were malign here on this particular point (contrary to Brave communication and all the press coverage). But yes, Google shouldn’t add entropy by sending the same “page view id” to different adtech providers. Note that Google is “better” than the others here: every other adtech providers send the same user id to each partner (persistant identifier, not session or page view like google). And those providers are sometimes quite big: for example, AppNexus or Criteo trackers are also everywhere on the web. Overall, it’s the RTB system with all those cookie syncs that shouldn’t exist, and except for the “google_push” argument, Brave study is quite good (they are just explaining how the adtech world works).
> Google claims to prevent the many companies ... from combining their profiles about those visitors
> Brave’s new evidence reveals that Google allowed not only one additional party, but many, to match with Google identifiers. The evidence further reveals that Google allowed multiple parties to match their identifiers for the data subject with each other.
BTW, many comments in here seem quick to agree w/this headline given how buried the details are. If someone has better detail, please share it.
Essentially, Google assigns an anonymized identifier to a user and sends that to prospective ad buyers. The idea is that the ad buyer can use this to target ads to people who have visited their site as they browse other areas of the internet participating in Google's auction. This is called remarketing.
An example. You go to footlocker.com and put a pair of sneakers in your shopping cart but decide not to buy. When you go read an article on the New York Times site, a potential advertiser recognizes your anonymized id and bids to serve you an ad for the sneakers.
The issue Brave is raising is that the same anonymized id is served to each potential ad buyer. This isn't an issue with data Google collects or exposes, but Brave states that buyers could theoretically collude to build profiles by sharing the data collected on their own sites with each other joining by Google's identifier. There is no evidence of this actually happening and Google's contract with ad buyers specifically prohibits this activity.
If it's anonymized then how could they send targeted ads to you? I think you're using a slightly different version of the word anonymous.
How I use the word anonymous it means, roughly speaking, that it can't be traced back to you. Or in this context, google wouldn't be selling anonymized data to third parties who in turn could contact you.
If they were selling data like X persons like product Y more then Z, there would be less of an uproar about this.
Also there was an interesting story a while back about a clash between advertising and the Fuchsia engineering team https://9to5google.com/2018/07/20/fuchsia-friday-respecting-...
There is de-Googled Chromium OS project, but Brave takes a few steps sideways by making further changes such as proxying location services, safe browsing API, etc. I doubt a 12 y/o could compile it though, let alone in 2 hours.
This sort of resolution was inevitable.
I said it before and I'll say it again: GDPR is an annoying measure for developers, small businesses and startups. It doesn't do much other than put in place so many steps that growth tools for startups become risky to use. For big businesses that (ab)use big data, it's not much of a hassle because they can afford the legal steps as well as the change in infrastructure. They can even work around it and keep abusing data without consequences.
If they're able to beat Google's lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that'll be more than covered by their daily revs.
57MM$ is nothing to Google. They've escaped even antitrust cases with minimal injury, it would be a truly shocking event if the EU actually managed to touch them.
"The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher."
For Google that would be 4% of its worldwide annual revenue, I'd assume. Taking into account that it's not one infringement but multiple that could mean a pretty hefty fine.
In it's current form, yes. However, I'm not so sure that everybody here would agree that "the web today" is fundamentally better than the web ten years ago, technological advances aside. Everybody smelling gold and starting a blog to mindlessly shill for products in hopes of getting a commission, super low quality texts written/generated/spinned entirely for SEO reasons to place ads between the paragraphs etc doesn't come to mind when I ask myself "what could be better on the web?" If those things disappear tomorrow, I don't think a lot of us would miss them. We'd notice them being gone because it might feel like being able to breath freely after a strong cold, but I don't think many would miss them.
> But it will take a while until we start paying for news again, for example.
Plenty of people pay for news. They won't pay for Gawker or Buzzfeed though. I don't think that's a problem for anybody not invested in or working for those companies.
I paid $2K for my first GDPR consulting session for a $7K MRR app and was quoted ~$25K for consulting while I would personally implement what needed to be done. $25K is nothing for a large company, but it's prohibitively expensive for a lot of small companies. This cost also doesn't include the (probably hundreds of) man hours required to implement and certify GDPR compliance, which are also disproportionately valued when it's being done by 1 person in a <5 person company versus N people in a >5K person company.
Hopefully these costs will fall as more people become lawfully knowledgable about what GDPR entails and the market of people available to help grows. Unfortunately there's no "feel free to wait if you can't afford it yet" clause in GDPR.
The whole penalty system is quite silly. The fines destroy small companies who are the ones struggling to comply, and do little more than offer extremely gentle pokes on the wrist for megacorps that have relatively unlimited resources available for complete compliance, if they actually wanted to comply.
That's why, IMO, GDPR sucks for small businesses that can be outed to the ICO for a minor oversight and not so much for big data abusers that can take on GDPR and come out unscathed.
A quick search indicates "Up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher" https://www.gdpreu.org/compliance/fines-and-penalties/
Google has come out of antitrust cases relatively unscathed. They've even violated GDPR itself once before explicitly, and got out with a 57MM$ fine. This case won't be any different than all the other times that Google has blatantly violated laws and walked away with a slap on the wrist.
I would be very very very shocked if the EU actually managed to touch Google. I welcome and hope to be proved wrong.
If the law literally doesn't work because of reasons, then that's just systemic corruption.
It's a lot of regulations that can be worked around and the fines are hard to and rarely enforced. There are a bunch of poster children of GDPR fines that make it seem like it's doing a lot but the principal abusers (i.e. Google) just walk away with a light slap.
It needs the ability to be enforced, and I think this much should be obvious to lawmakers -- a law that can't be enforced well is useless.
That's why I'm calling it privacy theater. It's the EU saying "look what we did!" but in practice it doesn't really do much without enforcement that still does not exist both at a national and global scale.
I'm very happy that the GDPR exist, if only because it forced all these websites from explicitly giving me a list of the literally hundreds of partners they want to share my data with, along with a way to say "hell no". Of course Google and friends will try to work around it but hopefully that won't come to pass and they'll have to actually bother changing their crappy business model. I think the spirit of the law is fairly clear, I wonder why Google thinks this scheme can work. Maybe they're just trying to buy some time.
As for startups that sink because they can't be bothered to sanely handle my personal data: good riddance.
- It doesn't explicitly force them to do that. And most sites aren't explicitly sharing the data either; i.e. almost every site uses Google analytics which doesn't really comply with do not track all too well, and Google will then share their data with everybody else (which is part of their violations in this article). Also saying "no" doesn't do much either as most of these big sites either already stored the cookie or won't do much to delete it. And it's not that they'll try to work around it, they either don't put forth the effort because GDPR is like a pebble for them, or they already worked around it in a way that changes nothing. Their business model is still the exact same.
I think the spirit of this law is fine, but the actual law does nothing and is just privacy theater. Google isn't buying time, almost 4 years later nothing has changed -- they just know they can't be touched.
- They're not going to sink, they'll just grow much slower and thus won't be an alternative to the big data abusers you hate so much. And they're not failing to handle your data, most of the time startups aren't selling you out they're just trying to figure out who their customer is internally. To do this they collect some data that is usually optional and very much with your consent; GDPR just puts a bunch of hoops in front of this so that it's an enormous pain to do so. I run a startup that collects basically no data (literally, we do not have a database for 2 of our products). It was a pain for us to become GDPR compliant because that disables our metrics entirely and requires a bunch of banners and checkboxes everywhere even though we literally store nothing.
I'm all for the spirit of the law. I just think the execution sucks and they definitely didn't think it through enough. I think the evidence for this is clear based on the sheer number of privacy violations we've had since GDPR was enacted alone, and how little enforcement and regulation has actually gone on.
How do you know? The fact that there's still crime doesn't mean that law enforcement doesn't do anything. Somebody reports an alleged violation, an investigation is started, and maybe the investigation will produce that Google is in violation (in which case a fine will "regulate" Google's behavior) or they are not (in which case it may be fair to criticize GDPR for allowing that behavior, or it may not be because the info wasn't correct).
> almost every site uses Google analytics which doesn't really comply with do not track all too well, and Google will then share their data with everybody else
Unless you have specific info, I believe you're mistaken here. GA is generally seen to be compliant if anonymizeIp is active and you're not pushing PII into it via customization. Google is, if I understand it correctly, not "sharing" GA raw data with anyone, but analyzing the data for their own research and providing the website owners with aggregate data (i.e. demographic information) without sharing data on individuals. I'm not a fan of GA, but I haven't seen any info that they're that obviously in violation.
> It was a pain for us to become GDPR compliant because that disables our metrics entirely and requires a bunch of banners and checkboxes everywhere even though we literally store nothing.
What was the specific pain? I get that having to add a privacy info sucks (and might cost money if you get a customized version), but I never found it to be that big a deal. If you don't store any PII, it's pretty straight forward, and so will the procedures be if anybody asks about the data you stored: just inform them that your systems do not store any data in general and also didn't store any data on them in particular.
We're not four years into the GDPR becoming enforceable (it was just last year), and certainly not enough time to see real action for complex cases - regulators and courts move slowly.
Startups barely ever asked for consent, and collect way more data than you imply - including, as you mention, by using Google Analytics.
The GDPR requires zero banners and checkboxes if you are not processing data.
Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be.
> The maximum fine under the GDPR is up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements.
From here: https://www.itgovernance.co.uk/dpa-and-gdpr-penalties
A straight 4% would be absolutely bigger, but relatively the same (once beyond $500M).
Otherwise, you get into accounting chicanery (or outright loss-making companies being able to operate with impunity while they grow).
There's nothing stopping the enforcement action to take into account the underlying profitability if something like a grocery store were to run afoul of GDPR.
My problem is with fines that they don't really force the PEOPLE in the businesses to play fair.
What about required & [RESPONSIBLE] roles and jail?
I am asking that in general because I am fed up with our business-entities made world where committing a crime is basically RECOMMENDED if the numbers and percentages say so.
GDPR penalties are a flat fee or a percentage of revenue, whichever is higher.
If Google is truly willfully violating the GDPR, the maximum penalty by law could be up to 4% of their global turnover. I would not call that pocket change. But more importantly, it is a relative increase in fine based on the law breaking company.
(Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!)
4% the first time might be something you can shrug off, especially for a company the size of Google. But if you continue breaking the law and give the regulators an easy second or third bite at the apple...
I’d expect Google makes no changes and fights the regulators the first few times.
E: I used to have a comment here about Google continuing their current practices against non-EU people but it appears from my reading of the GDPR that may not be so simple
The EU already fined Google a total of $9 billion over the last two years.
If GDPR wants to be effective they need a ridiculous company-breaking fine for big abusers like COPPA and the like. Something like a per-user fine for violations that means they either can't do business in the EU or they have to become compliant otherwise risk being basically destroyed (for reference, violating child protection laws in the US can break and have broken companies before).
EDIT: also as for the tracking growth comment -- I agree on this, but the effects of GDPR on growth tools reach far beyond this. Even basic metrics are hard to get without a bunch of hoops. Even if you store no data you have to have a bunch of checkboxes and banners everywhere. Just for using Google Analytics that just relies on what they know about your computer (fingerprinting), and uses no PII at all, you need a banner and privacy policy. The laws are making it hard to use even basic analytics without fearing a misstep.
Although I feel that Google has won its position in search, etc by offering a legitimately better product, we need to punish companies that continue to break the law. Success does not put you above the law. If you use your massive profits to absorb fines for breaking the law repeatedly, you should lose your ability to operate as a corporation and be dissolved. We need to reform antitrust laws. It's not just being able to control an entire market anymore, it's about being able to ignore international law because you have so much money.
IMO, punishing data abusers can't be solved with data privacy laws. It's a regulation with very little ability to be enforced.
In the first place to abuse data you need a lot of it, so really we're looking mostly at big companies with big pockets. The easiest way to attack here is to punish unfair markets and to have stronger antitrust laws.
Let's look at the textbook case for privacy with Facebook. Facebook would be the prime candidate for antitrust no matter how you look at it: there are basically no competitors to it in the US social media market. They own everything except Snapchat, which is dying off and failing to turn a profit. Facebook accounts for so much presence in the US that they have login buttons you can integrate on different sites (Google does too because of how crazy cemented they are). Yet somehow besides being so obviously monopolistic and out of control they're hit with no antitrust. Bell was split up for doing much less.
Antitrust is just a joke right now. We have to get better enforcement first before looking to create regulations to be enforced.
Let's hope Lina Khan and the seeming bipartisan consensus that Big Tech needs taming are the beginning of an antitrust renaissance.
This is why the 4% of global annual revenue fine option exists. A few of those add up quick.
We've stopped cookie matching in EU28 countries so I can't verify if they do pass the buyer_uid.
If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me.
Also, if a malicious actor targets an ad to a group of people, and some of these people buy the advertised items, then the actor can infer things about those people not necessarily related to the items sold.
They're not choosing to have targeted ads that share their info around the web and cause someone over their shoulder to infer things about them.
That's the point -- we should have that choice. And the default should be "no".
Ideally you would have site-specific or content-specific ads normally and personalized ads if you created an account and chose to opt-in.
Seemed like a major HIPAA violation to me.
Maybe not, but GDPR sure is.
How you're using it, it sounds like Bob or Charlie in your mind is a person. I might be wrong in interpreting it that way. If so could you give another example where Bob and Charlie are companies and the information of Alice is part of a transaction.
>If Alice tells her coworker Bob that she had diabetes, it's not a HIPAA violation for Bob to tell Charlie.
I was responding to the parent comment's claim that it's not a HIPAA violation but rather a GDPR violation.
You have to take some personal responsibility, though. If they saw your Youtube recommendations or your Spotify playlist, they'd probably make inferences as well. That porn link in your history you forgot to clear? Be aware of who's watching and browse anonymously if you're concerned.
Easy to prove, store a log of all your network traffic, and record all the audio you speak, then when you see a match, go back, find the proof, become world famous
"What if we capture the flashes and steal the password?"
Well, if you're positioned to capture the flashes, you're definitely positioned to just watch me type it in...
I assume most users would not. But they would be ok with their bank balance being shown if they specifically opened their bank website.
It's not hard to imagine a person's career being affected by something like that.
Because what Google are doing is not dissimilar to how any other RTB participant is acting, saying this is a Google workaround seems disingenuous.
Unfortunately I fear this will only embolden Google to further monopolize digital advertising.
I mean, if the allegations are correct, Google didn't find any loophole, they're just hiding the fact that they're selling person identifiers.
Edit: Why downvote? Do you really think that the US government will stay silent if the European Union threatens with such fines? Political tensions are something you take heavily into account.
I bet that hurts Google 10 times more.
I'm _really_ tempted to write that they could use the fine to finance the information campaign, but I know that government finances doesn't work that way.
I can't help but consider one current "information campaign" in the UK. In response to skyrocketing violent crime they've chose to put anti-stabbing/knife messaging on fried chicken boxes, Literally [1]. Knife amnesty bins and fried chicken anti-knife messaging. That's a government "information campaign" through and through.
[1] - https://www.cbsnews.com/news/u-k-government-tries-to-fight-k...
Exactly how would Google fight back? Kill Android? Close down YouTube??
Consider the two topics above, combined. The global media has nearly universally tried to condemn Brexit. And while media clearly doesn't have as large as an effect as some would like to imagine (Facebook was seeing an exodus of young users before any media outrage - it's become the social media site for your mom), it equally clearly does have at least some effect. And so imagine Google simply swapped their bias. And was suddenly now disproportionately promoting messaging come propaganda against the EU, in favor of Brexit, promoting things such as the yellow vests in France, the various leave campaigns gaining momentum in other nations, etc.
When topics, even with the media disproportionately on one side, are so close - if that media that people were presented suddenly started lobbying for the other side, that would have a massive effect. I don't think it's hyperbolic to suggest that companies such as Google and Facebook could effectively cause the EU to collapse if they so desired. It's already on somewhat shaky ground with near universal media support. If they don't play ball with the companies that direct that media, that ground very much stands to give way.
That doesn't mean the governments are completely obsequious to the corporations, yet, but it does mean that the corporations are also in no way obsequious to the governments. And I think this interbalanced relationship is one major reason that we see increasingly see governments reluctant to do anything that could meaningfully negatively affect mega corporations or other very powerful players. It's also why I see us gradually headed towards more overt corporatism. Corporations grow exponentially more powerful by the decade, and this shows no signs of abating.
Nah. Too big to bother.
Also the 4% global revenue fine wasn't exercised yet because it's the maximum fine, and there needs to be room for escalation: hard to serve a bigger punch if you're already at the maximum.
> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.
I think you're right in that "site content" is a good-enough proxy for users/viewers/targets for advertising, tho I also readily understand why advertisers would always like more info with which to target their ads.
Your answer is that we should match something other than the user, that happens to correlate with user interests. That is, by definition, not matching ads to viewers.
Viewers get ads matching their interests, as proven by the fact that they are on a related website. I don't see how that isn't "matching ads to viewers"?
In fact Contextual Targeting predates the current approaches, but it became less important once advertises/adtech companies started preaching the thinly veiled idea of using behaviourism to trigger conversions/less products.
Changes like this are slow to introduce due to technical and (mainly) structural/cultural issues in the Advertising Industry, but that’s a topic for an entire essay/series of blog posts.
Source: I work in AdTech and deal with privacy/the ethical impact of programmatic, content monetisation models. Opinions obv. mine.
How about conversions, sweet $$?
I think replacing audiences with a semantic targeting model (nlp) could perform almost as good (if not better). Behavioural Targeting performance is overrated (feel free to look it up, esp. CPM vs. conversions, it’s quite interesting, I’m on holiday and shouldn’t be sitting on HN anyway!).
Another, deeper point-how much advertising do we (or brands) really need? Do alternatives exist, are they expensive/hard? What problem does advertising solve? I know this sounds like a silly question, but I think it’s worth asking given the current technical landscape and the ethical impact.
On the PG/PMP side, the usage is obvious, but I'm also curious what it will take for publisher-provided data to be trusted in the open exchange environment where historically advertisers and DSPs have tended to not trust the publisher-supplied categorization.
I think of it like the UID I get on a UNIX machine: it identifies me, and anyone with /etc/passed can get my name, and things that don’t have access to it can still see “oh uid 1099 is logging in again to play nethack”.
I realise I am in a minority, but I have never clicked on a digital ad and went through to buy something, and I never will.
The minute I see ads on a webpage, I automatically associate that site with trash. (Please take note HN :))
It is as if humanity cannot be trusted with technology. This creates a certain "ceiling" for us in terms of development as a species. Such a shame.
You might want to reconsider
It's the same thing as a full-page advert in a magazine that you flip through. For some readers, they will stop an read it, raising awareness to that brand/product/company etc.
A company spamming my eyeballs with visual ads to "raise awareness" does not get my money. I take particular offence to that, as it is my screen. Not a Billboard for example.
My point is proven in the HN website, where it enjoys a large readership, largely influenced by the sites clean, ad-free design.
Slashdot used to be like that until they started displaying ads, and that is what brought me to HN. Thank you HN for not doing this.
At first glance, I would have thought this isn't a workaround at all. GDPR allows for pseudonymisation as a method of data protection. But, Recital 26 of the GDPR disallows this:
> The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. [...]
That said, I don't think this is cut and dried, because Google themselves isn't providing the linkage to an identifiable natural person. The person that can make that linkage necessarily already has the identifying information. Get ready for a major legal battle.
>"The primary targets of this campaign are Google and the IAB, which control the RTB system."
Can someone say who makes up the IAB exactly? Is this just an industry trade group?
It's a mix of the major players in the digital advertising industry. Historically the IAB has taken actions that are good for the industry overall. It focuses on standardization/interoperability in the ad-tech space. It generally isn't a watchdog and doesn't regulate the industry except when the industry as a whole would benefit (e.g. self-regulatory programs that have no real effect but stave off state regulation).
You can fight back by providing fake and bogus data. For example, there are browser extensions that do this for you.
I think there are some folks at Google who have just read too deep into both 1984 and The Google Book to go on to think that privacy violations like this is a normal thing. But what do I know? I'm just another 'privacy lunatic' on the net that wears a metal helmet (tinfoil hats are just not good enough) trying to protect my privacy.
Enabled by default can and should be the default for security-related features.
I tend to agree about the rest of the creepiness, especially anything personally behavioral.
Sound decision making requires metrics. If you opt-out of metrics, you don't get to participate in decisions.
Not use data from a mechanism that's controversial with some of the user base to drive decisions? Reach out and ask people, instead of asking their machines?
> Sound decision making requires metrics. If you opt-out of metrics, you don't get to participate in decisions.
Sound decision making requires some kind of metrics and also sound reasoning. It doesn't mean that metrics have to be widely-deployed telemetry. There are alternatives, like doing studies "the old way". Moreover, it can be argued that a lot of problems on today's Internet stem from people vacuuming up whatever data they can find and divining decisions out of it. It's not how you do science.
That would require more time and money that could be spent elsewhere.
So you would have statistics biased by not accounting for people not bothered to answering these questions instead of not accounting for people not using popcon?
Would you agree to a Democracy where the government put sensors in your house, then told you which candidate your vote would be counted towards from your behaviour?
And if you opted out of that, you don't get to participate at all?
"If you deal with people with strict security/privacy requirement, you are correct to do so. I would do the same."
How do you figure?
Not since Google uses the argument of increased security to justify data collection for quite some time in the interest of itself.
If you're in the minority, you should expect to have to do more work to get the right balance of security and privacy.
> If you're in the minority, you should expect to have to do more work to get the right balance of security and privacy.
It is exactly this false dichotomy that I am criticizing here, because it is completely baseless.
You are reading an article that hints to privacy violations.
You can only be secure if your privacy is protected. That is the causal relation between these two needs.
This isn't a veneer. It's a signature check to ensure a package is what it says it is. Have you seen the hassle npm routinely goes through because of this? A centralized, trusted server is a sensible "default" setting. The fact that they offer a self-hosted solution is a great benefit.
> You can only be secure if your privacy is protected. That is the causal relation between these two needs.
Nonsense. I can have a completely secure system and everyone knows who I am. I can have an entire insecure system with zero means of identifying the owner and thus, remain private.
You aren't just conflating privacy and security, you are implying a casual relationship between them. Both are nonsense.
If you want to know which Go modules I use, go check out my github. They're listed right there in import statements. If I'm hacking on a project that I want to keep private, I'll disable this feature with a command line flag - easy.
My issue with the paranoid folks in that thread is not that they made no sense (they can't help that), it was they were attacking the person who implemented the feature viciously. He had implemented a feature that a majority of Go developers had been requesting for 5+ years, had done it in a way that improved clean build time, improved security and could easily be disabled or replaced with a private DB. Literally what else could that man have done?
Even though all his work could be verified trivially (Go is open source!), they still chose to attack him.
He could have not sent all build-time network accesses to Google by default. It's that simple.
Why are you so upset that other people will be using a feature you obviously won't? Why are you upset when this leaks literally no info that your github repo doesn't already?
I bet the DB is small enough that you could default to just downloading it and syncing on your machine.
Care to maybe check real quick before making bets?
This makes sense right? Cargo, the rust package manager, does replicate the entire package index using git and it is ~250 MiB (~150MiB in .git/) (The cargo index stores much more metadata in a more verbose JSON format). It seems like a very reasonable bet considering prior art.
That's a conservative estimate, and if you try to sync only what's needed you're no better off then not-syncing.
If you try syncing the whole thing incrementally (rsync style) all you leak is the frequency of your updates
I get that Google changed the way go packages work, but I don't understand the difference between that and literally every package manager in existence.
Try being a little less rude to the other folks on this thread.
Only the Paranoid Survive. A book by The President and CEO of Intel.
The main difference between the two is just which paranoid thoughts you give credence to.
"Come on that's just paranoia"
Snowden leaks secret program that implements everything details in the patriot act.
"WHO COULD HAVE SUSPECTED?"
EU was warning about Echelon since before 9/11. The Patriot act detailed everything Snowden "revealed" (we basically only learned the actual names of the programs).
There was genuine shock in Europe that Chirac, Sarkozy, Hollande, Merkel were all spied on by NSA. Yes, we were naive conspiracy theorists when we were saying "you know, they gave them the right to do it, so they are probably doing it". But it all fell on dead ears.
The USA (and all major powers) has spied on foreign diplomats and leaders since its inception. This should come as a surprise to nobody. You had earlier claimed that the NSA was spying on everybody, which clearly isn't happening.
[1] https://www.theguardian.com/world/interactive/2013/jun/06/ve...
I can't believe we are having this conversation on this board, that is supposed to be populated by people who have read that kind of news a bit in depth...
If the data can only be queried with identifiers of people with a reasonable suspicion of terrorist links, that hardly seems like "spying on everybody." Subsequent oversight board reports showed that automatic querying of the data with identifiers not associated with people reasonably suspected of terrorist links was deemed illegal and shut down prior to Snowden's leaks. If they could spy on everybody, there would be no reason to shut down that program. https://www.lawfareblog.com/latest-nsa-documents-iii-governm...
> I can't believe we are having this conversation on this board, that is supposed to be populated by people who have read that kind of news a bit in depth...
And I can't believe you didn't know that countries spied on foreign leaders before the Patriot Act, yet here we are. http://www.telegraph.co.uk/news/2017/06/22/germany-accused-h...
You are assuming you were branded by a large swath while similarly branding an entire company that is clearly represented by many diverse opinions on diverse products. The debate needs more nuance lest everyone pulls out their broad brushes while also taking offense to receiving a fleck of paint. Conflating the Go proxy w/ Google's ad business is a perfect way to ignore nuance in the debate downplaying the real, tangible effects.
What are the privacy issues in Android 10? Anything new compared to previous versions?
Other than that, it seems that privacy controls have been generally improved in Android 10.
It's called a pre shared key for a reason.
https://sum.golang.org/privacy
This links to the Google Privacy Policy which is an additional 27 pages.
"I think there are some folks at Google who have just read too deep into both 1984 and The Google Book..."
Is this The Google Book?
https://cryptome.org/2012/07/gent-forum-spies.htm
It's just as valid a technique for large organizations as it is for governments.
Active Perception Management is most definitely a thing. Of course it only works because most people aren't aware it is a thing.
You were doing baseless accusation on something you don't know anything about. Your comment was basically "they market it as being better to handle privacy thus they clearly are worst with your privacy!".
You didn't raise anything substantial at all in that comment.
McDonalds already had complaints (and some lawsuits) over the (significantly higher than industry standard) temperature of their coffee, so this wasn't exactly out of the blue.
She ended up with 3rd degree burns on her legs and crotch. She asked only for her medical bills to be paid. McDonald's refused, so she eventually took them to court. Even then, she only asked for medical bills (and now legal expenses).
The jury decided that McDonalds was not only liable for those costs, but had treated the woman so poorly that they should pay punitive damages. The massive amount you heard about in the news was based on the amount of money McDonalds makes selling coffee in one day.
But that's not the story that was spread by the shills...
In popular circles, the story is framed in a way that does make the lawsuit look frivolous. But this is also a case that has made it into the legal textbooks as an example of corporate negligence that's clear-cut enough to use for demonstrating the concept in introductory textbooks.
Of course, in the legal textbooks, the version of the story that's told includes a lot of details that, as you point out, get excluded from the popular version.
The Internet extreme position machine. Everything has to be clear cut.
How McDonalds no longer engages in "corporate negligence": they put pronounced warnings on the cup that it's a dangerously hot substance. That's it. They did not lower the temperature (as is frequently claimed, nor is the temperature at all outside of normal industry standards, yet this is being repeatedly stated throughout this thread -- coffee, brewing with boiling water, is hot). You can get a searingly hot cup of coffee from most quick-serve restaurants today depending upon how freshly it was brewed. This is a case where the solution is more warnings on things.
This case was, however, an example of bad brand management, and perhaps throwing good money after bad for something they could have privately settled early on.
This is certainly not a hill I want to die on, and generally arguing against the prevalent opinion (which is overwhelming the one that you and the GP have expressed, albeit almost always positioning it like it's contrarian) is self-defeating, however this whole case is fascinating in how public perception shifts.
Typical coffee serving temperature is 155-175F. I'm considered unusual among my friends for being able to sip 170-180F coffee. 190F is just way too hot.
Again, if you buy a coffee at McDonalds today, or at Starbucks, or virtually anywhere else, you'll get a coffee that can be as hot or hotter. It's a hot beverage.
Now, yes. Not 25 years ago.
According to the facts presented at the trial, it is, at least for the fast food industry. All other fast food chains were found to serve coffee at about 140 F.
aka compression machine. optimized to trigger brains' reward circuitry for accomplishment by 'tidying up' unmanageable landscapes of disjointed data into easily stored and recalled bimodal silhouettes of same.
Citation needed. Anecdotally, every person I ever talked to about that case either had a profound eye roll or a shrug about how people will sue over anything.
If I bought a hammer and smashed my finger with it, should I sue Home Depot for selling me a hammer that was too hard and not warning me about it? That’s pretty much the basis of the McDonald’s case: they sold a hot beverage, some lady sticks it between her legs and it spills. A reasonable person could have foreseen that a hot beverage, stored in an insecure manner, could pose a spilling hazard and that hot liquids have the potential to scald. A woman in her 70s has been around enough hot liquids in her life that she should have known the risk of scalding. None of that is McDonald’s fault. It was just easy to manipulate the jury into the award by using emotion and painting McDonalds as some uncaring villain. That case was frivolous— but since it made it to the jury, the old lady won and now we all get to pay more when we buy coffee from restaurants to cover the higher insurance costs restaurants must now pass on to the customer.
But recently brewed coffee is dangerous anyway, it's quite stupid to hold it with one's legs. Still, I don't know about the details, and even the defamation she suffered might be enough for the punishment.
Of course if they do brew that, they won’t give it to you before either adding a bit of cool water (most places prefer to brew strong and then dilute) or letting it cool down (if they just insist on a strong-taste brand).
Coffee nuts are a fan of really high temperature in my experience. They just know that you can’t taste the difference if your first sip burns off your taste buds.
IIRC at the time the McDonald's stated rationale was that by serving at that temperature it would be at a good drinking temperature when people arrived at their offices. These days that seems ludicrous to me.
FWIW I think the temperature of coffee is way too hot at most places. It drives me crazy. If I can't drink it immediately after them handing it to me? Too hot!
1. A woman willingly purchased hot coffee from McDonald's.
2. She spilled it on herself.
3. She sued McDonald's because of her injuries.
Those three things are true no matter which circle you ask.
A lot of people I talk to, even when given all of the facts of the case still consider it a frivolous lawsuit because they place almost all of the blame on the woman.
To bring it back on topic: when web users are told "we care about your privacy", they should be able to take it at face value. When the company then weasels out of the headline promise on technicalities (we don't share cookies — we share JSON, haha!), then it is violating that promise.
It reminds me of that recent case of 90%+ passengers "putting the oxygen masks wrong" because they are "idiots" - an opinion that seemed to be shared by a lot of people even here on HN, but even more so on Twitter.
https://www.stuff.co.nz/travel/travel-troubles/103226206/alm...
To me, someone whose never seen an airplane oxygen mask up-close, it's pretty clear that the design of the masks would make people think that this is how you use it, and not over your nose. When you're going down with your plane, fear for your life ending, and have like 30 seconds to act, it's like not you have time to think about the "proper usage of an oxygen mask" - you use it instinctually, based on the design of the thing.
Therefore, those people were not "idiots". Idiots were the people designing the masks in a way that doesn't make sense for humans in an extremely high-pressure situation with little time to react.
Also, as usual, when the vast majority of people do something "wrong", that's the first and only red flag you need to know that the issue is a system design flaw, not a user error one. Same with Apple's "you're holding it wrong" antenna issue, etc.
How is unusually hot temperature significantly different from poison in this situation?
But I agree with you about high-pressure situations and not ascribing idiocy.
Which such small masks, people probably believe they are doing something wrong when they are not tight against the skin (like a gas mask or scuba mask) and then puts them over the mouth where they fit tightly.
The mask people probably have experience with are scuba mask or gas masks and they both need to fit tightly.
https://en.wikipedia.org/wiki/Choice-supportive_bias
Possibly they would have drawn a different conclusion if given all the facts to being with. It's hard for many to admit they were wrong.
"in America someone sued McDonald's because the coffee was hot"
"in America it says on the box to not microwave cats because someone once did"
"in America you get a gun when you open a bank account"
Etc..
Oh well I'm sure similar incorrect stories about Europe float around America.
Honestly, I don't think about Europe that much. America is huge (both geographically and population wise) and there's so much stuff going on nationally that there isn't enough bandwidth for most Euro stuff.
"Brexit seems like a mess" and "Boy the G7 didn't seem to go well" are the most recent thoughts I've had on Europe.
Sample set of 1, but it was odd for someone not from America, and indeed it was his first time in America, to be as misinformed about things. Not knowing things is fine, but knowing wrong facts, and refusing corrections, was just weird.
It was an eye opener for what I "know" about Europe.
Most Americans have guns, support open carry, etc. I was an unfathomable oddity for not owning a firearm.
Most Americans support the current president (whoever that may be at the time), or at least hope he succeeds with his plans.
We only eat fast food, or at the least primarily as a people, prefer "American Food".
And a lot of things that can be boiled down to "America is horribly unsafe, if you go for a walk alone, you WILL get mugged or otherwise hurt"
The Hot Coffee thing was part of a larger thread about the American legal system being a game people play.
There are truths in some of these things, of course, but the scale of them was way off in his head.
This definitely happens with some narratives. For instance, some news outlets report that some parts of Europe are no-go zones for non Muslims, where Sharia reigns.
https://www.caoc.org/?pg=facts
I'd like to note:
> Liebeck’s case was far from an isolated event. McDonald’s had received more than 700 previous reports of injury from its coffee, including reports of third-degree burns, and had paid settlements in some cases.
> Mrs. Liebeck offered to settle the case for $20,000 to cover her medical expenses and lost income. But McDonald’s never offered more than $800, so the case went to trial. The jury found Mrs. Liebeck to be partially at fault for her injuries, reducing the compensation for her injuries accordingly. But the jury’s punitive damages award made headlines — upset by McDonald’s unwillingness to correct a policy despite hundreds of people suffering injuries, they awarded Liebeck the equivalent of two days’ worth of revenue from coffee sales for the restaurant chain.
> The chairman of the department of mechanical engineering and biomechanical engineering at the University of Texas testified that this risk of harm is unacceptable, as did a widely recognized expert on burns, the editor-in-chief of the Journal of Burn Care and Rehabilitation, the leading scholarly publication in the specialty.
She balanced the cup not in a cupholder, but between her knees. Even normally hot coffee is going to be bad news if it spills like that - the only difference the increased temp made was that the burns were more severe. But the coffee would not have spilled at all if she was not negligent in handling it (i.e. she should have given it to a passenger to hold or put in a cupholder).
If the coffee had been incorrectly sealed and it spilled out during normal operation of the cup (for example, drinking it) then I'd blame McD. But I don't see why it's reasonable to blame McD just because the coffee is 10 or 20 degrees above normal temp.
She went into shock and had to be rushed to the ER. 1/6th of her body was burned. The coffee was 30 degrees hotter, putting it closer to boiling than to the average temperature other machines served at. I dipped my hand in a fresh cup of coffee at home just now for reference. I could hold it fine for 3-5 seconds (which should get me close to a third degree burn with McD).
They also had over 700 reports of previous burns -- doesn't that sound like a systemic problem? The jurors, after seeing images of her injuries and reports of previous injuries, increased the punitive damages. I think the amounts are telling:
Plaintiff: ~20k (medical/legal fees)
McD: 800
Jurors: 2.7m
Judge: ~650k
Final settlement: < 500k
It is also worth noting that the court in this case did not assign full responsibility to McDonald's; your point was certainly considered in this case.
I'm not sure that was the case at the time... specifically there being "paid shills" on the internet.
Concern / outrage over the legal system seems to be a bit of the human condition, I'm not convinced there was a conspiracy required to have folks retell an inaccurate story about that incident.
Sometimes it feels like anything that is perceived to be corporate friendly is called a "shill" as if individuals (mistaken or not) couldn't organically have X opinion.
It actually all relates to trucking/truckers who use their own special cups, but demand the coffee be scalding so it stays hot longer on the road. McDonald's catered to these truckers to grow their coffee business, they knew the risks and gave no warnings to customers. I think the employee was also negligent in securing the lid leading to the spill itself.
As you say the coffee was so hot it scalded this woman so badly through her jeans she needed skin grafts. And sure enough there was massive money spent to spin this in the media as "woman burned by coffee sues for millions, everything wrong with our litigious society." Where this should have read: giant corporation disregards safety standards to boost their bottom line to the detriment of its customers leading to boiling coffee that scalded a woman's privates requiring skin grafts, then in bad faith the insurer denies the woman's claim to pay her medical bills, drags her through court which they lose, then they drag her through the appeals process which she didn't want any part of either.
From a UK perspective I'd always thought of it as a case of crazy pay-out. Why does this one women get several million dollars (although googling reveals this number went down a bit on appeal)? Especially if others had a similar experience. Either there should be a limit on the temperature of hot drinks, or there shouldn't.
The fact a warning is deemed adequate seems weird too, people will actively try and avoid spilling a stone cold cup of coffee on their lap!
It feels to me like the internet moved from shilling for big burger to shilling for big law firm.
That lawsuit was frivolous. Coffee is hot. If you spill it, it might burn you.
As far as just asking for medical bills — that might have been true until her lawyers smelled a multi-million payday.
Lawyers like that are the reason we have warnings on hair dryers to not use while showering and warnings on coffee cups that warn of the hot beverage inside. Coffee is traditionally made using boiling or near boiling water — unless McDonalds super-heated the water, the temperature at which it was served was consistent with how coffee is normally served.
That it was an elderly lady makes no difference. That’s just emotional distraction and has no relevance. The McDonalds lawsuit ushered in the “nanny” era where people have to be warned against such hazards as “boating carries a risk of serious injury or drowning.” And product costs (including medical care) is dramatically more expensive than it should be because the trial lawyers had to all get paid. Punishment under statute is one thing, but unlimited punitive damages is absurd. We talk about CEOs getting paid to much — not even close to the payday trial lawyers get.
That corporate entity had decided it was cheaper to not fix it than to fix it, until a human being who they contributed to significantly harming brought the problem before a jury. And she was found partially responsible for her own injuries, a fact which you elide (while speaking so authoritatively that I must assume you know this to be true, otherwise you wouldn't, yes?), while the jury also found that McDonalds' had been reckless in their operation--that most of the money awarded was a punitive penalty assessed because that corporate entity was cavalier in their treatment of actual, real-not-fictive people.
While we're at it, the punitive award granted was $480,000, not "multi-million"--though the jury asked for it, as two days of McDonalds' coffee revenue, and was reduced by the judge.
You've either been had, or you're trying to do the having. I shall not speculate on which.
https://segarlaw.com/blog/myths-and-facts-of-the-mcdonalds-h...
Have a read and then come back here and lets hear you argue that the lawsuit wasn't warranted.
Unfortunately, you often don't need to try particularly hard to get the media to repeat false claims.
Besides, there's little point in spending more than you'd lose in a settlement on a PR campaign to avoid the settlement.
Well, all of these changes (perhaps with the exception of industry standards) are IMHO irrelevant to responsibility of McDonald for the incident.
Companies do actually employ shills to go on forums and try to sway public opinion. They call them something like public advocates, doesn't change the idea though.
I've commented here defending China on some issue a few times in the past. I have no ties with the country (except being on a business trip in Shenzhen for two months), nobody paid or even offered to pay me to do it. It's just I hate bullshit, especially when it becomes popular opinion. Just because China has serious issues doesn't mean it's the Devil and everything it does is evil. It's a country, not unlike Russia or the US.
(Particular things I've been addressing in the past are a) treating a billion+ population as if it was a small country, and b) blaming China for all cheap mass produced crap and its environmental impact, conveniently forgetting that they aren't doing it for fun, but to fulfill orders from Western companies.)
Moreover, consumers don’t realize the damage they are causing if you let a corporation completely externalized the associated costs,(this is not a uniquely Chinese problem) and markets won’t pick the correct winner in those conditions either, who cares if $CHEAPPLASTICGOOD will last a tenth as long if it’s essentially free? China has not only enabled western consumerism, it disrupted the natural economic forces that would prevent such a thing from arising in the first place. To the detriment of the both parties and the world, all because they didn’t respect their environment and thirsted for power. Please explain how this rational is wrong.
In other words: it's bad that China is offering, but it's also bad for the west to take them up on that offer.
> Also the factory orders were coming from multinational corporations, they have no real allegiance with the West, they disrupt Western political, taxation and legal systems just like anywhere else.
That's IMO just giving up. Corporations are not yet independent governments, they should still be taken to account in the countries they originate from and those they operate in.
> China has not only enabled western consumerism, it disrupted the natural economic forces that would prevent such a thing from arising in the first place.
Not sure what they disrupted. It looks to me they played by the books, simply arbitraging labor costs like everyone else does in a global economy. Still, it's a feedback loop - China is enabling western consumerism, but growing consumerism is driving further growth in environmentally unsound manufacturing, most of which happens in China. If China did not enable it, probably some other nation would. It's a feedback loop, and both sides of it are to blame.
I’ll point the finger at any country who lets their national environment(which is really a global resource, we all share the same air and oceans) get trashed in the name of industrialization to serve consumerism. Western countries have a system that controls those externalities at least to some extent, in the US we have the EPA, OSHA, and our various institutions of permitting make sure of that, at a very real cost to businesses and consumers. By not caring about the environment developing countries absolutely are burdening the species long term. The lack of a level playing field in this regard enables consumerism because you are allowing consumers to not pay for externalities, else we should really be placing tariffs on any country who doesn’t meet at least EPA regulations and probably all of our regulations and laws—building, safety, worker compensation—but that would likely shock the global economic system. This is what “developing” countries disrupt, and why I think that ultimately globalization and environmentalism(which I prioritize personally right now) are incompatible. This is a problematic conclusion because war is probably worse for the environment and globalism is the only thing that’s made this era so relatively peaceful.
I don’t think you can blame both sides, because on one side you have a relatively organized group of people with power who rule a country, and on the other you have a mass of people with 0 organization and no structural power whatsoever. Blaming the /populace/ of any country for a problem is a very slippery slope indeed.
And there are also paid propagandists who attack Google at every opportunity, while ignoring far worse behavior by Google's competitors.
I'd really like to know what percentage of online content is authentic, and what percentage is paid astroturf to shape public opinion by business interests and ideological/political campaigns.
That’s because whataboutism ia rarely an excuse, if ever. At best it could offer some context. But given the sheer scale of Google’s operations there's not much context to add. They have both the power to do everything on a massive scale: both the violations and the subsequent “opinion shaping”.
The only reason mentioning a competitor would be relevant in many Google related topics is as a distraction. I don’t have to care about the competitors to be 100% correct when attacking Google.
On the other hand I got downvoted into oblivion even when comparing Google to competitors with undisputed data. My subjective experience is that the pro-Google camp is doing more overtime on the interwebs. And it makes sense that they would be more organized since they are working under one umbrella with more or less one voice. I find it hard to believe that all anti-Google parties would manage to reach anything close to the same level of organization and alignment of goals.
By "pro-Google camp" do you mean paid shills trolling and astroturfing to promote Google?
If so, I'd love a cite or three, because I haven't heard of pro-Google astroturfing campaigns.
Doesn't mean they don't exist, but I have heard of very real anti-Google campaigns sponsored by business competitors and ideological warriors.
Is your implication that ideological warriors can only exist on one side, against Google? Or that Google would resort to plenty of things that are borderline immoral or illegal but they draw the line at playing the PR card to make it look better? How about some of the thousands of employees that support the company line?
You have switched between “whatabout the other guys” and “Google never does this but all their ideological warrior opponents do”. The wording alone is already suspiciously aggressive, not to mention the naive implication that a company like Google would not resort to something all of its opponents are (apparently) doing.
Perhaps Google’s real strength is getting people to blindly support their crap. You see, it doesn’t actually have to be a “campaign” if all they did was train people to distract and constantly point the finger at others, pretend everybody else is bad but Google can’t be, and try to censor (via downvotes, reports, etc.) any internet opinion that doesn’t conform. Might sound weird but it’s more or less a literal summary of what you did in the previous 2 comments.
As for tech companies, I would honestly mark a lot of that down to fanboyism. Not that I'd be entirely surprised, but I somewhat doubt that Elon Musk, in particular, is actually paying all of those people. And Tesla seems to have the most defensive supporters on the internet. People talk about Facebook and Google for their privacy practices, Apple for their crappy laptop keyboards, but it's a tiny minority that goes after Tesla when they're the company least capable of hiring people to argue on the internet.
(I would also assume that it's a little bit overrated how often this happens, for the sole reason that I spend a lot of time arguing on the internet and never once have I received an offer to go pro!)
As for paid shills, there is an entire sub-industry of PR called "Reputation management" devoted to this.
(I don’t have a direct link to said FT article, just a photo I took of said military person’s quote which is somewhere on one of my computers)
Sure. But there are also fanboys everywhere. Between presumption of good faith, Occam's Razor, Hanlon's Razor, and the breadth and depth of fanboyism I've seen online, my default presumption is always "fanboy" over "shill". Similar to your point about nationalists.
Link from them doing this in 2010. I highly doubt it has slowed down or stopped.
https://www.youtube.com/watch?v=LofScCiJT4c
The question still remains, are corporations doing this actively/knowingly or is it only governments that are doing the shilling.
So it’s not surprising that some BigTech employees are going to actively defend their employer’s values on forums.
The best way to understand modern tech company culture is to consider them all very successful cults.
The today's employment model is a no strings attached contract: the employment can be terminated for no reason at any moment without a notice. This is a double edged sword: not only it gives the company flexibility to fire anyone they don't like, it makes employees mostly indifferent about the company as long as it cuts the paycheck. A typical software engineer does a 4 year gig and when the stock vesting plan ends, he moves on to another gig. There is no reason to take seriously policies of a company he worked at 10 years ago. And regarding evaluating promotions thru the cultural values lens. Yawn. There's no money in promotions.
For a cult to be successfull, its members need to be bound by something more serious than a company values training they watch once a year.
Or maybe people have widely differing views on all kinds of subjects?
I've been called all kinds of things, which I definitely am not, so I'm inclined to think that people put far to much weight on the conspiracies.
Of course, posting and flagging may not be intentional policy of Google, but also the work of individual Google employees.
It's gotten a little better over the years but still being critical of Google gets you downvoted and flagged quickly.
Also worth highlighting that many HN members work for Google, so they have less incentive to shine light on these issues, sometimes maybe even defend Google.
If a company wants to present its views, they can do so via press releases or clearly mark their posts as such (or via verified accounts like on Twitter).
IINAL, but since we are at the topic of laws, in the last years influencers (at least in Germany) had to fear hefty fines if they didn't label sponsored posts as such, as that counts for covert advertising. As astroturfing could be construed as advertising, that might fall under the same law.
Note also that "on behalf of" can only exist in response to some prior meeting (or deal) with certain members (board or employees) of the corporation who wish to push "its" policy.
That said, I don't think there are nearly as many shills as some people think nor do I think they are very effective.
I'm John and I have views on privacy that are completely genuine and happen to align with what benefits the corporation(s) that my company, TotallyLegitimateComments LLC, contracts for. I believe advertisement is a force for good in the world and can bring together people and products that enrich their lives while creating value for shareholders! While I'd love to share what wonderful businesses my company works with, various privacy agreements prevent us from doing so. However, I can tell you that they all appreciate the fact that you find their views important! We will continue to lobby your congressmen on your behalf to ensure that these views are reflected in the nations laws! Thanks and remember, corporations are people like you and me!
Sincerely, John
https://gizmodo.com/how-an-investigation-of-fake-fcc-comment...
https://twitter.com/AmazonFCHannah/status/116191039733676851...
I wonder what that says about the state of "truth" on the Internet.
Paying someone else to share a very sanitized, market researched version of your opinion while pretending that they're organically sharing their own opinion isn't that. It's dishonest, and it's eroding honest conversations for the sake of advertising.
Personally I tend to think of most people on HN as privacy nuts. Honestly of all the problems in the world to get worked up over, online advertising is pretty low on my list. There's nothing I can do about Google/FB/whatever, so why even think about it.
If Google or whoever wants to pay me to keep posting, I'm listening.
This risk might be lower than you think, the key phrase is, "we didn't realize that the marketing firm we contracted was subcontracting to other, shadier marketing firms, who themselves aren't evil, but fell in with the wrong crowd and ended up trusting a yet deeper level of marketing firm, who was in fact evil."
Actually, of all the stuff going on in the world, this is the one thing where you have an actual degree of control that matters.
Sure, one individual won't change business policies. But: you can easily take steps to prevent or reduce the amount of data these companies have on you.
Don't use their services, use an ad blocker, use tracking preventing, etc. You can even easily tailor it to your specific needs.
Compared to stuff like Brexit, fires in the Amazon, Hong Kong, ethnic cleansing in Myanmar, attacks on democracy in Turkey, Hungary etc., it is trivial to do something against Google/FB that has at least the effect of protecting you.
The threat that Google's tracking infrastructure represents is not limited to ads. If they stayed in their proverbial lane and used their panopticon exclusively to sell me things, many of us wouldn't mind as much as we do.
But they lend the power and reach of their machine to governments, whether it's China looking to smoke out dissidents, or the NSA PRISM program, or even the DEA itching to score another weed possession arrest, Google gladly and happily does whatever governments ask of them, frequently with no warrant required.
Either its employees, hired guns and or something...
Further She has emails from Google ATAP(one of their supposed R&D departments) in which they note they invalidated her patent after getting caught...
We've been over this topic a gazillion times on this site: https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme.... Astroturfing exists, but imagined projections of astroturfing are far more common, and whatever the effects of the former may be, the latter has an extremely degrading effect on discussion. In fact it eats up everything if you let it. We don't want that here.
I've personally banned several accounts over the years for propagandizing for Google (for whatever reason—it's impossible to distinguish between a paid agent and an overzealous fan, nor does it particularly matter). But this has been rare, and we don't do it without evidence.
Is Hacker News not a place where freedom of speech is welcome? Speech that is helpful to other not well connected innovators who when invited by the big G read this and tell the big G no I'm not going to take that meeting!
Overall I'm confused as to why you call my story and Jie Qi's story spam? Do you not think her story is true and or mine is? That is not helpful for other not well connected and or rich innovators?
Separately, there was an issue with your copy-pasting the same comment about this story repeatedly in a previous thread. That is what I called spamming (not the actual story). Doing that is no doubt what led to your being downvoted, rather than manipulation as you implied above.
In cases where the story is relevant, of course it's fine to discuss it. But I don't see that it's relevant here, and your history of bringing it up in ways that break the site guidelines suggest that the bar for relevance needs to be higher than how you've been drawing it.
But the main point is that you can't make up sinister stories about why you got downvoted ("I can attest...") and post them here. Long experience has shown that nearly all such comments are baseless, and as I just said, they eat everything if you let them. Therefore we mustn't let them.
Ive never knew or heard about an astroturf guideline before. Thanks for pointing it out ... i was trying to start a debate as I wasnt sure if my comment was downvoted voraciously because of multiple posts or something else?
As for telling my story and or Jie Qi's similar one in posts that detail other bad behavior from Google I wonder how that isn't relevant? Per the upvotes HN readers must feel it holds relevance? Though you don't think pointing out that Google steals/gets caught stealing IP is relevant to other posts detailing more/other examples of their bad behavior?
I've written a bunch about this over the years if you or anyone wants more explanation: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
Though are you saying I should never talk about Google getting caught stealing IP where it's relevant on Hacker News(have you censored other members b4 on certain topics)? It does not satisfy readers curiosity or is helpful to other dreamers/innovators, ones who dont have Joi Ito (MIT student's advisor) on their side, in whats the best way forward when Google R&D sends an invite?
Ive been a HN reader and commenter since 2007 and spoken freely since. I hope I am to continue to do so!
They might just say, 'That seems silly!', 'You're a nut', 'Do you have a source other than yourself'. Or they might just downvote stories that have a negative effect on their income.
You've got 100k people working at google and many of them are going to be active on this type of forum. The same goes for the other big guys that have a ton of employees
This is all quite in the open.
There are definitely some acting as spokespeople (even if they claim otherwise), but there are also quite a few who are just, you know, incredibly biased fans of their employer, who like to defend them on topics unrelated to their job.
But when a tech company has 100,000 employees, it's not particularly surprising to see a good number of them on a tech forum. ;)
https://www.theguardian.com/technology/2018/nov/21/facebook-...
If you see these kind of behavior online, it's almost always people paid to explicitly monitor forums and "protect" a company image.
--Upton Sinclair
I'm inclined to believe you, but sources please. Especially interested if you (or anyone) have anything on Google in this respect.
It's not going to be entirely legitimate but there's going to be some eye opening items in there for you I suspect.
Thank God we have Redditors to break the case.
False. He went missing a month before the bombings:
>Soon after, another redditor named Sunil as a plausible suspect after asserting a resemblance between the suspects in the FBI's pictures and Sunil, who had gone missing a month before the bombings.
The book Merchants of Doubt highlights the practice across decades and industries.
Ralph Nader was subject to corporate smear tactics and surveillance in the 1970s.
The idea that companies would suddenly stop using these tactics the moment they become divinely powerful defies all reason.
Reddit's /r/shills and /r/HailCorporate highlight some modern instances.
Full thread in a nicely readable format at https://www.thepoke.co.uk/2019/08/15/amazon-ambassadors-take...
[0] https://twitter.com/rulesObeyer/status/1161758672973811712
This is the lazy and ignorant method of dismissing other people's arguments. Shill or not, what does it matter if what they state are facts?
It's super creepy
I can't relate to this impulse even a little bit, but believe that it's common. That being said, I don't see how its ubiquity makes it any less a failure of critical thinking ability.
The Internet is a pretty hostile environment for those whose epistemology depends on who's behind the pseudonym: it's not clear to me that shills are going to make these people much worse at thinking and processing information than they already are.
The same goes for those who do have appreciable critical thinking abilities: you shouldn't be credulously consuming the thoughts of any random pseudonym, and the same skeptical habits that inoculate you against dumb ideas from unpaid strangers work roughly as well on shills.
I don't want to sound like I think some "smart" people are somehow immune to this - I think everyone, regardless of their education or intelligence, is susceptible to this kind of group-think.
It's still not clear to me that I see why shills are such a cause for outrage, at least at a personal level: if a person's critical thinking abilities are impaired enough of people that they'd have their views appreciably changed by shills' voting patterns, the absence of shills just means they'd be blindly following the whims of online mobs. I can see how this is better, but just _barely_.
OTOH, for those who are capable of basic critical thinking, shills don't seem to have much power: if they make good points, then good, if they don't, then no harm done.
I just don't see how why bad comments are somehow worse when they're driven by payments instead of simply the stupidity of a normal person.
First, please observe the principle of charity when posting.
> Shill or not, what does it matter if what they state are facts?
Because it is entirely possible to tell large lies using small facts.
Because propaganda and disinformation are actual, real things and are very difficult to combat once unleashed in the commons.
Because the "let the marketplace of ideas figure it out" excuse to not police propaganda and disinformation attacks is hopelessly naive at best, and deliberately ineffective at worst.
Dictatorships use Whataboutism to help cover stuff like this... https://www.reddit.com/r/pics/comments/cz75gj/hong_kong_poli...
When you're wrong, you shutting down discourse by effectively saying the other person isn't even a person. This gets us to far more extreme us-vs-them dynamics than otherwise possible.
Edit: doing some more googling, maybe it's in the 10 billion range; getting better for Google, but I still can't see a company deciding that such a fine is irrelevant.
None of my products violate GDPR in any way I could conceive, but I’d hate to be handed down a mandate to do so. Both not accepting a project and not signing off on it are pretty bold moves.
"Please don't comment about the voting on comments. It never does any good, and it makes boring reading." - https://news.ycombinator.com/newsguidelines.html
Reminding fellow readers/commenters to not just shallowly dismiss comments once in a while doesn't do much harm, and actually lead me to reply to the parent.
Just like execs have to personally sign for and are accountable for their financial statements, they should do the same thing with privacy. GDPR sets a very common leveling of the field so it's completely fair now.
Giving jail time for any of these is like giving jail time for any kind of "offensive behavior". Maybe someone just didn't like what someone said and called it offensive, or maybe someone physically attacked someone else. You don't get jail time just because someone claimed offense, you have to prove harm, and fit the punishment to the crime.
This is why I can't take privacy advocates seriously. Their effort to fight for all privacy undermines the attempt to prevent real harm from specific kinds of information being exposed.
I'll take your word for it, the evidence doesn't look clear cut to me,
> privacy violations
Again, who cares if it was just your shoe size? We should not send someone to jail for leaking who your favorite pop star is. Did it, or could it, do harm? This is a nearly universal standard used to assess how someone is punished according to the law.
> in order to increase profits
Of course it's to increase profits, you think they're doing it for fun? Did we stop living in a capitalist economy and nobody told me?
All personal information makes fraud and blackmail easier. Even the seemingly mundane.
I won’t go into details because the relevant law already exists.
This brings me to my second point:
> Of course it's to increase profits, you think they're doing it for fun? Did we stop living in a capitalist economy and nobody told me?
Even in a capitalist society, doing illegal things for money is generally considered worse than doing illegal things without the expectation of getting paid.
Whoever cares, cares, and it's none of your business. Noone is suggesting that you should not be allowed to allow companies to collect your shoe size and sell that information, so you are mostly just missing the point.
There are people who do not want to allow that, and there is absolutely no reason why we should force them to allow it. Claiming that what you stole is of little value does not make your theft legal. It is simply not up to you to decide what has sufficient value to keep for other people. If you take something that is someone else's property without them transferring property rights to you first, that is theft, and it is completely irrelevant whether you think that they shouldn't value what you took.
> Did we stop living in a capitalist economy and nobody told me?
If anything, you seem to have a very confused understanding of capitalism. The one core idea of capitalism is strong individual property rights, because that is the basis for decentralized price discovery. Capitalism could not possibly work if the state simply declared that property rights for low-valued goods (based on a valuation decided by the state, presumably) a not enforceable, or if you could simply steal and use your competitor's machinery to produce goods as long as you didn't harm them (like, returned them repaired before their next production run, maybe?).
The fact that someone could make money by violating your property rights certainly never was a justification that allowed them to avoid punishment in a capitalist system.
Your shoe size point is simply a strawman. You've chosen one arbitrary data point in order to make the argument look less important. In any case, I'm of the opinion that neither Google nor the governments of the world should be allowed to do this kind of large scale surveillance and profiling.
And finally,
> We should not send someone to jail for leaking who your favorite pop star is.
I agree with this completely. However if it's not just my favourite pop star, but it also contains all the articles I've read in the last two weeks, and my age, and what I've recently bought... All of these neat little data points about me, neatly filed in a profile made just for me, then the natural question that arises is: Why do you even have this? Who allowed you to start building this profile on me and on thousands of others? The systematicity and scale of it is hard to argue against.
This discussion is about intentional, systematic, large-scale violations of privacy by large corpotations. You pointing out (essentially) that sometimes your one neighbour tells your other neighbour how they heard this rumour about you is simply an attempt to derail the conversation, not a relevant argument.
> You don't get jail time just because someone claimed offense, you have to prove harm, and fit the punishment to the crime.
That's just nonsense. Talking away people's stuff without their consent is a crime. Noone has to prove any harm for you to be punished for theft. If the theft also harmed someone, they obviously can demand that you compensate them for their loss, but that is a completely separate issue.
Yes, the punishment has to fit the crime. And if you were the head of a multi-billion dollar corporation that made money by organizing the stealing of low-value goods from every person on the planet, that punishment presumably would be quite something in order to fit the crime.
Google's 2018 revenue was $136.22 billion. GDPR allows for a maximum fine of 4% of global turnover.
At a maximum 4%, GDPR could impose up to a $5.5 billion fine. I agree, getting something closer to the maximum might help the situation. Although ultimately, my bet is that Google is already baking the 4% revenue risk into their business model. If that's the case, GDPR's maximum penalty should be reconsidered.
The key to getting reasonable ads back is making the bad ads impossible for advertisers to buy.
Some other ad thing which doesn't need tracking: Sponsored posts or targeting people who follow someone on Instagram.
I am not sure how viable such a company will be in the real world.
I invite any developer / blogger to check out https://CodeFund.io. We are a non-tracking 100% open source ethical ad platform that focuses on funding open source.
But it looks like you've been using HN primarily to do this. That crosses into spamming, so please don't.
These complaints filed by Brave, with their own employees posing as professional “victims” intentionally grasping at straws for evidence of privacy violations, smack of desperation. This is not the first claim they have filed, and sadly, it won’t be the last. Their claims thus far have been disingenuous at best, downright dishonest at worst.
GDPR was not meant as a weapon with which one could hobble their far more successful competitors. It’s sad to see that a company that claims to care so much about privacy is undermining GDPR by bringing the worst fears of those that opposed it to life.
I'm not sure that's true: uBlock Origin has twice as many installations as Brave does. You might say "oh, but that's just blocking ads!" But if you don't block ads, privacy problems are going to spring out of the woodwork like nobody's business. That is, they might not care about privacy by name, but they certainly care about it in effect.
People really do hate ads. We're inundated with them, constantly. Low grade psychological assault, at all times. I don't blame people for wanting a respite.