Hacker News Reader

Comment by scottmcleod | Hacker News Reader

This is seriously just a purchase event for a t-shirt that OP got. There is no mysterious Lan Tim 2 its just a random app for a random merchant that uses FB Ads and uses offline conversion / uploads.

View on HN

Why do Facebook get that information though?

It's fine that OP bought a t-shirt, not fine that that is somehow reported to Facebook.

Quite simply so that "lan tim 2" can track their customer acquisition, they give the data to FB, FB correlate it with "did the customer see ads on our network, which ones, how often, etc." and give that back to the supplier.

Hello stasi

Which means they are sharing their entire customer activity, everyone, including personal data you never forfeited for this purpose (like the phone number / address used for shipping).

Yeah, I'm not sure I understood OP's innuendo at the end, but this is totally against GDPR right?

GDPR only applies in EU

I'm an EU citizen in the EU, therefore it applies.

I meant that maybe OP is not from the EU, so the GDPR does not apply to him and that's why he/she's complaining...

Yes. Degenerate marketers don't find anything wrong with this but it is a clear violation. Lan Tim 2 probably doesn't care though.

The GDPR is not enforced, so there's plenty to gain by breaching people's privacy and nothing to lose.

https://www.compliancejunction.com/first-ever-uk-gdpr-penalt...

https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-o...

Someone in the know can confirm. But i presume they just receive statistics, not actual data

Honestly, I don't think that there's a general expectation in the digital or brick-and-mortar world that when you buy something from a merchant the information related to that transaction is "your data" and they cannot use it. Certainly there are businesses that promise discretion, but that's normally a selling point for a particular reason. On the other hand, there is a reason to expect privacy when you are using Facebook for personal communications, photo sharing, etc. This scheme, then, is the more privacy safe way to do it. The T-Shirt company isn't saying "hey, Facebook, can you tell me some interesting personal info about my customers so I can target ads better?" and Facebook isn't responding with "here's all the stuff they're into based on their Facebook activity." Instead, they say "here are my transaction records" and Facebook says "OK, we'll use this to show your ads to people who are likely to want your T-Shirts." So, yes, to some extent Facebook has data on lots of stuff you do in the world because the businesses you interact with opt-in to share the data. This doesn't really bother me, just like my credit card company knowing all of my purchases doesn't bother me. If it bothers you, though, it does really work to a) periodically reset your IDFA/AdID on your mobile device, and b) delete cookies on your browsers.

> Honestly, I don't think that there's a general expectation in the digital or brick-and-mortar world that when you buy something from a merchant the information related to that transaction is "your data" and they cannot use it.

It would be nice if it were, or that they promised that they wouldn't just hand it out to everyone.

> If it bothers you, though, it does really work to a) periodically reset your IDFA/AdID on your mobile device, and b) delete cookies on your browsers.

How does this help in this case?

> I don't think that there's a general expectation in the digital or brick-and-mortar world that when you buy something from a merchant the information related to that transaction is "your data" and they cannot use it.

True, but that's not the expectation in play here. I think there is a general expectation that when you're doing business in a brick-and-mortar store, that store is not going to be reporting your business to the likes of Facebook, Google, etc.

My 0.2$, a previous comment of mine https://news.ycombinator.com/item?id=22180163

"Some chat apps (like Viber and others) have Facebook SDK integrated in them, without any direct Facebook functionality people would use. Discovered after using NetgGuard, and seeing who is calling home, and not only home. (Why viber is making requests to graph.facebook.com anyway?)

Duolingo is a nice app for learning new languages, yet it might be using the same sdk, since it likes to call facebook.com domain.

Netflix is a good streaming service, but it has some option somewhere, which allows them to share data with others, and enabled by default. And yes, it's present in fb activity.

The list can go on...

There are developers who integrate dozens of SDKs, without any specific purpose for users, and not knowing what is happening. We need something like PrivacyBadger/ublockorigin for phones/laptops/routers/homes/cars. It's getting more than creepy.

And why would Facebook allow third-parties/businesses upload into FB info they have on their customers...

PS: analysis of how a simple menstrual tracking app is leaking data about the owner https://media.ccc.de/v/36c3-10693-no_body_s_business_but_min... "

You can't really blame developers for this. Most aren't integrating SDKs for no reason at all -- they're integrating them because users are asking for a feature the SDK provides.

For one app I worked on, we made a decision not to include Facebook or Google login and only support email/password login, specifically to avoid leaking information.

A subset of users was not pleased at all -- and they sure let us know about it. Maybe around a third of our support requests were asking for third-party sign-in. People often made privacy arguments in support of it: they'd say "why do I have to give you my email address to create an account?" (though usually much less politely). And they kind of had a point. You may trust yourself more than you trust Facebook, but most people are going to trust Facebook more than they trust [random developer].

Anyway, it takes a lot of effort to deal with these support requests, it sucks getting yelled at (even in text). Some of these users probably went on to give the app a 1-star rating, and just a small percentage of those will really drag down your overall score. Dealing with this was not fun. It would have been much easier to just add FB or Google login.

> You can't really blame developers for this.

Sure I can. And I do. Developers are making these choices, after all. I understand the economic drive behind them, but that doesn't get the devs off the hook.

My point is that some users want Facebook or Google login and get mad if you don't have it. Other users don't want them and get mad if you do. Because you have to decide whether to include the SDK when you build the app, it's impossible to make both groups happy at the same time.

It's not impossible, it just requires more development effort. Just because the SDK is present doesn't mean it always has to be used.

To be honest, Fb login is one of the least reasons I worry.

I have seen apps sending requests to facebook graph without using the login, or they don't have facebook login at all..

I haven't rated any apps based on this, though.

I had the same LAN TIM 2 in my personal data export - and I too had purchased something from Spreadshirt before.

Edit: How they matched it up though is a mystery to me, as I use another e-mail address for FB than for the rest of the online world.

What if you were logged into Facebook and checkout page contained a script that sent data to Facebook?

To fix this by the way, just install the Facebook Container in Firefox. Somebody else (presumably a Mozilla employee?) does the extensive curation needed to get this to work and stay working. You are logged into Facebook inside the Container, but everything else is pristine, on the outside of the Container you can log into whatever and it's not connected back to Facebook.

Firefox's Container system is a powerful solution to this general problem, but normally you need to do curation work proportional to the effort being taken to track you. Their Facebook Container though comes with that curation done.

If you use Login with Facebook (you want Privacy, but you choose to Login with Facebook? Maybe reconsider your life choices) the Container puts everything you logged into this way inside the Container too, so that dissolves your privacy but you chose to have it happen.

They even have a better version, the Multi Container plugin. You can separate multiple contexts (fb, goog, banking, memes..), and each lives in a separate container. Takes a little time to get used to, and if used with privacy badger, ublock origin, FF built-in anti-tracking, might give good results in reducing your exposure to online tracking.

Yet some mobile apps still use heavy analytics which is sent to some domains, again, you need something like netguard, vpns, to filter your mobile traffic. Privacy becomes a pain https://media.ccc.de/v/35c3chaoswest-32-toll-of-personal-pri...

Reply on news.ycombinator.com