More precisely, to collect any personally identifiable (PII) of an EU citizen, you need their consent. PII includes things like name and email, but also anything like an IP address that can be used to "unmask" a person. Consent must be freely given and can be withdrawn at any time. If requested by a citizen, you must turn over or delete any PII of the inquirer. You must do your best to keep the PII safe, and follow security best practices - and in case of a data breach you must inform the data authorities and affected citizens. You may only ever hand over data to other companies (sub processors) if you have a contract guaranteeing that they will also abide by the above constraints (nice little GPL-esque twist there).
I hate the barrage of popups from websites trying to weasel out of it in order to continue business as usual with ad-tracking. But at its core, the GDPR is actually a pretty good piece of legislation - we now have a right to be forgotten anywhere.
In fact, "big tech" has figured out how to get around the rules by exploiting the lack of enforcement. The majority of big tech is knowingly not GDPR-compliant.
Ok, that's nice in a fantasy world, but in the real world a lot of people/sites rely on ad revenue, and ad revenue for the most part, requires tracking built in. So now if you legally force me to allow users to decline "stalking" you are basically allowing users to decline my monetization model and use my website/product for free. And why should I allow that?
Why can't I say: "accept that my site is ad-supported or don't use my site?"
> Ok, that's nice in a fantasy world, but in the real world a lot of people/clothing companies rely on cheap manufacturing, and cheap manufacturing for for the most part, requires child labor. So now if you legally force clothing companies to allow consumers to decline "child labor" you are basically allowing consumers to reject clothing companies' monetization model and get their clothes at a loss to the company. And why should clothing companies allow that?
edit: maybe I've couched my argument a little too much. I think it's a pretty good comparison, actually: I think most (but not all!) people agree that tracking and child labor are bad, but turn a blind eye because they enable cheap/free stuff.
It's already legal to "force" your customers to exchange money for content. If anything, it's even worse because a lot of children end up malnourished because their parents spent to much money on entertainment.
This is a fair counterpoint; it is not a perfect comparison. I think it did its job though, to clarify (now with your help) the actual point of contention:
> why should the government able to stop this transaction between parties that mutually agree?
Most nations have a concept of human/inalienable/natural rights, which cannot be signed away. For example, it's usually illegal to sell yourself into slavery. In the GDPR's view, privacy is such a right.
Do you think the government should not be able to stop these transactions at all, or do you think privacy should not fall into that category? Or a different objection I haven't thought of.
---
I have my own views, but I'm not really interested in arguing them. It largely comes down to what moral system you subscribe to, which I think is a waste of time to discuss on HN (or any public forum) -- there's too many people on the internet to argue with everyone you disagree with; better to learn to get along, and focus advocacy on communities closer to home. As for why I comment at all: figuring out how to frame issues is not a waste of time — it's much easier (less emotional) and provides a useful reference for future conversation.
> do you think privacy should not fall into that category?
This one. Supermarket rewards are an example exchanging privacy for money that is rather uncontroversial. Obviously tech companies collect a lot more information, but I believe the same principle applies.
First: If child labor laws were abolished tomorrow, almost no parent in a developed country would encourage their children work, and almost no employer would accept child labor. Parents want their children to succeed in life, and in developed countries that means sending them to school until they have enough knowledge to work a lucrative job. So a parent must be desperate for money or have a very low opinion of formal schooling if they're willing to let their child leave school at age 14 and find employment. Such instances are exceedingly rare in developed countries with social safety nets, but they're not as uncommon in poorer countries. In those places, a parent must sometimes choose between their child going hungry or their child going to work. It's a terrible choice, but we should let families make that decision. The state doesn't have as much information as the parents do, and parents care about their children far more than the state does. A blanket policy prevents families from choosing what they think is best.
Second: As we've seen with laws banning drugs and prostitution, the net effect is to drive the practice underground. This means that anyone involved can't rely on the police and courts. It encourages violence and discourages victims from reporting worse crimes for fear of being prosecuted themselves. It means that banned products aren't subject to controls on quality or safety (as they would be if they were regulated like everything else). So too with child labor. In poor countries, child labor laws mean that children work illegally. They have no protection from hazardous working conditions or abusive practices. The fact that their labor is illegal also means they can't join a union.
Third: In the US, there are exemptions to child labor laws. The Amish are allowed to leave school and work full-time at 14. They work on farms. They use power tools[1]. Some even work in woodshops and sawmills (though usually less hazardous jobs such as cashier or stacking wood). As young as 10 years old, they drive horse-drawn buggies on public roads. Compared to other children in the US, Amish kids don't seem to be particularly unhappy or have worse life outcomes overall.
I think people should have more rights sooner in life. That includes the right to vote, the right to leave school, and yes the right to exchange labor for money. There are plenty of successful people who left school early. Heck, the former Prime Minister of Australia quit school at 14.[2] Scroll through Wikipedia's list of autodidacts[3] and you'll find quite a few high school dropouts.
One can criticize a practice while still arguing against blunt laws that outright ban it. I'm certainly not a fan of child labor, but I think that many of the laws around it are counterproductive, especially in developing countries. I also think many drugs are dangerous, but imprisoning people who engage in such practices causes more harm than allowing it. And I'm worried about how governments and large companies are collecting information, but I'm also convinced that GDPR doesn't help. If anything, it makes the problem worse because larger companies can more easily afford to comply. And there's the issue with GDPR's exceptions for government agencies such as law enforcement and intelligence. Funny how that works.
1. The Amish use compressed air or hydraulic tools. Some sects allow electricity if it's from self-sufficent sources. For more info, see https://www.tested.com/tech/453794-how-amish-are-adopting-po...
That’s not relevant to the parent’s alternative —- as I understood it —- of unconditionally blocking European users entirely.
I'm free to insult the King of Thailand and drink scotch whisky all night long (as long as I don't die behind the wheel) contrary to the laws of Thailand and Saudi Arabia, respectively.
That's what the NYT has done, and they've seen their revenue grow: https://news.ycombinator.com/item?id=18920079
The options that appeared are (a) Accept (b) Manage Trackers
Manage trackers leads to this page
https://www.nytimes.com/subscription/privacy-policy#/cookie
Which seems to list lots of 3rd parties that will track me if I view the site. I'm told I have to go to their sites and opt out.
In fact, every advertisement outside of the web works without tracking/stalking the consumer. At most, you get a discount code for "seeing this ad on X place"
> Why can't I say: "accept that my site is ad-supported or don't use my site?"
Because that's the equivalent of me giving you my address, dob, SSN, etc just for entering your store
So what? If you don't want to give me those things (ad tracking isn't nearly that bad, btw), then don't enter my store. And likewise, if a consenting adult doesn't mind giving out that info in exchange for entering my store, why prevent them from doing so?
Don't agree to my terms, don't enter my shop. It's as simple as that.
Sounds like you're the type of business the law was created for
Note, I’m not in any way an expert on the legality of it, but this seems like a silly argument to make. If anything, being more up-front with the model may open alternative methods of monetization (subscription-based, etc).
And this is why I have such a problem with the rule. Without some dramatic changes, any video streaming site almost surely wouldn't be able to handle the substantially lower ad revenue and still make a profit if everyone actually opted out. Sites like Facebook would probably turn a profit, but there's a large portion of the internet that would not survive when faced with 90% less revenue (untargeted ads payout drastically less).
>“Freely given” consent essentially means you have not cornered the data subject into agreeing to you using their data. For one thing, that means you cannot require consent to data processing as a condition of using the service. They need to be able to say no. According to Recital 42, “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.” [1]
[1] https://gdpr.eu/gdpr-consent-requirements/
EDIT: Come on can we not down vote just because you disagree here? It's just going to be come a circle jerk like most of Reddit if you guys keep this up... I linked a source even proving this OP wrong... from the official GDPR resource...
And you are clearly tracked across Google services at least, as anyone who has ever google something shopping related, then viewed a youtube video can tell you.
>The obvious answer is that monetized videos generally have a subject, and advertisements can be tied to that subject.
The obvious answer to me is that not everyone opted out. Businesses generally want to make money, collecting data clearly made them more money, or they wouldn't have done it. Now they make less on those who opted out.
I want to start a car rental business, however that requires upfront capital to buy the cars and I don't have that, so I'm gonna break the law and steal the cars to offer them up for rental. Is that what you're advocating for? Being in business is not a right; if your business model isn't sustainable without breaking the law then find a different one.
> ad revenue for the most part, requires tracking built in
Magazines are essentially full of ads and people actually pay for them and yet there's no tracking other than very generalized targeting (a car magazine will have car-related ads in it). Just because web advertising became the wild-west doesn't mean we should now legitimize it.
> and use my website/product for free
The biggest offenders (Google, Facebook, etc) don't even allow you the option to pay for it to decline tracking (and a lot of them track non-users as well; Google Analytics and the social media networks track people regardless of whether you're a user and agreed to their ToS/privacy policy).
> Why can't I say: "accept that my site is ad-supported or don't use my site?"
Because it's the law and the same reason why I can't walk into a store, start shoplifting and when caught say "sorry, should've read my ToS and not let me in if you disagreed with it".
You are welcome to vote and nag your local politicians to amend the law if you believe it's wrong but until then you need to respect it regardless whether you agree with it or not. The advertising and marketing industry has proven it is unable to self-regulate so the law has now stepped in. The industry had many chances to clean up their act (the do-not-track header was one of these chances) and they clearly told us all to fuck off so now the GDPR is a stronger solution.
The problem is there is no consistent definition of stalking in this context. Which could be the difference between a store manager watching how people move around a store vs following you home and going through your trash.
Seeing the information is one thing. Collecting and storing it is another.
Hence the massive debate to this day over the rules.
> Don't stalk people
Are you just not aware of your own hypocrisy?