Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

> If it's detremental to your business to not be able to track users on such a granular level, it's a bad business.

Except that Apple still allows tracking on this granular level, it's just that now they have to explicitly ask users to allow this.

Says a lot about Facebook's (and others) business model if it only works when the vast majority of users are mostly unaware of the amount of tracking they do, but the minute you make these users aware of the tracking and ask for their permission, the business model falls apart.

View on HN

It's not even just the amount of tracking that Facebook et al do but the pervasive scope of it all. It's also a serious abuse of language.

Facebook and others use the word "ad" hoping people assume the definition is the old school television or print ad; "here's our thing buy it and it'll make you happier". Beyond whatever massage it had that advertisement only affected you if you turned to that page or watched it during your show. The content creator got paid to use some of their space/time to let an advertiser reach their audience.

For Facebook (and Google and others) and "ad" means a content creator is not just selling their own space or time but they're selling their audience. To them an "ad" is a means to hoover up a vast amount of data on people. Because of their reach and the fact they run a social network the data amounts to tons of PII. There's little regulatory control over the collection, storage, or dissemination of this data. The person being surveilled has no meaningful way to control what data is collected or what's done with it. Even opt-ins don't provide meaningful data to someone to make an informed choice about "ads".

Apple making some of the scope of their tracking clear is a step in the right direction for users. People shouldn't have to participate in a dystopian panopticon just to use an app or a website. If the apps or website somehow can't survive without surveillance that would give Stasi agents a boner they can fuck right off alongside Facebook.

Isn’t it common knowledge at this point that our browsing history is used to target ads? Who hasn’t had the experience of searching for a product and then seeing ads for it?

For starters, it's not just browsing history but all of your activity on pages or in apps that use Facebook's spywa..."ads". This includes activity times, connections to other users, and even proximity to places or other people (Bluetooth beacons etc). This is all on top of the voluntary PII you might have fed directly into a Facebook profile or the shadow profile they helpfully created for you when your friend uploaded their contacts into Facebook.

There's zero oversight of how that data is used or who it's sold to and what those buyers do with it. We've already seen a number of cases where this harvested data was sold to unscrupulous or outright criminal concerns.

So it's not just Facebook using browsing history to sell you boxes of Tide. They're selling dossiers on you to groups literally trying to gaslight and manipulate you, to subconsciously influence you to do things, or to just make you generally feel like shit. Facebook exacerbates this behavior by "advertisers" by using your dossier to stick you in a filter bubble while at the same time showing you content that maximizes "engagement" and nothing else.

The dog wagging and gaslighting are not common knowledge or well understood by most people. Neither are the shadow profiles or the access of data by any organization that drove a dump truck full of money to Menlo Park. They're worse than the old school information brokers and credit reporting agencies because they feed all of your behavior into their graphs rather than just transaction history or public data.

> They're selling dossiers on you to groups literally trying to gaslight and manipulate you, to subconsciously influence you to do things, or to just make you generally feel like shit.

Where can I find one of these dossiers? Or at least a screenshot example of a dossier that someone bought from Facebook?

Surely you wouldn't make a claim without seeing proof of this behavior happening. That would misinform people and your not trying to do that, right?

Who needs a screenshot? Look at your own[0]. Yeah I am[1] trying to misinform[2] people[3].

[0] https://m.facebook.com/help/212802592074644 [1] https://money.cnn.com/2018/03/24/technology/facebook-data/in... [2] https://www.buzzfeednews.com/article/katienotopoulos/faceboo... [3] https://www.cnbc.com/2018/03/20/how-to-see-which-facebook-ap...

Wait, you’re saying that Facebook allowing you to freely download your own data is selling dossiers? Complying with GDPR is wrongdoing, when Facebook does it?

You're well aware that's not what I was saying. I was demonstrating the data Facebook makes available and what they build their Ad products out of.

It sounds like Facebook is allowing advertisers who already have names and contact into for people (which is widely available info, so not too surprising that they have it), to target ads to those users. Is that what you meant by “selling dossiers”? That doesn’t sound like a dossier. I could see describing the user’s ability to download their own data as a dossier, but that’s just compliance with GDPR, not “selling dossiers”. I feel like there is some confusion happening here, where the data about yourself that you can download is being conflated with the name/contact info that the advertisers already have and use to buy ads, and these two separate things are being mixed together and described as “selling dossiers”.

To be clear: GDPR data you can download about yourself includes the information about the advertisers who already had your contact info. Those advertisers don’t get a copy of the GDPR data portability document.

You're being willfully obtuse here. All of the data your GDPR documents is what Facebook builds their actual products out of. Facebook is selling advertisers and data brokers your social graph, browsing habits, and other details linked to extremely easily correlated selectors (e-mail, phone number, etc).

Insinuating Facebook is not selling a personal dossier because they don't attach a copy of your driver's license is ridiculous. Your relationships and activity are your personal identifiable details.

Facebook sells ad space, not data. I think you have a misunderstanding about Facebook’s business. They don’t offer any product where you can pay to look at someone’s private data. There is no way to buy a dossier from Facebook, it’s simply not a product they sell. Maybe you’re thinking of background checking companies who actually provide that kind of service? I haven’t seen much protesting against them, and what they do seems pretty invasive!

I think these (to the extent they are true) are just a bunch of synonyms for ad targeting, which people already intuitively understand. If an ad is targeted at you, obviously the information needed to do that has to exist somewhere. People may not know the technical terminology, but they understand it. I’m not just talking about the tech filter bubble. When I visit my rural family home, people talk to me about it. They joke about what the algorithm will think of this or that activity they do on a phone.

It’s not true that you can just buy a dossier on someone from Google or Facebook. That would make no sense, their business is rationing the use of that data by selling inferences (the gold eggs), not by selling the model (the golden goose).

So Facebook apps with access to your friends lists, group memberships, and likes aren't dossiers? As Cambridge Analytica should have demonstrated is relationship graphs are personal dossiers. They're significant predictors of habits and behavior. It's also trivial to link those graphs to selectors like phone numbers and email addresses.

But let's pretend that because Facebook isn't providing third parties Manila folders full of photocopied papers that they're not selling your PII.

Woah, motte, meet bailey! So by “selling dossiers” you actually meant “allows users to choose to share friends list for free”, a feature that does the same thing you can also do with your contacts list on iOS and Android? And you’re muddying the waters by bringing up a group of criminals that also used other, now defunct APIs?

Took a long time for me to notice since I didn't even think that it could be possible.

To be fair if you add an opt-in step to anything, it will kill that thing. No moral judgement, just human laziness. If it doesn't kill it, it still becomes something everyone loathes (e.g., how you need an extra click to accept cookies on every site you use).

I think in some situations if users see value in the opt-in then it can be ok. E.g. your phone asking you if you're happy to share your location with an app. I sure as hell want my mapping app to know where I am, but I also feel very comforted that I still get a say in the process. The thing about this tracking opt-in is that no user would ever want it because it's solely there to exploit them. So in this case I think you're 100% right.

Wouldn't the value in this situation be "you get to use Facebook"? If they didn't make money off their users, Facebook wouldn't exist.

Would you be ok if they did it that way? A warning that says "by using Facebook, you are agreeing to be tracked", at which point the user could either continue or uninstall the app?

This is a bullshit tradeoff. Facebook still knows a ton about you by your friends and activity on Facebook, and they can still show you a ton of ads on Facebook that are highly targeted to your demographic profile, and make a shit ton of money doing it. They could also make a ton of money showing you ads on a partner app if, for example, you logged in with FB to another app.

The only thing Apple is preventing them from doing is making an even larger shit ton of money by essentially knowing every app you ever use for anything that includes the Facebook SDK.

Note the same thing is true of Google. Google can (and did, and does) make shit tons of money by showing you targeted, relevant ads just based on your search keywords, or alternatively on a partner site by showing you ads just based on that site's content. But no, they need to make even more gargantuan shit tons of money by tracking your every move in Chrome and Android.

I think the new changes will hurt facebook competitors more. Everyone knows Facebook and it has a brand. They want to collect some info? Most people won't care - they just want to use the app like they always have. They might think twice with a new app that they don't know

I hope it might have the effect that those newer apps instead choose to innovate with their business models and pursue directions that don't require the user to sacrifice their privacy.

The change Apple is making keeps Facebook (and others) from using the advertising ID to track users between apps. Facebook's ability to notice that you have suddenly started posting a lot of baby pictures and choose to serve baby-related ads is unaffected.

Aren't they free to make their app not work at all without this setting? If so, then they must still find enough in letting you use facebook without it, even if less than they would like.

IIRC, Apple’s rules say an app is prohibited from not functioning if it’s denied permission.

Oh you may be right, sorry. I guess it's supposed to offer what functionality it can, like voice calls but no video if you decline camera permissions.

That wouldn’t fly in the EU because if the GDPR. https://ec.europa.eu/newsroom/article29/document.cfm?action=...:

“If consent is bundled up as a non-negotiable part of terms and conditions it is presumed not to have been freely given.“

If you add an opt-in step to anything people don't want, it will kill that thing. If people were opting into getting an actual cookie rather than a tracker for advertisers to understand and target their behavior, you'd have 100% uptake.

That people won't opt into something that they didn't ask for and isn't primarily for their benefit is unsurprising.

I think it’s a stretch to call Apple’s solution opt-in. It is answering to a Yes/No question where your reply to allow tracking is no more obnoxious than to prevent it.

> To be fair if you add an opt-in step to anything, it will kill that thing.

That's like saying if you put a price on something, it will kill that thing. No, it doesn't.

It will certainly kill anything users wouldn't normally want. If my business model depends on stuffing a shit sandwich into my user's pocket without them knowing, and then something changes so I now have to ask them "Would you like a shit sandwich?" my business model will be in big trouble.

Most people gladly opt in to use their webcam for Zoom.

That's the key feature. That's why they're using the product.

I opt-in to using my car to drive, and I opt-in to using my laptop to write code.

I don't opt-in for tracking, advertising, or other negative externalities.

I think that was the parent commenter's point. That is, "opt-in never works" is only true if the thing you want the user to opt in to is something someone would never want in the first place.

And I don't even think it has to be the primary feature. As someone else mentioned about maps, map apps are still plenty useful without location tracking (indeed, analog maps worked well for millennia without it), but I know if I opt in to location tracking while using a map app that I'm going to get a lot of additional useful features, so I do it.

I thought the model was you had to ask permission, not that you just had to tell them.

E.g. it's not a cookie banner type thing, you provide the text for the dialog, and the dialog gives users a yes/no option.

So there's no ambiguity about what the user's intent in, and any developer who ignores it wouldn't be able to argue that they didn't understand.

> but the minute you make these users aware of the tracking and ask for their permission, the business model falls apart.

Unless you break the service in case the permission is revoked. Then users gladly enable the permission.

Reply on news.ycombinator.com