Hacker News Reader

Comment by fxtentacle | Hacker News Reader

Oh wow, it's the same guy who won in court against Facebook. I can understand why Apple feels the need to quickly shoot back.

He's pursuing Apple under German law, and Apple's statement was that they fully follow EU law. So they may both be right at the same time.

In detail, Apple is creating a device-unique ID for advertisement tracking and access to that will be user-controlled in iOS 14. And Schrems is filing because it is exposed to advertisers without the user's consent in iOS 13 and earlier.

View on HN

Here's Schrems' NGO announcing the whole thing:

https://noyb.eu/en/noyb-files-complaints-against-apples-trac...

Edit: NOYB (the NGO, "None Of Your Business") is probably one of the more cost-effective ways of supporting a fight for real privacy over corporate interest. Just in case people here are wondering where to put their holiday season donations...

I can no longer find the option to reset my Apple-Advertisement-ID in iOS 14.

It has always been user-controlled, but it was previously opt-out, while the change will make it opt-in.

It's not user controlled if it is on by default.

if the user can opt-out, how it isn't user controlled?

default passwords, that can be changed, aren't under the user control?

I interpreted the statement as if something is invisible to the user (without knowing to look for it), the (average) user has not had a hand in it, and are thus not controlling it.

Pedantic, granted, but relevant in practice.

You're right. This is why "defaults" need to be part of the conversation.

https://www.fastcompany.com/40403706/the-subtle-power-of-def...

GDPR isn't interested in control, it's interested in informed consent. You can't give informed consent if you were never asked for consent in the first place.

GDPR effectively prohibits ANY opt-out. A an informed consent via affirmative action must be freely given.

Apple is so much in the wrong here.

Maybe one day we can get a law like this around opt-out autoupdates that hands control of your device over to a remote party that can execute arbitrary code on it without your involvement.

This is becoming the norm even in security/cryptography software like iOS and Signal and it’s terrifying.

>GDPR effectively prohibits ANY opt-out.

This isn't true. I don't understand how people continue to make GDPR into this grandiose thing that does everything under the sun.

I did mention the need for consent quite explicitly. Which part of it 'isn't true'.

It's true though that you need explicit consent for sending PII under GDPR. Whether IDFA is considered PII (I think there are strong hints it is) is up to the jury. More surprising is that Apple is hellbent to defend this when they've only their pro-privacy stance to loose.

IPs alone are considered part of GDPR consent (when collected/tracked).

> GDPR effectively prohibits ANY opt-out.

This is absolutely not in any way a true statement. The GDPR applies to very specific things, and I don't think you could find a reading of it where it applied to maintaining the IDFA on a phone.

Reply on news.ycombinator.com