Hacker News Reader

Comment by smarx007 | Hacker News Reader

I think what Apple is saying is that it's not the browser's job to ask consent for storing a cookie or for doing browser fingerprinting but a website's. As much as I dislike IDFA, I think I must agree with their line of reasoning.

Edit: Let me bring an analogy (GDPR applies to physical world too). Most cars have a visible VIN number like a phone has an IMEI (if you replace IDFA with IMEI mentally, which would be much worse if that was exposed to the apps). If you take a photo of the VIN and then track the car using this identifier in some way, you are [potentially] violating GDPR, not the car manufacturer.

View on HN

However, the car number is mandated for legal reasons that are easy to explain. The user on the other hand gets no benefits, the society gets no benefits, and those who benefit are random people whose motives are unclear.

I find that I benefit greatly from targeted advertising.

A couple of years ago I realized that Spotify's recommendation algorithm provides me with a better selection of music than any other method ever has.

Lately I've found ads targeted using advanced ML implementation have been of great value to me as well.

I don't remember ever purchasing products from direct response marketing before, but this year I've purchased multiple high importance things that I would not otherwise been even aware of.

If it was actually of value to you then you would have searched for it yourself. That you needed advertising to find it only shows the toxic effects of advertising (convincing you that you needed a product that you actually didn't, and/or incentivizing the lobotomization of organic search so that you would go based on the ads instead).

I enjoy receiving targeted products or services which I wouldn't have otherwise known about. That isn't toxic; we live in a world with tens of millions of products being offered worldwide. Just because we don't come across them "organically" doesn't make their advertising toxic. I'm still an individual who makes a conscious purchase decision.

>convincing you that you needed a product that you actually didn't

What if it's convincing him that he needs a product that is actually of benefit to him, that he didn't know existed?

It's an issue of Push vs. Pull.

I don't want crap pushed on me without consent. Once you have consent, (which is me doing a pull of what you're offering), then it's okay.

I'm surprised with all the controversy over consent in the last year or so that Tech and Ad companies still don't understand this. Then again, the wisdom of Upton Sinclair applies.

--It is difficult to get someone to understand what their paycheck is dependent on them not understanding

You would be hard-pressed to find anyone who disagrees on the issue of consent. The following is what I replied to though, and is unrelated to consent:

>The user on the other hand gets no benefits, the society gets no benefits, and those who benefit are random people whose motives are unclear.

This is blatantly false. In this thread alone there are multiple people who have stated they find benefit through targeted ads.

“If I had asked people what they wanted, they would have said faster horses.” - Henry Ford.

Several years ago I saw a Facebook ad for an online coaching program for aspiring music producers.

It was exactly what I needed at the time, but I had no idea that someone had put something like this together, and I would never have independently thought of googling this. Instead, I relied on music production tutorials on the one hand, and generic productivity advice on the other hand, and assumed that was the best help available out there.

That is just my anecdote, but I'm sure everyone here has their "how could I possibly live without this before" product or service.

Advertising can be useful, and the more targeted, the less obnoxious.

It seems you're conflating innovation with marketing. It's perfectly legitimate for someone to invent a car. It's not, however, to cold call me or send me car catalogs or show me car ads on the web ad infinitum until I submit and buy one.

I'm not a huge fan of targeted advertising but this strikes me as pretty hyperbolic.

„more purchased items” is main target of ads, isn’t it?

How do you benefit if they separate you from your hard earned money you wouldn't otherwise spend?

Since your experience is the exception (or at least not the rule), targeting should be opt-in.

Does Spotify base recommendations on the kind of tracking used by targeted advertising? I would think their recommendations are entirely based on the music you've listened to on Spotify, rather than, say, information they've gathered about your demographics, web browsing, purchasing habits, etc.

Personalized recommendations by an app based on your usage of that app are not what people mean by "targeted advertising." The privacy implications are completely different.

I thought so too, but I'm not completely sure since they rolled out the personalised "Time Capsule" playlists. Most of the tracks in mine seem more based on my age and location than my listening history. Particularly, many tracks that were in high rotation on a popular national alt/youth radio station when I was 10–15 with no obvious connection to my current listening habits.

I looked it up after writing the last paragraph, and indeed "playlists are [...] based on the country you live in, genres you listen to and your age" (https://www.billboard.com/articles/columns/pop/9456319/spoti...).

Still I'm not sure if this information comes from tracking or my mistake of signing up to Spotify with my Facebook account.

As well I've find the time capsule playlist absolutely horrendous in all its recommendations. Sure it plays some things from my library but that's what I have my library for. Everything it's suggested has been ridiculous and honestly had me thinking it was just another corporate mandated playlist by committee based more on money for plays than my actual enjoyment of the music provided.

Well, then you can opt in. Your choice. Do not impose it on others though.

> I find that I benefit greatly from targeted advertising.

Then by all means, in the future, opt-in whenever you need to!

> I find that I benefit greatly from targeted advertising.

Your only foundation for this reasoning is that you've bought more things. What this definitely says is that the advertising is targeting you successfully, what it does not say is that you benefited from it. You clearly lived before you owned those things, presumably pretty well given your evident spending habits.

In conclusion, when looking at this post we can say just as easily that you were harmed greatly by targeted advertising.

Totally agree. This is why you don't shut down postal service, just because they could be (mis-)used to deliver drugs or parcel bombs.

But you should close it if they made it easy for that purpose.

I think NOYB can make a good case for nuking apps that fail to ask for consent completely off the App Store if requested by any protection agency.

how much easier could it possibly be to use it for that purpose?

Special discounts?

Perhaps they actively subvert the ways in which those bombs are otherwise detected or they start offering blind pickup so everyone has plausible deniability. There are many ways in which a bomb delivery service could be more convenient than the post.

The consent MUST be received before storing cookies. As Apple stores the cookie without consent, they break the law, even if the cookie is never read by anybody without consent.

What you are saying is that if the websites fingerprints a Chrome browser instance without consent, Google is liable for that.

> The consent MUST be received before storing cookies

I don't think we have any disagreement about that. We are discussing who is liable for failing to follow GDPR here.

Is consent required before setting a MAC address on a NIC? I don’t think it’s the NIC manufacturer’s duty to get consent because others fingerprint devices using the MAC address.

Someone please correct me if I'm wrong but I think things that are required for the functioning of the program/device/service are exempt

... and how is Apple supposed to know whether the cookie that is essential or not? This is precisely why the onus is on the website owner.

If the device can work without that ID (which Apple admits it can, since they say they never READ it), then obviously it's not essential

This is the correct view on the matter, in case the grayed out reputation makes you doubt it.

why is this the correct view?

I didn't elaborate because there really isn't any more to say about it. If you've read up on how the GDPR works and know what essential means, you will see this person is correct.

For what it's worth, I have been involved with implementing the GDPR properly in a number of reasonably large companies. Sadly a number of people can say this and a vanishingly small amount of companies actually adhere to it properly, so I'd take it with a grain of salt.

They are exempt from consent but not from the law. Also, GDPR is not about things but their processing purposes. If you use my MAC address to address my network traffic, that's a legitimate business need; no consent is needed. If you use the same MAC address to track me, you need consent.

Right, but Apple isn’t using the adid to track anyone (other than traffic to its own sites). So the gdpr aspects apply to sites, not the phone maker.

It’s not a cookie. Idfa isn’t even available in the browser.

A distinction without a difference as not every interaction involves a browser. It can be used in the same manner as an identifier cookie (it doesn’t carry a payload) for cases that do not involve a browser.

It’s not a distinction without a difference.

Some people here seem to think it is available in the browser. Using the word ‘cookie’ furthers that false belief.

I otherwise agree with you.

The term “magic cookie” in the sense used by browsers predates the WWW. That’s why the term was used.

True, but the term ‘magic cookie’ is not the term we use today. If you said magic cookie I’d know you were using the historical term. I’m old enough to remember but most people here are not.

Reply on news.ycombinator.com