Messenger API Updates for Europe | Hacker News Reader

Messenger API Updates for Europe

developers.facebook.com

81 pointszsiciarz78 comments

So instead of making their system less-privacy-invasive (which I have seen no indication should be impossible wrt the APIs mentioned here), they just shut down services where this is regulated.

Not surprised, but there's no way to spin this in a way that doesn't make Facebook look shady and bad. So much for "working with regulators".

What makes you think the APIs could be changed to comply? Maybe there’s no way to implement what they used to do legally.

You can see what API calls do not work on the listed page. Most of those should not require any privacy breaking features so it should absolutely be possible to implement them legally. They just don't like to do so.

This is just speculation on my part, but if facebook implemented these API calls in a privacy-respecting way for the EU market, then it would be very easy for the US government to suggest that the already-existing privacy-respecting version should be used in their jurisdiction too. Maybe that's what facebook wants to avoid?

It does say:

"We are currently working to restore these features and will continue to update this document and the changelog section with the details as they are available."

Doesn't this suggest that they aren't being shut-down?

It might be temporary, but removing features "temporary" certainly sounds like being shut down, but temporary.

Interesting that Facebook and everyone else has been knowing that these rules have been coming for years, they still haven't been ready. Certainly reads like they haven't been working with anyone, and their last resort is now to temporary shut down the features they were unable to fix, during these years.

As the other commenters have said about GDPR, it could also be polite-speak for "never" (or "until we can lobby our way to new laws").

>Interesting that Facebook and everyone else has been knowing that these rules have been coming for years, they still haven't been ready.

There's being ready, but I think there's also some wariness that the penalties for non-compliance are so severe that it's not worth taking the risk.

When GDPR was first being proposed, I was at a startup in the messaging space, and we were in the midst of expanding into European markets. The level of effort to ensure compliance wasn't that high, but without established case law and a history of enforcement actions, it was deemed too much of a risk so we pulled back.

Various websites not available in europe are saying stuff like

> Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market.

and have done so for years.

Facebook's "currently" may be worth as much as the "engaged" and "committed" of those sites.

That reminds me of the many local and regional newspapers in the US that are owned by Tribune Publishing, and whose websites have been inaccessible in Europe since the GDPR went into effect. You'll be met with the following disclaimer:

"Unfortunately, our website is currently unavailable in most European countries. We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism."

Ok, I'm sure it'll be any day now…

It's PR-speak to make the regulators look like the bad guys who took something from you that always-benevolent FB is working on your behalf to restore.

To honest, I think this is probably the begining of the end for Facebook. I foresee that they'll be forced to reduce services in Europe repeatedly. It'll be interesting to see what takes its place.

they'll end up preying on the people in 3rd world countries that don't have strong privacy legislation. Same way as Phillip Morris did with cigarettes...

It's still good if you minimize their impact.

A similar example is sending garbage to China. At a certain point China stopped accepting it. Hopefully soon others will do the same and recycling will be tackled correctly.

Good luck for them in competing with somebody that has the network effect of being available everywhere.

The network effects has its limits. Messengers and social media platforms have so far resisted a winner-takes-all situation. Since social networks are still more often than not rooted within geographical boundaries, it's possible for competitors to coexist on a global level.

It'll be definitely interesting to see what Facebook is going to do if one of those bills that would require it to federate and/or provide an open API gets passed.

I don’t see FB shutting down a service like Watsapp in Europe in the next decade at least, first of all because countless European politicians use it, to say nothing of the hundreds of millions of Europeans who use it regularly. There’s nothing else comparable that can take its place.

Telegram, I think Signal, too. There are alternatives, they're just not as popular now.

Telegram may be getting momentum, but it’s nothing near the usage of WhatsApp over here. Signal nobody knows anything about, there’s nobody on there.

I think this is very local. Here in Sweden I have only ever met one person who used Whatsapp. I feel most people use Facebook messenger with some use of Skype, Google Hangouts, Telegram, Signal and Slack.

In at least France, Romania, Luxembourg, Italy, Germany, WhatsApp is very popular.

By popular I mean "small businesses start advertising contacting them through WhatsApp"-popular.

It would be nice to have a breakdown of these numbers but we'll probably never get them from FB.

Do telcos in US/Europe create the same incumbency that telcos in Latin America create?

Here in Mexico, any mobile data package comes with free data for blessed services like Whatsapp and FB Messenger. Obviously trying to compete with each other on these perks.

Using a competitor like Telegram is a complete nonstarter when trading memes or video chat eats into your data. The cheapest plan from Telcel (pay-as-you-go + holding 20 pesos in your balance) lets you use Whatsapp infinitely.

GG to competition.

They do the same thing here, yes.

But if the EU decides to legislate against FB, for example, I doubt they'll be that silly, they'll probably shoot these clauses down.

In Sweden they do not do that for messenger clients but they do it for video streaming sites. Data is so cheap here that a messenger would not be a good selling point.

It is probably illegal (on the paper we have net neutrality, the telcos just blatantly break the law) to do so in Sweden which why some telcos are in a legal battle with our regulatory authority.

Heh, my cable TV provider in Mexico came with a remote control with a fat "Netflix" button on it for easy access.

While useful to people, most of whom want to just go to Netflix, that level of integration doesn't feel right.

It’s not illegal if you get user consent. I signed up (in Sweden) for a mobile contract with free Apple Music data last year, and they made a big thing of getting consent for them to do DPI to get that.

It’s actually somewhat of a grey area due to net neutrality regulations. Those are EU-wide, but up to the local regulation authority to interpret, which means that a regulator in Portugal or Sweden says it’s cool, in The Netherlands that any music service (sadly not your own Plex) can apply to be delimited, and in yet another EU country it might be completely illegal.

Telegram? Signal? Viber? Matrix?

I feel like all of these apps (with special emphasis on Telegram and Signal) have almost the exact same UX and features of WhatsApp... beyond adoption numbers.

Surely one of these can take its place?

Matrix is used by the French government [1] and the German military [2]. I’m honestly surprised Matrix isn’t robustly funded by the EU yet as an open competitor to US Big Tech.

[1] https://matrix.org/blog/2018/04/26/matrix-and-riot-confirmed...

[2] https://news.ycombinator.com/item?id=23152780

Is WhatsApps a money generator for Facebook? I would have thought it was just a service they bought to stop someone else buying it.

Not yet, they are obviously moving into merging WhatsApp with Messenger/Instagram Direct, but it looks like these recent actions against FB (US Congress questioning monopolistic practices, FB having promises it would not merge WhatsApp with FB Messenger at the time of acquisition, and various privacy investigations from EU countries) are making FB go very very slow on this.

Therefore, so far FB only collects contacts and improves its social network (in the technical sense) with WhatsApp.

They're trying to monetize WhatsApp through their Business API. They have a directory of Business Service Providers that can provide API access and integration services. Their partnership model is very convoluted and flawed, though, and it's hurting adoption.

https://developers.facebook.com/docs/whatsapp/

> There's nothing else comparable that can take its place.

Nothing that can replace WhatsApp? A simple messaging app like hundreds of others out there? If they shut down tomorrow I don't think anyone would be impacted. People would just switch to one of those. Nobody in 5-10 years would be like "I miss WhatsApp".

It might be the bigginning of the end of Facebook dot com, but Facebook as a company I feel will be here for a while. Facebook used to just be Facebook dot com but they've since become almost a tech conglomerate. The big tech firms are basically just holding companies for all the stuff they've acquired over the years.

Yea, once you're that size even if you're struggling you're around for decades.

While Messenger is linked to our Facebook account state, where you can be arbitrarily banned for any reason without any accountability or recourse, the idea of relying on Messenger as a communcations app is an absurd proposition.

Problem with this is, that you have a massive number of users on facebook, and not wanting to do business using them, could be a massive hit to your sales.

I know people, who only look for businesses on facebook, ask for support questions there, and dont't care if the business doesnt have a full webpage, if it has a facebook page (and even if it has, sendin an email is a lot "harder" than just clicking "chat" on a facebook page, to ask something (eg. if they're open now, due to pandemic,etc.).

I mean, if I was a business I'd look at using it purely for that, but as a personal service? Absurd.

Seems like a huge hit to the myriad business-to-consumer chat startups that sell premium messenger experiences to brands for customer service etc. It’s also a hit to any business who has invested in chat as a service/sales channel, assuming that all chat APIs will be subject to the same limitations.

These APIs that are being limited have very little to do with user privacy and mostly impact usability. For example it looks like handoffs between chat apps are no longer possible in Europe- a company could have an entry point chat bot that routes to a live human, or routes to an order-taking bot. That routing is no longer possible without the “handoff protocol”.

It looks like users can no longer send attachments to a business either. (Or rather they can still send the attachment, but the business can’t use the api to access it?). I don’t believe this is a win for users and just shows some unintended side effects of EU legislation.

Unintended by the legislators, maybe, but I'd wager this punitive reaction by Facebook is very intentional. Many EU businesses are going to have their commerce and customer service flows break 9 days before Christmas. It will be interesting to see how much backlash from these businesses is leveled at the EU regulators and how much is directed toward getting off Facebook's platform.

This is desperately short on explanation? The very high granularity suggests that some features are more privacy-invasive than others, but not why that is.

(Also, listing the UK under EEA is .. complicated and subject to change in the next few weeks. https://en.wikipedia.org/wiki/Membership_of_the_United_Kingd... )

While come January the UK won't be part of the EEA, at least initially GDPR will continue to apply as most EU law has been grandfathered into UK law post-transition.

Yes, but as far as I'm aware the question of whether the UK will be a "third country" for purposes of data transfer outside the EU after January 1 is still undecided?

(Where is Facebook's data center anyway, is it Ireland?)

Forest City, North Carolina; Altoona, Iowa; Fort Worth, Texas; Los Lunas, New Mexico; Clonee, Ireland; Lulea, Sweden; and Odense, Denmark

EU laws and regulations still apply to the UK. It’s not clear though what the situation will be starting with the first of January next year.

The UK is subject to EU law and is part of the EEA today; they have to go on what's true now, not what may be true in a few weeks. In any case the UK will inherit most EU data protection rules; they'll presumably change the wording in January, but the rules won't change.

Great news!

Less so for Switzerland? Because this does not seem to apply to Switzerland, which has signed the EEA agreement, but did not join.

I am wondering about the same, even though Liechtenstein is mentionned which has the same agreements as CH with Europe.

How do people here feel about these changes?

I've the initial impression that this will be a good step for reducing the drift of user content into other websites and spaces where messages or user data may end up outside of the context for which it was generated.

What are they claiming is motivating this change?

> As part of our efforts to comply with new privacy rules in Europe

That doesn't really say very much. What new rules? Why the API?

epd

epd means e-Privacy Directive [1] for those who are not familiar with the acronym

[1] https://edri.org/our-work/epd-faq/

Sorry but epd (ePrivacy Directive)[0] is from 2002 with last amendments in 2009 and has nothing to do with this.

There's a draft for "ePrivacy Regulation"[1][2] introduced in 2017 that looks to replace ePrivacy Directive, but it's still in a draft and discussions stage. There's no guarantee it'll become a law.

[0] - https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32...

[1] - https://www.mckinsey.com/business-functions/risk/our-insight...

[2] - https://en.wikipedia.org/wiki/EPrivacy_Regulation

Sorry but you’re mistaken. The original ePD applied to messaging services, ie, SMS providers. What changed this year is that a few months ago the EU decided that providers like Messenger should be covered by the regulation too.

Source - worked on ePD compliance.

Could this be why Google are withdrawing their free phone calls on Google home devices in the UK as well?

Thanks!

But I don't understand how ePD with no changes from 2009 can suddenly include Facebook and others? Unless there have been other regulations passed?

I can't find anything about ePD changes that forces Facebook to do this, all I can find is the upcoming ePR (ePrivacy Regulation) that will affect Facebook and others, but it hasn't been passed yet.

I haven't heard of any privacy/GDPR/ePD changes recently other than the EU-US Privacy Shield invalidation.

Is there anything I can read on the changes you're talking about?

Sorry, everything I’ve read is internal material. The lawyers spoke to the EU and were told this needs to happen right away. So it is happening.

> ...lawyers spoke to the EU and were told this needs to happen right away

Sorry but this is not how EU works and it doesn't make any sense at all.

You can't "speak with the EU", in the same way you can't "speak with the United States of America".

You can speak with a data regulator in a specific country if you wish so. But each one of them is also part of the European Data Protection Board, which ensures the consistent application of data protection rules throughout the EU.

I can understand lawyers speaking with one of the regulators, and been told about the ePR "ePrivacy Regulation" proposal that looks to repeal the ePD "ePrivacy Directive".

But we live in a sane world (at least here in the EU) where impactful regulations and directives don't change overnight without any notice and implementation period. The ePR "ePrivacy Regulation" draft suggests a 24-month transition period, similar what happened with GDPR which was agreed in 2016 and went live in 2018. So the earliest ePR will take effect as of today is 2023.

Having some "lawyers speak with the EU" about some unannounced "internal material" that "need to happen right away" doesn't make sense.

So no, I don't see how your or Facebook changes were influenced by ePD "ePrivacy Directive" from 2002/2009.

Ok dude. You know better.

I was using short hand when I said “spoke with the EU”. You chose to misinterpret that.

All I know is that Facebook needs to comply with this by December 21st. This was something we became aware of a few months ago.

If you think that’s impossible, fine by me.

You should've said December 21st straight away! I now have found what you're talking about.

On December 21st, a 2018 European Electronic Communications Code (EECC) directive goes live on 21st of December 2020.

It's a directive to consolidate and reform the framework for the regulation of electronic communications services and networks in the EEA.

> Under the EECC, the scope of electronic communication services will be expanded to include over-the-top/online communication services. Therefore, providers of VoIP services and other online communication apps (video, chat, messaging) will be subject to telecoms regulation and by extension the ePrivacy Directive.

> For the foreseeable future, those caught by the provisions of the ePD will continue to need to comply, taking into account the interplay with the ever-evolving guidance and case law on the GDPR (e.g. on consent, notice, etc.), which will often apply in the context of the application of the ePD. The ePD rules have not been kept up to date with the latest technological developments and are also not well aligned to the enhanced protections of the GDPR.

I was wrong, the changes are influenced by ePD, but indirectly because of the broadening definition of electronic communication services. Finally we're there. I'm surprised no one else commented about this earlier and it took so much time to understand why this is happening.

Just speculating, but it could be to do with the recent ruling that the EU-US Privacy Shield data sharing agreement was invalid https://easygdpr.eu/2020/08/privacy-shield-invalidated-what-...

This means that data sharing between the US and EU is a lot more complicated, as the EU ruling basically says that US data protection regulations are not sufficient to comply with the requirements set out in the GDPR.

Some further context on the case, with dates: https://www.irishtimes.com/business/technology/transatlantic...

It seems like some of these features were loading images directly from the client. So presumably this could have been used to get info like your browser and IP as your phone made the request to the server that they provided.

The recommended work around to to just send the link which now makes it explicit to the user that they are connecting to the third party.

If this theory is correct, sounds like they want to avoid another Cambridge Analytics incident.

I've added a guide here to help you figure out the impact on chatbots specifically: https://medium.com/chatlayer/breaking-facebook-messenger-api...

How is prohibiting sending audio/video attachments in messages related to complying with privacy regulations?

The way this page destroys my browser history and disables the back button is a bit troublesome...

We need a decent gdpr compliant business dependable rich messaging platform for europe. it is ridiculous, now the rest of the world has wechat, messenger, kakao and line, but in europe there is nothing.

I thought both Teams and Google Chat claim GDPR compliance?

Google chat is not business dependable because google shuts down and replaces its messaging product every 4 years or so. Teams is not a platform in the sense that you could not eg. start selling pizza to random endusers with a pizza bot. I mean something that can be a european wechat revolution.

I guess, for GDPR purposes, they would need to show why they can't provide the service without privacy invasion.

Great news, I feel much safer now. Now I'm waiting for EU to completely ban computers, this way I will never be attacked by anyone online.

But seriously, if anyone had doubts what GDPR will achieve, I think this person is pretty naive. GDPR is not a progression, but a regression, and it will seriously hit (already does) online businesses in the long run.

Same thing with cookie warnings. No normal person will read tons of legal text on every website they visit. And even if the normal person will read it, they won't be able to decline the cookies, because the site will not work. But let's say you're a technically savvy person that is actually interested in cookie privacy; I'm really surprised you're not using "cookie autodelete"-style plugins already.

Creating laws only to have laws will never work. It only creates cost for everyone in order to be compliant. And people always go where the cost is lower.

> But let's say you're a technically savvy person that is actually interested in cookie privacy; I'm really surprised you're not using "cookie autodelete"-style plugins already.

I feel this is like saying "we don't need safety legislations at work because businesses take a hit trying to stay compliant, if you don't want to be hurt at work, I'm surprised you're not wearing a helmet already."

Thing is, I wouldn't need "cookie autodelete" style plugins in the first place if companies cared about data privacy.

You shouldn't wear a helmet because other people tell you need to wear it. Instead, you should wear it in order to be safe.

The problem with law is that only good guys abide the law. And you don't need to defend yourself from the good guys, only from the bad guys. And bad guys will violate the law anyway.

Cookies that are required for the site's functionality (like login, shopping cart, etc) are allowed without even an opt-in dialog

Reply on news.ycombinator.com