Hacker News Reader

Comment by Hitton | Hacker News Reader

I'm surprised about:

>Consent must also be freely given. The DPA highlighted that users should have a real choice not to consent without any negative consequences. Grindr made use of the app conditional on consenting to data sharing or to paying a subscription fee.

I thought that this was allowed. Kind of puts companies depending on advertising in really bad position. One would expect that having choice of paying or getting tracked would be, at least for some people, better than just having to pay to get to the content.

View on HN

> Kind of puts companies depending on advertising in really bad position

Good. I hope these companies die. This business model is more toxic than Dow Chemical.

You can advertise without bulk collection of personal data.

Yeah, but personal data is way more profitable. Hence why every popular site puts all the opt-out buttons & privacy terms behind tiny fonts placed in some hidden inconspicuous corner.

I recently stopped thinking of myself as an Internet user on the web but rather an advertising ID holder.

I would dispute the profitability of contextual vs personalized advertising (see NYT’s experience) but is too early and coffee hasn’t kicked in yet.

What kind of financial losses are we realistically talking about from being denied such tracking? what kind of percentages of lesser revenue?

Probably net zero, as long as everyone follows the same rules. Advertising is a zero-sum game, and changing the height of the playing field shouldn't impact relative revenue all that much.

As an advertiser, not true at all. Promoting products to any niche smaller than "man" or "woman" basically requires targeted advertising to make work.

Couldn't this be done based on content, without looking at personal data? "Here is an article on investment. How about I show an ad of an investment bank."

If only one company does it, they lose. But if everyone is forced to do it, noone will lose.

And it's more commercially effective to be more specific than that and take the reader's profile into account.

It's also not a zero sum at all. An advertisement that is not within the user's interest is wasted, rather than going to the competitor.

> An advertisement that is not within the user's interest is wasted, rather than going to the competitor.

Not completely, if there is anything to the concept of "brand awareness" (and I believe there is, and a good chunk of advertisers do too). An ad that is not within user's interest still makes an imprint of the brand, product and vendor in their head. Later on, where user's interest change, that brand/product/vendor is a bit more likely to be recalled by them. A mistargeted ad is better than no ad at all.

In theory, yes, in reality, no. The strongest, biggest signal of what ads people will click is what kind of ads they clicked in the past. Content based ads have really bad performance comparably.

> biggest signal of what ads people will click is what kind of ads they clicked in the past. Content based ads have really bad performance comparably.

Has anyone actually compared this over long stretches of time and compared apples to apples, not apples to oranges?

Additionally, most people don't want personalized ads based on tracking: https://www.emarketer.com/content/do-people-actually-want-pe...

No one denies that they don't want it.

I'm sure customers also don't want planned obsolescence. — it is very good for business, however.

There's very little planned obsolescence anywhere. It's more about racing to the bottom and building the chepest possible product that will hold for a while.

Planned obsolescence is a tricky term and has many faces (see e.g. a classification at [0]). A good and widespread example of overt, in-your-face planned obsolescence (surprisingly not mentioned in the article I linked) is "fast fashion", where nobody even tries to hide that clothing is designed to deteriorate quickly, to accommodate a season-long replacement cycle.

I think race to the bottom deserves to be its own type of "planned obsolescence" (again, not mentioned in the Wikipedia classification). While in a highly competitive market, the design process may boil down to "do the same as competitor X, but slightly cheaper" instead of explicitly setting the durability target low, the end result is the same - products that have no business existing enter the market, live very briefly, and forever enter the waste stream. It's a systemic problem, and it's planned in the sense that if you enter such a market, you've already decided to create short-lived trash.

[0] - https://en.wikipedia.org/wiki/Planned_obsolescence#Types

Surely male and female also require targeting? It's not as if browsers come in pink and blue editions and broadcast that.

Nope. There have already been articles/studies showing that "targeted advertisement" is about as effective as plopping a billboard sign on a motorway.

> I thought that this was allowed.

No, that's one of the big wins of GDPR. You cannot just force the users to sign away their rights.

How is giving choice between paying with money or paying with data forcing users into signing their rights away?

Well, to make it more obvious - if users had the choice of paying with money or paying with their future voting rights, would that be "forcing users into signing their rights away?". Surely, not "forcing" since it's their choice - but, I hope we agree that it's a choice that should NOT be presented to them, at all.

You may or may not agree on whether the right to privacy should be on the same level as the right to vote, but other than that, it's really the same principle.

I don't share your paternalistic view of having to police people's actions. Giving informed consent to use some data (and eventually ability to withdraw that consent when the business between the parties ends) should be enough. And your comparison between sharing users' personal data, something that influences only them and voting rights (which are not transferable btw) that influence everyone is absolutely ludicrous.

Privacy absolutely affects everyone. If you gave consent to Facebook to track you & you are my friend, you'll give my phone number to Facebook, and photos of me, etc. I cannot opt out of that! And in fact FB is well known for building shadow profiles [+]

Look, I understand if you feel "privacy rights" and "voting rights" are not in the same class of rights, I even mentioned explicitly that even though the same principle applies, you may not agree they're comparable. But you can't deny that the only reason voting rights are not transferable is because we said so - we have laws that dictate "voting rights are not transferable". It's easy to imagine a world where voting rights would, in fact, be transferable. It's just as easy to imagine a world where advertisers don't have the right to build a profile about you.

What is happening now is that we started with a world where (online) privacy rights were non-existent, and laws like GDPR are aiming to change that. You may not agree with the change, but others do, and it's a legitimate sentiment to have. It's not necessarily outrageous to want to "impose on everybody" my view of privacy rights. No more than it was to "impose on everybody" the view that e.g. women should be allowed to vote.

[+]https://theconversation.com/shadow-profiles-facebook-knows-a...

I don't know why you are bringing Facebook into this. Its business model is completely different, afaik it doesn't offer paid subscription to opt out of all tracking. This is known as straw man fallacy - misrepresenting someone's position and then rebut that.

What you are suggesting is not like "women should be allowed to vote" it's akin to "women must vote".

What does the business model have to do with everything? I was merely replying to this:

> sharing users' personal data, something that influences only them

It does not influence only them, and I gave you an example. Also, I don't care what's FB's business model, I advocate that nobody should have an automatic right to build user profiles. I explicitly advocate that you should not have the right to demand payment in "data" because privacy should not be considered currency. Is that a strawman? I thought that was your entire argument "people should be free to decide to pay with their data!". NO THEY SHOULD NOT. Data is not currency, just like votes are not currency. You ask for currency, if you need payment - you don't ask for profile data.

> it's akin to "women must vote".

Well, it's an analogy, if you don't find it useful, let's drop it. The gist of it is, I feel very strongly that we should legislate that privacy is not currency, you seem to feel otherwise. It is fine to disagree, but it doesn't make my position irrational or absurd in any way. Yes, I feel that allowing people to pay with privacy _is_ exactly "taking their rights away", in the same way that allowing them to pay with their voting rights would be.

I didn't expect having to qualify everything I say to the context of a discussion and topic on hand. I don't agree on your definition of personal data. Phone numbers and email addresses of my contacts are personal information that don't belong to me, I have merely unwritten consent to use them (but not to give them to every spammer).

But none of that seemed to be relevant to the Grindr fine. And one thing I should have probably mentioned before - I don't know Grindr and how the subscription works there, but my opinion on paying(subscription) vs giving data away would also depend if there were additional features granted in the subscription (now thinking about it probably yes) or not. This would in my opinion qualify as forcing user into paying even for thing he might not necessarily want to just to protect own privacy.

I'd like to sell you some cough medication, it's all natural, made from a concentrate of two south-american plant called "coca" and "tabaco", everyone who tries keep asking for more, even when we increased the price !

Too bad the big bad governement regulation prevent me from selling it. It's absolutely ridiculous, all my customers wants it and I pay my taxes.

I'm not a hard core libertarian to argue about whether banning drugs is good, but even in your scenario customers having information about what is the "medication" made of and any addictive properties those things might have would go a long way. And lets not pretend that whether a drug is legal (alcohol, tobacco, even marijuana somewhere) or not is result of rational process and not just result of lobbying and historical custom.

Everyone (in the EU/EEA) has the right to not to have their data processed if there’s no applicable basis. So if Grindr requires money to keep their service active, then everyone should pay the same fee (leaving aside service levels) and not be forced to give up their rights. Alternatively, Grindr could come up with a business model that allows them to offer their service for free without processing their user’s un-needed personal data; an obvious first idea would be advertising targeted at gay men, but not at any one specific user.

I'm not sure if I've ever seen such choice being offered in the first place. It's always either "pay with your data or don't use it at all", or "pay with your money and your data, or don't use it at all".

Also, prior to GDPR, the "pay with your data" aspect wasn't even mentioned by the companies. Ultimately, GDPR doesn't prevent people from donating their data - it just requires that it's explicit and not mandatory.

Really? Going to der spiegel as someone from Chicago I get a "Continue reading with ads, Visit SPIEGEL.de as you normally would with the advertising and the usual tracking. (You can revoke your consent at any time.)" with an accept and continue box or "… or purchase a PUR subscription, It allows you to visit our site without any ad tracking and mostly free of advertising. €4.99/month, €1.99 for SPIEGEL+ subscribers".

I've never been there before. I went on to read the details of their "PUR subscription" via Google Translate, and it seems to truly be a "pay OR give up data" model, the first one I've ever seen. That said, it still isn't advertising-free[0] and contains some amount of internal, first-party tracking[1] (but see [2]).

Below are excerpts run via Google Translate. I'm truly very surprised by what I just saw - the directness and honesty of communications is even more refreshing than privacy-friendliness itself. Their FAQ covers privacy and advertising concerns separately, and is very specific. If I had a need for German-language news, I'd subscribe to this just as a token of appreciation.

[0] - "We continue to advertise our own products discreetly because SPIEGEL readers expect information about new products from the company. We cannot technically remove advertising from podcasts and our digital edition, but this is played without tracking. Individual sponsorships are just as difficult to fade out, and separate page areas such as voucher and sports betting marketplaces that are independently offered by the providers there are only to be made inaccessible in the navigation of our journalistic offers - but not, for example, for searches from outside. This is the level at which the exceptions move."

[1] - "We depend on it [internal usage measurements] for both basic control and further development of the news site, especially in order to optimize our payment model: Which texts are of interest to readers, where do operating elements not work, which pay offer might interest a reader and which rather not?"

[2] - "What data does DER SPIEGEL collect from PUR subscribers? The customary reach comparisons and usage statistics for the control and optimization of the site, especially via our first-party service provider Adobe." - I'm not sure what they mean by Adobe being a "first-party service provider", but I don't like it collecting anything.

EDIT: here [3] is a list of cookies they set for PUR subscribers. Seems to be true to their word (and it's nice this list wasn't hard to find in the first place), but I'm worried about the presence of Outbrain on that list. I can't imagine any legitimate interest a third-party chumbox provider would have.

[3] - https://odbdegi64ni2b3m74jattyok7i--www-spiegel-de.translate...

Yet a very large number of companies do. Open Facebook in an incognito window - it'll give you a dialog with "Accept FB cookies"; options are, "Accept all" or "Manage" (already in violation of GDPR since rejecting is not as easy as accepting!). Click manage, and you get presented with a single button, "I Accept"; sure, there's one checkbox that you can leave unchecked, but it's really unclear from that wall of text what exactly you are "Accepting" and what you're not.

If Grinder was fined 10% of revenue - why exactly aren't they fining Facebook 2.2 billion? It'd be much more impactful, and hopefully help put an end to those practices.

Reply on news.ycombinator.com