EU privacy agency urges more safeguards to curb U.S. tech giants
reuters.com
reuters.com
That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?
The CNAME practice is becoming more and more common. See https://blog.apnic.net/2020/08/04/characterizing-cname-cloak... or https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... or https://www.laquadrature.net/2020/10/05/le-deguisement-des-t...
I think proxying or doing it server side only will be implemented later when these people will be forced to hide to save their shitty business model.
It is similar to a CNAME record but instead of storing the domain name you want to map to it pulls the A record and puts that IP as your A record.
I’m not saying this is a perfect system. It’s not. But it’s an attempt the problem you describe.
No, thank you, I don't want to go through audits and deal with bureaucracy when I just want to publish my side-project blog on the web. If you want to discourage people from building and publishing their personal projects and making them easily accessible to the public, that's how you do it.
However, I am absolutely ok with EU doing this, given they seem to be hellbent on running their local tech industry into the ground. Truly great founders from EU will either manage to make their companies succeed despite EU or eventually end up creating their companies in the US, and both of those scenarios sound like a win-win to me (from the perspective of the US; from the perspective of the EU, I guess they are doing all of this knowingly, so they get what they wanted, which would count as a win in a way too).
If all you did was publish an HTML+CSS page, your innocence is self-evident. Anyone can look at your page's source and confirm it. If you link to Google's javascripts though, that should put you into a completely different category of suspicion.
Things change. Back in the day, HTML+CSS page was all it took. These days, wanting to know how people discover your page or how many new readers come to your blog is basics. Reliability and performance tracking is something that wasn't really a commonplace thing back then. For all of those things, you kinda do have to use JS.
The question is, do you necessarily need those features? No. Would it be nice to have? Yes. When I publish a side project, I want to make it nice and great, since I am not getting paid to do it, I am doing it out of pure enthusiasm and motivation for creating the best I can. Forcing anyone in this situation to go through audits and deal with bureaucracy just to be able to publish their personal side-project is a certain way of discouraging people from ever doing so. All you end up with is a bunch of people who are willing to jump through all these hoops because they have something monetary to gain from it or those who know how to jump around those hoops really well.
Your accusation would be very troublesome if made against individuals but for corporate lawyers its just another day at the office.
Inverting the burden of proof is listed as a logical fallacy for a reason. It is never appropriate.
The income accounting in the UK and Pakistan are the closest thing to legitimate and even then self evidently regarded as extreme by their limited adoption.
Advertisers would compete within that search engine to have the most relevant and accurate product and service offerings to match demand, and would pay the search engine provider for the hosting.
The search engine provider could attribute and send credit back to the websites from which advertising requests from the user agent originated. This could be attributed based on requests, clicks, purchases, etc.
Under this model, publisher websites would not need to design and manage their pages specifically to incorporate advertising slots, and users would not have to see any advertising at all unless they are genuinely interested in further commercial information related to the page they're on.
As a side-effect this could reduce the usage of advertising in various grey areas (spam, disinformation, and even the rare-but-feasible harassment of individuals by using targeted advertising).
It does actually cost money to operate a good search engine.
A few years ago my response to this would be that I'd gladly pay Google $10/year for access to Search without adverts, but over the past couple of years that's changed. Google have become so utterly terrible at handling customers that I no longer would. I'll only use Google services if they're free. The idea that Google might just kill my account without notice leaving me with no access to search would be catastrophic.
I would gladly pay a different search engine company for access to a good search service though.
So for less than a Netflix subscription you have Youtube, Gmail, Search, Drive, Translate, Calendar, Maps, Photos, Hangouts and more. Services that many people use regularly.
It wouldn't be hard to argue that any of these products is worth a lot more than $10 a year, but convincing users at large to go down that route will be a challenge, undoubtedly.
(Also, many users would agree on the value but balk at redirecting funds from an existing allocation to continue service on something they've already gotten for free.)
[1] https://mondaynote.com/the-arpus-of-the-big-four-dwarf-every...
The ad industry's biggest accomplishment is making most users believe that they can have access to state of the art search engine, video streaming, messenging etc... for "free". It means that it's incredibly hard to compete with a different business model.
Instead of google I am aggregating multiple search engines and joining the results eliminating all that are not on most of them. I am losing anything special (like there is something "special" today) but at least I dont get bunch of stuff on google that just wastes my time.
Nextgrid: yes, exactly that. I want old results, I want old content, I want content that matches with my search words 100% instead of getting what google crappy algorithms think that I want. I dont want hipster crap that propagates next silver bullet (that is just a copy what we already had packed into SaaS).
People on Hacker News seem to think Google's results have gotten worse over time. Maybe they have for the narrow set of interests and requirements of this crowd, but I'm very confident they've gotten better for the vast majority of other users (users who I bet are less likely to use an ad blocker too).
> That they eliminate all SEO crap (i dont want those results anywhere near the 100th page of results) and ads from my results and serve me relevant content.
This is an extremely difficult engineering problem. Google doesn't make a conscious decision to include low/middling quality SEO'd content. That content is optimized to appear relevant and high quality. Google does a better job than say Bing at telling the difference, but it's still obviously an unsolved problem.
- Hosts commercial advertising content (not the entire web; only product and service offerings)
- Charges for hosting
- Has a highly qualified audience that genuinely wants to receive relevant advertising (based on requests being user-initiated, not software-initiated)
- Claims credit for revenue generated as a result of providing relevant advertising
... then you're likely to be able to cover the costs of developing and maintaining the system.
- This is a bit like eBay or Amazon, arguably; except that the user profile and context is optional for the user to provide
- Addictive products could still be a loophole that bad advertisers could exploit to monetize users without providing them overall benefit; fortunately local regulations tend to cover that
They are crazy cheap though and essentially act like a TV/Radio ad. It's about getting repeated exposure, even if it's not a direct conversion (because it never is). Everyone wants to get rich quick these days and highly customized ads appear to be the best way to get there.
Not only will they stop showing ads of washing machines after the purchase, knowing the make and model will help them gauge when to start targeting repair ads as well as start targeting replacement machine ads. They will also know whether you will stick to the current manufacturer or which you will switch to, and which model you will buy. You will be able to live with the comfort of knowing that your entire future of washing machine purchases is planned out and concentrate your energy on more important things in life (such as lobbying for better privacy protections).
Even if they have the sales data, it is not connected to the ad data (bought a laptop from a big chain here this week: will get ads for that laptop from the same chain for months) so common sense should work fine for now. If the ads appear around the days I am looking for the article, I even might click on them. Now that my brain knows all ads are irrelevant because they are outdated things I already have, I just do not see them anymore.
It makes sense to show ads for potato chips but with washing machines you should stop after purchase.
I much preferred the time when kiteboarding sites had static kiteboarding ads instead of the current situation where ads are totally out of context.
Or out of nowhere. I get ads for real estate in Chicago - except that I live across the Atlantic. Or ladies products every time after my fiancee used my phone.
Not to mention how most ads are just plain bad. I don't mind actually watching good ads - I was hooked onto buying the Asus Zenbook Pro Duo for a while because of its ad (although later I learnt that the product was shit). The Honda Day/Night ad is another one that comes to mind.
Half of Google's income is derived from businesses pissing their marketing budget up a wall with incorrectly targeted ads. But it's still more effective than newspapers.
Ah yes I was waiting for a response like this. Adsense campaign or do you mean Adwords campaign? There's a pretty big difference between the two.
Also, what's the difference between pissing away money on "poor targeting" and "testing" targeting which helps you to determine what the best options are?
Alot of bro-vado in your comment - what's your avg CTR? Churn rate? Spend? Out of curiosity.
In any case, I put up a network wide Pi-hole blocker shortly after it because the washing machine adds didn’t just show up on my single device, but pretty much every device i own, including my wife’s phone.
I’ve since spent a long time since trying to convince my wife that Apple doesn’t listen for keywords and sell it (though I have no doubt Facebook, Google and Amazon would - if allowed), and that the fact she was seeing washing machine adds as well was either that she had searched for one (at the same time) or they were basing it on our public ip.
I also switched my search engine to DDG at the same time, and it’s quite funny watching the profiling algorithms struggle to find something they think I like. There are still washing machines in there, but the rest of the adds are pretty much all over the place.
New platform, new opportunities. I have thrown money into ad's on various content suggestion platforms, Reddit, Quora, BuySellAds, Google, Facebook, LinkedIn and a hell of a lot more.
TikTok is apparently incredible right now with conversions and pricing. It's all over the forums and the guru's are pumping it too. Give me some solid targeting options and viable metrics and you could probably wrangle some money out of me and many other marketers out there. I would say it's easy money if you can spin the ad network in a new way.
So inevitably you try it, then you get some 'tips', then you read a marketing guru's success story, then you start getting ads for ebooks all of which have the best strategy and you really feel that you have no choice but to go for it. It's the FOMO/what if complex magnified by professional requirements to grow at all costs.
From now on I consider online advertising like gambling. You think you can win but the house always win's because you spend more money on A/B testing, copy edits and new keywords all of which create very few leads or deals. You always think you can win too, 8 years later I still go back to online ad's because I feel that there's just that juicy copy, design, content combo round the corner.
We buy ads for political clients. On FB I could get a positive immediate roi for donations. Scaling huge is hard (i got one client to over $1 million last cycle for context). Admittedly but you could go a lot bigger if you look at ROI down the line with email donations.
And we're not alone. I don't think the many many direct to consumer brands would spend so much money on FB if they didn't get a positive ROI.
Maybe some PE or other funded brands are trying to grow over profit spending more than they make. But there are a ton that are profit seeking and get good value. FB is definitely an exception though unless you are an app install ad on mobile.
For us we make a donation page. The only links that go there are from FB ads. We also use different refcodes for different ad groups AND the FB pixel passing in purchase value which is really good at optimizing FB's delivery to highest ROAS
FB is very very very good at this
I feel like people who question it or like don't understand basic attribution should do some more research before denigrating
There are other non-direct measurement, FB for instance allows you to upload offline purchases. Definitely not as clean especially if you're hitting across different channels. But a basic A/B holdout test is pretty good in that case too.
For us personally we cannot get anywhere close to similar ROI from other platforms like Snap that attempt to be FB let alone contextual targeting.
It probably works better for app instal ads but otherwise it's.
The cookie based ecosystem also doesn't add a ton of value, some studies say between 5-15%.
It's Facebook and Amazon and Google's 1P data that don't rely on cookies.
If you don't think it's right for them to exist, I'm not challenging that viewpoint at all. But coming in and assuming, with minimal to no research, that thousand of people and billions of dollars are pouring into complicated products which don't actually do anything, is a bit of an anti-vaxxer approach to the world.
Parameters are:
- negative effects on society at-large
- destruction of privacy
- creation of turn-key surveillance systems
- negative effects on urban environment aesthetics
- ...
- legitimate business desire to promote goods and services.
It's that sole last item, which is the entire stated purpose of "advertising". We could create a web just for product promotion, and it would be opt in. Looking for widget x? Go to the market and even provide demographics for better service.
Advertising is a pretext for baking in surveillance and social modification systems into society. It is, like certain aspects of financial system, 'sacrosanct', and it is strictly taboo to state the obvious regarding advertising, as a systemic approach to moderating societal norms and behavior.
Their P/E ratio is 27. It’s below P/E ratio for SP500, which sits right now at 40, and includes tons of beyond ridiculous companies like Tesla, with P/E ratio over 1200.
There’s lots of wrong with Facebook, but calling their stock overpriced isn’t one of those things.
Especially the focus on "illegal" content and political advertising only (as opposed to, say, advertising as such) makes it appear not as an attempt to improve the situation in general, but rather to carve a bigger slice of the extant lucrative pie for certain interest groups.
> EDPS said gatekeepers should provide an easy and accessible way for users to consent or decline the use of their personal data by the companies for their other services, and that there should be tests to ensure personal data is effectively anonymous.
Users will consent to anything, especially if they have no choice, and any tests can and will be gamed. Ultimately if the problem is to be solved it would require a more novel approach than this.
> The proposed European Commission rules will need to be discussed with EU countries and EU lawmakers before they become law, a process which will take 16-24 months.
The implementation deadline seems excessively long to me. A lot can change within this timeframe, rendering the laws obsolete before they even come into force.
Have you actually read the proposals?
I don't mean that in a snarky way, but you're never going to be able to figure that out from a couple of lines in a wire report.
For instance: it's not mentioned in this article, but the proposals add extra conditions on Very Large Online Platforms (VLOPs) which wouldn't apply to smaller entities. The definition of a VLOP would be one that reaches > 10% of the entire EU population (~45 million).
>The implementation deadline seems excessively long to me. A lot can change within this timeframe, rendering the laws obsolete before they even come into force.
It's not like this is now law and the EU will be sitting around for 2 years. The DSM and DMA are just legislative proposals which need to be considered (and almost certainly amended) by the European Parliament and the Council of the EU before they can become law.
Large, impactful legislation shouldn't just be plonked on the statute book by the executive.
Apparently in order not to track me reading their web page, Reuters requires (among others) my full name, residency, date of birth, street address, and telephone number.
I interpreted the "Reject All"/"Confirm My Choices" buttons at the bottom to belong only to the "Manage Consent Preferences" section. The "Information Our Partners Collect" part above it is a separate section, with a separate "Accept All" button, and an opt-out link in the text, so I figured the final "Reject All" might only reject the second section. Because why else would they have separate sections with separate buttons?
Either way, none of this inspires confidence that they have my interests in mind.
Bingo. This is the underlying issue. And indeed this dual opt out is probably intentionally confusing - and I'm never sure either whether 'refuse all' refuses also the partners.
You are probably not the right person to ask then, but I always wondered: How prevalent are these consent popups outside of the EU?
A lot of the same sites don't bother to throw the popup when I'm browsing from India.
[1] https://data.consilium.europa.eu/doc/document/ST-6087-2021-I...
Partly recycled comment from https://news.ycombinator.com/item?id=26103635
> Cookies can also be a legitimate and useful tool, for example, in assessing the effectiveness of a delivered information society service, for example of website design and advertising or by helping to measure the numbers of end-users visiting a website, certain pages of a website or the number of end-users of an application. This is not the case, however, regarding cookies and similar identifiers used to determine the nature of who is using the site, which always require the consent of the end-user.
It is, of course, legalese. But they seem to be drawing a distinction between analytics and tracking. Counting distinct users seems to be acceptable without consent; profiling users does not.
On the day the legislation takes effect all users should be assumed to have opted out, regardless of any terms of service or non-negotiated contract.
The only exceptions should be things strictly necessary to do business (e.g., contact info for a bank account holder.)
I'm not sure exactly what this is suggesting, but noticing that a user has previously posted abusive comments and using that to lower the threshold for flagging future comments for review seems completely fine.
I want to be asked every time a service wants to know who's using it from my device. I want to have the option to immediately decline authorization before any information about me or my device is sent.
I want to have the option to say "no, I don't want this service to know it's me". I also want the option to say "I am <soandso>" even if really I am not <soandso>.
Not giving me that option is a disrespect of me as a user.
Do you think you are clever? Like this ad trackers can't just switch to use local storage, fingerprinting or other methods to go around your clever solution? You can't use tech to solve this, Google, Facebook and the others will tech around your fix.
Much simpler, make tracking without permission illegal so everyone can benefit not only the tech people and the ones that can afford extra routers, VPNs or other tech solutions. Also not sure if private mode is 100% safe.
Please don't propose technical solutions for things that should be solved by law. Protection should be the default, and not up to your own cleverness vs. the cleverness of trillion dollar industries. If that is the fight you have to fight, you will lose either immediately or eventually (see also the next point).
Please don't propose technical solutions that are mostly ineffective due to the huge amount of brainpower spent on browser fingerprinting, super cookies and other means of persistence. Cookies were invented in the 90s, and the means of being more clever than those deleting cookies were invented soon after.
Please don't speak with such condescension about these topics. People might mistake your confidence to imply you are actually on to something, but if the solution to the problem was so simple it would have been solved already - and the industry behind this would be dead or pivoted away.
Some of the methods are explained here:
I already instantly accept cookies without hesitation.
They've lobbied hard to water down tracking bans to be "user choice", and then used dark patterns/malicious compliance to make not agreeing a horrible experience to wear people down, so that people just give up on privacy.
(Edited to clarify 5G carrier equipment competition)
can't the govt simply ban google and fund these 'different solutions'.
every tool has its use, but protectionism is not the way to solve big tech's bad incentives.
Coddling them with a protected domestic market. Protecting one company means harming others who depend upon their type of outputs. This in turn harms their competiveness and can lead to domestic demand declining.
Effectively imposing a tarrif is like sanctioning yourself - If protectionism was helpful shouldn't they be at least a player in the Caribbean and South and Central American markets? Cuba had its own domestic auto market for decades from sanctions and the only people to benefit were mechanics as they had to play automobile reanimator to actively used vehicles that have grown older than the oldest member of their workforce.
However, to respond to your snarky tone, does Germany have a monopoly on the world auto industry and use that to abuse the rights of citizens while squashing all competition? If so, absolutely, tax the hell out of them! My ‘99 VW Jetta was a piece of junk and I sold it at a major loss after a year.
Right now, everything is going through Luxembourg and Ireland... perfectly legally!
> then invest that money into the EU-based startup ecosystem.
So bureaucrats deciding where money is going... How did that work out for the EU again?
Because Big State is worse than Big Tech.
In the mean time I'll block all ads and third party cookies and hope for the best.
What could be interesting are economic incentives. For example, social networks profits could be taxed and part of the money acquired could be applied on independent de-centralized services. Imagine the impact if just a small amount of facebook profits were donated to wikipedia.
It is never good to see regulation. Never ask state to fix the problem or you will end up with two problems. Especially, the Big State.
Maybe I'm missing something, but why can't we block all forms of stateful identifiers to third-party content? First-party cookies, localStorage, etc only. Is there some big legitimate use case I'm not seeing?
Having said that, I'm sure if they were blocked, tech companies would just provide an SDK that passes through first-party state so companies could continue the status quo.
Other identifiers are required for the functionality of the service, such as your contact details or information you enter in a social network.
Given you can't work around providing the information, the only solution is to use legislation to prevent that information for being used in malicious ways.
Also, the current situation with the consent prompts in Europe is not because of the GDPR but because of its lack of enforcement. The GDPR learned from the former "cookie law" (which I agree was a shit-show) and explicitly prohibits annoying/misleading consent prompts.
Yeah that one's pretty unavoidable, but is at least for many people temporary and pseudonymous only. Once their dynamic IP rotates (granted this isn't the case for everybody), the connection is lost. Much better than every website with a "Like" button on the page allowing facebook to track you as you traipse across the internet.
> Other identifiers are required for the functionality of the service, such as your contact details or information you enter in a social network.
That's first-party information. You're not posting on facebook via an iframe on another site. If you choose to provide your information to facebook, they're gonna use it - legislation or not. Legal encodings of intent are always full of loopholes, even if they escape regulatory capture via lobbying. The best way to stop Facebook from getting information about you, is to not give them information.
> Also, the current situation with the consent prompts in Europe is not because of the GDPR but because of its lack of enforcement. The GDPR learned from the former "cookie law" (which I agree was a shit-show) and explicitly prohibits annoying/misleading consent prompts.
I'm sure it won't be long before that argument goes to court and teams of lawyers spend the next decade arguing over the meaning of the word "annoying". Hence my argument that if we want Facebook to not know everything about us, perhaps we should stop them knowing everything about us?