Hacker News Reader

Comment by dalbasal | Hacker News Reader

Not a ton of depth in the letter itself, but I like the angle they take. It's not all about privacy or data security.

"In addition to the clear privacy issues caused by surveillance-based advertising, it is also detrimental to the business landscape."

"In the surveillance-based advertising model, a few actors can obtain competitive advantages by collecting data from across websites and services and dominant platform actors can abuse their positions by giving preference to their own services."

In many senses, Google & FB have achieved what net neutrality wanted to prevent ISPs from doing. In the developing world, FB has actually achieved it. If AOL had succeeded, we would have ended up approximately here.

View on HN

> a few actors can obtain competitive advantages by collecting data from across websites...

This is going away: all the major browsers have said they are going to block cross-site tracking.

(Disclosure: I work on ads at Google, speaking only for myself)

Google analytics won't track cross site ?

Does Google Analytics even track cross-site today? Looking at it in developer tools I only see it using first-party cookies.

But anyway, Google Analytics won't be able to do it because nobody will be able to do it. For example, here is Chrome's project to remove cross-site tracking: https://www.chromium.org/Home/chromium-privacy/privacy-sandb...

(Still speaking only for myself)

I'm not sure if you're being intentionally obtuse or not. GA phones home with vast information about user, and builds a profile of them. That profile is correlated across sites to personalize search results and sell ads.

I'm not being intentionally obtuse, but I also don't know all of Google's advertising business. I didn't think Google Analytics did that? What makes you think it does?

(GA sends a message to Google, but I had thought that it was not linked to your behavior on other sites via GA?)

google analytics tells you the interest of your audience. how do you think it does this without correlating you to a profile they've built?

Googe Analytics consultant here (not Google employee).

1. Google Analytics' primary identity signal is a first-party cookie. this is not shared between domains. There is no technical way to link identity between domains with different cookie values.

1a. Google Analytics has built-in library functions to allow site owners to share first-party cookie values between a whitelisted set of domains. This effectively lets one company with multiple sites share a first-party identifier, but still not let anyone (Google or otherwise) link that identity to identities set on other sites.

1b. BUT. But. BUT. Google is rolling out "Google Signals" for Google Analytics, which will use your Google Account as the identity signal instead for users who are logged in to Chrome. This, obviously, lets your identity be correlated across sites.

(Personally, I suspect that the availability of this feature played a part in Google's decision to let Chrome follow the industry towards blocking third-party cookies. But this is a baseless opinion, one step removed from a conspiracy theory.)

2. Google Analytics can link their identifier (the first-party cookie or Google Signals) to your DoubleClick profile via DoubleClick's third-party cookie. The checkbox that does this is unchecked by default. There are many other features of GA that encourage or require you to check this checkbox.

2a. Google's documentation (including legal contracts!) places limits in the data exchanged between the two profiles. Data exchanged does include demographic and interest information from DoubleClick's profile into GA. This is one of the big reasons why people click the checkbox.

To my knowledge, GA data is not used to inform the DoubleClick profile. GA data can be used to build an "audience" in various Google ad platforms, and direct ads to those people specifically, or to use as the basis for a "look-alike audience."

3. Google is a Processor under GDPR for Google Analytics, and a Controller under GDPR for Google Ads. To a first approximation, this means they make the specific legal claim that they do not use GA data for their own purposes. Linking Analytics and Ads data is... complicated and frankly I still haven't gotten an explanation of its legal status that I fully understand.

In my personal opinion, I don't think Google actually uses Google Analytics data. Most Analytics implementations are tire fires, and they can get all the data from other more reliable sources, like Publisher data or Chrome. Given that they have based on their entire GDPR compliance strategy for Analytics on being a Processor, I don't think the risk/reward is there.

(apologies for lack of copy-editing, the thunder's about to take my internet away)

Interesting insight. Their privacy policy suggests they are able to do this however[1]:

"When you’re not signed in to a Google Account, we store the information we collect with unique identifiers tied to the browser, application, or device you’re using."

What is stopping, legally, them from taking e.g. HTTP Headers from independent connections and linking them together through fingerprinting? Maybe this is not implemented in Google Analytics, but that is certainly not the only connection made to Google on most websites (see e.g. gstatic and Firebase). Since there is practically no technical barrier, it seems that the vague privacy policy leads to the only question being what the 'unique identifiers' are exactly.

[1] https://policies.google.com/privacy?hl=en#infocollect

> What is stopping, legally, them from taking e.g. HTTP Headers from independent connections and linking them together through fingerprinting?

Setting aside legality, the attack you're describing will be thwarted by network state partitioning: https://www.chromestatus.com/feature/6713488334389248

Am I missing something, or does this not address the fact that https://whatsmybrowser.info/ will always yield the same thing whether a connection is made to GA, Firebase, YouTube or Blogger? That seems to have to do with connection timing and caching, not with what the connection itself leaks.

I thought the parent was talking about using information about the network connection to link users across sites hosted by the same entity?

If you're talking about fingerprinting in general, that is also something that all the browsers are working on. I'm most familiar with Chrome's strategy, which is to first switch APIs that provide a lot of entropy from something you get by default to something you have to actively request, figure out how to provide similar functionality more privately, and then enforce a privacy budget that does not allow collecting enough information to identify users: https://www.chromium.org/Home/chromium-privacy/privacy-sandb...

Please omit personal swipes from your HN comments. Your post would be fine without the first sentence.

Note this site guideline, including the last bit: "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."

https://news.ycombinator.com/newsguidelines.html

Is Google going to give back the $100B is made from cross site tracking in the past?

Is Google going to consider YouTube, Gmail, Maps, and Android Location history different sites, or is "having an effective monopoly an exemption to crosss-site tracking prohibition?

Does anything in the proposal prevent server-side cross-site tracking? (No.)

Is Google going to stop buying third party tracking data like credit card transactions?

No it isn't, Google will still track me across the web.

So will Facebook (and several others) if you take no steps of your own to block them. It's an escalating war of cat and mouse. You'll block them, they'll find a new way around it, you'll block them some more, they'll find another way. Eventually the only answer will be to shut down the Internet because it's become just too broken to use anymore.

The simpler answer is to just ban it. The law doesn't need to be technically detailed or envision every single technological adaptation: it just needs to be sufficient for a judge to be able to recognise it when a prosecutor describes it and a defence lawyer attempts to pull the wool over their eyes. It needs to be focused on outcomes.

Once banned, Google and Facebook will submit. They will attempt to lobby against the reforms, eventually saying "it will prevent legitimate business: it represents a small fraction of our revenue, but we are selflessly lobbying on their behalf to ask you to implement this technically specific law to reign us in". Ignore them. You don't listen to the hitman when they comment on homicide laws.

And ensure that the penalties amount to a ban. The US congress and courts can and do terminate human lives. Whatever penalty they propose on abstract legal entities is not too harsh; even if they completely dismantled Google and destroyed all of their economic value, it is nothing compared to the things we do to natural living breathing humans in response to criminal behavior.

Profitable companies will submit to a law that aims to control their behavior.

> law doesn't need to be technically detailed or envision every single technological adaptation: it just needs to be sufficient for a judge to be able to recognise it when a prosecutor describes it and a defence lawyer attempts to pull the wool over their eyes

This is a terrible philosophy for legislating. It undermines the rule of law, i.e. that you should ex ante be able to determine if what you're doing is legal or not.

What you're describing is rule making. Congress regularly does this, in passing a law that requires such and such agency propose (or even implement) rules that achieve this or that within so many days.

This is fundamental to the rule of law. Judges and juries apply the law to the facts. Civilians can ask the government to review their plans in advance and make a ruling.

We don't say murder laws are bad because there's no way to know in advance if "bashing someone's head in with a pipe who dies a month later" counts as murder.

Every important criminal law includes the idea of intent. Killing someone with a car because you sneezed is very different from intentionally running them over in the eyes of the law.

> criminal law includes the idea of intent

Yes, but intent alone isn't sufficient. We need a precise, side-effect light definition of the kinds of activities we want to ban and by whom. To date, I haven't seen that.

Passing a law which bans "surveillance-based advertising" with little more specificity is a recipe for disaster.

I'm all for big game hunting but taking down Google would be a gutpunch to every Gmail user ever

Gmail can still exist without Google in its current form, or without Google entirely. It is likely one of those services that does not require surveillance to remain profitable, and competitors would be falling over themselves to claim the data and domain names if Google claimed otherwise. Losing integration to other Google services would likely win more hearts than gutpunch users.

I think this is one of the big misinformation being propagated. That somehow you would not be able to get GMail or other services if Google is not allowed to collect information. The reality is that Google did just fine before they did surveillance-based ads and they can do just fine when they stop doing them as well. There are other ad systems and Google can do just fine using normal ads.

That being said, there are great alternatives to GMail that you can use, both free and paid. FastMail, Proton Mail, Tutanote and Vivaldi.net mail are just a few options you might want to try out.

What was Google's business model before they sold ads?

Google started as a search engine. Their results were accurate and there were no ads. Gradually they started doing ads on search results, related to the search itself. This was better than what many of the competitors at the time were doing, which was for paid searches to be at the top.

Gradually Google became more and more an ad company. In 2007 they bought DoubleClick that was one of the leading ad companies on the Internet. This was part of them moving towards providing ads not only on search results, but on sites as well. At the time most ads were site or context sensitive.

So Google has been making money off ads for a long time. More or less from the beginning. The big change, however, was the move to surveillance-based ads, where the ads depends not on the site or page you are viewing, but on the person viewing the ad. That is where it went all wrong.

Sure, Google started as a Search Engine, but it's monetization strategy has always been to serve ads. According to Wikipedia it first released Google AdWords in 2000. It became a public company in 2004.

can't they just advertise based on what's in the email rather than keeping a profile on you? Not a lot of people want to see google go away, we just want them to stop being asses and get broken up.

I do think reading your mail for ads is another level of surveillance-based advertising. It is also quite personal.

I think banning it is the wrong approach. Data ownership should be regulated that personal info belongs to the person it is about. Companies need to pay for it if they want to store it over a certain time period. They also have to face large fines when they leak personal info.

Imagine how quickly companies would only save minimal personalized data.

> "This is going away: all the major browsers have said they are going to block cross-site tracking."

That's mighty pleasing news to hear. A step in the right direction for sure. Here's hoping it's the beginning of a trend.

The thing with information is that once it is shared, it can't be unshared. Sure, blocking cross-site tracking would ostensibly make monopolistic accumulation of new data more difficult, but except for the most decay prone information, there is already a comprehensive profile established for a good chunk of the users, which can be milked for a good while. This is not even taking into account of backchannel acquisition of the missing data (i.e. through brokers) with the sweet sweet profits already made, potency of which is enhanced when joined with existing data (and therefore still creating monopolistic dynamics).

It can be made useless if you don't have a identifier.

The browsers intent may be to remove cross-site tracking, but we all know that Google Ads will still follow people around the web through latent signals (even if wrapped in something like FLOC), and other parties like KISSmetrics will continue the fingerprinting cat and mouse game.

> Google Ads will still follow people around the web through latent signals

I'm not sure what you mean by this?

Google Ads has committed "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products." -- https://blog.google/products/ads-commerce/a-more-privacy-fir...

> even if wrapped in something like FLOC

FLoC doesn't allow "a few actors [to] obtain competitive advantages by collecting data from across websites" since everyone sees the same number of identifying cohort bits.

> other parties like KISSmetrics will continue the fingerprinting cat and mouse game

Historically, the TOR browser was pretty much the only one that took fingerprinting prevention seriously, but it's now a substantial focus for Safari/Firefox/Chrome. I do think fingerprinting groups will continue to have things that work when third-party cookies go away, but I don't expect it to persist that long after? I also would not be surprised to see a regulation here, since I (not a lawyer) don't think fingerprinting is compatible with the GDPR or the other regulations it's inspiring around the world.

(Still speaking only for myself)

The point is the FLOC is surveillance as well. You are still profiling users. This has got to stop.

https://vivaldi.com/blog/no-google-vivaldi-users-will-not-ge...

I agree FLoC is tracking (though not at the individual level). The question we've been discussing, however, is the effect on competition in particular: https://news.ycombinator.com/item?id=27763345

Clearly not allowing anyone to track is good for competition. Now there are certain companies that collect data from multiple sources. That gives them a benefit compared to others. But what I do not understand is how they can do it? How can you accept that your company spies on its users and collects data on them? How can you say it is OK?

https://www.jefftk.com/p/why-i-work-on-ads

Interesting read. Clearly you are struggling with your choice.

> Clearly you are struggling with your choice

What in the post gives you that impression?

(I'm not)

I guess the start of it gave that impression in particular. It is great you are giving so much of your salary to charity, but the fact that is the first thing you write as an explanation of why you do what you do does send a signal.

I also have a feeling you are trying to explain to yourself why the things Google is doing is not bad. So you twist things a bit here and there to make your point.

In any case, you are not in a position, I assume, to influence what Google does. Google is on a path that a lot of us do not like. We do not like being tracked and we do not like profiles being built on us. We want that to stop. You try to convince us it is not so bad, but the feeling I get is that you are just as much trying to convince yourself, but obviously I am not you, so this is just based on a feeling.

Regarding your "earn to give", I feel like I want to play devil's advocate and ask why not cut your salary in half by working or volunteering on more humanitarian projects and charities? Not sure the pay would exactly be half less, maybe even more, maybe less, but the net positive of what you do may be greater? (I say that, as if we can measure such impacts :p)

I've considered doing directly valuable work, have tried things along these lines in the past, and may try them again in the future. For now though, I think earning to give is a much better fit for me: https://www.jefftk.com/p/earning-to-give-transcript

> I agree FLoC is tracking (though not at the individual level).

FLoC significantly increases the entropy in a user's fingerprint (typically by 15 bits iirc). This improves existing individual tracking mechanisms that use a fingerprinting-based approach. FLoC therefore enables further individual tracking, and browsers that take privacy seriously should disable it.

FLOC is tracking in your browser. How is that not individual? Not that it matters. Tracking is wrong whether you are able to track an individual or not. This is not just about privacy.

All the major browsers already locally track the sites you visit so they can maintain your browsing history, turn links purple, etc. What FLoC adds is that it locally computes a low-cardinality anonymized summary of your browsing history, and makes it available to sites.

So in other words FLOC makes the browser spyware. Clearly the browser history is useful for the user. That is why it is there. The browser company has no right to take that history and turn it into an ad profile. It is just plain wrong.

Yes, FLOC and similar technologies, are another way to track users, but this time in the browser. We really do not see that as being any better. In many ways it is really worse.

https://vivaldi.com/blog/no-google-vivaldi-users-will-not-ge...

Be careful not to confuse one cross-site tracking techniques with cross-site tracking. Ask about company behaviors that may be of interest, not specific mechanisms. You can always ask about the mechanisms later.

"Will you use information about users from third-party sites when making decisions about how to interact with them?"

"Will you use data about offline purchases made by users when deciding how to interact with those users?"

Etc.

Nobody needs cookies to track users cross-site. Cookies are just convenient.

All the browsers have said that they consider general-purpose cross-site tracking to be deprecated, not just cookies. They are working on removing other forms of linking users across sites, including the browser cache, link decoration, and fingerprinting.

And some of them, such as Google, are working on FLOC... This has got to stop now.

Creating more private alternatives to cross-site ad tracking is a project that most of the major browsers are working on. In addition to Chrome, Edge has https://github.com/WICG/privacy-preserving-ads/blob/main/Par... and Safari has https://webkit.org/blog/8943/privacy-preserving-ad-click-att...

These are not more private alternatives. This is just tracking using other methods. FLOC is tracking and it is in no way more private.

Setting aside whether FLoC is private enough, how can you say it is not more private? Today, with third party cookies, many companies have almost your entire browsing history through a combination of direct tracking and cookie matching. With FLoC this information stays on your device, and only a summary is made available to sites.

Feel free to read : https://vivaldi.com/blog/no-google-vivaldi-users-will-not-ge...

Really, FLOC is for me the ultimate betrayal. The browser is not supposed to make an ad profile based on the browsing history. It is just wrong.

I'm not sure which part of the post you're referring to when you say that FLoC isn't more private than the status quo; is it the "FLoC will expose your data. More than ever." section? That has "Now every website will get to see an ID that was generated from your behaviour on every other website", but this is not what Chrome has said:

"Websites can exclude a page from the FLoC calculation by setting a Permissions-Policy header interest-cohort=() for that page. For pages that haven't been excluded, a page visit will be included in the browser's FLoC calculation if document.interestCohort() is used on the page. During the current FLoC origin trial, a page will also be included in the calculation if Chrome detects that the page loads ads or ads-related resources." -- https://web.dev/floc/#do-websites-have-to-participate-and-sh...

Suddenly the tracking includes all sites and pages. That is not an improvement. Having an opt out or even an opt in is not the solution here. We have all seen how that works.

The tracking just has to stop. Google can generate plenty of revenue without tracking us. They were in fact making plenty before they moved from context sensitive ads to surveillance-based ads.

> the tracking includes all sites and pages

But it doesn't! They are proposing, in the stable version, to include only pages that opt in by calling the FLoC API.

For the origin trial in particular, to avoid a chicken-and-egg issue, they are also including pages that have ads. Since ads today make extensive use of third-party cookies for cross-site tracking, This is still not anything like "all sites and pages".

(Still speaking only for myself)

Your statement below is both funny and misleading at the same time and I guess it is also why opt-in is often such a misleading term.

So you start with all pages that have ads, meaning most all pages that are tracked today. Then you add to that by "opt-in". Now, most sites are not built by hand. The tools they use may thus "opt-in" for them. Also, this method may make it harder to block the tracking, so you end up tracking more in practice, which is obviously why this is being introduced, as so many have chosen to use tracker blocking of some kind.

Your statement on "opt-in" really needs be reiterated. In many cases you are left with options like: do you want to use this product? Then you have to "opt-in". Great examples are Windows 10, that insists on you logging in with Microsoft. Similarly many products require you to "opt-in" to use them.

We need this to stop. Ban surveillance-based ads now!

The argument is bad for privacy, since the business solution to that problem is the same for other IP antitrust: mandating non-discriminatory licensing to anyone who wants access to the data.

I can see where you're coming from, but I think common carrier type action is pretty unlikely here.

Besides controversy, it's too technically hairy to legislate. There's also no reason. "Surveillance advertising" isn't a necessary service.

The reason I like the angle of this letter is that it isn't stand-alone. It's providing another perspective to the pile. Data centric advertising is monopoly & centralisation prone. They're extracting a lot of value out of the digital economy and this chokes out a lot of potential economic activity.

It doesn't negate or replace privacy, data security, general creepiness or other rationales. What they're literally calling for is a ban. How this affects politicians, if it does, is providing them an additional persona of affected groups. Businesses .

Reply on news.ycombinator.com