Well, maybe that's what they think. But EU is coming with new security and AI regulations that will change things forever.
[I do not speak for my employer.]
It’s still profitable enough with data silos that this is not happening yet
Understanding full well each standard solves different problems, for some of us in tech achieving compliance is a non-trivial amount of critical work and maintaining it similarly isn’t always something you easily drop everything and make happen in a day or two.
I think that’s 100% relevant and shouldn’t be immediately responded to as others have by assuming the relevance comes from a position of opposing the regulation or standing against user privacy
The problem with this is twofold:
a: 'Most' (by loudness or other perception) of the complaints are known to be bad faith because they're coming from malicious actors like Facebook or Google which we know are against user privacy (since that's their business model).
b: You have to go out of your way to build a site that interferes with actual user privacy, for example by actively adding Google Analytics scripts or faux-CAPTCHAs, or actively demanding a real name and actively doing something about it if the user lies to you. (Technically you get IP addresses by default, but much like mailing addresses, obscuring these pretty much has to be the user's responsibility, since how else would you respond to them.)
So if you want a assumption of good faith, you need to be clear that you're complaining about the bureaucratic compliance overhead (eg having a particular data processing officer or whatever GDPR calls it), rather than about having to change your object-level service to eliminate spyware that you went out of your way to incorporate in the first place.
Is this a bad thing? If we take privacy seriously then it shouldn’t be. We don’t see too many people fighting food or drug regulations intended to keep us safe because it might be costly for companies to comply. Maybe if a company cannot afford to comply with privacy regulation they should not be handling our personal information. I guess the reason it seems heavy handed in the tech/web world is that the barrier to entry started at next to zero and so much of what we put on the web is not monetised that any cost/compliance seems like a massive burden.
If you had less intervention with respect to privacy would there be more dynamic market-driven initiatives to fill the gaps? Would there be more incentive to develop technology that would be effective for privacy? I don't know.
Regulation is just hard because reality is complex and dynamic and regulation is often complex but not very dynamic.
This is hilarious. Because we had that, and it was lacking, to put it mildly. And some people still have that, in a way that's easy to compare (e.g. EU vs US, CA vs other states). For me, the results are in and obvious. Privacy regulations are the only thing that reflects the privacy externalities they might impose on society back onto them (and the shareholders).
However it does serve as a moat for players with more capital, and that's something we should also be mindful of. For instance, maybe we could have some of the requirements scale and only kick in when a product meets certain thresholds in terms of numbers of users.
Also, arguably, shoddy financial regulation. In many countries, large private companies have to submit audited accounts to the regulators, and that would likely have raised alarms about the other problems with the business earlier.
Frankly, dodgy companies screw over the people unwise enough to invest in them every day. Theranos was unusual in that it also directly screwed over members of the public.
Relatively speaking, this is as it should be. There are ways to cope with arbitrarily-convincingly fake lab reports (most generically, do multiple tests and compare them), whereas there's not a procedural fix for your X-ray machines occasionally going THERAC. Those measures generally aren't actually in place, but they should be anyway to cope with eg human error.
But the regulations actually in place on both patient-proximate and lab-based equipment are insufficiently stringent. (Annoyingly, they're also gratuitously burdensome.)
[ And even with all of those cutbacks, I'm still not really compliant on all my sites... (legacy software/not knowing what exactly my data server is logging/etc.) ]
But, as a direct answer to your question: I don't think many things in principle are impossible with the current privacy laws. But that doesn't mean it's not having a chilling effect.
I’m not convinced that large amounts of personal data is required for search to work well, at the very least I’m not convinced the personal data must leave an individuals control.
We don’t see a lot of innovation in this direction as hyper personalized search seems to work reasonably well and the startup costs to compete are massive.
Doesn't the cost of compliance inherently favor larger companies with better lawyers and deep experience in passing audits?
A company in the EU has to design the whole model with no private data which means they will have more difficulty competing with Google rather than less.
It could even extend to most consumer product. e.g. Some obscure chemical compound for plastics is much more costly to produce in an environmentally friendly way, therefore it’s nearly all produced in the least regulated jurisdictions, therefore the compound and all derivative products have to be tariffed from those jurisdictions?
>Google can then use non-private data to adjust the model to the EU market.
Google can do everything a EU-only company can do. They can also do things a EU-only company cannot do. The reverse is not true. So at worst they'll be roughly as good and at best much better.
There are regional differences between the same language that can be pretty severe, all the way down to the pronoun level.
So, no they can't.
They can also get US data that doesn't follow EU privacy requirements. So Google has two source of data they can combine into a better product.
In the US the dialects are very similar and usually separated mostly by accent.
When dealing with different countries, entire groups of words do not mean the same thing because either (a) the language has changed, or (b) those things literally did not exist at the time the split occurred. Training an AI on Parisian French will result in an utterly broken experience for Haitian French and Cajun French.
Also, the biggest difference would be the pronunciation differences vs words being different. The word differences are easily modeled after any ASR, if the developer understands the differences and plans for it in their NLU models.
If you care about privacy at all you should be very happy that is possible today. It is how we got all those articles showing what data Google and all other companies collects about you, since they asked about this referring to this EU law and the companies has to comply. So even if you don't use it yourself it greatly helps you anyway.
This is the problem with EU regulation. Good intentions, bad implementations and unforeseen consequences. In fact this goes so far into the reasons why EU cannot harbor a growing startup scene or make rockets. I am not against regulations but if you lay a landmind in front of every endeavor in the form of regulations, it bears down on people that want to disrupt existing and overweight companies that can afford to abide by regulations. I've talked to many Europeans and they resonate with the same sentiments.
I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there.
What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.
Cookie banners has nothing to do with GDPR.
> I own a small business and I've gone through the process GDPR compliance. It is not too bad but there is a reason why there are upteen number of GDPR compliance consulting firms and checklist makers out there.
The reason is that GDPR compliance gets more expensive the more technical debt you have. For big enough companies with bad engineering practices it can costs hundreds of millions of dollars. For a small business with a straightforward product they likely are all but compliant without even trying.
> What should have happened is a complete solution to privacy in the browser instead of playing cat and mouse games with businesses that will find loop holes.
GDPR has nothing to do with browsers, it has to do with forcing companies to ask for and track data they keep on you no matter where it comes from. It applies to apps, to hiring interviews, to storing transaction data when you buy groceries etc. What you are talking about is a completely different issue.
> The proliferation of such alerts was largely triggered by two different regulations in Europe: the General Data Protection Regulation (GDPR), a sweeping data privacy law enacted in the European Union in May 2018; and the ePrivacy Directive, which was first passed in 2002 and then updated in 2009. They, and the cookie alerts that resulted, have plenty of good intentions. But they’re ineffectual.
https://www.vox.com/recode/2019/12/10/18656519/what-are-cook...
What you probably meant is the user data banners/popups you have to click on that are new since GDPR. They are not cookie banners, they are a different thing, calling them cookie banners gives people the wrong impression.
The fact that you mix these two makes it look like you don't understand what you are talking about here. Especially since you talk as if this was the only thing GDPR changed. The cookie law is stupid, but GDPR is not.
This matters to the nerds on HN and Reddit,some clout chasers on Twitter, and no one else.
People don't care about most data, you are right about that, but they care a ton about some data.
GDPR is just about that, make you own your own data rather than companies owning it. Companies has to ask for it rather than just taking it, and you can revoke that right at any moment and the company has to comply.
Not to mention the reduced happiness from working with GDPR.
If Google could help remove GDPR and the Cookie law i would welcome it.
I'm of the opinion it should be even more onerous to deal with people's data than it currently is. GPDR doesn't go far enough.
My company had about a week of design of our data handling infographic and policy page and that was it for GDPR. The transition was incredibly simple, as we just didn't keep such data in the first place.
Because we did collect voluntarily submitted items from users which might contain such protected data, we simply explained our retention process to users and documented in full the data's life-cycle once it hit our servers. I think we had to add a few extra S3 regions for uploads also, but that was just a few clicks.
GDPR is anything but a headache unless you're trying to do the things the GDPR doesn't want you to be doing; then yeah, it's probably quite a headache.
As a side point, I work in a tech startup in the EU that was founded post GDPR. We have no issues being competitive and also complying with the GDPR, however we do not make our revenue by selling personal data.
American sites on the other hand tell me either "tough, take our spyware if you want to see this site, or to to a restricted list of five pages" (which I'm pretty sure isn't legal under GDPR); throw up the gauntlet of 1000 tick-boxes, infinitely nested, or say "you're from the EU and we can't serve you page".
The problem is cultural. I've de-googled myself as much as possible, but I don't like the fact that all of my real mobile device choices are written in California and made in china.