How is this compliant with the GDPR? Is the GDPR a complete joke?
Something additional will be required to stop this tracking. As it stands right now some European countries have started forcing ISPs to save logs, that’s actually worse. We must make sure that it’s well understood that the public does not want these policies. The public must also deny any party their vote if fixing this is not in their agenda. Politicians are getting away with slowly eroding our freedoms without many people noticing or speaking about it, that has to change. We need to let them know that they have zero support from us if they decide to continue in this trajectory.
I would assume the EU would act much faster than the US to add regulation against this behavior.
I thought the GDPR didn't allow signing away of privacy? Because if it does, then it's utterly useless - every webpage comes with a 100-page terms of service these days.
> As it stands right now some European countries have started forcing ISPs to save logs, that’s actually worse.
In fact the European Court of Justice declared that illegal [1], yet many countries simply ignored that ruling. You would think this would result in a large media assault about "subverting the rule of law", but I guess that's only a concern when they dislike the one doing the subverting.
[1] https://www.reuters.com/article/us-eu-court-privacy-idUSKBN1...
If that was the case Europeans wouldn’t have been able to use services like Facebook or iCloud.
> In fact the European Court of Justice declared that illegal
For example, Sweden did it shortly after an ISP Bahnhof advertised to its customers that it would not save logs. What seemed at the time to have fuelled this whole thing was mostly entertainment companies pushing these policies against European countries to crack down on piracy. Obviously an unsuccessful project. Many of our politicians traded our freedoms for the sake of the entertainment industry not losing money (supposedly). It didn’t serve its purpose, rather it just gave the government(s) more power over the people.
Telcos are not giving anything except the IP address. If you go to other websites and don't provide your data to them, all they will have is an identifier about the IP. It is that data that can be managed under GDPR, but IP in isolation means nothing.
I stand by what I said: IP addresses, by themselves, are not PII. To become PII, it needs to come with the data from the person visiting the website.
> GDPR has nothing to do with it.
This is false: if they use the IP address to match the website visitor with the ISP customer, GDPR is very much relevant as GDPR restricts the use of personal data (including IP addresses) like this.
The networks are in the clear.
Also, as far as I know, PII is a US concept and appears nowhere in the GDPR.
Another way that I can argue for this interpretation is simple: if you want connect to a hotspot in Germany, no one asks you if you opt-in to sharing your IP addresses. These, by itself, are considered "required information to appropriate service" (or something equivalent in legalese).
The third argument I can give is a bit circular: if GDPR had any way to rule this illegal, it would already have been met by huge outcry from the proper privacy NGOs. If it has gotten to the point where the companies are announcing tryouts, it means that the networks are confident enough that they are (at least in regards to GDPR) legally in the clear.
All in all, I hope that people crying for regulations and government intervention could understand once and for all that the laws that get approved are never going to do what they wished it did. I already got into plenty of arguments here with people that believe that GDPR is effective to protect users, but this is just yet-another example of regulatory capture.
1. Courts and legal teams don't always agree. Also, privacy scenarios are nuanced: when something falls under GDPR, it's not automatically illegal and you don't necessarily need to ask for consent either or even list it in your privacy policy. You need to read what the GDPR says and see whether you are within the lines or if you need to adapt your business model, processes, tech and/or disclaimers.
2. Connecting to a hotspot does not automatically mean collecting or sharing your IP address: Yes, a hotspot needs to store the DHCP lease while it's active and the MAC address while there's traffic, but GDPR often allows such processing that is limited to what is technically necessary and obvious. It would be different if the hotspot stored the data for longer time, shared it with third parties and/or used it for other purposes. Selling data without user consent is typically illegal.
3. We don't know enough about these tryouts to assess how they plan to align with GDPR: perhaps they'll ask for consent, perhaps they don't use IP addresses, perhaps they plan to bargain a deal with the governments or pay the fines.
4. We need effective laws and luckily some laws are effective. Privacy laws and GDPR are somewhat unsettled and the ultimate effects remain to be seen, but EU courts have already ordered some significant fines in cases that have made sense so I'm still optimistic.
I suggest you let go with the pedantic posturing, and if you really think that GDPR has any way to actually stop these new actions from the EU telcos, go ahead and initiate legal action against them.