Hacker News Reader

Comment by johndhi | Hacker News Reader

This is a crazy way of making laws, IMO.

To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means.

Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law.

Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and all of those billions of dollars have gone to waste.

So absurdly inefficient. No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better? No; we prefer to thrive by ignoring problems for a long time then smashing them with a hammer.

View on HN

>Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and all of those billions of dollars have gone to waste.

so when you say a crazy way of making laws, you mean the way that laws basically get made?

>No regulator has had the idea of just going to Facebook,

pretty sure there was all sorts of conversations with Facebook and others over at least 5 years where it was quite clear people wanted to fix privacy issues and it was also clear that it was in Facebook's financial interest that it not get fixed.

>tried to draft a forward-looking law that will make the whole system better?

Facebook doesn't want the system better, Facebook wants the system to benefit them. At some point these things are incompatible. No body has gone to a bank robber and tried to discuss with them how to best draft the laws on how to stop the robbing of banks, because of an intuitive understanding that it is not the bank robber's intention to help stop the robbing of banks.

So when the law gets made to stop the robbing of banks, the bank robber than goes ahead and breaks it.

Or in the case of Facebook they say we are obeying the law! But still try to do what the law wants them not to do.

But I think this is the core of our disagreement here >according to their fair reading of that law

I would say according to their desire to get around that law.

> so when you say a crazy way of making laws, you mean the way that laws basically get made?

I think what's being characterized as crazy is that the laws as written are at best vague. It takes years to find out what they actually mean in implementable detail. This makes it very difficult to comply.

Have you read through GDPR? I have. It talks a lot about "reasonable measures" and includes vast swaths of other laws while being very light on details. Compare to, for example, electrical codes. Those tend to be quite specific and clear with sharply limited room for interpretation.

With this in mind, I can see why someone might regard this as an insane way to create laws.

Reasonable is a common term in laws, see for example the "reasonable person test" which is widespread in US civil law. Laws are not written like electrical codes in the most part because such specific laws either explicitly enumerate what is permissible (which is more ok for something like "acceptable methods of wiring a house" than "acceptable uses of data") or are rendered obsolete by the first thing the law writers didn't foresee ("Oh, the law bans tracking with cookies? Well we just have a server side database for UA+IP address combinations, so we don't need to comply" - in fact the first EU attempt at privacy law arguably failed for this reason)

It is, but generally reasonableness comes with useful legal context to help you understand what it means.

In the context of GDPR? I was left guessing what a regulator in Brussels might consider reasonable when their path to career advancement might run through my employer. Coupled with being uncertain what various national regulators (or empowered industry bodies) might add in, as they were allowed to do so until quite literally the last second. It left a person with no good way of judging what might be considered reasonable, only nervous paranoia.

It was a distinctly unpleasant experience and one I was left thinking was both anticipated and avoidable.

Don't we have to use broad terms to avoid abuse of edge cases? Should we have avoided writing a constitution because "freedom of speech" is extremely vague?

GDPR is a radical step forward considering how poor the situation was. We're talking about a fundamental right to privacy. It was absolutely expected that it would shake some businesses, that's why it was announced years before implementation. Also, the courts don't come suddenly stab companies in the back out of nowhere. There was and there is a lot of pedagogy around it and usually the cases escalates gradually with warnings. The ones getting fines are clearly the ones who are still trying to do it the old way.

It sounds like the recent decisions are making the laws less vague are they not? Shouldn’t that make everyone happy (other than those who are invested in other legal realities)?

> This makes it very difficult to comply.

It is really not hard at all to comply with GDPR. Don't collect private informations you don't need, and don't share them.

Now what's hard is to build a system that complies with GDPR's letter _and_ breaks GDPR's intent. And you know what? That's intended.

> It is really not hard at all to comply with GDPR. Don't collect private informations you don't need, and don't share them.

The problem is, not all personal data corresponds to the intuitive notion of "private informations". For instance, I, as a U.S. citizen, would be violating the GDPR if I operated a dumb HTTP server that stores request logs indefinitely and does no other processing, such as "python3 -m http.server". (IP addresses are personal data, and U.S. authorities can make me turn over my logs; thus, I cannot store the logs for however long I want.)

Can you define "private informations" and "need" in unambiguous ways, please? In my experience it's shockingly hard to do so once you get beyond the basics.

Even when you have clear legal obligations to collect a bunch of private data, you still have to figure what reasonable measures to protect it are. What's a reasonable measure when you're obligated to keep seven years of financial records about your customers in a way that lets you produce ready reports for regulators? Complete with mandatory personal identifiers for tax purposes?

I’m not sure what you mean with your second point. A legal need to collect and process personal data is a valid GDPR basis. You don’t need to get consent there.

You don't, but obligations under GDPR include taking "reasonable measures" to protect the private information you're obligated to collect. The point I was making is that this underscores is how difficult it is to define "reasonable measures" because not collecting private information is not always an option.

GDPR is not just about being obligated to ask for consent. Its requirements go a great deal further. Probably. Maybe. Depending on what someone unknown with an unknown background considers reasonable based on unknown factors.

I'm sure that will be easy to write requirements around. Right?

> No body has gone to a bank robber and tried to discuss with them how to best draft the laws on how to stop the robbing of banks, because of an intuitive understanding that it is not the bank robber's intention to help stop the robbing of banks.

It seems reasonable to survey or research bank robbers with intention of making their further attempts as miserable as possible and as unattractive as possible.

In the same way I expect that any good privacy related regulation will be analysing and researching what FB/Google/etc is doing and designing policy to outlaw their undesirable data gathering.

> No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better?

This would never work because Facebook is uninterested in making "the whole system better". Their entire goal is to make money off of user data, and they have zero incentive to work with governments that threaten that goal.

on the contrary, I think facebook and google have a huge incentive to work with different governing bodies to define what data is ok to collect and build identifiers around, and what is not. There is no way facebook would just throw up it's hands and say "we have no incentive to find a way to advertise to a population of 750 million people."

Yes - especially if they can do this in a way that still makes them money but is expensive and burdensome to comply with. That would keep them in the game but seal the market off to potential competitors.

> There is no way facebook would just throw up it's hands and say "we have no incentive to find a way to advertise to a population of 750 million people."

And yet, this is exactly what they do repeatedly [1] [2] [3].

1 - https://www.vice.com/en/article/889pk3/facebook-threatens-to...

2 - https://www.exchangewire.com/blog/2022/02/08/facebook-threat...

3 - https://www.niemanlab.org/2019/01/google-is-threatening-to-k...

I would suggest reading some of the sources of those stories instead of just the headlines ^^

(Spoilers: the reality of the “threatens to leave Europe” headline is a much less click-baity “lists ‘leaving Europe’ as one of many possible paths to take, but one they would prefer to avoid”)

> one of many possible paths to take, but one they would prefer to avoid

This seem to be exactly the sentence one would use to respectfully threaten someone else (try it with a different theme, it might be clearer: "we are exploring all possible solutions to the conflict, going nuclear is just one of the way but one we would prefer to avoid")

I mean, the parent comment have a pretty compelling case to the contrary:

> Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law.

It's valid to say "Facebook isn't the one who should be expected to have citizens' best interests at heart", but the incentives of regulators and Facebook are absolutely aligned in that both are looking for a law that will be followed.

My understanding is that they did this. It just happens that they are basically outlawing large parts of FB business model.

This appears to be deliberate and I am happy about it.

Any internet-related law actually increasing privacy and harming tracking/spying/personal data gathering was going to harm FB. If it would not, then it would mean that it is toothless and useless.

If you have a complaint against you under GDPR the first thing that happens is the authority in question contacts you and suggests how you could clear up the problem. It is only through refusing to comply that you get fined

> Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law.

So often in the last 20 years I’ve seen companies (and particularly US tech companies, but it’s not exclusive to them) deliberately read more charitable interpretation of the law, knowing they'll make millions over and above any fines they might receive.

It’s so common place that there is even a saying for it:

“ask for forgiveness not permission”

So I have a hard time believing that Facebook, with their army of lawyers and millions earned from data collection, are the victims here.

It's definitely hard to say that big corporations are victims, but I know that I personally find lots of bog standard legalese hard to interpret. Granted, lawyers have a lot more experience there, and more employed gives lots more perspective.

At the end of the day, they are still human, and laws and regulations are still written by humans, meaning that it can often be hard to suss out intent from the letter of the law.

> standard legalese hard to interpret

Indeed. We should know what the law is, without first hiring a team of lawyers. There's a trend to make laws that are harder and harder for ordinary people to understand.

Partly that's a result of having to cut out exceptions and loopholes for lobbyists and donors; but I suspect it's largely because lawmakers are increasingly trained, practising lawyers. If the language you speak is legalese, I guess that's the language you use to write laws.

oh and the facebook EULA is easy to ubderstand and grants you make rights and protections?

Parts I read of GDPR were more approachable than any of the EULAs I have seen. More approachable than software licenses as well.

The harder the better. Corporations should think thrice before collecting even one bit of information on anyone. They should be scrambling to forget everything they know about us the second we're done dealing with them. Storing data about people should actively cost them money. Keep adding difficulty and liability until they stop this surveillance capitalism nonsense.

Just so I understand your viewpoint, you're saying that the harder it is to understand/comply with the law, the better?

If your goal is to prevent data collection, why wouldn't it be better to just draft a law that says "It's illegal to collect data" with super clear rules and enforcement criteria?

> Facebook has invested billions of..

..of dollars that Facebook recieve by selling info about their users?

People who make laws can't see the future, it's a constant race to curb corporate behavior that is deemed unacceptable and the laws evolve as new loopholes are found and exploited. Corporations know this and take it into account when making a cost/benefit calculation. A while ago Facebook was threatening to pull out of the EU. When nobody cared they ponied up the tech required to stay. They will this time as well.

> People who make laws can't see the future

People who make laws can see the future (yeah, sometimes they don't), it's the people that do not understand them and protest, because they do not see the immediate benefit for themselves, so the laws have to be changed to accomodate the snowflakes of the World.

Making laws is about govern, not about futurism.

A compromise has to be found every time a new law is proposed to be approved.

See for example the ban on ICE engines, one side wanted it NOW the other side wanted it NEVER, truth is a good compromise was to accelerate as much as possible for some heavy user (Amazon alone, for example, is responsible for more than 20% of the global deliveries) and make some exception (5 years tops) for supercar luxury brands like Ferrari or Lamborghini, that sell a few thousands cars/ year.

But things being as they are, people complained about Ferrari asking for an extension (for themselves and other luxury brands) but at the same time against the ban in general because everyone owns a car.

The real problem is that people put in charge of making laws other people like them, not people better than them.

It's a vicious circle.

EDIT: the HN paradox: everyone knows what's bad, everyone has a very important job, but apparently things never improve because "politics".

Maybe things are harder than what they look at first sight, from outside, and it's not about "people not seeing the future", but about the fact that the more a society is rich and established, the more changes are hard and people oppose to them.

See for example how hard it is to convince American people that socialism is not a crime and USA could survive free health care paid by everyone's taxes.

Does it mean that Americans are stupid and can't open Wikipedia and do a simple research, that they can't see the truth in front of their eyes, or that they are simply afraid of change, because the system works for a large part of the population, the same part of the population that basically runs the country and decides who gets elected?

On the contrary, it’s actually quite refreshing to see law that patches a loophole which was being exploited by a data mining company to enrich itself.

As a matter of process, this isn’t a new law. It’s the same law that was in place in 2018 when the first complaint was filed. The courts have only just decided what it means for this specific scenario. They decided you can’t rely on contractual necessity to excuse not presenting the user with a choice about whether to be tracked, just because Facebook’s business is tracking. Up until now Facebook had operated assuming they could.

The main fault of the process is that it took 4.5 years. That’s 4.5 years of illegal revenue. Speed is justice. We all know this. It would have been preferable for the law to have been so clear that it didn’t take that long to argue. I forget the exact wording but I think it was pretty clear, and they just managed to draw it out long enough to turn more profit in the meantime. Possibly not so much a problem with lawmaking as with the litigation.

> according to their fair reading of that law.

I do not care at all what FB claims. They repeatedly lied, cheated (see 2 factor phone numbers) and deliberately misinterpreted law in insane ways.

One of their attempts was putting serving interesting ads as service given to users and claiming that it means that they are obligated to track them.

>No; we prefer to thrive by ignoring problems for a long time then smashing them with a hammer.

and here I was thinking that breaking things and disruption is what Facebook in particular was super into. Sucks if it happens to you I guess. Laws and regulations aren't made by meeting Facebook representatives and then asking them what's convenient. Okay Facebook has invested billions of dollars, luckily they've also made billions of dollars. How much do you think traditional journalism, including all the positive externalities it entails has suffered from Facebook? They didn't seem to care, it's a legacy industry if I remember correctly.

Car manufacturers all over the world have invested probably a hundred times as much in the combustion engine and the traditional car, it's going away as well. Like are we going to reimburse and invite everyone who has made anything we've decided we don't want any more?

Facebook has many legal experts. They have surely consulted with them, before investing their billions... For them it is more profitable to "not comply and be caught" than to exit the business... Now they got caught and they will fight until the end - because they have many more billions to spend... Any business in any country is making a risk, that laws will change...

> Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law.

I think the crux is that they instead implemented a system according to their most favourable reading of that law.

They took a calculated risk, it backfired a little bit (albeit after 5 years of using it to their advantage), and now they need to approach things differently.

Business as usual.

> a law was put in place 5 years ago that said [...] with some very vague and general language [...].

> Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and [the law changes].

You've just described how US legal system works (case law - https://legaldictionary.net/case-law/)

> just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better

You've just described how US lobbying works.

This is called regulatory uncertainty and there is a long history to it. Its also part of why you want a stable polity that listens to the people it rules, why you want lobbying to be legal (but not bribery), and why you should be careful about building businesses in areas that have regulatory uncertainty.

In terms of society, regulatory uncertainty better than no regulation, hands down, and is a spectrum whether the risk is too high to engage in the market profitably.

> all of those billions of dollars have gone to waste

'Gone to waste' is the best possible outcome of money spent on advertising infrastructure.

> Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law

This is utter bullshit. They have tried to twist and bend the rules and tried to use an exception that doesn't apply to them at all. Everybody knew that Facebook went against the spirit of the law.

Somehow they got the Irish authority to go along with their idiotic interpretation of the law, but that doesn't mean they were working "according to a fair reading of the law", it just means that the Irish authority failed to do their job.

If Facebook had gone with a conservative reading of the law, like many other companies have, they would have added consent prompts 5 years ago, and they wouldn't have a problem today.

I would suggest you spend some time reading the GDPR. It's surprisingly approachable. The parts about consent really aren't that hard to understand at all, and it's clear what the intention of the exceptions were (eg. a pizza delivery service obviously does not need to ask for consent to share the customer address with a delivery driver for the purpose of delivering the pizza, but they do need to ask for consent if they want to add the address to a direct mailing directory).

It's unfortunate that it took the EU 5 years to do something about this obvious violation, but the problem is not the law itself.

What? No. This legal response is perfectly reasonable in light of the facts.

"Having a real conversation" is clearly not how Facebook intends to operate. It has never been particularly open or forthcoming about how it handles data.

> To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means.

The "vague and general language":

Article 7, paragraph 4:

> When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

https://gdpr-info.eu/art-7-gdpr/

Recital 42:

> Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. 2In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. 3In accordance with Council Directive 93/13/EEC¹ a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. 4For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. 5Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

https://gdpr-info.eu/recitals/no-42/

Facebook didn't like the business impact of complying so has spent years grasping at loopholes that don't exist in a law which is remarkably clear for legalese (especially EU legalese). The fault for that lies with Facebook, not the law making process.

I am not a lawyer, a GDPR implementation specialist, or even a GDPR enthusiast and I knew this.

Specifically, my understanding has always been that a company cannot demand consent to data storage and processing in exchange for providing a service except where the data is actually necessary to provide the service. It certainly isn't necessary to track what users do on other websites in order to provide Facebook's core product. It isn't even necessary to do that to provide ads targeted to a Facebook user's interests because people who use Facebook normally provide significant information about their interests through normal use of Facebook.

There is no way that Facebook wasn't aware courts were likely to understand the law that way.

> Then, some random guy says he doesn't think Facebook's interpretation is right

This is not "some random guy". It's noyb and they're doing an important job. They not just "saying this and that" but do try to get the actual laws enforced which is what they did here. You can learn more about them here: https://noyb.eu/en/our-detailed-concept

The "random guy" you've probably actually meant is Max Schrems and his history is also quite noteworthy: https://en.wikipedia.org/wiki/Max_Schrems

What?

Article 7 par 4. GDPR [1], "Conditions for consent": When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. (emphasis mine)

Personalizing ads is not necessary for providing the service, hence the forced consent is not given freely.

To anyone involved with the GDPR back then, this was as clear as the day.

Also, Article 7 par 3. clearly states that even if consent were given freely, the "data subject shall have the right to withdraw his or her consent at any time", and "[p]rior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.", which was clearly not on the table with Facebook.

[1] https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...

Many would argue that that's what happened, Facebook choose to bet a few billions on trying to get around it by trying to argue loopholes into the interpretation and is now getting told to knock that off a bit more forcefully.

How about not rolling with ones own interpretation of the law, which coincidentally is very convenient for oneself?

I mean, if they do not actually know for sure how a specific law is to be interpreted then better err on the side of caution, instead of becoming a criminal, violating the rights of many millions of people. Better take precautions in case ones convenient interpretation turns out to be BS. I am sure they made their business viable without all those violations of the law. They can just flip a switch now, and stop doing the bad thing, that they now know for sure is illegal :)

But hey, that is just what I personally would consider an ethical approach, ha! Maybe not caring about the law and just continuing to ignore people's rights, being as invasive as possible to people's privacy, for as long as it is financially viable is the more ethical choice ...

The article makes it seem pretty straightforward:

> Meta explained that its updated terms rely on the GDPR concept of "contractual necessity". The GDPR mostly prohibits companies from forcing users to turn over personal information to use their services. The only exception is when that information is necessary to execute a contract: For instance, a car sharing app needs to know your location so that it can show cars near you.

For a car sharing app, it is necessary for them to get your location for the service to work. In Facebook's case, personalized ads are not necessary for Facebook to work. Since it isn't necessary, Facebook needs to get express permission to use personal information for ads.

Facebook took an overly optimistic view of the law expecting regulatory capture to allow them to skirt the rules. It didn't work, so their investment was a poor one. Regulators didn't force Facebook to make a poor investment.

Also, Facebook can decide to pay the users it tracks in Europe. Maybe the investment has poor returns, but the money hasn't entirely gone to waste yet.

There's a very strong assumption that Facebook are operating in good faith.

The article suggests you need actice consent, which is what a basic reading of gdpr rules would mean. I don't know why hiding it in the terms and conditions would possible be conpatible.

And to think, neither of these interpretations has anything to do with respecting my privacy, in a way that I think is fit!

I should be able to choose complete privacy.

Anything less, regardless of what corporations or government agencies say or agree, is illegitimate. And it shows that the governance agencies are illegitimate too.

It shouldn't be that it is assumed I am a criminal and that as crimes occur online, my data should be collected. Not should it be assumed that my data should be monetisable by intermediaries.

> according to their fair reading of that law

I get the feeling that you can bypass laws in the US based on technicalities and loopholes. In the EU, it’s the intent of the laws that matters, not how the words are written first degree. And the intent is pretty fucking clear: don’t mess with EU citizens private data. I can’t wait for Facebook to die and will never care that they spent billions trying to bypass EU laws for nothing.

Oh no, will someone think of the poor companies!

A pessimistic take: Europe isn’t capable of producing that many good tech companies[1]. Thus the goal of these fines is to raise money by fining foreign companies. Under that lense, the system functions perfectly as it was designed.

[1]source: a list of the largest tech companies sorted by market cap.

GDPR requires consent for a specified usage of people's data. If you want to send people emails, then you need emailing consent. If you want to use people's data to target advertising, then you need to ask them for that consent.

https://gdpr.eu/gdpr-consent-requirements/

I'm doubtful that Facebook have been using a fair interpretation of the laws as that doesn't seem to be the way they operate. I'm also doubtful that users can easily revoke consent which is another requirement under GDPR.

Can't believe this is the top comment...

I unfortunately expected just that.

Protection of personal data is not something many in this bubble like to see since it threatens their products business model.

Indeed, the law is only confusing if what you're trying to understand from it is "How do I track my users for my own revenue model, who would not agree to be tracked if it was as easy to decline and they understood the options?" and don't want to accept the answer is "You don't"

“It is difficult to get a man to understand something, when his salary depends on his not understanding it.” - Upton Sinclair

It's not even that.. he also wants that laws can't be contested or reinterpreted...

according to their fair reading of that law.

If their "fair reading" of that law is about as accurate as the characterization in your post, it's no wonder they lose court case after court case about it.

Are you a Facebook employee?

No. Never have been. Nor do I work in ad tech. I'm an attorney who interprets laws, including gdpr, for a tech company that does not engage in targeted advertising.

Sorry, I just had to ask. I'll control myself better in the future

Facebook interest is being ambiguously regulated. So no, you can't have fruitful discussion with them.

History shows us the regulator always comes after the original culprits exploited what they could, never before.

You gotta be kidding defending a toxic and frequently illegal privacy abuser like Facebook.

It's really not up to Facebook nor you to decide what is the "fair interpretation of the law".

No court has decided over this. It's the decision of a regulator, so Meta will most likely appeal to a court, and then we will know what the law allows or not.

On the contrary, these laws are proving to be very efficient at stopping Facebook's abusive surveillance. The Facebook problem should be smashed. Hopefully Gooogle and the other Big Techs are next in line.

All they have to do is stop collecting people's personal information, all their problems would go away. People don't want their surveillance capitalism abuse anymore. No one is interested in watching Facebook "discuss" the matter with regulators in order to massage it into a "compliant" form. We want Facebook's unconditional surrender on the matter, cease and desist all surveillance activities. We don't care how much money it will cost them, what they are doing is simply not acceptable and it has to stop.

Facebook didn't have a leg to stand on. Their justification was utterly ridiculous. The only insane thing is that they made it this long.

I'm impressed both by your outrage at requiring free, informed consent for tracking and personalized ads as well as this change resulting in "all of those billions [going to waste]".

To me it means one of two possibilities:

1. Facebook is incompetent, not only did it spend billions developing lackluster practices that don't fit the spirit of the GDPR but that money also instantly disappears because they are apparently incapable of adding a prompt for tracking consent and evolving with the regulatory landscape like every other company on earth.

2. Facebook relies on its relationship with its users being non-consensual.

<<2. Facebook relies on its relationship with its users being non-consensual.

Well, I am not certain FB tells users exactly the extent to which their online persona is being profiled. We have relatively vague lawyer talk for 'more targeted ads', but it does not tell you that FB identifies as a prime target for ads that would feature, say, a suffering animal. For the record, I am making it up, but inferences taken from massive amounts of posts people make daily make it highly unlikely that a detailed and thorough psychological profile that would normally require years of visiting an actual psychiatrist are now very much a possibility.

And the only official indication of this we have comes from various FB court cases, but those being 1000s of pages of useful information is not an average person will go through, let alone understand. I forgot which company tried to shed some light on it with ads that used that info indicating to ad viewing person that "you are an X who likes Y". They got shot down fast.

I guess my point is.. it may be consensual in the sense that user agreed, but did the user truly understood what he/she agreed to, is something I would argue against.

> Facebook relies on its relationship with its users being non-consensual.

Its very existence depends on it. Facebook is a company that builds shadow profiles of people who never joined the social network, never agreed to the terms of service and not even once consented to anything.

Considering FB's past behaviour (See Cambridge Analytica), the last thing they deserve is good faith treatment.

It is crazy. If the EU just wants to fully outright ban advertising - then do it - but set a standard and stick to it.

Tracked advertising is not all advertising.

I didn't say it was. However, defining what is tracking and what is not is also an issue.

Let's say facebook runs an ad on its platform to my website with a url of site.com/fbad. Then I can see how many people clicked on the ad on facebook and how many people converted on that webpage. There are people on this site who will tell you, and FULLY believe that that is TOO much tracking and is morally wrong.

Incrementing a counter is not tracking. I don’t know where you’d find someone saying otherwise. However, keeping records associating the fact that something was clicked with personal identifying information, such as an IP address or a unique identifier, is tracking, and you need to ask for consent. What is and is not acceptable use of data related to a person is defined in the regulation.

There's no problem with advertising, the issue is with companies misusing people's data. If a company wants to use targetted advertising then they just have to openly ask for consent to do so, but tying it up with the terms and conditions to use the site is hardly asking for consent.

> If the EU just wants to fully outright ban advertising

Come on, don’t be obtuse. The problem is not advertising, the problem is tracking and using user data without consent. The fact that they do that for advertising is irrelevant. They would have the same issue if they were doing it for any other reason.

> set a standard and stick to it

That’s what they did. It’s called the GDPR. One can argue that enforcement was insufficient, but the standard has not changed.

Move fast and break things (C)

> very vague and general language about how consent can be gathered

The language Art. 7 (https://gdpr-info.eu/art-7-gdpr/) may not be clear enough, but check out the recitals.

Unless you're actively trying to skirt the edge (in which case you shouldn't act surprised if you find yourself on the wrong side of it), it's pretty clear.

However, I think this article is slightly missing the point, as is your conclusion. (https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag... explains this a bit better.)

Facebook wasn't trying to get consent through the fine print (that would be very obviously illegal). https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dis... says that the decision "settles ... the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising".

Under GDPR, you need to have a valid legal basis for any data processing. This can be a) consent (which Facebook was not getting, nor claiming to get), b) doing only what's necessary for the performance of a contract, (some other things), and f) legitimate interests.

Consent is the easiest: When you get it (properly), as you said, you can basically use data in any way. But getting consent properly means actually getting consent, not tricking, annoying or forcing the user into saying yes when they don't want to. Ad platforms tend to either try to claim consent without actually getting it in a valid way (because, surprise, most people don't want this), or they reach for the other justifications.

While the advertising industry is trying to push to justify legitimate interest, anyone who has read the official EU interpretations (e.g. https://edpb.europa.eu/sites/default/files/consultation/edpb... - page 16 point 50, referencing Page 47 in https://web.archive.org/web/20220305192156/https://ec.europa...) would plainly see that you cannot use that to justify the kind of tracking that these ad networks do.

I suspect Facebook has realized this because otherwise they would have claimed Legitimate Interest. Instead, they claimed that processing the personal data is "necessary for the performance of a contract". That is obvious bullshit, and the EDPB has now explicitly confirmed this.

So I would recap it differently:

- A law was put in place 5 years ago to protect people from exactly the kind of behavior Facebook wanted to engage in (intrusive tracking, wholesale collection of personal data).

- Facebook has made a massive profit by violating the law, claiming to be merely skirting it, relying on creative interpretations that they must have known were "creative".

- They have now been told that their creative interpretations are wrong and that they need to actually follow the law. (They will likely also have to pay a fine that is a fraction of the profit they made from violating the law.)

- They can still do the thing they want, they'll just need to actually get voluntary user consent. Which they probably will not get in many ways, in particular because they're known for abusing the users and illegally misusing their data (see above).

I agree that it's inefficient that they were allowed to do this for 5 years before being told to stop, but I don't think that's unfair to Facebook, to Facebook's detriment, or because Facebook couldn't have known. It's because Facebook correctly concluded that they will get away with, and profit from, violating the law until caught and stopped.

You are not getting it.

This is a fight for the money Facebook is generating. The court, the law, the administrations, the bureaucrats, the media, the lawyers, the judges are all complicit. Using the law to say, take over someone house without reason will be outrageous (though it does happen in "lesser" countries than the EU).

But in the EU, you can still get people to look the other side if you explain it by Facebook is evil, Facebook is tracking you, Facebook is addicting you, Facebook is generating lots of money, etc... Of course, you have to realize, this is the same government that will sell your blood if they think they can make profit out of it.

Welcome to the Jungle.

Reply on news.ycombinator.com