Hacker News Reader

Comment by whimsicalism | Hacker News Reader

Spy on people? If you like a post on Instagram it is core to their service that they log that information. If they didn't, the app wouldn't work very well.

View on HN

"Personal data" as mentioned in the article includes more than just logging what posts you liked. I'm sure you knew that already.

My reading here is that an "instagram lite" that:

1. Showed you posts

2. Used what posts you liked to show you more posts you'd like

3. Also used that data to show you ads you're more likely to click on

4. Didn't give you a free choice on whether they did (3)

Would still be illegal under the GDPR.

Yes, it is the post-hoc analysis that is the issue, not the "spying" which is just the modern-day spin on standard logging and business processes.

If you do not prefer term "spying", "voyeurism" fits as well.

That’s my understanding as well. Point 4 being the key factor. They would have to ask, and give a clear yes/no option, on whether the user wants ads to be personalized based on their previous activity on the app (which posts they have liked, how many seconds they spent looking at posts, etc.) Otherwise, the ads would be based solely on the context that they are displayed in. Which seems perfectly fine to me.

If I navigate to a page that embeds a Facebook "Like" button, Facebook tracks that I visited that page even if I don't click the button.

This article doesn’t seem to be about tracking.

Why do you participate in discussion about the GDPR when you clearly know nothing about it? Of course a "like" or any kind of data that is core to the service doesn't infringe the GDPR. The illegal part is about processing or forwarding personal data of users to third parties, when users haven't agreed to that aspect of the "service".

You usually see the distinction between "functional" and "advertising" cookies in those annoying banners, where you of course can't disable the former as that data is core to the functionality of the website. And guess what, if you don't do any shady stuff with user data you don't even need to display any banner (the banner is for getting explicit permission from the user to potentially do shady stuff).

> Of course a "like" or any kind of data that is core to the service doesn't infringe the GDPR

I’ve heard many “of course X or Y” pertaining to GDPR that turned out wrong. Because it’s a law interpreted by twenty-seven separate DPAs.

GDPR’s aims are good. But there is legitimate criticism in its design.

If you work in a European company that has a web presence and/or collects data, you should be familiar with what is/isn't personal data by now.

I don't blame Americans or others for not knowing this, but the amount of bad takes about the GDPR by Silicon Valley people in particular is so ridiculous. Every single comment section about a GDPR topic on HN has a bunch of Americans talking about how Europe is some backwards, regulatory hellhole, always talking from a position of total ignorance.

> you should be familiar with what is/isn't personal data by now

Again, I hear this sort of thing all the time. Then you ask lawyers and lobbyists and get a host of opinions, many of which stick depending on which DPA one approaches or complains to. As a competitive stick, it’s dangerously dynamic.

+1 and what the GP is stating is not how any multinational I work with considers GDPR compliance. Properly managing "likes" and other member activity are absolutely key to compliance.

> managing "likes" and other member activity are absolutely key to compliance

As is keeping an eye on competitors, particularly lightly-capitalised ones, and noting when they stray into grey areas. Bonus points if you can get multiple DPAs to issue simultaneous requests in obscure languages.

I literally work in this field and can tell you that "likes" are regulated under GDPR just like any other personal data.

If someone asks us to delete under GDPR, we have to delete these as well.

Are you sure about this?

Being roughly familiar with GDPR, I would be reasonably certain that you could keep a like as long as the identity it's attached to is deleted. Much in the same way as you may see reddit posts that just show a [deleted] user.

Reply on news.ycombinator.com