Hacker News Reader

Comment by ranguna | Hacker News Reader

To opt out?

Shouldn't it be opt in?

I think data collection on the scale of what Meta is doing should just be illegal altogether, or at the very least it should be mandated as opt-in with the opt-in process being filled with warnings and never being the easiest way to get rid of a banner. It should be hidden away under a menu and there should be no banner at all.

The dark patterns used to trick people into opting in need to end. I religiously opt out on every GDPR banner, but even I've accidentally opted in sometimes because the button layout is intentionally designed to be confusing.

If I see a pop-up, especially from "OneTrust", I immediately close the tab and re-open the site in Private/Incognito mode. There are some sites I just reflexively open that way. "Ars Technica" is but one example.

This includes the permission to link your behavior across "devices"? Iirc, it is quite trivial to link one Private-mode session to another.

Not without breaking said laws

Linking devices is one of the standard permissions normally. So if you give permission in one window and don't say anything in another, it probably counts as permission for both.

I don't give permission even in private mode. If they do it anyway it's on them.

Closing the tab is good, but is it safe to assume, that they wont use fingerprinting, to map your "consent" (more like extortion) to future visits? Also they would still be tracking your incognito browser, if fingerprint is unique?

Maybe they do, but they ask each visit, so these tracking companies at least maintain the illusion that they don't know who I am. Each time I say no.

If something is free- you're the product.

If something is paid for- you're the product.

Interesting. How so?

Are there any indications that paying for Meta Verified opts you out of their data collection, since you've given them money instead?

I see, you were referring to Meta specifically. Your statement doesn't generalise though.

Well, I wasn't the GP but I see their point. Because today, buying a product isn't enough. Subscriptions and rent-seeking is where it's at.

Once you've bought a smart TV, it shouldn't really be any of Roku's business what you watch, but you basically have to airgap any brand of "smart" TV to avoid data collection.

Cars are much more computerized nowadays, so it would not be a stretch to imagine they have data harvesting software somehow (especially in light of Volkwagen's emissions test cheating); but if I've bought a car, it's mine, so why allow that? And then there's Ford's idea to have self-driving vehicles drive them back to the dealership if you miss a payment, which is a lot less time-gracious than missing utilities or anything like that.

The last time I paid for a laptop with Microsoft on it I still got ads shoveled in my face, and of course there's all the telemetry to deal with. Apple had that drama a few months back with people not being able to launch certain apps because some connection to their servers wasn't being made that would allow it, and Apple products go for premium.

It would seem rather prudent to assume that if you buy a product and it is electronic, there is probably some mechanism to transmit data to the manufacturer, because IoT and profit and why the fuck not.

Are there any incentives for companies to not collect data about their paying users? Who is even doing this?

The "if it's free" trope comes up on the regular in these threads. There are numerous examples out there, but off the top of my head, I pay for my cell service, my car's gas, airline tickets, and my rent, and all of those push advertising on me anyways.

While there is an argument for a product needing a revenue stream to survive, paying for a product clearly does not save you from ads and data collection. The company is there like Bilbo Baggins, holding the One Ring, and asking itself, "After all, why shouldn't I have both revenue from the customer and the ad revenue?"

No, this form is about right to object. It isn't about consent because consent is not needed for legitimate interests, which in this case is to offer personalized advertising.

This form lets people object to the use of their data for a legitimate interest.

I find it incredible that they are bold enough to try to pass this as legitimate interest when the Internet Advertising Bureau (IAB) is currently neck deep with the Belgian DPA over that very matter.

Legitimate Interest is supposed to be used for thinks like fraud prevention, not for added value things like highly target advertising that requires building a profile of a user.

I don’t think it’s going to end well for Meta.

I agree. From reading the text it appears legitimate interests was not intended to cover tracking for advertising purposes. However some government implementations specifically talk about it as likely allowed (uk) and in practice it seems to be on all the ridiculous popups now. If it is allowed for this expanded scope it completely defangs a lot of the gdpr.

I think some major differences between Meta and IAB is that IAB was sharing the data with other companies where Meta keeps your data to themselves. Additionally as a part of personalizing the non ad posts on ones feed the data is already being collected and processed. Showing a relevant ad isn't much different privacy wise than showing a relevant post. Tracking how you interact with a post isn't much different from tracking how you interact with an ad post.

This is a completely circular argument which also happens to completely miss the point.

1. They want to show personalized adverts

2. So they collect and process the data to do so

3. And therefore because they've collected the data, they must be allowed to show personalized adverts.

Aside from it being complete nonsense, the contention is around the 2nd point. They should NOT be allowed to collect and process the data for that purpose without permission, which EU courts have repeatedly stated.

Reply on news.ycombinator.com