The EU’s Digital Services Act is now in effect | Hacker News Reader

The EU’s Digital Services Act is now in effect

theverge.com

110 pointsredbell125 comments

The ban on advertising targeted at things like sexual preferences will be interesting to watch. As some people have pointed out, Netflix for example seems to be very good at targeting people who are "questioning", anecdotally before they begin to consciously do so; the suggestion being that this isn't intentional.

So if an AI decides that I'm likely to buy something LGBT if they offer it to me, despite using no label for the category, rather a token in the net, then does this break the rule? If so, can I ever responsibly use any form of AI-based targeting?

EDIT to add ref: [https://www.bbc.com/news/technology-66472938]

That is interesting, and kinda weird.

Where is the line I wonder?

If Netflix effectively says “you seem to like watching gay stuff, here’s more gay content”, is that wrong? Because it seems like that’s not Netflix targeting a user’s sexuality, just their viewing preferences.

OTOH it’s pretty harrowing to hear about people in (for instance) Uganda who are outed by an algorithm and (whether it is correct or not) find themselves ostracised or worse.

I've definitely had situations on Spotify where I've been listening to Abba and the Scissor Sisters, and started to be offered playlists aimed at LGBT people, but this is musical-choice targeting. It just happens that I like stuff that gay people like.

Spotify algorithms are complete trash.

There was a period when, for some reason, it would recommend playlists related to getting "tarted up", "makeup on", being a "powerful woman" etc and recommending lots of music it thinks is for women.

Though I do listen to a wide variety of music, there's nothing notable I'd say could encourage it to believe that.

Generally I play metal and rock, grime, rap, hip-hop; but also classical, some pop and indie, occasionally "UK Top 50", "Coding Mode" and "Jazz Vibes" playlists and lots of children's bath time songs.

I had to have a purge and its much better now but I still avoid the auto-playlists.

I bet you it's the children's bath-time songs that did it. Very mumsnet-on-the-razz.

It's a weird one, the playlists it was creating for me had a very "young woman" vibe, say 20s, aside from not being a woman I am not that young either, also, does Spotify think parenting is only for mums?

I wonder if it had something to do with my location; I was living in London and now live in the North.

I'd argue it is, and it should be so even in the US.

Even if Netflix's intentions had been perfectly benign - and even if they didn't specifically target this category but only did so emergently through some unsupervised algorithm - they now have a way to find out for all of their customers whether they are closetted gay.

Imagine someone like Trump or Desantis or even worse coming to power. People like those will certainly find such databases helpful, and they won't care at all whether the data is ostensibly about viewing preferences or directly about sexual orientation.

Yeah I absolutely agree that it’s chilling what could be done with that information and it won’t matter to such people whether it’s accurate.

I mentioned Uganda because I listened to a story earlier in the week about a man being thrown out of his mother’s home because she saw his Tik-Tok feed and it was full of very openly gay content. So we don’t necessarily have to imagine it - in some places this is already happening.

No need for a counterfactual, how do you think Trump used this data when he came to power?

No idea, what did he do?

>Legislation is put in place to ban behavioral advertising

>"how i can use Tech XYZ to do behavioral advertising now?"

you don't.

"the DSA bans targeted advertising based on a person’s sexual orientation, religion, ethnicity, or political beliefs and puts restrictions on targeting ads to children."

So I can still apparently, for example, target running shoes to people who like running, for example.

I wonder how will female hygiene products be advertised.

One way to do that would be to advertise to everyone, and.allow to opt out. Thus the advertisers would build up a database of users who don't mind such advertisements. It will be an overwhelmingly female audience, but it's not going to be targeting based on gender (gleaned somehow), it will be based on revealed preferences of users.

Is advertising based on things correlated with gender allowed? Since the opt-out would presumably be correlated with gender.

But then if that's allowed, you can claim the AI model is just correlated with gender or whatever and not using the field directly and thus also OK.

>But then if that's allowed, you can claim the AI model is just correlated with gender or whatever and not using the field directly and thus also OK.

That genererally doesn't work on protected classes even in the USA (a privacy laggard). Look up the history of redlining.

I imagine the best way would be good old context based advertising. Don't advertise to women, but book banner ads on women's health websites, run preroll ads on movie reviews of romcoms, sponsor true crime podcasts and fashion influencers, run ads on the websites of "women's health" or "cosmopolitan".

That's how basically all advertisement worked until just over a decade ago, and it's how a lot of advertisement is still done today.

But if you do this, then you can't say that your company uses AI to improve your customers' experience!

Gender/sex are still on the table tho?

with caveats. the biggest being that it’s just the EU.

Just 448 million people? That’s ahead of the US by over 100 million people but behind only China and India, and they have their own regulatory framework around social.

Briefly discussed here:

https://news.ycombinator.com/item?id=37106476

Are Netflix recommendations advertising?

The people who see them have already bought the product (a Netflix subscription) so the recommendation isn't trying to convince them to buy something.

Of course they are.

If people don't see content they want to watch when they start Netflix they will eventually stop paying for it.

Netflix is not there for you to watch your favorite movies when you want. It is there to encourage you to watch as much Netflix as possible. So it makes sense for them to advertise as much content to you as possible.

A subscription is by definition something you have to keep paying, so it doesn't make sense to say that they've already bought it.

i see a lot of pg18 ads on my workspace, i fell annoyed, who to blame?

may be you check your history, may be you have log in your personal account on system or may contact sys admins

But Netflix isn’t one of the “very large platforms” identified.

Not sure when the DSA will impact smaller platforms but you won’t see it for some while.

I won't lose any sleep over personalized ads being restricted. The negatives promoted by these far outweigh any real positives. And there are readily available alternatives without the most harmful side effects --- aka simple, context sensitive advertising.

While I agree, I think it is a matter of perspective. For the industry a click rate of 0.00020 vs 0.00026 makes a big financial difference.

(Numbers are obviously made up :))

Great. That one-second delay caused by the ad networks and creepy tracking scripts adds up too. I know it's not you, but any time someone tries this defense, they claim small percentages for [time / click-through rate] over the population add up, without acknowledging that it goes both ways.

How much bandwidth and processing power is getting consumed? Not just serving it up, but on the client side too once it's delivered.

I already agree with the DSA, there's no need to sell it to me

American tech companies ads is just pure evil, not a fan of over regulation but the current state is just bizzare to me.

IMHO, we are not in a state of overregulation in IT. We are certainly on a path towards having more solid regulatory framework (looking at privacy, post market cybersecurity and basic no-gos like here) but the road is still long and overregulation far away. We are just leaving the wild west.

I work in medical device development, stuff like GDPR our regulatory team has for breakfast without much drama. It is normal for us, as it is for airplanes, cars, food processing, financial services, etc.

There's many great things in these laws that, in a vacuum, I'd love to have. Outside of the vacuum, I couldn't care less. The benefits absolutely pale in comparison to letting ghouls whom the mere existence of the Internet offends have any sort of say on anything remotely connected to anything that has even tangential proximity to the Internet. The greater the year and number of laws passed, the clearer it is that the only correct position on this is an absolute one.

If there is a discrepancy between what is legal offline vs. online, and you feel you must correct it, then you can strip down the laws that govern the offline. There, solved. The threshold between governments and privacy on, and control of the Internet has been worn down low enough, and has been for over a decade. The only laws we need that have to do with the Internet are to curtail the power of law enforcement and intelligence agencies. Anything other than that betrays all the things the EU says about privacy and fundamental rights as the marketing bauble it is.

And an EU Commissioner saying "we're bringing our European values into the digital world" should scare people. It's a good time to remind everyone that part of these values is letting the Europol do whatever and then rewriting laws to reatroaticely protect them when they've found to be systematically violating them. And for Ursula specifically, those values are what drove her to try over and over again to curtail online freedoms regardless of having it made clear to her that her ideas are unwanted. The Commissioners might be democratically elected -- if you're willing to take the concept of representative democracy to its 100000000th degree -- but they're undemocratic in spirit.

But sure, lets all focus on protecting ourselves from the fucking ads again.

So the internet should be a lawless space. I would recommend you to talk to victims of doxxing, revenge porn, fraud and many other kind of internet based or enabled crimes.

And if you assume the internet should find its own kind of technical solutions, then the solution will look like trusted computing. Then is removing freedom of violating the law, which is worse than having a restrictive law.

.... and they still forgot the technical plane: interop of big tech with small tech: noscript/basic (x)html browsers, IRC(TLS or not) bridges, email, etc.

The other component of the regulatory package, the DMA (Digital Markets Act), brings interoperability obligations. This aspect is arguably primarily related to competition rather than content moderation, which is why it falls under the DMA rather than the DSA (Digital Services Act).

Ok, DSA and DMA, but as far as I can remember, No DMA news on the actual technical interop grounds.

What are the reasons of that? I wonder.

What do you mean no news? The interop mandate is still in it?

The DMA requirements for interop has a longer lead time. They won't go into full force until 6 March 2024.

With the IETF still working out MIMI and MLS, that's not necessarily a bad thing in my opinion.

What are those MIMI MLS? Why is it the first time I hear about this?

What's extremely important is how modular is the technical interop, and above all modules (and not 748397498324 modules) must be reasonable to implement by one individual normal developers (well, for the crypto module, "normal" is not enough). Hope we don't get a remake of the "semantic web" which end up pushing forward the current abomination of web engines (including their SDK).

MIMI is a system to allow different chat services to communicate with each other. It's intended to be the protocol between WhatsApp and Signal, for example.

MLS is a standardised encryption standard for messages, including a protocol and an architecture, to ensure that MIMI can be implemented securely.

MIMI and MLS are still being worked on by the IETF taskforce so you probably haven't heard of it because it's not even sure how it works exactly yet.

The difference between these protocols and the semantic web is that people from actual chat apps actually got involved in its development rather than just being a good idea by a bunch of ideological people.

So MIMI is a server-server protocol... even worse than what I thought, it is a "interop" client-server protocol which should be worked on.

Because signal or whatsapp, same same to me, I don't want them, but I would need to interact with some people there: namely create an account, and use a light open source client (not using any of those grotesquely and absurdely massive and complex web engines... and their SDK).

I have a very bad feeling about this. EU regulators seems to miss the point: in this very case, it is the client protocol which should be open, stable in time and super ez to implement by even a normal individual dev (not the TLS part ofc).

Then, there is the account creation or guest account, etc. A friend told me EU started to emit user specific certificates.

I don't see why we would specifically need an open client protocol, the goal is to prevent gatekeepers from locking users inside their networking effect.

The EU does not state specifically how gatekeepers must open up their services. For all we know, iMessage will open up a web API that offers the same functionality rather than sticking to MIMI. The IETF called for a unified protocol and people from several projects started laying down their requirements and suggestions, that's it.

In my personal opinion, an open server-to-server system would be better than an open client. An open client protocol would pretty much limit messengers in their functionality for the next ten years, because WhatsApp couldn't possibly alter their image upload API unless they're willing to risk an EU investigation. You'd also end up with ten different APIs, all in various states of feature support and implementation details, and if someone does manage to make a unified app, you'd end up with ten different contacts for the same person.

You're never getting a simple client API with modern chat messengers. E2EE is practically a requirement these days, and E2EE is hard to accomplish. Requiring a simple client would actually make the situation worse, allowing the EU to basically force chat apps to break their E2EE properties because of "API compatibility" reasons. I don't think anyone but the worst politicians want that.

I don't know anything about user specific certificates. There are some EU countries that permit authenticating to government services using a smart card, but that's got very little to do with this whole system. It's certainly not something we use to authenticate with chat services.

Allright, we do not agree since we are not talking about the same thing: I am talking about client interop, namely not using Big Tech web engines. This is what I am expecting from EU regulators.

I had a look at MIMI and MLS: this is IRC with/without TLS. Is this really from the EU?

What's need to be done is to clearly defines the various URIs to navigate between the various clients (with/without TLS): IRC client, voice/video conf client, email client. For the voice/video conf, it is still a slipery slope as I don't think there is an actually simple voice/video conf protocol yet: no, webrtc is not reasonable, I am talking about a brutally simple protocol namely direct TCP IPv[46]:port (signal, video stream, audio stream and the client will have to deal with UPNP IPv4) with optionaly a DNS name (like SMTP where the DNS is optional).

and again, it is missing the web: noscript/basic (x)html, 2D semantic HTML documents.

I both love and hate the long lead-times that EU regulations tend to have. It's occasionally a surprise to me when it comes into effect after I forgot about the law.

It's codified censorship.

Time is finite. Censorship is already in place by those that seek to use yours.

Whether this is 'better' is the debate. But that you a person is a product who's manipulation of is current is not. The new current is that of false agency.

That's quite a take, can you back it up in any way?

Well it's the textbook definition of censorship i.e government deciding the content media platforms are allowed to publish/carry.

I am not sure that's the case here.

Also, has there ever been a time without censorship. Please keep in mind I am not interested in shallow right wing ideology crap.

Big boys/gals always censor. Otherwise they wouldn't be big

The difference is companies used to decide what piece of content to nuke now it's the government doing it which is a big no-no.

So instead of a private, unaccountable censor you now have a democratically elected one? How is that worse?

Government can put you in jail this is not a slope we want to grease.

Private "censorship" is localized and fairly harmless.

> Private "censorship" is localized and fairly harmless.

That, again, is a bold claim with nothing to back it up.

Here's an example of private censorship with a political motivation: https://www.businessinsider.com/twitter-leaked-internal-mess...

Nobody elected Musk, and yet he just autocratically controls a major medium of communication now, with no democratic control mechanisms in place. Better not upset the owning class or you, too, will be silenced!

Is this supposed to be a counter example? These actions are localized to twitter and afaik no one has gone to prison for it.

Like it or not (and I don't) Twitter is Musk's property, it's his 44B toy and he can break it if he wants.

they aren't elected

What do you mean?

I think they mean whoever is put into these companies to ensure compliance is just hired for the role, and isn't from some set of directly elected people.

This distinction between "elected", "appointed", etc.. people comes up pretty often in criticism of the EU and its institutions.

By that standard, the president of the US isn't elected either.

This is different still. It's more like how the US president's cabinet is unelected. I was referring mainly to the European Commission, and a common criticism I hear about it.

The electoral collage does follow a process that is election, even if there's one (or more) layer of abstraction between that and initial ballots.

Not that I share GPs opinion, but the US president really isn’t elected by the people. The winner takes it all is a strategy suitable for the 1700‘s, but not today. It may be what it is, but it certainly isn’t democratic.

Or, advertising is harassment.

How do you mean?

It allows hosts on every level to be criminally charged for user content. It has come with a backdrop of powerful interests pushing for cross-border takedowns in the EU. It suggests allowing copyright enforcement firms and NGOs to arbitrarily take down content and the legal protection against abuse is intentionally written vaguely and open endedly.

Worth remembering that this allows unlimited censorship of social media. What kind of things do they plan to censor? "Disinformation", broadly defined. The European Commission can now censor anything it wants, globally, and has already compiled lists of things it thinks are disinformation:

Consider, for instance, some of the key “disinformation trends” listed in the EDMO’s recent 2023 briefing on disinformation in Ireland. They include “nativist narratives” that “oppose migration”, “gender and sexuality narratives” that touch on drag queens and trans issues as “part of a wider ‘anti-woke’ narrative that mocks social justice campaigns”, and “environment narratives” that criticise climate-change policies and Greta Thunberg.

https://dailysceptic.org/2023/08/25/the-digital-services-act...

This gives the EU an extraordinary amount of power. The regulation of the DSA will be overseen by the Commission itself, not an independent regulator. What’s more, the DSA includes a ‘crisis-management mechanism’, added last year in a last-minute amendment. The Commission argued it needs to be able to direct how platforms respond to events like the Russian invasion of Ukraine. Apparently, in a crisis, the ‘anticipatory or voluntary nature’ of obligations on tech companies to tackle disinformation would be insufficient. Under the DSA, the Commission has given itself the power to determine whether such a ‘crisis’ exists, defined as ‘an objective risk of serious prejudice to public security or public health in the Union’.

https://www.spiked-online.com/2023/03/23/the-eus-censorship-...

You call it "censorship", I call it fighting disinformation, fear mongering and state-actor propaganda campaigns.

I would welcome measures that go a lot further than this.

So you oppose freedom of speech, you oppose property rights, you oppose the right to protect children. Because you oppose basic rules in society, I support violence to fight you

Ahahahaha :D Thanks, made me laugh :)

it’s censorship by the politicians of the day.

europe has been backsliding on hard won freedoms for a while. this is just part of the trend.

Yawn at empty generalisations with zero backing data.

right to forget, gdpr, now this. it’s a clusterfuck.

You just cited two of the most pro consumer laws in the world. I guess I know which industry you work for…

I enjoy all the website, banners, and I’m certain that my choices are being respectful fully.

Citing people breaking gdpr as a failing of the EU is like citing people speeding as a failing of traffic rules.

Why wouldn’t it be plausible that some traffic rules are ineffective and we can be critical of them?

> You just cited two of the most pro consumer laws in the world.

i guess you don't live in europe.

> I guess I know which industry you work for…

your guess is wrong.

the problem is, who gets to decide what is disinformation?

yes, there is a lot of fake news out there, and i'd rather see it go away, but i fear that the barrier to decide if something is disinformation is to low. if someone claims that something is disinformation, it is not enough to show that it contradicts some other information, but once such a conflict exist we have to go the next step and show actual evidence that one is right and the other is wrong. and the source spreading the disinformation has to be given the chance to present their evidence as well. if they can't then they may be denounced accordingly, but their spread should then only be limited, and not outright blocked so that there is still a chance to critically evaluate it.

here is what i would like to see:

* there must not be a single entity that is the arbiter of truth, but we need multiple independent institutions that evaluate sensitive topics and give their recommendations.

content providers may then follow any one of these institutions at their choice. (most practical would be to have regional institutions to give diversity, but content providers may follow any of them. if the french one says something is ok, and the german one says it's not, then the content may still be unrestricted even in germany)

* content must not be completely blocked but should come with a warning or be hidden. like on hackernews.

i can, if i want to, access all the dead content. it's just an extra step, and the majority won't bother with it, but the ones curious can check, and if there is something wrongly hidden they can share that.

The commission is subject to the courts like any other government body. The European courts have been quite in point in defending consumers and common people. IMHO no drama here.

I hate it when people define dirty words like censorship to only mean censoring "good" things, and censoring bad things is not "censorship" but some other more positive euphamism.

Every single regime that has ever censored anything did it in their mind for the "good" of the people to protect them from negative influences.

And while you are right, languages and communications play with nuances like that. It is all about context.

What a nightmare. The state(s) are becoming total insane.

Downvoters: is what this poster says broadly untrue or not?

Read https://edmo.eu/wp-content/uploads/2022/09/2023_EDMO-Ireland... and decide for yourself whether a chain of three people quoting and restating the parts they disagree with the most managed to produce an accurate representation.

You're insinuating that the quoted text unfairly represents the document. You shouldn't do that. If you think there's a misrepresentation, point out what explicitly, don't use slippery rhetoric.

The summaries are entirely accurate. Here are some quotes from the document itself:

(p12) The narratives propagated by right-wing extremists in Ireland are broadly aligned to a nativist ideology. Nativism is a particular construction of nationalism that advocates protecting the interests of native or indigenous inhabitants over those of immigrants. Nativist narratives have circulated for many years in Ireland, rising to prominence in tandem with wider events that are ripe for exploitation by extremists ... Some of the key narrative themes that are prominent in the current protest include: Inauthentic claims: References to “economic migrants”, “fake asylum seekers”, and “fakeugees” imply that refugees and asylum seekers are lying about the dangers they face and attempting to scam the state.

(p14) Climate change is often viewed through a conspiratorial lens that seeks to “expose” the ulterior motives behind climate action and downplay the evidence for climate change (see Figure 9). Greta Thunberg is a frequent target for abusive language and humour relating to climate change while Met Éireann weather warnings are viewed with suspicion.

(p17) Some notable characteristics of disinformation campaigns in Ireland are summarised below: Participatory memes and content templates ... Attacks on the credibility of mainstream media and journalism.

Given that both of the sources he cites are infowars-level right wing rags, with headlines such as:

* Nick Dixon and Toby Young Discuss Virtue-Signalling Men Pretending to Love Women’s Football

* Official Guidelines Reveal Anti-White Racism of Sadiq Khan’s ‘Branding’ Campaign

* How woke colonised Mexico

* No, Brexit is not the cause of our economic turmoil

It doesn't really seem worth engaging with those articles.

These laws are bad for a lot of reasons. One thing is certain: they will drive up prices. The Tech companies usually pass the costs on to comply with this stuff onto the users, naturally.

We are now in de facto monopolistic behavior (think apple, Microsoft and Google or Azure, GCS and AWS) with permanent price raises of the richest companies in the world. Data interop can break this de-facto monopoly and allow competition.

By no means do I believe the problems stem from our corporations. Instead, the problems stem from the government, "social" policies, high taxes, etc. Our corporations are not the problem.

Reply on news.ycombinator.com