Hacker News Reader

Comment by crazygringo | Hacker News Reader

> which is likely illegal in some areas

Do you have a source for that? Because that would definitely be the crux of the issue then.

The article itself quotes:

> "In its ruling, the CJEU expressly recognised that a subscription model, like the one we are announcing, is a valid form of consent for an ads funded service."

which suggests that it is not illegal. But of course this depends on whether the "ads funded service" includes tracking.

I can't find any clear answers from a few quick google searches. Of course, the existence of this lawsuit suggests that the law itself may not yet be sufficiently clear, and so the judicial ruling will ultimately provide that clarity.

View on HN

It IS illegal in the EU under the GDPR. People need to *voluntarily* consent to give access to their data. What Meta did, which is "give access to your data or you need to pay to access the site" is not by any stretch "freely given".

Source, for example https://gdpr-info.eu/issues/consent/#:~:text=Consent%20must%....

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

https://www.bfdi.bund.de/EN/Buerger/Inhalte/Allgemein/Datens...

A lot of German newspapers seem to use this model and nobody has successfully challenged their interpretation yet.

Same thing for many websites in France but I didn't find any track if it being challenged in court.

I doubt EU lawmakers planned for this approach to defeat privacy laws, it's definitely against the spirit but this will need an update. In FB case if you pay they 100% still track you anyway, they've been pretty clear they don't care even if they get caught.

Another angle against FB moving to a paid access system would be they could be considered public service due to how omnipresent the service is in day to day life, but lately it's probably more true for their other services like Insta or Whatsapp.

Yup, and those three links don't provide a clear answer against it either.

For example, the ICO link specifically states that it's OK to make a customer rewards loyalty card dependent upon tracking -- a clear exchange of allowing tracking explicitly in exchange for cash equivalents. That's still consent freely given.

A lot of the limits around consent are described with regards to employment, because there's an imbalance of power there. But that's irrelevant here.

The clearest prohibition is around "coupling", e.g. you can't make a purchase of an online grocery order contingent on sharing your data with third parties, because there's nothing "necessary" about that to fulfill the purpose.

But it seems pretty easy to make the case that tracking is "necessary" for fully effective advertising (ads without tracking perform much worse). So either subscribe for no ads (thus no tracking), or accept ads (and accept tracking). There doesn't seem to be any imbalance of power here, because you don't need to use Facebook the way you need to keep a job. Your consent is freely given, just like with a rewards card.

Although at the end of the day, the law does seems vague enough that it will be useful for a court decision to clarify it.

There’s a major flaw in that argument. Advertising without tracking still generates revenue, so having two different amounts of advertising based on tracking or no tracking is likely permissible.

However, linking the lack of tracking with buying a zero advertising tier is clearly coupling not a discount. Consider the reverse what if someone wants to pay for zero advertising but is perfectly willing to have tracking. Thus we’ve discovered 4 possible decisions and FB is trying to artificially limit them.

Right, but this is where it just gets unwieldy.

Are the courts really supposed to mandate that FB provide 4 tiers instead of just 2?

We're already in checkbox hell with the various popups. And the notion of "coupling" is notoriously hard to define in practice.

It's precisely the vagueness around what is and isn't coupling, that I could see the courts going either way. I was really just arguing that it's not clear cut according to the law as written.

I agree there is some vagueness here, but the number of options isn’t mandated. The only mandate is the for people to be able to avoid tracking. FB is free to only have 1 option advertising supported without tracking, or 1 option paid without tracking.

They can have 2 options advertising based with and without tracking, or 3 if they add paid without tracking etc.

It’s the same deal as wheelchair access. You don’t need to have stairs if you’ve got a ramp, but stairs alone doesn’t qualify as wheelchair accessible.

I think newspapers received an explicit carve out a little while back, which is where I think it's quite fair to call out the EU on a bit of hypocrisy.

Has been challenged and ruled illegal:

https://noyb.eu/en/pay-or-okay-tech-news-site-heisede-illega...

However, law is slow and it will take a while to propagate to more sites.

What that describes is a problem with the actual wording/sequence/nudging involved, and the result was merely a "reprimand".

It doesn't seem to declare that the model is fundamentally illegal. Also, wouldn't that kind of decision need to be taken at the EU level? Because until then, you could have all sorts of inconsistencies between localities and countries.

This is one of the dumbest things about GDPR and one of the reasons why the EU has a stagnant tech industry. Their own regulations choke their companies to death.

If your company can't exist without infinite free access to user's data, then your company shouldn't exist.

> This is one of the dumbest things about GDPR and one of the reasons why the EU has a stagnant tech industry.

If progress means having to exist in a world without the GDPR, then I'm good stagnating.

The thing is, I can't find any part of that ruling[0] that even remotely matches Meta's claim. Can somebody point it out for me?

And it makes sense that there is nothing like that in there. Subscriptions were totally irrelevant to the actual questions that the CJEU was asked to rule on in that case (which was e.g. a claim by the German competition authorities that it was impossible for anyone to freely consent to tracking by Meta due to them having a dominant market position, and a counter-claim that the competition authorities did not even have jurisdiction over a GDPR case).

[0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

It is safe to assume that Meta will absolutely have tracking and data collection to the nines on this, because they have glibly been pleading ignorance and shock every step of the way as they've wrenched things towards the most anti-privacy interpretation possible whenever they get the obvious door in the face.

They just don't get any benefit of the doubt anymore.

Reply on news.ycombinator.com