Meta unlawfully ignores the users' right to easily withdraw consent: complaint
noyb.eu
noyb.eu
They invented "essential cookies for marketing purposes" anyway. And after there was this "You accept tracking ads or you pay to us" popup.
Anyway, if this thread leaves you frustrated then maybe just don't participate in it?
The EU has 100's of millions of people, not all of them are in a position to bring this kind of effort because it requires bringing suit (which children may be able to do but don't generally do) and a very large chunk of a lifetime's worth of dedication. So in an attempt to roughly indicate the order of magnitude of difference between the number of people that could have taken action but didn't I used the 300 million figure. I haven't checked it for accuracy and Greta Thunberg notwithstanding the fact that you bring her up as an example is exactly because such individuals are so rare which is exactly the point that I was making.
Without Schrems for privacy and without Thunberg for climate change these subjects would get less attention than they do, and both of them have been instrumental in making meaningful change when in fact both of these subjects should concern the vast majority of that 300 million, give or take.
In this case, it's specifically that not all DPAs are doing their job correctly: some due to understaffing, others arguably due to ideological reasons.
I partially blame the GDPR itself - I still stand behind the spirit of that law, but it's IMHO not strict enough (or has too many loopholes): I think the selling of personal data to third parties should have been banned outright.
Meanwhile, others of us in the EU simply delete their FB accounts and don't look back. (Right at 5 years ago, fwiw.)
But I'm very surprised the apparent offsenses are so large and so obvious.
I was expecting them do do more subtle things like 'accidentally' asking users their cookie preference every time they use the site till they hit accept, and then never asking them ever again. When investigated, they can easily say 'oh, it was a bug because the fact the user rejected cookies was itself stored in a cookie'.
As long as it continues to be more profitable to go big when they break the law that's what facebook will do. Same as any other company. No need for facebook to even try to hide it because the fines/slaps on the wrist just don't matter. Try locking up CEOs or shareholders and watch how quickly they start following the law.
Like I have some sympathy for a legacy business that simply mismanages their GDPR obligations and buys some dodgy "compliance management" solution and ends up infringing - there a "slap on the wrist" light enforcement is appropriate.
But Meta has been entangled in GDPR enforcement since the beginning, repeatedly, who clearly understood the regulation to begin with and went straight out of the gates attempting to workaround and arguably being the reason the regulation was enacted in the first place.
I really want to see those 4% of global revenue fines piling on at this point.
Hopefully I can wait it out. The only reason I might have needed to use it would be to reach people whose contact I only have on there.
At least the group who did show up "blamed"* the host for only inviting to the event via FB, which I see as a massively positive sign of the culture slowly changing
*Not in a negative way, but in a "what did you expect, only inviting people via facebook" kinda way
That cliché is no longer applicable (was it ever?) and repeating it only helps the worst infringers.
You can pay and still be the product. Consider the streaming services which charge you but still serve ads, or physical appliances that you buy but send your usage habits to the manufacturer (like TVs). Paying is not a guarantee that a company will treat you or your privacy with respect.
Consider that paying makes you prime rib for Sunday dinner from a data perspective: card verified PII.
And do not forget that you can be assigned an ID and disassociated from your data, which can then be tracked anonymously completely legally as a non-personally identifiable account. And let me assure you de-anonymizing a collected dataset is often not a very difficult problem in the modern data brokerage filled era.
We cannot pay out way out of this. We need rights to privacy and deletion enshrined in constitutional-style law, and soon. It must become a fundamental human right.
Now it makes sense - they meant wary / leery.
Indeed. A mistyped phrase missed by both my sleep addled self and my annoying spell checker.
Rather than be defenseive (fore I gaudere gehrehte), let’s reflect on this moment to enjoy the fact that “we have over two thousand years of records of old people claiming that language has already peaked.”
Nothing in life is a guarantee. It’s pure pedantry to hear someone say “I would rather pay than be the product” and to choose to interpret that as “I believe that paying always guarantees that the company will never also use indirect monetization”.
Preferring business with direct monetization models is risk mitigation, not a naive (and incorrect) belief in a magic bullet solution to a complex problem.
I say that where money can be made, money will be made. But we have laws and regulations, and when the Metas of this world play dirty, you can stick it to them. (in most cases it will be too little - too late)(but the solution is not to roll over)
I pay for the ad-free experience on every service that offers it, and I still see ads. The 4 second hulu splash screen at the start of EVERY item I stream is still an ad. HBO, sorry MAX, showing 30s ads for other shows EVERY. TIME. I stream something, still an ad. At least those I can skip, but I shouldn't have to.
There was no real purpose to my post, I just needed to vent about that part your point.
That’s fairly recent. It was (and is) normal to pay for having a phone number. Paying more for making a phone call was normal, too, as was paying for such services as a phone line that told you the current time or a weather prediction.
It was also normal to pay for having an email address, and most people, to this day, pay for having internet connectivity.
I think it’s more that people object to moving from ‘free’ to paid. If most people pay for a service, they’ll accept that as the way it is.
For example, I think people would happily pay $1 of more a month for GPS, if it never hadn’t been free.
No, it's not. In the early days, everything on the internet was free. Before 1996, commercial activity on the internet was forbidden.
AFAIK the first commercial ISP dates to around '89.
But I don't think the fact the internet once had restrictions on commercial activity really makes much difference to the argument above other than in the details, given the argument was broader than about the net.
So I read the argument above as being about internet services; not hardware or connectivity, that would make it hard to understand.
They should charge a fair price for their product and deliver something good to customers.
No one is forcing Facebook to not charge for their service. They just can’t do it without slurping your data. If they can’t have a business without invading people’s privacy, they shouldn’t have a business. It is baffling that people still shill these practices from big corporations. It’s like saying “I can’t make money without robbing you, so it should be legal for me to rob you”.
> the only result that will satisfy organisations like noyb is that companies like Facebook disappear from the EU.
This is absolutely not true and frankly reads like an argument in bad faith. noyb’s position is clear: don’t invade people’s privacy.
> This is illegal, as the GDPR clearly states that withdrawing your consent must be “as easy as” giving it.
The whole point of the article and this discussion is precisely that you can’t make privacy protections a separate “feature”.
NOYB is perfectly fine with companies making money by placing ads (as long as they preserve your privacy).
All I want is for the true costs of using a product to be understood. Businesses can and should make money! But it’s wrong to present a product as “free” when it is not. It’s no different than having a fine print click license granting Facebook permission to come take stuff from your garage.
Yes, businesses cost money to run. No, that does not mean that all business models must be permitted regardless of consumer and social harm.
There is no fundamental right to a profitable businesses; if a business cannot be profitable within the bounds we choose to set, oh well.
(And I say this as a huge EU policy skeptic that thinks they are way over-regulating)
Edit: You can still charge for your services. Literally nothing in the EU prevents you from charging for your services.
Through it should be noted that GDPR requires no tracking but not no ads, and companies try to lump that together to pretend there is no reasonable solution.
E.g. a lot of newspapers use approaches similar to Meta (and similar not lawful) i.e. either you get tracked and ads or you pay and get neither ads or tracking. But this is illegal as opting out is noticeable more complex then opting in (account creation requirement is already illegal, money requirement more so). What would be legal would be a choice between "ad(personalized with tracking)" or "ad(no tracking)" and "no ad but account + cost money". You also still can choose ads based on the article/site content etc. (Also another problem with account requirement for no adds is that it often deceptively sneaks in the permission to track when creating the account making it de-facto no option to not be spied on!)
Another problem is that it can be easily too expensive for many people (not just very poor ones). Especially if like currently there are no "supper cheap but also very limited accounts".
I mean consider YT Premium Lite is 5.99€, no ads but you still get tracked. Twitch has no Lite version (and some non YT-lite premium features are actually for free) cost 11.99 (YT non lite is 12.99). Most news papers and similar are between 3€ and 8€ or so, commonly 5€. Of most of them I only read ~1 article per moth or so, often less and often not even the whole article sometimes I just look for a link to the original source and often I realize I just got click baited and bail out. Like you could easily end up 80+€ a month that's just ... to much for many.
And in pretty much all case paying means no ads but not no tracking/selling your information, at best a bit less tracking.
For example, I considered paying but I have a semi-inactice Facebook account which isn't worth that to me. I'm also not convinced of Facebook's integrity to honor the deal and not process the data anyway.
The cost of running most social media is only about a $1/year (yes year not month) [1]. Social media companies when they want to charge $50-100/year. People are not stupid. Why would they pay more than $2/year.
This worship of the Market Strategy was bad enough before when there wasn’t much talk of actual laws defining how much of a “product” they can make their users. But now there are! And this submission is about unlawful practices. And we’re still going to frame this as Meta just being effectively forced by the horrible consumers who refuse to “pay for services”? Ridiculous.
And I haven’t even really gotten into how much of a fallacy the specific belief is that if you just “pay for services” then you won’t become a “product”. But thankfully there are a lot of other reasonable posters on this forum about tech company profit-maximization.
[1] The Company’s perspective is the prime one. The Company doing shady stuff is merely because the consumer’s are stingy or difficult in some way. If the consumers are inconvenienced by the Company then that is just because the Company had to adopt a market strategy which is not as wholesome as the one they could have used if the consumers were better in some way.
[2] And do we have to retread the hopelessness of making a social network where you have to pay to use it when no one else is using it (at the start)? That’s a complete dead-end.
The answer to advertisers and suveillance capitalists is technological blocking of their monetization attempts while simultaneously leeching their "free" services. You want the value they extract from you to be zero or negative. It should cost them money until they cease and desist.
Putting aside the obvious ethical issues with such a system (that are obviously the reason why NOYB is filing), the "as easy to withdraw as it is to give" setup would be kept in such a situation I think.
Ethically, paying for privacy has in my opinion no place in a post-GDPR world (and I do support the GDPR) and it's shameful that several DPAs have tacitly approved of it for local newspapers. Facebook doing it will likely drag the practice to CJEU, which is the worst outcome for this scheme because CJEU tends to not like GAFAMs "it's not against the letter, but against the spirit" crap in the slightest. I personally wouldn't be surprised if CJEU ends up shooting down the scheme as violating the GDPR.
DPA: Data Protection Authority. They're local to each EU country (including those that aren't full Member States but do follow EU laws) and it's their job to enforce the GDPR at a country level. Usually they're a government department. The one you hear the most in the context of GAFAM enforcement is the Irish one, which is infamously underequipped and overburdened because GAFAM has lobbied the Irish government to not take enforcement seriously so all GAFAM companies can put their EU headquarters there (which permits them to only have to comply with the Irish DPA, something called the "one-stop shop" solution.)
CJEU: Court of Justice of the European Union. Think SCOTUS but for the EU. While technically the CJEU doesn't operate on the concept of precedent (its main job is enforcing that Member States follow EU laws and directives correctly), their interpretations of EU law are the final interpretation of those laws. Usually once a case has gone through a DPA and isn't resolved satisfactorily (or isn't complied with), it ends up before CJEU. GAFAM has dragged basically all enforcement cases before CJEU to drag out the process.
GAFAM: An abbreviation referring to the five largest American tech giants: Google, Apple, Facebook, Amazon, Microsoft. Usually is used as a shorthand for the "big tech" side of the IT industry.
I do think it's good though when somebody will go and try to take the most extreme position of some law so that the lawmakers will maybe realize that they got it wrong.
Debatable. Let’s say the base fee was 1€ and premium was 1000000€. Not many people could afford the latter. Even if it were 25€, or 10€, or even lower, as long as there’s any price discrepancy, one is not as easy as the other.
You can consume alcohol and various drugs in the EU but can't say yes to consenting to tracking. Absolutely absurd.
Did you ever hear about the network effect? An example: https://news.ycombinator.com/item?id=38954091
> but can't say yes to consenting to tracking
You can. But how do you not consent?
Anyway, Facebook tracks people who've never visited the Facebook website, via their fkin Like button. So yes: people are making me use Facebook.
Individual action does not work for some issues. This is one of them.
Tracking is everywhere. It is not just facebook. It is every website and there is no realistic alternative as an individual user except be excluded from majority of the internet.
Is that paying for privacy or paying with privacy?
Are you talking about what online newspapers do in EU, US or where?
Meta should be getting fined for every red cent they steal from users, 4% of global revenue doesn't even come close to the sort of fines that scumfuck of a company deserves.
First he subscribes to Facebook and Instagram for free, an unpaid subscription where he agrees to receive targeted ads.
Next he tries to change his subscription to paid, presumably with terms where Meta agrees not to send targeted ads.^1
Signing up for the unpaid subscription can be done with a single click.
Signing up for the paid subscription cannot.
"When the complainant finally reached the correct page, he was confronted with two options. The first preselected and reflecting his current situation was to continue using Facebook with trackers (Kostenfrei mit Werbung verwenden). The second entailed the purchase of a 9,99 monthly subscription, in order to have access to the service without being tracked (Aboabschlieen und ohne Werbung verwenden) see screenshot below, left side."
There should really be a third option: unsubscribe.
1. But does data collection still continue. Meta would probably argue it needs to track everything the complainant does while logged in to the Facebook and Instagram servers for "security" but without any restrictions on how they can use the data collected. We have already seen Facebook and Twitter getting caught using collected telephone numbers for commercial purposes when they were collected under the guise of being needed for "security". Even more, is Meta still allowed to track the complainant on the open web, outside of Meta's websites. The claims of "security" arguably do not apply there.
Is Meta still collecting and processing the complainant's data regardless of which subscription he chooses. If yes, then arguably he is only revoking consent to have ads placed on the Meta webpages that he accesses. The consent may not relate to data processing.
How does the GDPR define "data processing".
For example,
"Data processing is the collection and manipulation of digital data to produce meaningful information." French, Carl (1996). Data Processing and Information Technology (10th ed.). Thomson. p. 2. ISBN 1844801004.
Meta could still "collect and manipulate data [from the complainant] to produce meaningful information" but refrain from placing ads in webpages viewed by the complainant.