Hacker News Reader

Comment by tlb | Hacker News Reader

Part of what it means to be "good at regulation" is to anticipate the likely consequences of regulations. So a regulation that says that "businesses must now give away their products for free, unless they honk each customer's nose" will result in a lot of sore noses.

Which is basically the case here. Almost all websites make money through ads, or at least keep logs of user activity to help them optimize their website, and that's not going to change, so the EU's boneheaded regulations make the customers suffer a little extra.

View on HN

> Almost all websites make money through ads,

Doesn't require tracking of individuals.

> or at least keep logs of user activity to help them optimize their website

Doesn't require tracking of individuals.

> Doesn't require tracking of individuals.

Only if you maintain your own ad inventory, instead of using Google/Facebook ads like 90% of online advertisers do. And neither of those platforms work without installing their scripts on your site.

Sure, lots of people want to sell my data. That's a choice. You don't need to do that for advertising - it's a pretty recent invention having fully personalised adverts.

And they did it that way because they could. It could be done a different way.

It would be like opening an independent video store when the entire market has moved to streaming. Yeah you could try it, but there are good reasons not to.

The only change needed is to let people default to no.

After all, Google and Facebook still show ads if a user doesn't consent right?

I bet they'd add that option in a heartbeat if people would leave them otherwise.

The scale of this kind of thing is ridiculous. Opening a basic news site and I'm asked to consent to my data being taken and used by 750 companies.

> Doesn't require tracking of individuals.

Building a house doesn't require powertools, but if your company tries to do it with handtools we'll see who goes bankrupt first.

Building a house doesn't require using cheaper but more dangerous materials either but people try to, that's why we have regulations.

Analogies can be pithy but are rarely useful as an argument. Talk about reality.

analogies are even less useful when you make it to a widely regulated sector and seek anti-regulation analogies.

I am sure the construction sector is overflowing with grumpy people who feel like aspestos is the best form for isolation.

Correct me if I'm wrong, aren't but IP addresses are considered to be "personal information" and therefore collecting them is "tracking" under the GDPR?

Yes but it depends what you're doing with them as to whether you need consent. If you're keeping a record of my IP address and what I do on your site to sell me stuff then yes you're tracking me and need my consent for that. If you've got my IP address in your logs because you keep security logs for reasonable timeframes then you don't need my consent - though you do need to handle them appropriately because it's my personal data.

My guess is that they are because ISPs may keep records of them—I think they are required to in some jurisdictions. But you don't have to store IPs in your server logs.

You're also allowed to store IP addresses in your logs, you just have to take care with the data and the reason you're storing them needs to be justified - either because you have a legitimate interest in doing so (e.g. security) or because you have my explicit consent.

If I order something from an online shop, they don't need to have a banner in order to take my name and address to post the item to me - that's fully expected and reasonable. They do need my consent if they want to use that to post adverts to me though.

What else would you need my IP address for?

Uh...DDoS and spam protection?

Then store it for that purpose, don't use it for anything else, and delete it when it's not useful anymore (realistically, for these purposes, after a few minutes to an hour?).

Ok so now a criminal just needs to avoid being detected for an hour and the logs are self wiping. Sounds like a feature they’ll love!

I thought this was about DDOS and spam protection. If you want to move the goalposts, state that explicitly.

How is that misaligned with your DDOS? It’s not moving the goal posts at all you just didnt think of that possibility and now are upset.

How can you DDOS if you can only connect once per hour?

Keep them as long as is reasonable, then delete them.

Reasonable means different things in different countries and industries. Some require 14 years of retention.

Absolutely, and gdpr doesn't get in the way of those legal obligations. The point is that you can do what is necessary or expected to provide the service without consent, and you can do much more with consent.

Your point is well made, and this is an unfortunate consequence of the regulation (and I enjoyed the analogy). But it isn't necessary to have cookie banners on every website. Github is a moderately complex, user-optimised website, right? https://github.blog/2020-12-17-no-cookie-for-you/

I clicked on that link and immediately got a cookie banner. Am I missing something?

Interesting. Clearly I am providing out of date information.

More interestingly, that article says:

> We are also committing that going forward, we will only use cookies that are required for us to serve GitHub.com.

A few pixels further down, on the cookie banner:

> We use optional cookies to improve your experience on our websites and to display personalized advertising based on your online activity.

I guess now we finally have a rule-of-thumb figure for what "going forward" means: 3-4 years, tops.

OTOH, github.blog is not github.com.

I don't know; I clicked on the link and saw no cookie banner.

It's probably only displayed to EU users. I saw the cookie banner and it left a bad impression on me with such an blog article.

> Almost all websites make money through ads

The EU regulation does not prevent ads from being shown, it specifically targets tracking. No tracking > no banner > everyone is happier > go ahead and show all the ads that are required.

And all that tracking comes down with inability to take risk on business side. Ad company wants to be 100% sure that ads are shown to humans, and pay only for those shown to humans(going deeper - to specific cohorts of humans, which in the past was approximated by content of the site showing ads). Whereas sites serving ads want to extract as much money as it is possible from advertisers based on their audience count.

The incentives are on both sides to to one-up each other without tracking - hosts by inflating visitor numbers, advertisers by disputing that.

In a perfect world ad(wouldn't exist i know but bear with that) companies would pay X/month for site with Y visitors, where X depends on Y. No need for tracking, and roughly over multiple sites and multiple months it averages out.

Not enough conversion rates(risk for ad company - they could pay less)? offer lower rate per visitor next period. Site gets spike in visitors(risk for host - they could charge more)? report higher estimated Y for next period.

What we got instead is an insane tracking infrastructure that costs way more than any possible profit gained for both sides. It's not even profit - it's avoiding being 'scammed', avoiding risk.

Remember that all that tracking bullshit started before targeted advertising was mainstream and widespread. It all started with bots and inflated click numbers, and inability to accept risk.

Tl;dr banning targeted advertising won't remove all tracking bullshit

Without regulation, how do you expect this market to change?

without total removal of advertising industry? no change, they will try to find all the ways to skim around the law because they are so entrenched.

I'll take regulated market over unregulated one though.

Well said. It's frustrating seeing people earnestly pretending as if the 'solution' we're living with now is any kind of improvement.

sites know their audience, they know their usual impressions, and that's how marketing saleshouses functioned for about one-two decade(s).

it's much simpler for both sides, no crying about bots, etc.

of course it's not great if you want to target Putin et al. ( https://www.wired.com/story/how-pentagon-learned-targeted-ad... )

ad networks can simply send out banners to sites for time slots, and that's it. do you want to advertise healthy food? send it to yoga sites (insert it on #yoga hashtag profile pages, insert it after videos/snaps/tiktoks/reels that the AI categorized as yoga, etc.) ... it's called item-to-item recommendation (use the content of the page - as it was done for - again - decades)

it's perfectly possible to ban and remove tracking bullshit

Hmm, what if people outside of yoga like health food? Or what if some people at the yoga site instead eat fried food but just have a good exercise routine?

your solution here just makes ads less valuable, which isn’t a win for advertisers or sites. if you can remove tracking, and still allow targeting, then you’ve hit gold. short of that you won’t find meaningful buy-in.

> your solution here just makes ads less valuable, which isn’t a win for advertisers or sites

It sounds like that's a natural outcome of the point of the law in the first place: people felt that, for too long, tracking has extracted too much value from them without their consent.

Whether a website "buys in" to complying with the law is of course a risk analysis they can conduct for themselves. Neither advertisers nor sites are entitled to a "win" here.

Ad networks can offer to optimize the impressions, help to with targeting.

After all the current implicit user profiling and targeting is already not a 100%. Many people use adblockers, many devices are used by more than one user, etc. (In this day and age we are still baffled how Amazon/Google/whatever advertises us - for days - the same fucking thing we just purchased yesterday. Of course, because based on their model it's still the most likely thing the user might buy or click on, etc.)

Google seems to be already moving away from individual profiles with FLoC - of course they still want all of the data to be able do dynamically allocate users to cohorts (to maximize their profits).

And this is why Tiktok and Instagram just went ahead and are now doing direct sales. (They put a link on the video overlay where the user can go and buy whatever shit the video talks about.)

> isn’t a win for [...] sites

this is something that a lot of people are pushing back on, because their claim is that we need some slack in the system for sites to be able to pursue their own creative vision (however lame, banal, mundane, or seemingly useless it is). before every click was tracked it was okay if some article (or video) underperformed, because in general the advertiser got the increased sales (or brand awareness or whatever they measured)

I’ll be honest that’s too long of a post to read and a cursory reading didn’t really shed any light on your point of view.

Many of us are old enough to remember untargeted ads, and pretty much all anybody saw at the time as an ad for cialis/viagra. 14 year old girls, 25 year old men, it didn’t matter, clearly you’re in the market for ED meds. this is a regression and i’ll take anonymized profile data over seeing completely irrelevant ads.

One thing that stood out to me from your post is this

> Many people use adblockers, many devices are used by more than one user, etc.

adblockers see no where near the adoption you seem to think, as it’s not many users, it’s a very small minority. and most users in fact have their own device and have for some years now. you seem to be detached from reality.

> this is a regression and i’ll take anonymized profile data over seeing completely irrelevant ads.

exactly. let the user decide. that's why it's out to be opt-in/out.

> you seem to be detached from reality.

I'm simply stating factors that are not insignificant compared to the difference we are talking about.

the policy discussion starts with cost-benefit analysis of "implicit profile-based ads" vs "alternative ads", and I'm simply stating that there are already many factors that ad networks consider.

FB/Meta rolled out Advantage+, which is a machine-learning-based full campaign optimization system. (The advertiser uploads many banners, and Meta tries all of them for various target groups, and learns which one to show for which users.) ... and it did all this because of Apple's ATT (app tracking transparency)

I guess the confusion is about advertising and tracking - the banners are about tracking not advertising.

Advertising can be more targeted (and thus higher paying) when paired with tracking.

So can car insurance, but I'd rather my agent not install a GPS without my knowledge or consent on my vehicle.

not the same, you’re paying for car insurance and they offer you a discount if you allow tracking.

most sites using tracking are providing you something for no monetary cost to you, instead by showing you targeted ads

It's not that different, let's make it the same.

Welcome to my new insurance company! Thanks for requesting a quote (it's free! the quote, not the insurance), my agent will swing by to install a GPS chip while you sleep. We're not doing anything malicious with it, we just give you call whenever you're within 5 miles of one of our locations. We'll put it in the bin the vehicle manufacturer conveniently installed for us to hold all the trackers grocery stores and shopping malls use to offer free parking, which you can of course empty out at any time (it's clearly labeled once you remove the oil pan).

What's this, a shopping center now asks before installing a GPS chip on my car (but still somehow offers free parking if I decline)? How inconvenient!

You’re forgetting a key thing, market acceptance. Drive at all once in your life and you’ll realize a majority of people speed. You’re not going to force these people to punish themselves so such a system would have to come from regulation. The market has already said no.

A site can keep logs of user activity to help optimize without tracking my personal data. As soon as a company needs to track me, it's doing more than "optimizing its website"—it's using my data to sell me stuff or selling my data to third parties. And I'm glad it needs permission to do those things.

What if I want to optimize my site for certain classes of users? Say a less than abled person. What if I want to make my product easier to use with various control schemes used by a handicapped person and my product is so complex that tracking this demographic’s usage of my product is the easiest or only way? and what if there is no intent to sell your data?

I could ask permission and delay, or I could just capture the data and run experiments or A/B testing. You should also learn that nobody knows everything, and saying something isn’t required usually is just showing your own ignorance as in almost every case you’ll come across you will find at least one valid use.

> What if I want to optimize my site for certain classes of users? Say a less than abled person.

What are you learning from users' personal data that changes how you do this? Shouldn't your site be accessible, regardless of usage?

Say I want to know why handicapped people with certain disorders are having a difficult time accessing the site. Having a site accessible is a start, but unless you somehow predict difficulties using your product after design changes then you will constantly have to verify things like button sizes and placements.

Showing adverts is not what requires them to ask permission.

those pesky regulations. back in the good ol days where I could pillage for a living, but then that damn government came and took away my livelihood!

How dare they!

</sarcasm>

Just because you made money of it, it doesn't mean it is right.

Reply on news.ycombinator.com