EU tells Meta it can't paywall privacy
theregister.com
theregister.com
(This is how Facebook collects data on you even if you don’t have an account) https://www.vox.com/2018/4/20/17254312/facebook-shadow-profi...
Now it's time to target the myriad of newspapers that have all chosen to go that same path - and even if you pay, you still get heaps of tracking crap.
“”” What makes this all the more outrageous is that many major publishers in the EU use this exact same “pay or OK” model to achieve GDPR compliance — and none offer a free alternative with non-targeted ads. Don’t hold your breath waiting for Der Spiegel to offer free access without ads. Christ, they don’t even let you look at their homepage without paying or consenting to targeted ads. And Spotify quite literally brags about its ad targeting. But Spotify is an EU company, so of course it wasn’t designated as a “gatekeeper” by the protection racketeers running the European Commission.
They’re not saying “pay or OK” is illegal. They’re saying it’s illegal only if you’re a big company from outside the EU with a very popular platform. “””
No it doesn't. He points out, correctly, that there are EU companies that are doing so now, aren't being threatened, and will probably continue to be permitted to do so.
I wonder why he didn't.
https://www.edpb.europa.eu/news/national-news/2023/imy-issue...
It's obvious that he is running some kind of grift relying on the audience being ignorant of EU law and its application.
edit: it is actually for Large Online Platforms, which probably won't include newspapers.
[1] https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion...
They don't have resources to directly take on every company. Obviously they should be going after the biggest offenders first. Smaller companies will get in line once the precedent is set.
https://noyb.eu/en/pay-or-okay-tech-news-site-heisede-illega...
i have been arguing against this for some time and i am glad to finally see some support, but more work is needed.
Unfortunately, with so many misbehaving players, that seems to take some time.. But from the fines I read about, once it falls, it falls painfully. Their choice.
It's actually quite simple: they have to not violate the rights of their users. They proposed legislation explicitly targets large online platforms that offer users no choice but to pay to uphold their rights. It's practically extortion.
Other people here try the same idiotic take on Rgpd 'protectionism' but do not even think to look at active Rgpd cases. This guy is worse though, directly talking about Spotify and didn't bother to check, if you cannot be trusted to do basic research on your arguments, on your own blog, you shouldn't be listened to.
Spotify case:https://www.edpb.europa.eu/news/national-news/2023/imy-issue...
He's claiming remote work doesn't work when he's worked remotely his whole life.
He's raging against the EU even though it gets us concrete results that we would've never had otherwise, the very least being Emulators and Game Streaming apps.
He has a lot of "old man yelling at cloud" energy.
Facebook isn't paywalling privacy unless they are actively spying on you without you using their products, which would be a completely different situation.
Or if they were outright lying to you about what data they collect and what they do with it, again though completely different situation.
They are paywalling their product, you know, like how walmart "paywalls" milk.
So you can take milk from walmart without paying if you agree to tracking? Analogies are not arguments.
Problem solved. The EU is just trying to dance around doing this.
The problem is that GDPR enforcement is severely lacking, even in Facebook's case where there is plenty of evidence of bad faith as opposed to legitimate mistakes.
(please don't bother posting that "enforcement tracker" link - what matters is not the absolute count/amount of fines but said metrics relative to the total amount of breaches and/or estimated profit earned from them)
Then they should simply tell Meta. There should be no need to debate or dance around privacy paywalls.
But they obviously haven't done this.
This escalation to the EPDB is yet another attempt to get the Irish DPC to do what they were supposed to do in the first place.
There is little political will to fix this however, and data protection regulators are generally useless in every country (maybe not to the level of the DPC, but still). Here's a breakdown of EU-wide cases showing that over 50% of them are stuck for 2+ years: https://noyb.eu/en/project/dpa
> Then they should simply tell Meta
Umm, who's the they in this?
Call me naive, but I'd assumed corporations were expected to comply with applicable laws without having to be told to.
Agreed.
If I specifically express a need or interest in a particular product --- for example by doing a search, some ads are not unreasonable.
What is blatantly unreasonable and just plain dumb are these ads following me all over the internet on totally unrelated web sites for weeks or months --- long after I have made a purchase and no longer have any need.
In a great many cases, "personalized" ads are totally ineffective and waste the advertiser's money while being nothing but a nuisance to the consumer --- squandering his time, attention and communication bandwidth and violating his privacy.
Allow those who disagree to "opt in". This should be fair enough but the ad industry knows full well that there would be very few takers.
Affiliate links to professional tools or paint in a decoration/woodwork blog goes a long way. Probably if you're big you might want stuff a bit more complex, but for hacker it's quite good.
The electronic blog I follow only have affiliate links as ads, and they seems to do quite well.
A company should have every right to deny service. Untargeted advertising pays 90+% less than targeted advertising. If they lose money by serving a user content because they denied targeted advertising, they should be able to deny them service or have them pay up. They're just legislating into law the Meta (and others) have to provide a service at a loss for a growing number of users.
The article clearly mentions how they are only 'violating the rights' if the user chooses to agree with it rather than paying a subscription. It's a trade.
Why do you think people are entitled to consume free content with no strings attached?
Facebook has 3 options available:
1. Only provide their service to paying customers, no free EU version.
2. Don’t provide the service in the EU at all
3. Provide their service to paying customers, and a free version that doesnt’t violate the law.
What they’re currently doing is “provide their service to paying customers, and a free version that violates the users rights” — that is not a legitimate option, regardless of which rights are being violated or laws are being broken.
You don’t just get to break laws or violate rights because you’d make less money otherwise. You also don’t have to provide the service for free, but they seem to still want to do that.
Now, if you're at a public concert or any type of large gathering, you have less of a reasonable expectation of privacy.
Scale matters. Someone walking past you on the street, or recording everything you do are two very different cases even if all the info is there in both cases. It's not only the action that matters but also the intent and the consequences. Other laws take this into consideration, why not privacy laws?
People and systems are not the same and usually have different purposes. You give up a little privacy in to a person, they don't pay attention, forget, the info is trapped in their head to be converted in vague words. You give up a lot of privacy to a computer, they remember everything accurately and connect different data points across time, space, and systems.
The EU just has a difference stance on privacy, it's as simple as that. You just got used to be disadvantaged by these rules and it looks abnormal when others don't see it that way.
Obviously, the largest offenders are going to be the top priority for limited enforcement resources.
I believe the edpb will later publish guidelines on consent or pay for other companies, which will impact many news agencies.
The obvious counterargument imho is, that no-one owes these people a profitable business. If you can't do business without exploiting people or destroying their privacy, you can't do business. Someone else will come along and fill that niche without the exploitation or destruction of privacy, and they deserve our custom more than these other entities. And if no-one is able to fill it, that's OK, too. Not every possible idea needs to be profitable.
Pretty sure that's legal and Meta could do it if they wanted to.
> Pretty sure that's legal and Meta could do it if they wanted to.
It isn't entirely that blank & white. They can't deny service for refusing to let them do something you have a legal right to refuse to let them do. They can refuse service for refusing to pay, but the relevant laws don't allow giving up your privacy rights to be equated to paying. The law doesn't allow you to “pay” for things with your human rights (of which it considers privacy one).
This leads to “pay or no service” being okie dokie, but “pay or give up right or no service” (or just “give up right or no service”) not being.
This partly comes from a desire not to create a new underclass, with some able to pay to maintain their rights and the others effectively losing them because they can't afford other options. There would be a two class system anyway (those that can pay and those that don't have the service), but not having access to facebook is not seen as threatening like not having one of your human rights (as defined by relevant law) is.
this is the key argument why pay for privacy is a problem. unfortunately, given that for now we must assume that all ads are tracking people and are thus violating users privacy, this means that any ad supported service that offers ad free service against pay including youtube and netfix are in violation of this.
solving this will be difficult. we need some way to ensure that ads are non-tracking. but i don't know how to do that.
Actually not. Those ad free services are still tracking you. There is no payment for privacy, just payment for no adverts. The data they record while you are using the paid ad-free service can still be used elsewhere, including by that service if you later stop paying to remove the ads. This is bad from a privacy PoV, but at least it is equally bad for all from a rights PoV (rather than creating classes of haves & have nots).
There are points where ads and privacy are completely separate issues. If they were separate issues generally than I'd allow many more ads but block the stalky ads/services. Not all online ads are stalky (though the vast majority are), and many ad-free sites/apps/services are still stalky (directly, or via free services that they use such as many SaaS analytics options).
free = track content views + track ad views and clicks.
paid = track content views only
the privacy implications of tracking content are different from the privacy implications of tracking ads, especially because ads can track across different content sites in ways that pure content tracking on eg youtube or netflix can not.
the problem is that the ad tracking gets shared with the advertisers whereas content tracking mostly doesn't get shared as far as i can tell.
imagine how people would react if it came out that youtube or netflix would share which content people watch. we just had a discussion about this: https://news.ycombinator.com/item?id=39808994
Perhaps less relevant to the likes of Netlfix, but youtube are certainly tracking much more than just what you watch on youtube even if you pay for no ads. They will be recording details of all the sites you visit that embed their videos, and so forth.
And while they aren't going to be sharing exact data in any way, that doesn't make business sense, I'm sure there is some sharing of indirect tracking data (cohort flags & such), as I've seen activity on youtube apparently affect what I get hawked in recommended links elsewhere.
Plenty of utility companies are already being forced to provide service. As the EDPB opinion says, a lot of big tech is
> decisive for participation in social life or access to professional networks, even more so in the presence of lock-in or network effects
> Untargeted advertising pays 90+% less than targeted advertising
I don't think that such a large difference is rational. "Untargeted" advertising can still be based on the content being viewed, just not on surveilling the viewer.
> If they lose money by serving a user content because they denied targeted advertising, they should be able to deny them service or have them pay up.
As I understand it the opinion does not categorically rule this out
> Controllers should ensure that the fee is not such as to inhibit data subjects from making a genuine choice
That is why NOYB also focuses[0] on the fact the the fee is disproportionate:
> The current average revenue for programmatic advertising in the EU is € [1.41] per user - across all websites per month [...] visiting the top 100 websites can already cost more than € [1500] per year if you do not consent to tracking
---
[0] https://noyb.eu/en/statement-edpb-pay-or-okay-opinion, https://weis2019.econinfosec.org/wp-content/uploads/sites/6/...
If your business can't make money because you have to respect the rights and freedoms of your customers, then close your shop up. If your business can't make money because you have to pay your workers enough to live, then close up shop. If your business can't make money because you have to abide the laws of the countries in which you operate, then close up shop.
This bizarre entitlement that entrepreneurs have, especially but far from exclusively in the tech space, that just because they want their business to exist and make money that they therefore have this strange innate right to transact and draw profit, even when providing subpar service, paying subpar wages, cutting corners in the work they do, etc. etc. has been entertained for far too long. The way I was always taught it, markets select for firms that provide service well, at competitive cost, and business is a RISK because of those things. Sometimes risks don't pay off.
It would be way more fruitful if you redirected your anger towards the users who continue to just shrug and hand over their data. Or the ever growing contingent of people who are ad-blocking everything anyway, eating the fruits of garden while keeping their wallets taped shut. For them, the system as it is now is best.
I have a strong dislike of the notion that the only way for customers to avoid being taken for a ride is that they have to know things about the businesses they are interacting with. I ask you: why should we permit this? Why do customers need to be experts on how their data is used to avoid it being done, or worse still, have to pay for the privilege of not being surveilled? What is the gain in that decision for larger society?
Just like people are aware that Ubereats is a pile of fees on top of higher menu prices...and they still just use anyway to avoid having to call the restaurant to deliver or pickup themselves.
they may be aware of it happening, but they are not aware of the consequences, risks and dangers. they have no idea how that data can be misused. identity-theft, scams, stalking, harassment, doxxing, leaking of private information (your daughter is pregnant, gambling or other controversial activities) and who knows what else that can be enabled with access to this data.
I mean, sure. I don't think that's inherently wrong. All the parties making decisions in this transaction didn't do so at the same time, and I feel the temporal context is important as it amounts to a large scale "conversation" if you will between the public and Facebook:
- Facebook initially launched it's product some time ago and offered few if any features for ad targeting.
- As it grew in technical complexity and aptitude, as an organization, it created and refined more precise targeting measures which required more user data to operate, which incentivized the collection and categorization of more user data
- Users despite enjoying the product are (rightfully I feel) uncomfortable with the idea of being surveilled, but this doesn't necessarily mean they are prepared to stop using the product. Facebook has engineered their product to be at least somewhat addictive, and even that aside, social media is not totally without uses and enjoyable aspects.
- Users then instead of divesting from the product are asking their leaders to legislate rules about how much their data can be used in this way. Their leaders have responded with legislation mandating transparency and establishing rules about user's data.
- Facebook then responded basically saying "if you don't want us to use your data for this purpose, you need to pay X amount of money instead to cover the ad revenue we cannot make"
- Users individually make this choice, but also the leaders whom have been charged with working on this issue come forth and say, "you cannot paywall a user's right to privacy"
- The proverbial ball is now back in Facebook's court, it can either divest from it's EU users, or fall back on un-targeted advertising which makes them less money, or it can make the subscription fee give more back to the users and make it a more compelling offer where it can operate outside of being basically a protection racket.
I summarize all this to point out that users are not limited to simply using the product or not using the product. The EU suffers less from the malaise I feel has infected the United States, where we've forgotten that the letter of the law is not simply for punishment, but also to shape the society we want to see built, including incentivizing and disincentivizing behaviors of private organizations via regulation. In this case, users do want the product, but they are altering instead via public policy what is permitted to happen when they choose to use that product. That is a fair action on that part and Facebook's response, IMO, amounts to corporate whining. This is a reality of the business they've chosen to engage in: complying with regulations is not a new concept, and it is not unfair either: regulations are always subject to change at the whims of those in power, for better or worse.
Given that many EU countries are part of the 14 eyes alliance, these laws seem more like hypocritical protectionist legislation. They don’t care about the privacy of EU citizens. They only care about the survival of ancient EU companies. Ie why aren’t EU publishers subject to the same terms? Why can they offer targeted ads in lieu of payment?
EU protectionism is also one of the reasons why the US is growing tired of continuing to subsidize the EU’s defense.
I find it rather amusing how the notion that a business that can't make money in a given region is so wholly incompatible with your thought processes that you just jump immediately to "the EU is trying to get them to operate for free!" Like just... what if Facebook just wasn't in Europe? Like... that would be fine. The planet would continue spinning, Facebook would still make shit tons of money. It's honestly kind of wild how committed you are to this one shitty product remaining available in this one region.
Also if it was such shitty product, why are law makers forced legislate it to death? One would assume that EU users would simply stop using it.
No. Facebook can paywall their services.
What they condition the use of their services while respecting user's privacy to payments. It is like EU fighting against a criminal organization that offer "protection services" if you don't want them to burn your shop.
They don't
> A company should have every right to deny service.
They do.
>They're just legislating into law the Meta (and others) have to provide a service at a loss for a growing number of users.
They don't.
---
You can't just do something illegal just because you are offering a paid version where you don't do the illegal thing.
I also have no idea how they came up with that number, since earlier in the article they mention 9.99 and 12.99 a month.
Not without creating a situation where only those with at least a certain amount of money can keep their rights.
> I also have no idea how they came up with that number [€250]
Same. If their user numbers and published finances are to be believed then they make (IIRC) ~$25 per average EU user per year (closer to $75 for a US user) so €250 is a massive uplift. Unless of course they are lying about their active user numbers, or at least being incredibly disingenuous about how they calculate those numbers, which many believe is the case, in which case the amount made per active user is higher.
Even the €9.99/mo seems far too high if they aren't being deceitful about their active user numbers, which suggests deliberately trying to discourage take-up because being able to stalk for their advertisers is more convenient and likely more profitable (or that they are being deceitful about their active user numbers!).
Sure. They can pull out of the EU if they can't follow the rules.
> If they lose money by serving a user content
Btw, don't the users who generate said content have a right to be paid for it? Social networking doesn't generate shit, it's their users that do the work for them.
> Untargeted advertising pays 90+% less than targeted advertising.
But then they'll be able to drop the targeting infrastructure and reduce their hosting costs by at least two orders of magnitude :)
Perhaps if this kind of targeting is banned, the advertising budgets will be spent of untargeted advertising instead, raising the prices of non-targeted advertising?
Perhaps advertisers (at least those with useful products) will find that less invasive targeting is good enough, such advertising e.g. knitting-related products next to knitting-related content?
Remember, Facebook’s users are not the consumers. They are the sources of surveillance capitalism’s crucial surplus: the objects of a technologically advanced and increasingly inescapable raw-material-extraction operation. Surveillance capitalism’s actual customers are the enterprises that trade in its markets for future behavior.
Providers and users have been unable to strike a balance, with users being entitled to free content and providers being shameless about 3rd party data sharing. It's a self-reinforcing cycle, where intrusive advertising perpetuates ad-blocking and ad-blocking perpetuates more intrusive advertising.
In my opinion the best solution would be something like what Brave is perusing, a seamless integrated micropayment system where site owners can charge penny fractions in order to view content. Yes, I know, I can easily think of all the downsides to this system.
The core problem is that no one has figured out a good monetization method for internet content for 30 years. It's either pay with credit card or pay with personal data.
Also, patronage-style funding does work (even if the crowdsourced one somewhat fragile against deplatforming and not exempt of its own issues).
No. The company is required to provide any services it provides without breaking the law, which includes privacy legislation. If they can't operate without making a loss without breaking the law, then they are not forced to make a loss, they can always just stop service.
> A company should have every right to deny service.
They do, but not on the basis of refusing to consent to a reduction of your privacy rights as defined and protected by the law. If they should be able to break piracy laws in order to be able to provide service, what other laws / human rights / other should they be able to break too? If a delivery company can't turn a profit without being faster by ignoring road safety laws, should we allow them to break those laws in order to keep offering their services?
> Untargeted advertising pays 90+% less than targeted advertising.
If stalky advertising did not exist, non-stalky advertising would attract higher prices. The difference in success rate between targetted and untargeted advertising is incredibly small (the difference is orders of magnitude smaller than that pricing differential) in real terms so those doing the advertising would not miss out much. Advertising as a whole, targetted or not, is not nearly as successful as the industry would have us believe. This is why so much effort is made to try make some adverts seem as much as possible like personal recommendations instead of paid promotions, and so much effort goes into other forms of astroturfing (fake reviews, paying to have bad ratings dropped, etc.).
The advertising industry is conning its own customers to an extent as well as us, cleverly abusing statistics to make their services look as worth paying for as possible. This is not unlike parts of the spam industry: those buying access to send to mailing lists are conned into believing a higher rate of return is possible than is actually likely. The advertising/spam industry gets paid, the advertiser pays in money, we “pay” in irritation.
That's the conclusion some privacy folks came to after the GDPR came to life. Those predictions from 10y ago are not materializing.