Max Schrems wins privacy case against Meta over data on sexual orientation
apnews.com
apnews.com
Sounds like he managed to prove more in his case than is apparent from the article.
Basically the issue here is that meta was almost certainly in possession of information on Max's sexual orientation and was using this information for advertising, but it's unclear if they had any data.
Privacy wise it is great that even partial information counts, but practically almost any data about a person is tainted with fractions of bits of information about their sexual orientation (or political views, or almost any of the protected classes of information). Without resorting to information theory I don't really see any way forward that doesn't end up in endless court cases over how much information is too much.
Then again we could just ban targeted advertising and avoid the whole issue in the first place. When differential privacy gets to a usable state we can worry about those instances where it would be nice to use some information for the public good without infringing privacy.
Rather it's that, in the course of evaluating this case, the court has been forced to make statements clarifying how certain rules and principles in GDPR are to be interpreted. And this has, in effect, narrowed the way Meta etc can use data.
Which for Schrems is really his ultimate goal anyway - his case is just a way to force the courts to rule / establish legal precedent on broader issues.
But processed what personal data? Where would Facebook even get reliable data on users' sexual orientation in bulk? It's not like you can buy that the way you can get credit scores or geographic locations. (Or can you? I've never heard of it.)
I'm very curious for the actual details here. And just because you get ads for products that seem to be marketed to the gay population, what leads the court to determine FB "identified" him as gay? My YouTube regularly has random ads in Spanish probably just because of some bug. Most ads seem to mistarget me, in fact.
I'd also guess that Facebook can do this pretty reliably for gender and age, martial status, parental status, and lots of other things.
This differs from betting shown recommendations because you're actively being targeted.
At no point is Facebook ever making the self directed decision to show an ad to someone that doesn't positively match some criteria that the advertiser specified. That would be wild, and as I said, that's not how Facebook sells ads.
It's hard to explain a black box, but for eg, a Todo list SaaS company uploads a list of customers most likely having a diverse set of interests and behaviors. The NN matches more users that all seem like they'd be likely to buy such a SaaS because it figured they're in the market, or have disposable income, or maybe have searched for productivity solutions, or maybe have browsed some competitors, or have the same apriori but unrelated actions as someone who ended up doing the above or a combination of all of these.
If the audience you provide has none of these attributes, there's no way for it to magically intuit that you want these things from your customers. The neutral net doesn't know what a to-do list is or who uses one. It doesn't know the price of your service. The only thing happening is it's determining which of the signals about the users in your source audience are the most impactful. By supplying the source audience, you're supplying criteria for who your ads should be shown to.
Whether you're explicitly setting those things or not, you're still supplying criteria. You can't swap this system for a recommendation system, they don't work the same way at all.
I'm sure from their ToS Facebook legally has claim to my firstborn but this is obviously flagrantly unethical. There's too much money to be made behaving unethically for any legal hurdles to exist. There is a reasonable expectation about what you are allowed to do with someone else's data that you're stewarding. And data-mining your users to discover information they haven't and wouldn't voluntarily disclosed you isn't one of them. Hell in most cases accessing that data at all not in service of a direct user request shouldn't be allowed.
There is no reason for Google to access files stored in my Google Drive except to serve them back to me when asked.
I say this as someone who at $dayjob is a steward of petabytes of extremely personal data about people. I/my company would be genuinely be betraying our users' trust if we pulled something like this. Because we could and it would even arguably be useful, but it would be a complete violation of their privacy.
Does end-running around privacy by saying, "well I technically didn't violate your privacy I just compared your semi-private data you gave us/we collected to millions of other people and now know a bunch of private information about you with high accuracy" feel like it would go over well with people?
If this is the case, then you are processing special category data regardless of how confident you are that the inference is correct.
If you carry out any form of profiling which infers things like ethnicity, beliefs, politics, health status (condition or risks), sexual orientation or sex life, you will be processing special category data and must identify an Article 9 condition for processing.
[1] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
[2] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
Even then, how do you know the algorithm is recommending something "because" of the unlabeled sexual orientation class per se, and not because of some closely associated latent class?
That could be incorrect if (say) someone was researching fireman calenders for some non-sexual reason. ie boss assigned them the task of writing an article about fireman calenders through history
I'd have to wonder what other weird things such a person would be labelled with, given that they'd probably be researching a bunch of topics every week or so. ;)
That's fine. It doesn't have to be accurate for every single individual. As long as it's vaguely accurate to bring a targeting uplift, it'll be worthwhile to use.
Curious.
Stuff like that often ends up trawling through LKML posts trying to figure out wtf kernel might have a fix, potential things to try, and so on.
Probably also by people with zero interest in software development themselves.
The GDPR does not care if FB has a database column for “sexuality” or if FB never gathers that information directly. All it cares about is the fact that Facebook process personal data, and, using some of the data Facebook processes, sexuality can be inferred.
I think we in tech get hung up on technicalities, while the GDPR was specifically written to be as citizen-focussed and tech-agnostic as possible.
Regardless, this specific ruling seems a bit odd-it implies that FB took a fact he mentioned in a panel discussion (not on the platform), and used that information to serve him targeted ads based on his sexuality.
I have no idea of the mechanisms he supposes led to this.
I think of the story where Target was pushing diaper ads on someone before her dad (maybe even her?) knew she was pregnant
But if advertising works on a recommendation engine basis, or groups similar tastes together, then if someone uses the Meta platform enough, there will be circumstancial evidence that this person's interests and activities coincide with other gay people.
Perhaps the merit of the case rested with Schrems barely using Meta/FB, not providing any direct data or engagement, and only to discover that advertising was targeted. Of course, Meta is a vast platform, including comments sections and widgets and third-party cookies across many websites.
But Meta takes Meta's privacy very seriously, so perhaps nobody but the court will ever see what Meta and their partners learned about Schrems, or how they learned it.
If only the AP had gone web-first instead of staying legacy, we'd all probably be able to just follow a link to the actual case information instead of having to guess.
nit: did you mean conduct (which connotes moral principles) or did you mean plain behaviour (which doesn't lump what you do together with if it's "right" or "wrong", according to some but maybe not some other rulebook)
Does Meta differentiate these when processing personal data?
Does Meta seek truth/evidence? Does Meta weight inferences accordingly? does Meta accept subject's claims about self at face-value?
first, to your question above, repeated here. indeed meta "guesses" your age, gender identity, sexual orientation, political party affiliation, stance on various political issues, and many other traits, consumer profile and all. and meta guesses this from your interaction with your feed, from what you like or dislike and what you share and don't share, and where you comment in or don't. and it's accurate enough for your their purpose, placing content you'll positively react to, positive solely in the sense of those buying the content placement. that's the meta ad business. have profiles that are good enough to allow content targeting.
is it scientific, fully spot on, diagnostically sound? hell no. is it good enough to overturn Britain (brexit...) or get trump im office? you bet.
that's the first question, and the one you ask here and above.
the second is what I'm talking about in my nit. it's about assumed and hypothesized nuances of gayness, and the language to express those nuances. and what I'm saying is that the concepts of "only gay feelings, attractions" vs "living by it" are a moral concepts. in other words, the language, the words in the questions you've posted imply, carry, a good and evil dichotomy. and I point that out and reject it.
you are not less gay if you are closeted and suppress that trait. "oh I don't _do_ gay things, I 'only' am attracted to men, but I wouldn't allow myself to actually fall in love" is being gay, period. closeted. self-suppressing. but: gay.
claiming you were only gay when you kissed may be an environmental necessity (oppressive states or affiliations) I give you that.
but being gay is about attraction. fun fact: social sciences measure it by measuring arousal. if gay content turns you on, you're gay, scientifically speaking.
simples.
So your people, and my people, and Facebook, and the EU, may all have differing standards on what "being gay" means. But you would agree that a verbal assertion on a panel discussion would not necessarily be accurate or diagnostic.
I would also suggest that it's not a "yes/no" binary as you imply; many terms are left ambiguous and subjective; and my people would say that "orientation" may change over time or based on situation.
I don't know what you'd consider "gay content", but if you mean "Bewitched" or "The Wizard of Oz" or Marc Almond and The Smiths, then I must be gay as well, so where is my ad content?
The way it works according to this judgement seems to be that if you don't explicitly tell FB something, they can't use the data anyway for targetting ads.
This sounds like it'll kill the vast majority of their inferred data points, as well as any ingested from 3rd parties.
Sounds fair enough to me. Glad I sold my FB shares last month.
General browsing habits - he interacted with ‘gay content’ - websites, facebook groups etc. so could be targeted by advertisers that wanted their ads shown to people who interacted with that content.
I don’t think FB have a gay checkbox for targeting now but advertisers can choose websites and FB groups. Im not sure if this ruling effectively kills FB targeted advertising using data from outside FB or just if you're gay or not
They didn't say that the data can't be collected. They didn't say the data can't be processed at all. They didn't say that the data can't be "aggregated and analysed" for some purpose other than "to offer him personalised advertising".
Meta does indeed offer controls to disable personalised and targeted advertising. If Schrems had disabled these settings appropriately, would Schrems have learned what Meta knew? It would seem that the targeting and personalisation is often the only way a user will find out what social media knows about us.
So IMHO, this is a sad, sad day for your privacy and Schrem's privacy, because if Meta can't reveal what they know about us through advertising and targeting, then Meta does indeed take Meta's privacy very seriously.
Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
There is a list of exceptions, but I'm not sure any of them apply. I don't really see how what the court says matters all that much. They can't overturn the law.
They are just spraying and praying with their ads on best guesses as to what is relevant to you.
How is this a lawsuit?
I fixed that quote for you, because advertising is often targeted to the opposite demographic for various reasons.
Just try enjoying your favorite show on radio or regular TV, and you'll perceive ads for stuff you would never touch, but they are paying good $$$ to support that show you like, and to get in front of everyone possible, and perhaps wear you down with brand recognition and exciting jingles to influence your buying decisions in a moment of weakness.
However, targeted advertising may know exactly what you like, and be an effective means of call-to-action and conversion to sales.
On the back end, Meta advertisers fill out a list of audience interests and demographics. So yes, if the advertisements and their buyers were documented, Meta should also have sales info on the intended audiences.
It's a case brought strategically in order to trigger certain questions of interpretation of GDPR rules to be litigated.
Schrems' specific claim only needs to hold enough water to give him standing to get the case through enough filters in the court system to facilitate this.
Knocking over US big tech companies for fines is literally the fastest growing EU industry by total profits.
But anyways, not sure the EU will love it so much once the US finally puts its foot down and the EU capitulates. Unfortunately it’s hard to say no to the only country that will protect your sovereignty (NATO doesn’t work without the US and I’m sure Russia would like to keep going further into Europe).
After that data privacy revenue stream dries up, the only thing left will be the laws and regulations that permanently keep the EU tech industry from ever being competitive with the US or China.
But maybe the ballooning population of European social benefits retirees will pay for themselves? Who needs evil private industry to generate tax revenues when you have bulletproof data privacy over what toilet paper you bought last week. Who can afford the insane risk of somebody creating products that might disclose this highly sensitive data?
These were always 1 tweet, below the fold, and once a day.
Eventually I just clicked one of the hot girls and I've never got anything since.
> Meta said it was awaiting publication of the court’s full judgment and that it “takes privacy very seriously.”
I wonder how Meta employees can keep a straight face lying their faces off. I'm getting second hand embarrassment from them. Imagine being caught in such a blatant and egregious privacy violation and having to gall to make such a claim.
Did you see that Social Dilemma documentary? People only find their conscience after they've checked a big bankroll.
I've been in tech for almost two decades now and I've seen many many many good people throw their values right out the window once the price was right.
This reminds of people who claim they’re too honest to disguise that they’re assholes. You can absolutely start a company and make lots of money without compromising your values. Someone claiming otherwise is usually trying to excuse bad behaviour or get over a past failure.
Here's the thing though, and I say this from personal experience...if you're willing to compromise your values...you can make a shitload of money.
Of course. But then you’re also playing a different game, one where the downsides are expanded from make no money to go to jail or worse.
> The open-source AI model [...] Llama is the leading open source model family
Then from https://huggingface.co/meta-llama/Llama-3.2-1B
> License: Use of Llama 3.2 is governed by the Llama 3.2 Community License (a custom, commercial license agreement).
In that license: Section 1(b)(i) requires you to display "Built with Llama" (branding requirements, really?). Section 2 has additional restrictive licensing requirements. Section 5(c) has retaliation that your license is terminated if you initiate legal proceedings. There is probably more too.
Pretty close to "Not Open Source". Yet, Meta continue marketing Llama as such.
I think the idea is there's some percentage of the public that will just uncritically accept the last thing they were told as gospel truth, and the rest don't believe you any less than they did before, so it's a net win.
All they're saying is they take X very seriously. Which can be interpreted positively by some, yet doesn't put them too much at risk when tomorrow they're found again screwing X. They'll still be taking X very seriously at that time.
"The police officers killed my dog! Right through the screen door!"
"Please calm down sir, I assure you the the department takes the handling of pets very seriously..."
Is it not more likely that the group of people/profiles and activities he participated on Facebook are what "outed" him instead?
I had hoped for more details about how Schrems and/or a court were able to prove Facebook took his off-site meeting into account and based ads on that alone.
We have created a dystopian system where honesty is punished and lying is incentivized. This is the only natural outcome anyone should expect.
> The practice of using action to achieve a result, such as political demonstration or a strike in support of or in opposition to an issue.
If you're doing something about it, that can be called activism.
Without it, you'd have only "The practice of using action to achieve a result", which applies to anything, e.g. me pressing "submit" (an action) to achieve the result that my comment is posted.
I don't think the "such as" clause covers lawsuits.
Activism is where you take action to change something specific and significant, relative to the counterfactual where you did not take such action. (It also includes failed attempts at the same.)
If – say – there were strong social taboos against using the letter "e", and by using them in your comment you aimed to erode them, then yes, pressing "submit" would be activism. The same if you were coming out publicly, with the aim to make it easier for others to do so. Wearing clothes can be activism. There's no reason that lawsuits shouldn't qualify, if their goal is to create a better world.
"Create a better world" isn't a necessary condition for being activism.
> A long time ago, I was in Burma. My friends and I were working for the local government. They were trying to buy the loyalty of tribal leaders by bribing them with precious stones, but their caravans were being raided in a forest north of Rangoon by a bandit. So we went looking for the stones, but in six months, we never met anyone who traded with him. One day, I saw a child playing with a ruby the size of a tangerine. The bandit had been throwing them away.
> So why steal them? Well, because he thought it was good sport. Because some men aren't looking for anything logical, like money. They can't be bought, bullied, reasoned or negotiated with. Some men just want to watch the world burn.
— The Dark Knight, by Christopher Nolan and Jonathan Nolan
How do you think we got basic rights? (Natural rights are a philosophical object.)
That's always been a major component of activism, because legal compliance is never automatic or something you should take for granted. Nothing has changed.
Other major components include changing the law, and changing people's behaviors where law is irrelevant.
I think "activist" is just giving him well-deserved credit for the amount of legwork he puts in to see these cases through.
He is absolutely doing this out of principle / for a cause, and not because of his own individual grievance - he just needs to be able to point to something affecting him personally to give him the legal footing to bring the case to court.
Replace the word gay with bone cancer, which just so happened that you’ve been diagnosed with. Would you feel comfortable with Meta inferring that from your activity and flood you with ads related to cancer?
do you see the danger these ads put you in?
Helping people understand other people's opinions is a better stance.
I.e. The person in the article finds being surveilled by a company, outside of their relationship with the company, and having that information available for advertisers to manipulate them for money disturbing, immoral and offensive. Especially for very personal attributes.
And many other people do too. And the European Union.
--
At some point I hope there is a wave of non-ad social media. Imagine how few resources are required to run an online scrapbook?
When you don't need to have thousands of servers collating every scrap of information about you they can get, and applying ever more sophisticated AI to optimally insert "sticky" posts, reinforce your notification checking habit, finding the minimum number of organic friends & family posts they need to give you, and matching you to advertisers and ads.
Applied psychology is 99% of social media's expenses. 99% of the rest is legal and lobby.
It might show up in the "ad preferences" page if someone glances over your shoulder while you're looking at it, but generally people glancing over your shoulder to view private information isn't a Facebook privacy problem, it's a people-glancing-over-your-shoulder privacy problem. It turns out that even the most private & secure systems will leak information when you open it and let people see it over your shoulder. It's like saying your web browser puts you in danger if someone glances over your shoulder to see the gay porn you're watching on it.