Hacker News Reader

Comment by troupo | Hacker News Reader

> Maybe if the GDPR was a simple law

It is a simple law. You can read it in an afternoon. If you still don't understand it 8 years later, it's not the fault of the law.

> instead of 11 chapters and 99 sections

News flash: humans and their affairs are complicated

> all anyone got as a benefit from it is cookie banners

Please show me where GDPR requires cookie banners.

Bonus points: who is responsible for the cookie banners.

Double bonus points: why HN hails Apple for implementing "ask apps not to track", boos Facebook and others for invasive tracking, ... and boos GDPR which literally tells companies not to track users

View on HN

> Please show me where GDPR requires cookie banners.

That's the bit everyone forget. GDPR didn't ask for cookie banners at all. It asked for consent in case consent is needed.

And most of the time consent is not needed since I just can say "no cookies" to many websites and everything is just fine.

Intentions don’t matter, effects do

So why does every website persist in annoying their users? Are they all (or 99%) simply stupid? I have a hard time believing that.

It's (at least in some cases) malice, not stupidity.

By putting cookie banners everywhere and pretending that they are a requirement of the GDPR, the owners of the websites (or of the tracking systems attached to those websites) (1) provide an opportunity for people to say "yes" to tracking they would almost certainly actually prefer not to happen, and (2) inflict an annoyance on people and blame it on the GDPR.

The result: huge numbers of people think that the GDPR is a stupid law whose main effect is to produce unnecessary cookie banners, and argue against any other legislation that looks like it, and resent the organization responsible for it.

Which reduces the likely future amount of legislation that might get in the way of extracting the maximum in profit by spying on people and selling their personal information to advertisers.

Which is ... not a stupid thing to do, if you are in the business of spying on people and selling their personal information to advertisers.

You really think American companies are playing that level of 3D chess? I see cookie banners on corporate sites that have no ads.

Monkey see monkey do.

It is about tracking, not about ads. Ads without tracking require no banners. Non tracking cookies require no banners.

Corporate sites track you and need banner. Ir is intentionally obnoxious so that you click accept all.

It's called dark patterns and malicious compliance . The annoying banners in particular, were designed by IAB Tech Lab, which is an industry front for adtech/martech companies.

Oncehub removed tracking cookies from some of their meeting invite pages in the EU and stopped showing a banner, because they thought it looked offputting.

They got a few support tickets from people who thought they were still tracking, but just removed the banner.

Consent is never "needed". Consent is one of many legal bases that allows for data processing to take place. If other legal bases than consent do not apply, the industry can use "consent" as a get out of jail card. Consent as a legal basis was heavily lobbied by Big Tech.

If even consent does not apply, then the data shall not be processed. That's the end of it.

It doesn’t matter what it requires, the point is as usual, the EU doesn’t take into account the unintended consequences of laws it passes when it comes to technology.

That partially explains the state of the tech industry in the EU.

But guess which had a more deleterious effect on Facebook ad revenue and tracking - Apples ATT or the GDPR?

The EU just prioritises protection for its citizens over tech industry profits. They are also not opposed to ad revenue and tracking; only that people must consent to being tracked, no sneaky spying. I'm quite happy for tech to have those restrictions.

The EU right now is telling Meta that it is illegal to give users the option of either ads based on behavior on the platform or charging a monthly subscription fee.

> The EU right now is telling Meta that it is illegal to give users the option of either ads based on behavior on the platform or charging a monthly subscription fee.

And? With GDPR the EU decided that private data cannot be used as a form of payment. It can only be voluntarily given. Similarly to using ones body. You can fuck whoever you want and you can give your organs if you so choose but no business is allowed to be payed in sex or organs.

That’s just the problem. Meta was going to give users a choice between paying with “private data” or paying money. The EU won’t let people make that choice are you saying people in the EU are too dumb to decide for themselves?

But how is your data that you give to Facebook “private” to you? Facebook isn’t sharing your data to others. Ad buyers tell Facebook “Put this ad in front of people between 25-30 who look at pages that are similar to $x on Facebook”

> That’s just the problem. Meta was going to give users a choice between paying with “private data” or paying money.

Well, per GDPR they aren't allowed to do that. Are they giving that option to users outside of EU? Why Not?

> The EU won’t let people make that choice are you saying people in the EU are too dumb to decide for themselves?

No I do not think that. What made you think that I think that?

What about sex and organs? In your opinion should businesses be allowed to charge you with those?

> But how is your data that you give to Facebook “private” to you?

I didn't give it to them. What is so hard to understand about that?

Are you saying that your browsing data isn't private to you? Care to share it?

> Well, per GDPR they aren't allowed to do that. Are they giving that option to users outside of EU? Why Not?

Because no other place thinks that their citizens are too dumb to make informed choices.

> What about sex and organs? In your opinion should businesses be allowed to charge you with those?

If consenting adults decide they want to have sex as a financial arrangement why not? Do you think these 25 year old “girlfriends” of 70 year old millionaires are there for the love?

> I didn't give it to them. What is so hard to understand about that?

When you are on Facebook’s platform and you tell them your name, interests, relationship status, check ins, and on their site, you’re not voluntarily giving them your data?

> Are you saying that your browsing data isn't private to you? Care to share it?

If I am using a service and giving that service information about me, yes I expect that service to have information about me.

Just like right now, HN knows my email address and my comment history and where I access this site from.

There's a fundamental difference I think in the European mindset on private data and the American.

From the European mindset: private data is not "given" to a company, the company is temporarily allowed to use the data while that person engages in a relationship with the company, the data remains owned by the person (think copyright and licensing of artistic works).

American companies: think that they are granted ownership of data, just because they collect it. Therefore they cannot understand or don't want to comply with things like GDPR where they must ask to collect data and even then must only use it according to the whims of the person to whom it belongs.

It is more that they are not dumb enough to buy into these kind of manipulative arguments.

> Because no other place thinks that their citizens are too dumb to make informed choices.

In case of Facebook (or tracking generally) you had no chance to make an informed choice. You are just tracked, and your data is sold to hundreds of "partners" with no possibility to say "no"

> Just like right now, HN knows my email address and my comment history and where I access this site from.

And that is fine. You'd know that if you spent about one afternoon reading through GDPR, a regulation that has been around for 8 years.

Facebook doesn’t sell your data. Why would they? Having your data is their competitive advantage. They sell access to you based on the data they have.

> Facebook doesn’t sell your data.

A distinction without meaning. Here's your original statement: "no other place thinks that their citizens are too dumb to make informed choices."

Questions:

At which point do you make informed choice about the data that Facebook collects on you?

At which point do you make informed choice about Facebook tracking you across the internet, even on websites that do not belong to Facebook, and through third parties that Facebook doesn't own?

At which point do you make an informed choice to let Facebook use any and all data it has on you to train Facebook's AI?

Bonus questions:

At which point did Facebook actually start give users at least some information on the data they collect and letting them do an informed choice?

> At which point do you make informed choice about the data that Facebook collects on you?

You make an “informed choice” when you create a Facebook account, give Facebook your name, date of birth, your relationship status and who you are in a relationship with, your sexual orientation, when you check in to where you have been, when you click on and buy from advertisers, when you join a Facebook group, when you tell it who your friends are…

Should I go on? At each point you made an affirmative choice about giving Facebook your information.

> At which point do you make informed choice about Facebook tracking you across the internet, even on websites that do not belong to Facebook, and through third parties that Facebook doesn't own?

That hasn’t been the case since 2018.

https://martech.org/facebooks-removal-of-third-party-targeti...

With ATT, Facebook doesn’t collect data from third party apps at least on iOS if you opt out. It’s cost Facebook billions of dollars

https://www.forbes.com/sites/kateoflahertyuk/2022/04/23/appl...

> At which point did Facebook actually start give users at least some information on the data they collect and letting them do an informed choice?

https://www.vox.com/2018/4/14/17236072/facebook-mark-zuckerb...

The existence of Meta's shadow profiles [0] means there is no "informed choice" to be made. They will track you with or without your consent.

[0] https://www.theverge.com/2018/4/11/17225482/facebook-shadow-...

You did see my link where Facebook stopped doing that in 2018? You notice you can’t find any newer references.

You cannot barter with fundamental human rights, which right to data protection is (as per Charter of Fundamental Rights of the European Union), the same way you cannot barter yourself into slavery, even if you insist you are willing and consenting. By what precedent? By the precedent of the state being sovereign in enacting law.

WeChat would exit on Android if you didn’t give your contact list to them, but this behaviour wasn’t allowed on iOS by our Apple overlords and Im quite happy about that.

and it is illegal, and has been illegal for a long time.

Consent for tracking must be freely given. You can't give someone something in return for it.

Free as in freedom, or free as in beer?

Free as in free from coercion. And GDPR has clear language of 'no detriment'.

Good.

(And they are allowed to run as many non-tracking ads as they want.)

I love hearing pointificarions about unintended consequences from Americans and especially from Americans in tech.

No, being free to abuse others is not a positive feature. Not for tech, not for politics, not for business.

So was it intended for the EU not to have a tech industry of note?

[flagged]

> the EU doesn’t take into account the unintended consequences of laws it passes when it comes to technology.

So, the companies that implement these cookie banners are entirely without blame, right?

So what is your solution?

Reminder: GDPR is general data protection regulation. It doesn't deal with cookies at all. It deals with tracking, collecting and keeping of user data. Doesn't matter if it's on the internet, in you phone app, or in an ofline business.

Reminder: if your solution is "this should've been built into the browser", then: 1) GDPR doesn't deal with specific tech (because tech changes), 2) when governments mandates specific solutions they are called overreaching overbearing tyrants and 3) why hasn't the world's largest advertising company incidentally owning the world's most popular browser implemented a technical solution for tracking and cookie banners in the browser even though it's been 8 years already?

> But guess which had a more deleterious effect on Facebook ad revenue and tracking - Apples ATT or the GDPR?

In the long run most likely GDPR (and that's why Facebook is fighting EU in courts, and only fights Apple in newspaper ads), because Apple's "ask apps to not track" doesn't work. This was literally top article on HN just yesterday: "Everyone knows your location: tracking myself down through in-app ads" https://timsh.org/tracking-myself-down-through-in-app-ads/

So what is your solution to that?

Meta announced in their earnings report that ATT caused a drop in revenue after it went to effect.

They made no such announcement after the GDPR.

What’s my solution? There isn’t one, you know because of the way the entire internet works, the server is going to always have your IP address. For instance, neither Overcast or Apple’s podcast app actively track you or have a third party ad SDK [1]. But since they and every other real podcast player GET both the RSS feed and audio directly from the hosting provider, the hosting provider can do dynamic ad insertion based on your location by correlating it to your IP address.

What I personally do avoid is not use ad supported apps because I find them janky. On my computer at least, I use the ChatGPT plug in for Chrome and it’s now my default search engine. I pay for ChatGPT and the paid version has had built in search for years.

> They made no such announcement after the GDPR.

And yet they make no move against Apple, and they are fighting EU in courts. Hence long term.

> There isn’t one, you know because of the way the entire internet works, the server is going to always have your IP address.

Having my IP address is totally fine under GDPR.

What is not fine under my GDPR is to use this IP address (or other data) for, say, indefinite tracking.

For example, some of these completely innocent companies that were forced to show cookie banners or something, and that only want to show ads, store precise geolocation data for 10+ years.

I guess something something informed consent and server will always have IP address or something.

> What I personally do avoid is not use ad supported apps because I find them janky.

So you managed to give me a non-answer based on your complete ignorance of what GDPR is about.

> And yet they make no move against Apple, and they are fighting EU in courts. Hence long term.

What “move” could they do against Apple?

> So you managed to give me a non-answer based on your complete ignorance of what GDPR is about.

You asked me how do I avoid it? I do it by being an intelligent adult who can make my own choices

Reply on news.ycombinator.com