Hacker News Reader

Comment by onli | Hacker News Reader

It's not completely unwarranted. According to the article, Facebook was fined for their model of asking for pay or accept tracking. Which is exactly what almost all publishers do, e.g. all big German newspapers. It's absolutely clear that this is against the law - they could show ads, but can't invade the users privacy for that, so no tracking ads - but they do it anyway and got away with it in various decisions. And now Facebook gets a huge fine for the same behaviour.

Which is good in a way, maybe it will lead to a behaviour correction also for the smaller publishers. But it's of course not an equal treatment.

Apple on the other hand completely deserves its fine, without a question. They got clear rules and did everything to circumvent them. The Apple's Core Technology Fee was obviously illegal. Don't know why they expected to get away with that, there wasn't even a minimal chance of that working. Idiots.

View on HN

Big German newspapers do not need to comply under DMA.

The EU focusses, rightfully, on EU macro dynamics with these laws, not how smaller outlets work.

This is very much reasonable. When a platform is big, it has bigger impact, but also bigger budgets to hire legal help and bigger budgets to stay compliant.

This is well established in accounting where there exists different rules depending on size (in many jurisdictions)

What’s another example of different rules depending on size? “Content Moderation” I think? Anything outside the DMA? I think small companies get some exceptions for documentation requirements?

in my part of Europe there are tons: companies over a certain size might have different rules for layoffs, have to have union representatives, must pay for safety courses for the employees, must employ a certain percentage of people with disabilities...

It is a derivative of what is called the "Risk Based Approach" in compliance, and is widely adopted.

As for companies and accounting you can look into the directive 2013/34/EU that established micro, small, and medium sized companies based on their size. These types of companies have different reporting requirements.

In the US, some laws specifically exclude small companies. For example, the Equal Employment Opportunity Act of 1972 requires 15 employees, and the Immigration Reform and Control Act of 1986 requires 4 employees.

You could try to find some analogies but you probably won't succeed since this is clearly just targeting American big Tech

G-SIB banks for example

In practice it means that only American companies end up paying large fees to the EU.

There are no fees.

It also means that not all US companies have to comply, and that the ones that do are the most competitive companies in the market, making their claim that they have trouble competing moot.

I agree, except the DMA specifically only applies to companies over a specific size. I think if the German newspapers were at FB/Apple scale, in terms of number of users, then the DMA would apply (i.e. they would be designated gatekeepers or similar) and they could also be fined. Although I think pay for no ads is also a violation of GDPR maybe?

Exactly. While DMA does not apply, GDPR does. But it gets ignored and weakened by decision against the letter and the spirit of the law - which does not surprise if you realize how much power those legacy publishers hold. Not so FB, not here at least.

So it's not exactly the same regulation but pretty much the same situation. I'd also be pissed.

GDPR does not purport to outlaw targeted advertising. It just purports to require that the target consent.

In pretty much every other area of law in most of the world (including Europe) consent can be bought--the party requesting consent gives the consenter something in exchange for consent, and will not give that thing unless consent is given.

But under the rulings from some regulators that doesn't work for GDPR. Consent is apparently only considered to be freely given if withholding it would not result in any detriment such as not getting the same level of service or having to pay money for service.

If regulators want to outlaw targeted advertising it would be a lot better if they just did that, instead of making consent in GDPR work differently from how it has worked for pretty much everything else pretty much everywhere for centuries.

That's not entirely fair. The concept of duress exists and is always at odds with consent in a transactional setting. The issue is where to draw the boundary between "you freely chose to do business" and "you were coerced into accepting unfavorable terms".

I'm inclined to think that "pay or be tracked" is usually the former. The issue was never that I shouldn't have to pay but rather that I wasn't given the choice in the first place.

That would probably work if it wasn't already such an established business model. The grocery store hires a bouncer to not let me in unless he can take a picture of my ID? Fine... I'll go across the street.

But since it already is established that the Internet works this way, all grocery stores in town are already doing this. I might not want to but I still have to. Moreover, it's been firmly impressed upon everyone that they have to show ID to enter a grocery store, so if I created a new one that didn't, people would just continue going to their closest one anyway. To improve this situation, something more drastic than free competition is needed (if that could work, it already would have).

In this analogy the grocery stores pretty much all started offering the option to pay a cover charge and not have your ID checked. They believed this complied with the new laws but the regulator is making noises that this isn't good enough - that they have to make ID checks optional even for customers that won't pay.

So the question is, does charging you to not have your ID checked count as coercion or is it a voluntary choice? Or alternatively, does it have a detrimental effect on society at large? Is it somehow unfair to the individual? I'd tend to think that the answer to those questions would depend a lot on motivations - the funding model, the size of the fee, and how much money they make if they track you.

In the case of a newspaper they have to make money somehow. If readers aren't willing to pay I don't immediately see how offering a free tier that has advertisements with tracking is detrimental to society or unfair to the individual.

GDPR Art. 7 section 4:

> When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

Don't blame the regulators, it's pretty clear that "paying" with consent is a no-go from the text itself.

If regulators want to outlaw targeted advertising it would be a lot better if they just did that

Exactly. As it is now they're practically encouraging publishers to use dark patterns to trick users into "agreeing" to tracking.

Pay for no tracking / Personal Information trade is illegal. Pay for no advertising is legal. That's what Youtube is doing.

It's meta's "pay or allow us to sell your personal informations that is the issue, not advertising by itself.

Reply on news.ycombinator.com