Hacker News Reader

Comment by dabeeeenster | Hacker News Reader

Related (7 years ago):

https://www.reddit.com/r/soccer/comments/8q1j0o/la_liga_uses...

- Bars, pubs and other public establishments have to pay around 200€/month in order to show football on their TVs while the household package goes between 10 and 30€/month.

- The official app, with over 10 million downloads, asks you for microphone and GPS permissions.

- La Liga remotely activates the microphone and tries to detect if the sound matches with that of a football match. In addition, it uses the geolocation of the phone to locate exactly where the establishment is located. That way they can locate bars and other establishments where football is being pirated or showed without paying for the bar package.

Still amazes me this just sort of went by and no one really seemed bothered. Absolutely insane.

View on HN

> - Bars, pubs and other public establishments have to pay around 200€/month in order to show football on their TVs while the household package goes between 10 and 30€/month.

This is common in Europe in general, also for copyrighted music. If your establishment wants to play recorded music, even just playing the radio or Spotify on the background, a copyright royalty fee has to be paid.

Applies to all venues and events. Bars, restaurants, grocery shops, barbers, sports events, concerts, taxis, lounges, everything with an audience.

I don't want to say it's the same everywhere in the EU, but I have always assumed it's a common concept in most western countries at least.

This is common in many countries around the world.

I’m sure the prices have gone up since that comment, but 200€/month actually seems very reasonable for a commercial bar that shows sporting events. That’s let’s than 7€/day and would be more than covered by the first group of people walking in the door and buying a round of drinks.

I don’t approve of the microphone activation spying stuff or the ridiculous internet blocking. However it’s also kind of bizarre that it reached this point when the monthly fees for bar owners were such a trivial amount.

> That’s let’s than 7€/day

There is no daily Spanish football.

There are also things like 'interland breaks' or vacation periods when there is no football for two or more consecutive weeks, but the fee still needs to be payed.

is it different from turning on radio?

Applies to radio. If a taxi driver plays music from a car radio to customers, the royalty fee has to be paid.

On its own, nothing seems out of the ordinary. It's the extremes that La Liga takes to ensure they're getting that 200€/m that makes it insane.

Do bars in the US just show matches on a residential cable tv connection?

Yup

Small bars, yes. There are limits to the square footage, and the number and size of TVs - above which you need to purchase a commercial license.

What about this music from these free pages which are flooding the internet? There is plenty of royality free music? (e.g. used by youtubers?)

In most EU countries private copying levies are paid to the copyright mafia any time you purchase a hard drive, printer or even a blank cassette. Because you know, you might copy something using it.

Also, blank media levies in no way give you permission to do what you're paying a tax the biggest rights owners for.

yeah but I paid the full levy so I will download all the things that aren't illegal and hunting and gathering for free films isn't illegal

Corruption

It's not the same everywhere in the EU, but here in Poland as an establishment owner you have to pay this fee to an agency that purports to represent the musicians. As you describe eg. Spotify in background.

This agency pays out proportionately to registered licensed musicians, but the proportions are calculated in some ridiculous way that doesn't really factor in who's music is played. It means that the only folks who get reasonable payouts from this agency are, like, stars and old hits authors. The ones who's music gets played a lot in radio and other places. Winners take all.

The reality is that a lot of that cash is really for some chums who's job it is to be controllers.

AFAIK the entire scheme is a result of that one and only legacy industry that needs to protect it's interests: football and sports in venues, and maybe music clubs. In practice it means you rarely see TVs in bars the way you do in the US.

Idk it's a shitty concept imho.

> registered licensed musicians

What does this mean? Is a license required to make music in Poland? I can't find anything about this on the Internet.

I guess artist registers if they want the entity to collect money for their plays.

I think the outrage should be directed at an app secretly recording everything to look for "pirated content".

Private corporations acting like police, engaging in illegal wiretapping and eavesdropping at massive scales to detect and punish crimes as defined by themselves.

We truly are living in a cyberpunk dystopia.

It's clearly not illegal.

That's what makes it a dystopia

Often it’s not. Back when Sony put a Windows rootkit on autorun on music CDs just in case someone wanted to rip a FLAC, that was a felony violation of the CFAA in the US. The big difference is consent. If I use your app to watch a game and the conditions of using your app include giving you microphone access, that’s legal. If you breach my phone to turn on the mic and listen to me, that’s illegal.

So if someone for example, adds a statement to T&C that as a payment for use of software, the user consents to collecting of a sequence of pressed keys (including 16-digit numbers) and selling them on the black market to whoever is interested, it becomes legal?

Where did I say that?

Calling something like that "consent" when it's the only (legal) way to obtain specific services is extremely dubious. A much more rigorous definition of "consent" is generally enforced in cases where the ruling class doesn't gain by having such consent.

I agree it’s dubious. In the US cases have happened in which onerous requirements in shrink-wrap agreements were thrown out. I have no idea about Spain, but I’m betting asking for that permission in the phone app and getting it approved by the user is legally sufficient to at least make the company comfortable doing so. It may be a bold legal stance they’ll regret later, but if I took a guess I’d say this will get controlled by legislation rather than a court unless the country just wants to slide further into corporate control.

There has to be a EU privacy violation in there somewhere right? Or does that not count for giant EU companies?

GDPR is enforced by country itself and this racket is supported by government, so... You would need to sue whole country.

It’s not personal data.

GPS of your phone and the audio from your phone?

How is that not personal data?

It's not identifiable info maybe ?

It is.

Are we sure ? I'm not disputing it, but is geo location alone as a data point covered GDPR ?

I'll have to look that up, but as someone else said it's only enforced at EU member state level, however there is another central oversight to ensure it's enforced.

Yes. Personal data under GDPR is "any information which are related to an identified or identifiable natural person". If it's data about a specific person, it's personal data, it's a very straightforward definition. Businesses need either informed consent or legitimate interest to store or process it.

Not if you have no possible way to identify the person to whom it is related (this includes server logs etc). Theoretically, an event sent to a server with some GPS co-ordinates, with no metadata and no logs stored on the server at all could perhaps be found not to be personally identifiable.

This is almost certainly a thought experiment though, the amount of engineering effort required to ensure no logs of any kind could result in deriving the IP address of the user would be high, and they’re probably not doing it (even if they are actually not sending any identifying information directly).

You might also find that you have to take special care to avoid creating circumstances that allow inference of personal information. For example, sampling every night at 11pm, you’re very likely to be able to determine an address or approximate location of the subscribers home.

You realize it is an app on a phone, so the customer is always known, right?

I don’t really understand this comment. What do you mean that the customer “is always known”? To whom? How?

The LALIGA Official App on Android requires permissions to access Personal Information and Device or other IDs to provide services, send notifications, and facilitate registration. It may also involve location data and audio features, though these are not explicitly listed in the permissions. The app also shares your data with third parties and uses your email for the LALIGA Ecosystem.

Specific Permissions and Uses

Personal Information:

The app collects your personal data, such as your email, to allow you to log in, register for services, and provide you with content and information about your favorite teams.

Device or other IDs:

This type of ID is used to facilitate your registration and access to the app.

Location Data:

The app may use your phone's location to identify establishments showing football matches, potentially for a piracy detection feature.

Audio/Microphone Access:

In the past, La Liga has used the official app to remotely activate the microphone to detect audio from football matches, particularly in bars.

It feels like you perhaps didn't understand my comment. I'm not saying that LALIGA couldn't identify you if they wanted. They certainly could (and probably do).

What I'm saying is that it is possible to build a system where the app dispatches some kind of event to a server which does not have any identifying information associated with it.

It is always possible. Even if you do not need any permissions to access the AndroidID, nobody forces you, the app seller, to use it.

I have worked as an enterprise integratation architect in highly regulated environments. Sometimes you reuse interfaces that give you tons of info you are not supposed to have access to. You sign contracts that you will never look at this (dump it at the interface layer). This is acceptible in compliance.

Chances that in this case the app does not hover up all it can? 0%

It’s not about “the app”. The app can have two or two million datapoints locally.

What matters in terms of processing is how much of it gets sent to LALIGA (or their provider).

On a separate note, I am surprised you think you can just promise not to look at something. You can’t, it’s not “acceptable in compliance”, and I’m not even sure what that means—there’s no body that certifies GDPR compliance.

It is acceptible. I have sat many times through compliance meetings and negotiations. I would think compliance officers of very large enterprises know their game.

You might think that.

But there’s plenty of evidence suggesting you would be wrong. The biggest fines under GDPR have been for Meta, Amazon, TikTok, Uber, LinkedIn.

Even outside of tech you don’t have to look too far down the list to find H&M, British Airways, Marriott Hotels, Vodafone…

https://www.enforcementtracker.com

This example specifically refers to failure to adequately secure systems against unauthorised use: https://www.enforcementtracker.com/ETid-2306

This one is even closer to what you’re saying—Vodafone didn’t do enough to monitor third parties working for them: https://www.enforcementtracker.com/ETid-2646

The escape hatch with all personal data processing is "legitimate interest". Consent is a big part of it, but an industry with sufficiently deep legal pockets would likely go down the route of "legitimate interest" if cornered.

I'm not a legal professional. I just work next to this stuff.

I think a lot would depend on whether they do any kind of on-device processing to determine whether the audio is likely to be a football match or not. I think they could successfully argue that data processed on your phone and not shared with them is processed by you, and then they could argue that the data that is shared falls under legitimate interests and would be proportionate, and pass a balancing test.

IANALEither

That's not what legitimate interest is supposed to mean though.

Legitimate interest is about collection of data necessary to operate your service.

Listening to detect if someone in a user's surrounding is showing a match without license has nothing to do with the function of the application. There's no legitimate interest there.

It is perverted. Legitimate Interest includes hovering up all your data and shuffle it of to 100+ data brokers who 'legitimately' are interested in that data.

Legally, you mean? Because I'd say most reasonable people would say a literal wire on your phone is pretty personal. Location is PID too if they store the data at all

I misread/misunderstood. Apologies

They'll just say they have a "legitimate" interest in the data.

Wait, does that also mean bars have to police what people are watching on their phone, otherwise risking big fines?

E.g. I go to the pub, have a drink and watch some random LaLiga match on my phone?

No, the bar pays something like 10x the price of a normal subscription to be able to publicly show live Sports as a draw for their customers.

In UK/Ireland you can easily identify if the venue in question is paying for the commercial package as it will intermittently display a pint glass symbol in a bottom corner of the screen. Indeed, Sky investigators, who do spot checks, use it to quickly ensure that the pub has a valid pub contract and not a residential contract.

https://www.express.co.uk/showbiz/tv-radio/668952/why-pub-TV...

La Liga are presumably muxing infrasonic audio into their residential streams to try and:

(a) watermark the residential account(s) used to provide the streaming services so they can prosecute the providers

(b) Detect commercial usage of residential accounts used in piracy to prosecute the venues, by listening out via the App.

They could presumably get around GDPR by virtue of the fact they're only listening and recording audio out of human audible range, and only for identification of copyright infringement as per the TOS of the La Liga App.

I don't believe that's what OP is asking, they mean to ask about the following scenario:

1. Someone sitting next to you in a bar is playing a match on their phone, but the bar is not.

2. Your phone has the app installed and hears the match.

3. La Liga sues the bar?

Presumably then La Liga investigates the bar in-person. Or waits until X reports have occurred over Y duration and THEN have someone investigate in-person.

You are giving them a lot more credit than their behavior deserves.

I doubt it. They’re not going to take a case to court for a single hit because it would be so easily dismissed.

They would have higher priority situations where dozens of phones hit at the same time in the same bar.

>In UK/Ireland you can easily identify if the venue in question is paying for the commercial package as it will intermittently display a pint glass symbol in a bottom corner of the screen. Indeed, Sky investigators, who do spot checks, use it to quickly ensure that the pub has a valid pub contract and not a residential contract.

That seems as if it would be so easy to fake...

Does it cost more less time/effort for the bar to fake it though? The price of 200€/month above seems low enough to just pay it.

I think that's it.

I assume the pint glass pops up at intervals that the investigators would know and the general public would not, so you'd need some kind of central service with someone watching the commercial stream and showing/hiding the pint glass at the right intervals. In which case it would make more sense to operate a central service just pirating the commercial stream, which I'm sure does happen and does get shut down.

>I assume the pint glass pops up at intervals that the investigators would know and the general public would not,

This would be the smart way to do it. But now think about how you'd do it the lazy way...

A pub near us got quoted near £1500 a month just for one service, you have to have 3 separate ones to watch all the games. Risking a fine might be cheaper than paying that for some

The pint glass also changes colour

Aside from the changing pint glass color and level, the Sky set top box / decoder, will also overlay the subscription ID at random intervals and locations.

I don't know if Sky does it, but Foxtel in Australia, in addition to the pint glass watermark, have a separate set of channels for public venues, which have different ad breaks/content to residential subscriptions. (https://www.foxtelmedia.com.au/foxtel-media-network/fox-venu...)

> In addition, it uses the geolocation of the phone to locate exactly where the establishment is located.

How much do GPS/Galileo/GNSS jammers go for nowadays?

In days of prison time?

of course you can tip your favourite bar to the football police https://laligabares.com/denuncias/

I would never agree to this. But it doesn't strike me as particularly unethical, either. So long as both parties understand what they're agreeing to, this seems perfectly fine.

If, for example, the NFL ever did this, I would just not watch.

I'm not sure about other sports, but for the MLB, there are some very strange policies that make it difficult to watch games even if you want to pay for it, mostly stemming from the local broadcasters of the games. Even if you sign up for the subscription service to stream games, they'll "black out" the games that they expect you to be able to watch by getting a cable subscription, which not only is ridiculous (since one on of the main selling points for streaming is to not have to pay for a bundle of things you mostly don't want to be able to get the few things you do), but it assumes that people will never be traveling and unable to watch the games locally even if they do normally have access to it. My dad frequently travels for work, and he pays for the streaming service mostly to be able to watch Phillies games despite living in the Boston area, but the blackout rules mean that he can't even watch the Red Sox games with the streaming service if he's traveling outside of Boston. He also can't watch the Phillies games when they play the Red Sox in Boston, which is mostly fine, but it's still a little weird since he'll be have to watch the Red Sox broadcast (and therefore their commentators) rather than the Phillies one he's used to seeing for their games. The games that are given special slots on ESPN also tend to be blacked out for everyone, so that also causes issues for people wanting to stream them even if it's not a local game. The whole model seems to be more about trying to railroad people in paying for a less convenient, more expensive product even when they actively want to pay for something that's actually available but artificially limited. I don't get why anyone would be surprised that people just turn to "piracy" when things work like this.

Why doesn't he just save himself the time, money and hassle and just watch the highlights or highlight clips.

I understand why the NFL is going the stream route given how popular it is already. They can afford to inconvenience people. But MLB has been stagnant or declining for so long. You'd think they'd make their content more accessible to grow the fan base.

I think he enjoys having the entire game on in the background. He's partially switched over to listening to the radio broadcasts for games, which apparently are often provided online as well (which makes sense, given nothing really needs to change in terms of how they make money to provide it online instead of via a radio station).

What's weird to me is that the MLB does seem to genuinely be trying to make changes in terms of gameplay to try to keep relevant (especially around reviews for on-field calls, but also in terms of some of the changes in recent years that were controversial but seem to have produced meaningful results in reversing some of the creep in how long it takes for games to finish), and my understanding is that they basically were the first major sports league in the US to invest in streaming technology, to the point where I remember reading that the NHL app (and maybe some of the others) were originally developed and maintained by MLB's programmers as well. I'm not sure how they've managed to fall so far behind in terms of streaming experience; the most apparent difference is that the baseball season is over ten times as many games, which presumably could have some sort of effect on things, but my naive expectation would be that it would incentive having a stable infrastructure for this even more. Maybe it's just a matter of them being able to get away with blocking some games because there are still so many others that don't get blocked during the rest of the season? With only 16 games in a regular season, blocking even one of them might just be something viewers are less willing to put up with.

> I'm not sure how they've managed to fall so far behind in terms of streaming experience

It's because they need to keep the broadcasters and the teams happy and broadcasters want to have exclusive content. In some markets, teams want local blackouts to help get butts in seats.

The whole copyright institution seems pretty unethical to me. It's wild that someone can own the royalties to a particular piece of content for 70+ years after the original creator dies (at least that's the law in the US, I assume similar elsewhere), and that the creator can unilaterally name his price for licenses to that content (you can't even know if you want the content without first paying for a license to consume it) and then if you want to put the content into a different format (for example, if you own an HD Blu-Ray and want to put it on a hard drive) you effectively have to pay for a _new license_ for the same content. This is just scratching the surface of the ethical bankruptcy associated with intellectual property.

And this is how free markets result in dystopia.

Yes, regulation, with its whole screen occupying cookie permission modals is truly the way. Or, even better, collectivism-under which we’re all so poor there are no professional sports!

I mean, cookie permission modals are annoying but it's not exactly The Jungle out here.

Reply on news.ycombinator.com