6 ms·

”What these companies are doing is illegal in Europe but they do not care," said Ms Eckert, adding that the research had kicked off a debate in Germany about ho

”What these companies are doing is illegal in Europe but they do not care," said Ms Eckert, adding that the research had kicked off a debate in Germany about how to curb the data gathering habits of the firms. I think it’s important to be skeptical towards legislation as a solution to these things. The EU/UK cookie law is a cautionary tale, for example. After all that talk we ended up with a law that (effectively) mandates a boilerplate nag screens and no change in behaviour. Even if it had clearer language to distinguish allowable-illegal cookie use, it would still be very difficult to enforce. I don’t mean to say legislation has no part to play. Just saying that the politician outrage to legislation sausage factory has produced some duds in this area. I wouldn’t count on a solution coming from this direction. Speaking of enforcement… Most countries have an advertising standards authority. They create the rules and such. If an ad is (for example) a blatant lie, they can call up the Press/TV/Radio station and get the ad removed. Online, it’s not obvious what authority they have, or how they would enforce that authority at all. Where advertising standards are still not broken is regulated industries. If a locally regulated bank advertises “one weird trick to double your savings,” the advertising standards people can go to the regulator. They have a number to call, genuine threats to make. ..enough to promote self policing. Online, even reputable newspapers allow shockingly crappy ads. Sleazy data collection, snake oils, fake products, click farms, scams even fake news (ironically). Real shyster stuff. This is on the visible end of the online advertising stick, the ad content itself. We already have legislation and a custom of rules. Still, enforcement is nonexistent. Dealing with the unseen data collection end of this stick is even harder.

DiThi 9y ago
> and no change in behaviour In some cases, even the opposite. I used to use self-destructing cookies but stopped after so many websites required using cookies to stop showing that message. I know there are extensions for removing those, but the point is that they made more difficult to avoid what they wanted to avoid in the first place.
- dalbasal 9y ago
  Yep. I forgot to mention that. The irony of remembering users' cookie consent in a cookie.
- deleted 9y ago
  [deleted]
- frandroid 9y ago
  You'd think they'd use localStorage...
  - DiThi 9y ago
    In most cases, when you delete cookies, localStorage is deleted as well.
- codingmyway 9y ago
  Makes me think that laws like this should be more like programming (for humans) and easily reverted when they are found to cause bugs in behavior but somehow laws have to be fixed with new bills on top of the old. The law books are the biggest bunch of out of date legacy code that nobody understands apart from a few overpaid experts and is in need of a massive refactoring.
ZoFreX 9y ago
I think it's important to recognise how good - and effective - data protection laws are in some countries. The biggest challenge is US companies flagrantly ignoring them. In other words, the main thing holding Europe back from protecting data is that the USA is so lax. I think in that regard, more legislation could be massively beneficial.
- vorpalhex 9y ago
  Err, it's not clear that EU law applies to US companies online, nor should it. There are many things illegal in the EU that are quite allowable in the US including a lot of freedom of speech issues. One of the issues anytime we have legislation on the internet is how it applies. If XYZ company is based out of the US, markets itself to the US, but has a generally available website, does EU law apply to it at all? Even if an EU citizen uses it? Alternatively, can every country force their laws on websites based out of the EU?
  - dragonwriter 9y ago
    It's fairly clear that, absent a world government, national laws apply to companied outside of the nation based on the combination of will and ability of the particular nation to enforce penalties on foreign violations. The ability side tends to be very high if the company at issue has any substantial assets held in the country trying to enforce the rules, or in a another country with an interest in keeping that country happy.
  - A_No_Name_Mouse 9y ago
    I agree, but that is going to change. There is new European legislation coming up (GDPR, effective May 2018) which will be a lot more restrictive than the current privacy laws. It will apply to any organization that monitors the online behavior of people in Europe, even if the company itself is in the US or somewhere else. With fines up to EUR 20M or 4% of worldwide turnover there will be a large incentive to comply. Already you can see big companies like Google and Mailchimp adapting to it.
    - deleted 9y ago
kartan 9y ago
> Just saying that the politician outrage to legislation sausage factory has produced some duds in this area. The regulation is open to anyone that wants to read it. Which points do you think that are duds? http://www.eugdpr.org/the-regulation.html http://www.eugdpr.org/the-regulation.html
- dalbasal 9y ago
  I haven't read it (or the underlying legislation being amended), so I don't know. The eprivacy directive amendment (the "cookie law" I was referring to as a dud) didn't show it's flaws until it was implemented by sites in what now appears to be the recommended manner^. Basically, it allowed a generic (and IMO useless) interpretation of informed consent, Most of the discussion (parliamentary and otherwise) was around tracking and privacy. What seemed to have fueled it was retargetting. To the best of my knowledge, google analytics, FB advertising or any of the other major ad networks have not made meaningful changes to their systems as a result of the legislation. I think a change to browser defaults could have (still can) have a more meaningful effect than this legislation and all its regional children. The overview you link to, describe the legislation's intent. I agree with the intent. The problems are not there. The problems are with effectiveness in practice. As I said, I don't know the details of this commandment so I don't have those details for you. In the legislation this amends, many of the problems arise from the "user initiated" approach. You have a right to see what data FB have on you, but you need to know FB have info on you to ask about. It also (as this article suggests) needs to deal in a lot of grey area around anonymous data. I'm not against laws. I'm not a hater. I'm just skeptical that these issues can be resolved solely or even primarily via legislation. ^see here: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_4 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...
xg15 9y ago
So what else do you propose we should do? Demand that the companies self-police out of their deep commitment to ethics and communal wellbeing - and then be shocked and outraged when against all odds they don't?
- Bartweiss 9y ago
  I don't actually accept "the current state of affairs is bad" as a justification for new regulations. The entire point of e.g. the cookie example is that often regulation is not only annoying but ineffective. You don't get to say "this is bad, self-enforcement doesn't work, therefore we have an obligation to pass a law that also won't work". I agree that self-policing won't work, but it's entirely fair to say "all of the options I see are unacceptably bad, we need to talk about finding a new path instead of choosing any of these".
  - thsealienbstrds 9y ago
    In spirit of findings new paths, just an idea (and I'm not sure at all that this is a practical solution): fail2ban---a tool commonly used in servers to automatically block remote attackers such as spammers---can be configured to automatically send an attack report to some e-mail address when it detects an attack. A browser extension, such as PrivacyBadger, could do a similar thing when it detects a tracker. Let the report be sent to a law enforcement agency that is setup to deal with this kind of problem. If this agency collects enough data, then it can do some data mining to find, for example, the most violent trackers. If that works, maybe such a tool can be used to give law enforcement some actual power to punish these companies.
    - Bartweiss 9y ago
      Hmm... interesting. I'm not sure how practical the "to law enforcement" stop is here, for two reasons. First, lots of these trackers are based in places where their data collection-and-sales are legal - the EU makes decent efforts to pursue foreign actors, but it's a serious limitation nonetheless. Second, it's not clear how often illegal action can be demonstrated. The authors of the DefCon presentation here only identified one of the ten extensions they suspected because the rest couldn't be identified beyond reasonable doubt; with data being gathered by so many actors identifying one is hard. Even so, producing a bank of highly-suspicious extensions could be truly valuable. Law enforcement (sometimes) has the resources to pursue these things beyond a DefCon presentation - honeypotting might make it possible to advance suspicion to proof by providing fake data to specific trackers. And publicizing high-likelihood suspicions might produce publicity against bad actors and moves to transparency and guarantees by better actors. At any rate I'm interested by the idea.
specialist 9y ago
Thought experiment: Enfranchise every individual with the sole right to all data about themselves. Transmutes every privacy and identity issue into a property rights issue.
ouid 9y ago
I think it's appropriate to be skeptical of any particular piece of legislation in the same way that it's reasonable to be skeptical of a proof of a centuries old conjecture. It doesn't follow that you should be skeptical of mathematics as a system.

DiThi 9y ago

> and no change in behaviour In some cases, even the opposite. I used to use self-destructing cookies but stopped after so many websites required using cookies to stop showing that message. I know there are extensions for removing those, but the point is that they made more difficult to avoid what they wanted to avoid in the first place.

dalbasal 9y ago
Yep. I forgot to mention that. The irony of remembering users' cookie consent in a cookie.
deleted 9y ago
[deleted]
frandroid 9y ago
You'd think they'd use localStorage...
- DiThi 9y ago
  In most cases, when you delete cookies, localStorage is deleted as well.
codingmyway 9y ago
Makes me think that laws like this should be more like programming (for humans) and easily reverted when they are found to cause bugs in behavior but somehow laws have to be fixed with new bills on top of the old. The law books are the biggest bunch of out of date legacy code that nobody understands apart from a few overpaid experts and is in need of a massive refactoring.

ZoFreX 9y ago

I think it's important to recognise how good - and effective - data protection laws are in some countries. The biggest challenge is US companies flagrantly ignoring them. In other words, the main thing holding Europe back from protecting data is that the USA is so lax. I think in that regard, more legislation could be massively beneficial.

vorpalhex 9y ago
Err, it's not clear that EU law applies to US companies online, nor should it. There are many things illegal in the EU that are quite allowable in the US including a lot of freedom of speech issues. One of the issues anytime we have legislation on the internet is how it applies. If XYZ company is based out of the US, markets itself to the US, but has a generally available website, does EU law apply to it at all? Even if an EU citizen uses it? Alternatively, can every country force their laws on websites based out of the EU?
- dragonwriter 9y ago
  It's fairly clear that, absent a world government, national laws apply to companied outside of the nation based on the combination of will and ability of the particular nation to enforce penalties on foreign violations. The ability side tends to be very high if the company at issue has any substantial assets held in the country trying to enforce the rules, or in a another country with an interest in keeping that country happy.
- A_No_Name_Mouse 9y ago
  I agree, but that is going to change. There is new European legislation coming up (GDPR, effective May 2018) which will be a lot more restrictive than the current privacy laws. It will apply to any organization that monitors the online behavior of people in Europe, even if the company itself is in the US or somewhere else. With fines up to EUR 20M or 4% of worldwide turnover there will be a large incentive to comply. Already you can see big companies like Google and Mailchimp adapting to it.
  - deleted 9y ago

kartan 9y ago

> Just saying that the politician outrage to legislation sausage factory has produced some duds in this area. The regulation is open to anyone that wants to read it. Which points do you think that are duds? http://www.eugdpr.org/the-regulation.html http://www.eugdpr.org/the-regulation.html

dalbasal 9y ago
I haven't read it (or the underlying legislation being amended), so I don't know. The eprivacy directive amendment (the "cookie law" I was referring to as a dud) didn't show it's flaws until it was implemented by sites in what now appears to be the recommended manner^. Basically, it allowed a generic (and IMO useless) interpretation of informed consent, Most of the discussion (parliamentary and otherwise) was around tracking and privacy. What seemed to have fueled it was retargetting. To the best of my knowledge, google analytics, FB advertising or any of the other major ad networks have not made meaningful changes to their systems as a result of the legislation. I think a change to browser defaults could have (still can) have a more meaningful effect than this legislation and all its regional children. The overview you link to, describe the legislation's intent. I agree with the intent. The problems are not there. The problems are with effectiveness in practice. As I said, I don't know the details of this commandment so I don't have those details for you. In the legislation this amends, many of the problems arise from the "user initiated" approach. You have a right to see what data FB have on you, but you need to know FB have info on you to ask about. It also (as this article suggests) needs to deal in a lot of grey area around anonymous data. I'm not against laws. I'm not a hater. I'm just skeptical that these issues can be resolved solely or even primarily via legislation. ^see here: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#section_4 http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm#se...

xg15 9y ago

So what else do you propose we should do? Demand that the companies self-police out of their deep commitment to ethics and communal wellbeing - and then be shocked and outraged when against all odds they don't?

Bartweiss 9y ago
I don't actually accept "the current state of affairs is bad" as a justification for new regulations. The entire point of e.g. the cookie example is that often regulation is not only annoying but ineffective. You don't get to say "this is bad, self-enforcement doesn't work, therefore we have an obligation to pass a law that also won't work". I agree that self-policing won't work, but it's entirely fair to say "all of the options I see are unacceptably bad, we need to talk about finding a new path instead of choosing any of these".
- thsealienbstrds 9y ago
  In spirit of findings new paths, just an idea (and I'm not sure at all that this is a practical solution): fail2ban---a tool commonly used in servers to automatically block remote attackers such as spammers---can be configured to automatically send an attack report to some e-mail address when it detects an attack. A browser extension, such as PrivacyBadger, could do a similar thing when it detects a tracker. Let the report be sent to a law enforcement agency that is setup to deal with this kind of problem. If this agency collects enough data, then it can do some data mining to find, for example, the most violent trackers. If that works, maybe such a tool can be used to give law enforcement some actual power to punish these companies.
  - Bartweiss 9y ago
    Hmm... interesting. I'm not sure how practical the "to law enforcement" stop is here, for two reasons. First, lots of these trackers are based in places where their data collection-and-sales are legal - the EU makes decent efforts to pursue foreign actors, but it's a serious limitation nonetheless. Second, it's not clear how often illegal action can be demonstrated. The authors of the DefCon presentation here only identified one of the ten extensions they suspected because the rest couldn't be identified beyond reasonable doubt; with data being gathered by so many actors identifying one is hard. Even so, producing a bank of highly-suspicious extensions could be truly valuable. Law enforcement (sometimes) has the resources to pursue these things beyond a DefCon presentation - honeypotting might make it possible to advance suspicion to proof by providing fake data to specific trackers. And publicizing high-likelihood suspicions might produce publicity against bad actors and moves to transparency and guarantees by better actors. At any rate I'm interested by the idea.

specialist 9y ago

Thought experiment: Enfranchise every individual with the sole right to all data about themselves. Transmutes every privacy and identity issue into a property rights issue.

ouid 9y ago

I think it's appropriate to be skeptical of any particular piece of legislation in the same way that it's reasonable to be skeptical of a proof of a centuries old conjecture. It doesn't follow that you should be skeptical of mathematics as a system.