8 ms·

I absolutely agree that privacy is important. However, what I'd like to understand more is: What are the regulators actually expecting to happen? Looking at the

I absolutely agree that privacy is important. However, what I'd like to understand more is: What are the regulators actually expecting to happen? Looking at the first version of the cookie law, basically the end result was a worse user experience across EU websites. Large warnings that take up large screen real estate, people learning to just blindly accept without reading. I was trying to explain to my SO that I'd been to a presentation about GDPR and ePrivacy, and said "It's the new version of the cookie warning" "Oh is that those awful warnings? I hate those I don't even understand what they are trying to say" From a pragmatic standpoint the result of these new regulations seems to be not that publishers and other ad-financed businesses are saying "OK, ads are bad, let's do less of those". They are finding workarounds that abide by the law, but still allow them to target ads as optimally as they can. The true winners in this are obviously the platforms with the largest database of users and user interest: Google and Facebook. The two companies are are dominating already, and in essence killing smaller local (EU) publishers. So from that perspective, are the regulators hoping that publishers and local companies band together, creating cookie pools and sharing user information amongst themselves to strengthen their position against FB and GOOG? Or are they hoping that EU companies come up with the holy grail of new revenue streams that nobody has though of yet? TL;DR: In my mind: T stop bad things regulators make laws against something, and also to promote the "right way". Example: People get hit by cars crossing the roads anywhere. They invent a crosswalk and make it illegal to cross the road anywhere other than the crosswalk. What is the ePrivacy version of the crosswalk?

PeterisP 9y ago
The main cause with the "cookie law" is that the law as written failed to implement the intent; the intent was to reduce tracking by cookies, but the actual requirement could be satisfied by those obnoxious warnings while doing tracking as before, and so it was. If the concept of "consent to cookies" was worded more strongly, as in the current laws, then many websites would actually have not made these warnings and simply made do without the cookies, since they wouldn't be able to obtain consent from most people anyway. The new laws seem to avoid this mistake (of course, only time will tell for sure) - they are harsh enough to ensure the strategy "figure out what legalese we need to add to keep doing the same things" is not viable, and they have to actually stop gathering and using that data. In my reading, GDPR seems like it will not enable workarounds that still allow targeting ads as optimally as they could in 2017. They'll still try to target them as optimally as they can, they'll probably figure out some workarounds for parts of it but that will by necessity be ads that are less targeted and use less private information (at least for EU residents) than last year. Also, the intent of lawmakers is clear - whatever workarounds the ad industry figures out to circumvent that intent are likely to be closed in 3-5 years with the next iteration of this directive. The regulators are not "hoping that publishers and local companies band together, creating cookie pools and sharing user information amongst themselves" - they are explicitly creating conditions to ensure that it's almost impossible to get consent for that sharing of user information, and also that Facebook and Google will be able to get much less information than they could before - for example, the GDPR has a big impact on information gathered by all the FB like buttons and google analytics snippets in third party websites; and the "4% of global turnover" clause is included explicitly so that it has leverage to force Google and FB to change their behavior (at least for EU residents). There's no such thing as a "service-wide" opt-in for everything anymore; I will be able to deny Google consent to use my gmail data for targeting ads on google.com, and Google will have to obey; I will be able to ask Facebook for the data they've gathered about me on third party websites and get them to remove that data. Since it's expected that most EU consumers will not give that consent (why would they?) it will pull Google and FB down to the level of those ordinary publishers; they will lose the data that historically gave them this advantage. They're not hoping that EU companies will magically grow new revenue streams, they are taking away those revenue streams (regarding EU customers) for all companies, EU and foreign. This seems like what the regulators are actually expect to happen, and from what I've seeing in the internal activities of local businesses, it's going to happen - pretty much everyone here has major ongoing IT projects that will reduce the amount of private data that they are gathering and storing. That is the ePrivacy version of the crosswalk - stop gathering private data about users, anonymize/cleanse the data you already have, and do your advertising in a more coarse-grained manner.
- ec109685 9y ago
  I think you are expecting too much. Folks are going to click consent buttons in order to use the websites they want to use and never think to go to privacy dashboard and view/modify/delete their data.
  - PeterisP 9y ago
    No, GDPR quite explicitly plans for that. First, there's no such thing as "click consent buttons in order to use the websites they want to use" - if clicking that button is needed to use the website, then it doesn't count as freely given consent. I.e. either the choices are "Agree and proceed" and "Disagree, but still proceed" or you might not have bothered with asking, since that click is not consent. If the data is not inherently needed to provide the service (i.e. a delivery address if you want something delivered), then users must have the option to refuse. Second, there can be no single "consent to do everything". You have to explain every single usecase separately with details and specifics, and get consent for each use case separately. This is a big issue. If a small company has something particular in mind, it's not a big deal. But if a megacorp has (had) a habit to use your data everywhere for everything, that's not going to work. As GDPR states, “A purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”. If the list of use cases and their details doesn't fit on a single screen, users simply won't accept them. For an organization like Facebook, it'll be a major challenge to simply list the places and ways where they are already using my data - and they'll either have to give that full list to me and somehow convince me that I should agree (as the default option is to refuse with no consequence to me) or stop doing it. In essence, you have to bring them to the privacy dashboard first. And everything has to be opt-in (default off). If you have a random consent button like the classic "Agree" under terms and conditions - well, that doesn't count as informed consent, so if that was your system then you don't have consent from any of your users, and your use of their data was prohibited. Even if most users won't care, a few activists can force you to change the behavior for everyone or risk major fines - i.e. if I see that you're using my data without my consent, then it doesn't stop at you removing my data; the regulator can ask you to prove that you got informed, specific, freely given consent from all your other users. Third, previous consent doesn't imply future consent - if you want to use the data for something new, previously this was done by quietly amending the terms and conditions, and adding a new option to the privacy dashboard (often pre-selected). Under GDPR, every new use requires new consent. Fourth, a lot of the tracking has historically been done by third parties. I can see myself giving consent to use my data on some forum or blog that I frequent; however, the consent that I give them doesn't count as consent for all the ad networks running the ads on their site. The ad networks would have to ask permission separately (which they won't realistically get, ever) and they also can't count on getting the site owner to give them my data, since site owner needs my (separate! opt-in! specific instead of "may share with third parties"!) consent for that.
mastax 9y ago
I agree that the cookie law was a mistake, but I don't necessarily agree that it has any bearing on the GDPR's effectiveness. I won't wade into whether the law is better for certain businesses, that's a complicated topic that I don't have the cycles for. But what I will say is that the requirements[1] sound like really good benefits for consumers. Being able to go to Facebook and say "delete everything you have on me" is a huge plus. Being able to go to Whatsapp and download all of your contacts and messages in a 'commonly use and machine readable format' is awesome. Now, of course, the devil is in the details. If 'machine readable format' is poorly defined, that provision is useless. If the consent provision requires 120 pt red font legalese on every page you enter data into, that's ridiculous. But since neither of us is going to go read the thing... at least the goals are good. 1: https://www.eugdpr.org/key-changes.html https://www.eugdpr.org/key-changes.html
- lazyjones 9y ago
  > Being able to go to Whatsapp and download all of your contacts and messages in a 'commonly use and machine readable format' is awesome. Even better: being able to opt-out from sending all your contacts to WhatsApp, although they will just try to blackmail you into doing it anyway by citing false technical reasons.
  - PeterisP 9y ago
    Even better: being able to go and revoke the sending all my contacts to WhatsApp to what I once accidentally "agreed".
pjc50 9y ago
> The true winners in this are obviously the platforms with the largest database of users and user interest: Google and Facebook. The two companies are are dominating already, and in essence killing smaller local (EU) publishers. Neither is really a "publisher", and (as people are arguing elsewhere in this thread) it's the US multinationals which will be in a worse position, since they rely so heavily on doing things with people's personal data without clear consent. > band together, creating cookie pools and sharing user information My impression was the directive makes this harder since everyone involved would have to get informed consent. > promote the "right way". Example: People get hit by cars crossing the roads anywhere. They invent a crosswalk and make it illegal to cross the road anywhere other than the crosswalk. Ah, the American solution. The UK never made it illegal to cross the road and instead invented a type of crossing where the pedestrian always has priority. https://en.wikipedia.org/wiki/Belisha_beacon https://en.wikipedia.org/wiki/Belisha_beacon Just as an American must check the legality before crossing the road, it seems the intent of the GDPR is to make every developer think twice before storing any data about the user in order to consider whether it is personal data, or the even more restricted category of sensitive personal data. Hopefully this will prevent users getting hit by privacy breaches, intentional or accidental. The law doesn't regulate specific technological details because that would be far too dirigiste, and break down as soon as there's a new technological innovation. People would either be complaining that they couldn't use a new solution because it wasn't mentioned in the law, or that their privacy was being violated in a new context.

PeterisP 9y ago

The main cause with the "cookie law" is that the law as written failed to implement the intent; the intent was to reduce tracking by cookies, but the actual requirement could be satisfied by those obnoxious warnings while doing tracking as before, and so it was. If the concept of "consent to cookies" was worded more strongly, as in the current laws, then many websites would actually have not made these warnings and simply made do without the cookies, since they wouldn't be able to obtain consent from most people anyway. The new laws seem to avoid this mistake (of course, only time will tell for sure) - they are harsh enough to ensure the strategy "figure out what legalese we need to add to keep doing the same things" is not viable, and they have to actually stop gathering and using that data. In my reading, GDPR seems like it will not enable workarounds that still allow targeting ads as optimally as they could in 2017. They'll still try to target them as optimally as they can, they'll probably figure out some workarounds for parts of it but that will by necessity be ads that are less targeted and use less private information (at least for EU residents) than last year. Also, the intent of lawmakers is clear - whatever workarounds the ad industry figures out to circumvent that intent are likely to be closed in 3-5 years with the next iteration of this directive. The regulators are not "hoping that publishers and local companies band together, creating cookie pools and sharing user information amongst themselves" - they are explicitly creating conditions to ensure that it's almost impossible to get consent for that sharing of user information, and also that Facebook and Google will be able to get much less information than they could before - for example, the GDPR has a big impact on information gathered by all the FB like buttons and google analytics snippets in third party websites; and the "4% of global turnover" clause is included explicitly so that it has leverage to force Google and FB to change their behavior (at least for EU residents). There's no such thing as a "service-wide" opt-in for everything anymore; I will be able to deny Google consent to use my gmail data for targeting ads on google.com, and Google will have to obey; I will be able to ask Facebook for the data they've gathered about me on third party websites and get them to remove that data. Since it's expected that most EU consumers will not give that consent (why would they?) it will pull Google and FB down to the level of those ordinary publishers; they will lose the data that historically gave them this advantage. They're not hoping that EU companies will magically grow new revenue streams, they are taking away those revenue streams (regarding EU customers) for all companies, EU and foreign. This seems like what the regulators are actually expect to happen, and from what I've seeing in the internal activities of local businesses, it's going to happen - pretty much everyone here has major ongoing IT projects that will reduce the amount of private data that they are gathering and storing. That is the ePrivacy version of the crosswalk - stop gathering private data about users, anonymize/cleanse the data you already have, and do your advertising in a more coarse-grained manner.

ec109685 9y ago
I think you are expecting too much. Folks are going to click consent buttons in order to use the websites they want to use and never think to go to privacy dashboard and view/modify/delete their data.
- PeterisP 9y ago
  No, GDPR quite explicitly plans for that. First, there's no such thing as "click consent buttons in order to use the websites they want to use" - if clicking that button is needed to use the website, then it doesn't count as freely given consent. I.e. either the choices are "Agree and proceed" and "Disagree, but still proceed" or you might not have bothered with asking, since that click is not consent. If the data is not inherently needed to provide the service (i.e. a delivery address if you want something delivered), then users must have the option to refuse. Second, there can be no single "consent to do everything". You have to explain every single usecase separately with details and specifics, and get consent for each use case separately. This is a big issue. If a small company has something particular in mind, it's not a big deal. But if a megacorp has (had) a habit to use your data everywhere for everything, that's not going to work. As GDPR states, “A purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”. If the list of use cases and their details doesn't fit on a single screen, users simply won't accept them. For an organization like Facebook, it'll be a major challenge to simply list the places and ways where they are already using my data - and they'll either have to give that full list to me and somehow convince me that I should agree (as the default option is to refuse with no consequence to me) or stop doing it. In essence, you have to bring them to the privacy dashboard first. And everything has to be opt-in (default off). If you have a random consent button like the classic "Agree" under terms and conditions - well, that doesn't count as informed consent, so if that was your system then you don't have consent from any of your users, and your use of their data was prohibited. Even if most users won't care, a few activists can force you to change the behavior for everyone or risk major fines - i.e. if I see that you're using my data without my consent, then it doesn't stop at you removing my data; the regulator can ask you to prove that you got informed, specific, freely given consent from all your other users. Third, previous consent doesn't imply future consent - if you want to use the data for something new, previously this was done by quietly amending the terms and conditions, and adding a new option to the privacy dashboard (often pre-selected). Under GDPR, every new use requires new consent. Fourth, a lot of the tracking has historically been done by third parties. I can see myself giving consent to use my data on some forum or blog that I frequent; however, the consent that I give them doesn't count as consent for all the ad networks running the ads on their site. The ad networks would have to ask permission separately (which they won't realistically get, ever) and they also can't count on getting the site owner to give them my data, since site owner needs my (separate! opt-in! specific instead of "may share with third parties"!) consent for that.

mastax 9y ago

I agree that the cookie law was a mistake, but I don't necessarily agree that it has any bearing on the GDPR's effectiveness. I won't wade into whether the law is better for certain businesses, that's a complicated topic that I don't have the cycles for. But what I will say is that the requirements[1] sound like really good benefits for consumers. Being able to go to Facebook and say "delete everything you have on me" is a huge plus. Being able to go to Whatsapp and download all of your contacts and messages in a 'commonly use and machine readable format' is awesome. Now, of course, the devil is in the details. If 'machine readable format' is poorly defined, that provision is useless. If the consent provision requires 120 pt red font legalese on every page you enter data into, that's ridiculous. But since neither of us is going to go read the thing... at least the goals are good. 1: https://www.eugdpr.org/key-changes.html https://www.eugdpr.org/key-changes.html

lazyjones 9y ago
> Being able to go to Whatsapp and download all of your contacts and messages in a 'commonly use and machine readable format' is awesome. Even better: being able to opt-out from sending all your contacts to WhatsApp, although they will just try to blackmail you into doing it anyway by citing false technical reasons.
- PeterisP 9y ago
  Even better: being able to go and revoke the sending all my contacts to WhatsApp to what I once accidentally "agreed".

pjc50 9y ago

> The true winners in this are obviously the platforms with the largest database of users and user interest: Google and Facebook. The two companies are are dominating already, and in essence killing smaller local (EU) publishers. Neither is really a "publisher", and (as people are arguing elsewhere in this thread) it's the US multinationals which will be in a worse position, since they rely so heavily on doing things with people's personal data without clear consent. > band together, creating cookie pools and sharing user information My impression was the directive makes this harder since everyone involved would have to get informed consent. > promote the "right way". Example: People get hit by cars crossing the roads anywhere. They invent a crosswalk and make it illegal to cross the road anywhere other than the crosswalk. Ah, the American solution. The UK never made it illegal to cross the road and instead invented a type of crossing where the pedestrian always has priority. https://en.wikipedia.org/wiki/Belisha_beacon https://en.wikipedia.org/wiki/Belisha_beacon Just as an American must check the legality before crossing the road, it seems the intent of the GDPR is to make every developer think twice before storing any data about the user in order to consider whether it is personal data, or the even more restricted category of sensitive personal data. Hopefully this will prevent users getting hit by privacy breaches, intentional or accidental. The law doesn't regulate specific technological details because that would be far too dirigiste, and break down as soon as there's a new technological innovation. People would either be complaining that they couldn't use a new solution because it wasn't mentioned in the law, or that their privacy was being violated in a new context.