3 ms·

How is this different than Google Analytics? Both companies are tracking users and Google is doing this even more than Facebook.

JustSomeNobody 9y ago
Maybe they decided to take one company on at a time and flipped a coin and FB lost.
hjnilsson 9y ago
As long as tracking is not connected to personal information (name, IP, email) it is OK by GDPR. So Google Analytics is not affected (as long as you specify the anonymizeIps option) as it does not associate a user with their actual identity.
- Radim 9y ago
  Actually, the law is defined quite broadly, not restricting itself to "name, IP, email". Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? Or any other of the billions of combinations of your browsing patterns or seemingly random daily activities. Your entropy fingerprint, if you will. Check out "differential privacy" to learn more [0]. We've built a product to help companies identify the more obvious "private data" cases (https://pii-tools.com https://pii-tools.com), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. A dedicated person or algorithm can identify people from surprisingly little information (in the extreme, think Sherlock Holmes). Identification is a matter of degree, rather than a binary "name, IP, email" thing. [0] https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy
  - hjnilsson 9y ago
    > Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While this is certainly the case. As long as you do not use the data in that way it is not illegal to collect it. Intent and actions are very important in GDPR. Standard law: Purchasing a knife is not illegal, but using it to kill is. GDPR: Collecting browser, behaviour and city is not illegal, but correlating it in order to connect collected data to a single person is.
- mirko22 9y ago
  But GDPR says even if data us anonymized but can be tied to a natural person in “reasonable” manner it is still illegal. then it gives some vage examples of what might be considered reasonable... so a lawyer could still make a case that tracking data is illegal. you also have to explain to your user in clear and plain language using visualization where possible on how data collected is processed.
jpkeisala 9y ago
Google supposedly does not know who you are exactly. Facebook links it to individual profiles.

JustSomeNobody 9y ago

Maybe they decided to take one company on at a time and flipped a coin and FB lost.

hjnilsson 9y ago

As long as tracking is not connected to personal information (name, IP, email) it is OK by GDPR. So Google Analytics is not affected (as long as you specify the anonymizeIps option) as it does not associate a user with their actual identity.

Radim 9y ago
Actually, the law is defined quite broadly, not restricting itself to "name, IP, email". Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? Or any other of the billions of combinations of your browsing patterns or seemingly random daily activities. Your entropy fingerprint, if you will. Check out "differential privacy" to learn more [0]. We've built a product to help companies identify the more obvious "private data" cases (https://pii-tools.com https://pii-tools.com), but we're not fooling ourselves that we've solved "personal data". Or that the task is even solvable. A dedicated person or algorithm can identify people from surprisingly little information (in the extreme, think Sherlock Holmes). Identification is a matter of degree, rather than a binary "name, IP, email" thing. [0] https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy
- hjnilsson 9y ago
  > Have you considered how a combination of innocuous data points, such as "browser + city + top 3 popular sites" can make a person uniquely identifiable? While this is certainly the case. As long as you do not use the data in that way it is not illegal to collect it. Intent and actions are very important in GDPR. Standard law: Purchasing a knife is not illegal, but using it to kill is. GDPR: Collecting browser, behaviour and city is not illegal, but correlating it in order to connect collected data to a single person is.
mirko22 9y ago
But GDPR says even if data us anonymized but can be tied to a natural person in “reasonable” manner it is still illegal. then it gives some vage examples of what might be considered reasonable... so a lawyer could still make a case that tracking data is illegal. you also have to explain to your user in clear and plain language using visualization where possible on how data collected is processed.

jpkeisala 9y ago

Google supposedly does not know who you are exactly. Facebook links it to individual profiles.