20 ms·
Facebook now denying access unless EU users opt-in to tracking
- Lionsion 8y agoIIRC, the GDPR is very explicit about what constitutes valid consent, so things like pre-checked check-boxes aren't valid. Is "consent" gained by a screen with only an "I agree" button even kosher by it?
- fredley 8y agoAbsolutely not. This is Facebook basically goading the EU by obviously flouting the rules.
- willsinclair 8y agoLater in the thread, he mentions that the consent they ask for doesn't really comply with the GDPR principles. > This appears to breach several important principles of the #GDPR, including the principle of purpose limitation, freely given, non-conditional consent, and of transparency. In other words, if Facebook attempts to collect consent in this manner, that consent will be unlawful.
- ben509 8y agoIt may be that FB's lawyers come at it with a more American view whereby it's legal if it complies with the letter of the law. I suspect the Euro legal system tends to build a fence around the Torah, so to speak.
- dbbk 8y agoIt doesn't seem to comply with the letter of the law though, based on the requirement of "freely given, non-conditional consent".
- wang_li 8y agoWhat does it even mean to be conditional? Is the EU saying that FB has to provide their service to Europeans? Does the EU also require that businesses sell their services and products at a loss? Doesn't FB have some right to deny usage of their service to those who choose not to abide by FB's policies? Whether it's disapproval of tracking or behavior violations, it seems like FB should be able to say they don't want to provide their service to particular individuals.
- vidarh 8y agoThey can choose to not provide service to EU citizens. If they provide service to EU citizens, then with that comes limitations on what rights the have under EU law to pick and choose which EU citizens they want to provide service to. Nobody is forcing them to serve the EU market.
- KozmoNau7 8y agoTheir choices are to either be GDPR-complient, or to completely bar all EU users from accessing Facebook. They cannot use tracking opt-in as a requirement for access.
- cabaalis 8y agoAmerican here; I just don't quite understand the premise. "Here is what you are giving us, and here is what you're getting in return" seems perfectly legit to me. If this interpretation of the law is correct, then the government is essentially saying the "in return" portion has to be eliminated. Which seems to be against the idea of trade.
- quadrangle 8y agoAre you suggesting that somehow any law is inherently wrong if it regulates trade at all? Trade is a means to the end of having healthy, productive populations. It's not something to prioritize above all else, especially in cases where trade hurts the well-being of populations. In the specific case of Facebook, near-zero of the users actually understand either what they are giving or the full extent of what they are getting or not (especially since the latter changes constantly as FB alters their policies and algorithms etc). So, it's more like "give us stuff you don't understand with ramifications you haven't thought about, and you get a complex, somewhat unpredictable, changing service." This is nothing like the theoretical trade between two participants with equal power and complete information.
- mrec 8y agoThat sounds backwards to me. Mainland European legal systems are based on civil law, which heavily emphasizes letter rather than spirit. (As opposed to the common law traditions found in most of the Anglosphere.)
- TheCapn 8y agoI would be absolutely shocked if Facebook didn't have european legal professionals hired to deal with this instead of having their American lawyers try to interpret foreign law.
- vidarh 8y agoMaybe, but my experience with US companies is that surprisingly large companies sometimes think they'll get away with just doing stuff that's legal under US law and pretend the EU is just another US state. E.g. I spent 3 years at Yahoo (more than a decade ago now) wrangling with US product managers that found it incredibly hard to accept that the "workarounds" they kept proposing for EU requirements for payments systems were highly illegal in the European countries we operated in, as a means to cut effort. My team existed pretty much only to form a protective layer between the US payments team and the European business because the European business didn't trust them to not pull a fast one to save time, because they didn't understand the seriousness of the requirements. But in many European countries, the courts takes a very dim view on that kind of attitude.
- icu 8y agoThe European regulatory view is often 'outcomes based' rather than the American 'rules based'. What I mean is that in the European approach, you might follow the rules, but fail in the outcome or 'the spirit' of the law. In that case, you have still broken the law. If you allow a gross generalisation, European regulators point to perverse outcomes in the US where morality is subverted by the law as a reason why this approach is better. There is however a much higher compliance cost in the EU than in the US due to this approach.
- underko 8y agoMy guess is that GDPR is not yet in effect thus they can use this to get consent in advance. After GDPR is in place these will be changed to comply with it.
- KozmoNau7 8y agoThen they will have to ask again with a fully GDPR-compliant opt-in procedure, after the 25th. You cannot grandfather in user consent, especially not with a blatantly non-compliant procedure like this one.
- Angostura 8y agoI shall wait a couple of weeks until GDPR is in force before logging in again. That will be interesting
- mtgx 8y agoI'm pretty sure that's illegal under GDPR.
- zimpenfish 8y agoYeah, they're fairly clear that you can't make service conditional on marketing et al consent. > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
- Kiro 8y agoWhat if your service requires the tracking?
- floatingatoll 8y agoThen you’d be permitted to do so. Facebook Messenger’s chat with your friends service does not depend on tracking, for example, so this argument doesn’t apply to Facebook.
- star-castle 8y agoWhat do you mean by "does not depend on tracking"? Do you mean that you can conceive of a way to implement the service as it appears to the user, without tracking? Because Facebook can certainly inject tracking into their chat app. Given Facebook, I assume it's already the case that if I type "let's get married" and then erase those words and never send them, that Facebook's going to start showing me advertisements for how to pop the question.
- stedaniels 8y agoYou assume that, I assume that, these thoughts are a few digits shy of the decimal point of the percentage of people in the world who understand this. It's not commonly known that Facebook track your every conscious and unconscious interactions with their sites, apps, and every other site that has one of their tracking pixels/logins. It's even less commonly known that they gather data from numerous data brokers to enhance the data they have on you.
- willsinclair 8y agoInteresting. It seems like after the senate hearings, Facebook is trying to communicate to its users that sending them your data is a necessary part of using their services.
- blahfuk 8y agoIt's how they pay the bills, to be fair. I don't think that's much of a secret anymore but looks like they're making it more explicit.
- r00fus 8y agoYou could make an argument that the malware that encrypted your /home folder is also "just a way to pay the bills". In many jurisdictions that's illegal. EU is saying FB's approach is also illegal unless they make some key changes. Personally, I hope FB just quits Europe.
- dorgo 8y agoThat's what I would do: quit Europe. FB is part of life of millions of people. They would cancel this GDPR thing in a day to save their FB experience. Or at least add an exception to GDPR for FB.
- bonsai80 8y agoYup. Perhaps this will eventually be a screen for the user to choose: Button 1: Agree and proceed. Button 2: Set up credit card billing. Button 3: Close account.
- r00fus 8y agoI'd be very interested in Button2.
- thisacctforreal 8y agoThe Average Revenue per User can be found in their earnings report (linked above by ihumanable): https://s21.q4cdn.com/399680738/files/doc_financials/2018/Q1/Q1-2018-Earnings-Presentation-(1).pdf https://s21.q4cdn.com/399680738/files/doc_financials/2018/Q1... For US & Canada this was $86.65 in the last 4 quarters. For Europe this was $34.95. Keep in mind they likely don't target ads using just one person's data: accuracy can be improved by looking at the data of similar people, and looking at the data of friends and family. It isn't as simple as offering a $10/month plan to keep your privacy, because they want everyone's data. "Your data is worthless, everyone's data is priceless."
- hadrien01 8y agoJust after that Terms screen I got three real consent screens (including one about ads tracking and one about face recognition). I think this screen is only about the TOS update.
- probably_wrong 8y agoSame here. I think Facebook needs you to agree to the basic ToS, to then move on to your acceptance/refusal of tracking. My guess is that "we can silently change our ToS at any time" is no longer possible, and that's why you cannot login without agreeing first.
- Nullabillity 8y agoWeird. I only got the facial recognition screen and the "accept ToS or delete your account" one.
- jacquesm 8y agoI guess the option 'continue to use the service without tracking' was too hard to implement technically. Or maybe nobody thought of that.
- JadeNB 8y ago> I guess the option 'continue to use the service without tracking' was too hard to implement technically. Given how deeply tracking is built into their business and technical model, I wouldn't be surprised if it really was too difficult to implement.
- hadrien01 8y agoYou might have already configured (and disabled) ad tracking when privacy options went up a few months back?
- Angostura 8y agoYet, you are required to agree to the TOS without seeing the TOS. I wouldn’t have thought this was enforceable
- kevin_b_er 8y agoFacebook knows it is in the wrong. Facebook announced last year they weren't going to use Ireland as part of its tax dodging scheme. Otherwise GPDR rulings could just extract global money out of the Ireland tax funnel.
- zerostar07 8y agoI doubt they released this without consulting the relevant data agencies in the EU. And TBH there is nothing shocking here, just a confirmation of what everybody knows is already happening. I 'm also in the EU and this makes perfect sense to me: if you can't accept seeing some ads then you can't use the free service. I highly doubt people are willing to pay $5 cash / quarter to use it, but i would like to see FB giving that option, just to see how miserably it fails.
- KozmoNau7 8y agoAccording to GDPR, you cannot make access to your service require opt-in to tracking, unless your service very specifically cannot work in any way without tracking. And no, your business model not working because you cannot track users anymore is not the same as your service not working. Find a better business model. Facebook would still work just fine without the tracking, as proven by the fact that you can switch off targeted ads and everything still works fine.
- Havoc 8y agoDo you consent to this cavity search? (Required to board plane)
- star-castle 8y agoThat's basically how it works in the US, yes.
- Tharkun 8y agoNot just the US. Most of the western world has incredibly invasive security theatre in airports and train stations now.
- moz23 8y agoNo, it doesn't. (Except for perhaps UK and Canada.)
- rosser 8y agoI regularly travel to Peru. For years now, it has been the policy of the Peruvian aviation authority that you may not board flights to the US with bottles of water purchased after the security checkpoint. They have queues set up at the gate to rifle through your knickers in search of contraband dihydrogen monoxide, and will force you to dump any you have, and/or deny you boarding if you don't comply obsequiously enough. Flying to Mexico (or anywhere else) and then the States? Or even Europe? You're fine. Even when you board the flight that will land in the States, your water is welcome. It's only direct flights to the US, and it's only (in my experience) enforced on outbound flights, from Lima. I've never encountered this anywhere else, and I've visited dozens of countries, and did a several months long RTW a few years ago. Once you've spent 6-10 hours in a can at cruising altitude, with only the occasional thimbleful of water a few times, because of this kind of invasive idiocy, you might have a broader perspective on how much of aviation security is theater. EDIT: That's just one example of the absurdity I've encountered in my travels. Another: being told that my carry-on sized backpack was somehow a material threat to the plane I was trying to board, and that it needed to be checked in the hold. What am I supposed to do there? Logic my way out of my paid fare? Into one of $country's TSA-alike's interrogation rooms? This nonsense is endemic to air travel, over the last decade particularly, and it's only getting worse.
- ClassAndBurn 8y agoGDPR doesn't cover enough of the population using Facebook to warrant such a change to their business model where you can use the service without them using your data. They believe they are entrenched enough to just require this (and likely are for many EU residents).
- deleted 8y ago[deleted]
- purple-again 8y agoI'm really curious to find out if the GDPR privacy stance (I'm American, not well traveled, and with no non american social circle) is like the 'no JavaScript' community. Vastly over represented in the tech community and not really representative of the population as a whole. In other words, are 99% of European citizens going to just click through what ever annoying prompts they have to in order to get to their facebook (thats what I would do) or is there an actual widespread cultural difference in the EU that would stop large segments from agreeing to this.
- barrkel 8y agoThe click-through is itself likely violating the regulation. All it takes is for someone to complain; it's not enough for 99% of people to click through.
- frockington 8y agoHow long would it take a EU court to notice, plan, and take action ? VW was blatantly lying about emissions for years and nobody seemed to care
- icebraining 8y agoEU courts take notice when someone files a complaint. In the past, great people like Max Schrems have taken the mantle. I'd certainly support him or anyone else planning to follow up on his work. https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
- tonyjstark 8y agoIs it possible to delete my facebook account without consenting to usage of my data? So can I access the delete page without consent?
- icebraining 8y agoYou can try: https://www.facebook.com/help/delete_account https://www.facebook.com/help/delete_account
- 0982608790 8y ago0982608790
- 03110164189 8y agomi id delete
- znpy 8y agoI'm gonna guess that no, you can't. That's what I would expect from Facebook.
- mrweasel 8y agoGreate, so now my account will just exist in some state of limbo...
- icebraining 8y agoEven if you can't access the link, you can definitively send them an email citing the appropriate GDPR articles and demand a way to delete the account without approving anything.
- purple-again 8y agoVPN in and delete your account? I've no personal experience to know if this is the wrong use case but I've seen it recommended enough on HN now to think its the right solution for this issue.
- shmerl 8y agoHopefully it will encourage some people to ditch FB.
- Rjevski 8y agoI wish, but knowing the general public they’ll just see this as yet another screen to click through to get their daily dose of bullshit memes, game invitations from their “friends” and other bullshit.
- drivingmenuts 8y ago> Hopefully it will encourage some people to ditch FB. I know my reasons for wanting to ditch FB personally (I'm about 50/50 on that), but I'm curious as to your reasons for wanting others to dump it.
- shmerl 8y agoThere was a good article about it, but Observer swallowed it. Here is what remained: https://web.archive.org/web/20151011192709/http://observer.com/2011/12/in-which-eben-moglen-like-legit-yells-at-me-for-being-on-facebook/ https://web.archive.org/web/20151011192709/http://observer.c... Basically, anyone using it, encourages more people to use it, thus causing further damage.
- blklivesmatter 8y agoNice one! Users should accept facebook to access they medical records also. Very uselful would be let facebook to map your ancestor tree as a additional service. Bonus condition to skin deep microcompuer as embedded "security" feature for users.
- gagabity 8y agoWhats behind that Options link?
- carrja99 8y agoBelieve me folks, just delete facebook. I've been so much happier since I did.
- juxncxrlos 8y agoWhat about memes pages? that's the only reason I keep my account. Also, I don't even see adds with and Ad-blocker. What are they going to try to sell me, a meme page subscription?
- mozumder 8y agoWhat about memes pages? Memes pages seem like the best reason to delete Facebook.
- TremendousJudge 8y agoyeah because fuck having fun right
- inetknght 8y agoThey aren't trying to sell you anything. They are selling you to others. They are selling you to not just advertisers but selling your profile to companies that are able to use your profiled information to make their own decisions about things. It's not just about advertisements. Imagine if you didn't serve a single advertisement and instead bought profiling information about people. You could use that profile information to make business or political decisions regardless of whether an advertisement was sold. You could influence politics because you "know" your target audience. Say, for example, the US presidential election or Brexit. Those are just the most high profile places for your profile to be used without ever having presenting advertisement to you. Net neutrality is another one.
- EastSmith 8y agoIt is clear that FB does not plan to be GDPR compliant [1] https://medium.com/@bozhobg/facebook-doesnt-plan-to-be-gdpr-compliant-7f775231c497 https://medium.com/@bozhobg/facebook-doesnt-plan-to-be-gdpr-...
- jacquesm 8y agoWell, they had a chance. It's a bit like the Titanic aiming straight for the iceberg but in this particular case I don't feel sorry.
- newscracker 8y agoI for one would gleefully welcome it sinking. I'd probably throw a large party to many people if, by that time, we have a great privacy focused alternative too (preferably decentralized). Facebook has become a social justice issue (to steal a strong phrase).
- donatj 8y agoDenial of service is a perfectly valid route to GDPR compliance.
- brador 8y agoIs it? If they hold personal data of EU citizens in a shadow profile they must allow a way to view and correct or delete it. Head in sand like this approach will remain unacceptable to EU.
- brightball 8y agoSo basically Facebook is saying that if we can’t make money from you, you can’t have an account.
- wang_li 8y agoSeems perfectly reasonable, doesn't it?
- zzzcpan 8y agoNo, facebook desperately needs to keep users and keep tracking them, so they are abusing network effect monopoly into giving people a choice either accept any tracking facebook wants or lose all the connections and all the time you invested into the platform. Which is not much of a choice, obviously.
- Faaak 8y agoWhat's wrong with that ? I mean, FB is a free service. (I don't have a FB account)
- KozmoNau7 8y agoNope, the GDPR does not consider a flawed business model to be a valid reason to breach users' privacy.
- deleted 8y ago[deleted]
- Tehnix 8y agoI'm actually much more interested in what Google collects about me. At least for me, it's somewhat transparent that Facebook tries to slurp up all they can, but it's much less clear with Google, that seems to try to downplay that they are in fact also, heavily reliant on your data. Does anyone know if Google has made any statements on this?
- deleted 8y ago[deleted]
- newscracker 8y agoIf you'd like to see what Google has about you, you can visit https://www.google.com/settings/takeout https://www.google.com/settings/takeout (or search for "Google Takeout"). Google has maintained and updated its own solution to export data it has collected from you, the user. While I do trust Google more than I trust Facebook, I also actively avoid giving information to Google (through various practices).
- zzzcpan 8y agoIf websites are going to ask for consent to tracking or deny access to the service only allowing to take the data, delete account and leave, the whole thing will become meaningless. Users will just learn to blindly accept everything, as this is a huge annoyance to them.
- _rpd 8y agoYes, I thought that the GDPR was explicitly drafted to ensure it wouldn't just become a "more annoying cookie law." Edit: they are doing this before the May 25th deadline.
- KozmoNau7 8y agoThe GDPR does not allow you to make access contingent on PII data collection, unless your service cannot possibly work without it.
- gamblor956 8y agoI'm not sure why you keep spreading this FUD. The GDPR applies to all personal data, not just tracking data, and Facebook is useless without your personal data. IOW, FB can make access contingent upon agreeing to data collection.
- drucik 8y agoFrom my understanding user will have to consent both to personal and tracking data separately. So yes, users will agree to sharing the personal data - (name, age, gender etc), as this is essential for the service, in this case social network, to work. However, tracking data for ad purposes will need separate consent as this data is not essential for the service to work. Otherwise GDPR would be another dead letter, wouldn't it?
- KozmoNau7 8y agoIt is not FUD. I work at a major telco/ISP, specifically on ensuring GDPR compliance for a number of applications. Personal information that is deliberately and freely made public by the owner of that data (ie. you, the user) is free to use, both for the service on which you make it public, and for anyone who happens to read it on your publicly visible profile/wall. The reasoning is that you made a deliberate choice to make this information public, meaning you have given consent to public viewing of said data. What this Facebook issue is about, is the collection of personal data that you have not made publicly accessible, because it is private to you. FB is using this data to tailor ads and to modify your feed, giving you politics you agree with, suggesting pages for you to join, and so on. FB is also profiling you and inferring your private information, and using that to track you across the web (on every single web page with an FB "like" button, for instance). They have a disturbingly detailed profile on all of their users, including highly sensitive data such as political standing, sexual preferences, medical history, even possible infidelity. FB is perfectly usable without giving them access to any other personal information than a fake date of birth and a throwaway email account. It is perfectly usable with "targeted ads" turned off. It is perfectly usable without the "optimized news feed", it can just default back to a chronological feed instead. The violation of their users' privacy is not essential to the service FB provides to their users.
- jacquesm 8y agoBlackmail isn't opt-in.
- donatj 8y agoWith how insanely in depth some of the restrictions are, I'll honestly be surprised if this isn't the route a lot of companies end up taking to GDPR compliance.
- KozmoNau7 8y agoYou mean completely flouting the regulations and muddying the waters by putting up ToS compliance popups that don't have anything to do with GDPR, in order to fool their users?
- donatj 8y agoI simply mean having a contract indemnifying the company against GDPR, e.g. the user giving consent, to simply use the site. Same as the cookie situation Europe has, but more so.
- KozmoNau7 8y agoThat is very explicitly not allowed by the GDPR. You cannot make access to your service contingent on opting in. The consent has to be given freely, otherwise FB will be in violation of the regulation. Consent must also be given explicitly, you cannot have a pre-checked "yes" checkbox or an "accept and continue" button. Consent can also be given in a legally binding contract. A website ToS is very much not able to override the GDPR.
- donatj 8y agoSo you’re saying I’m required to develop two separate versions of my product? One for the users I can actually make money off and another for people who opt to get my product for free against my will?
- KozmoNau7 8y agoYou cannot base your business model on violating the privacy of EU citizens. That's just too bad, you'll have to find a non-scumbag way to fund your endeavors. You can absolutely still make money off ads, but you cannot target them based on personal information. You are of course perfectly in your right to block all EU IP ranges, if you think that's a better solution, although cutting off 500 million potential customers is a bit harsh. In short, EU citizens have absolutely no obligation to support your flawed business model.
- bprasanna 8y agoMark's attitude during the Cambridge Analytica issue very well reflected the fact that: Users are not going to stop using FB, so why bother much about bending the company rules, instead bend the users.
- newscracker 8y agoThings like this make me very, very angry! So many missteps over the years. So many things bungled. So many dark patterns to fool users. Yet, where is the mass exodus of employees from Facebook? If you're still working in any company that Facebook owns in the technology or privacy or legal front, don't you realize what harm you're contributing to? And you're still ok with that? Don't you have a choice? I'm appalled that thousands of people still work for this company by choice.
- pgwhalen 8y agoEven though you never hear the counterpoint on HN, it’s important to remember that FB’s behaviors are not necessarily objectively bad - people can have different views on these things.
- newscracker 8y agoI agree that people can have different views on these things for various reasons. But I don't see how "FB's behaviors are not necessarily objectively bad", unless one considers only the profit motive as prime without giving any thought to other factors. Can you expand on that?
- kodablah 8y agoTaking all behaviors as a whole, from operating the network to the nefarious things they do to make money, many would argue that they are not bad. Preferred over the actual alternatives (e.g. unstable networks, not existing at all, etc) for many in fact. While I am not a user and don't condone their practices, lots of people are happy and willing participants. Whether they need to be protected from themselves ala seat belts and cigarettes is a societal decision, but right now it's clear the citizenry has a favorable view of them even despite the onslaught from legislators and overarching media narratives. Going on a tangent here...But I've been thinking about this. At some point it's going to come to a head between these two views of FB if the squeakiest wheels also influence laws. If you rock people's comfy boat too much, there will be backlash.
- 8y ago
- originalsimba 8y agoAnd just like that, GDPR == Much Ado About Nothing.
- summerdown2 8y agoI wonder how this will co-exist with a) Tracking non-facebook users via Facebook icons on web pages, and b) Storing the information of non-users such as photos other people take, phone books other people upload, etc?
- tinus_hn 8y agoIf that means they will no longer track me if I’m not a Facebook user, I’m all for it!