14 ms·

I'm pretty sure that's illegal under GDPR.

by mtgx 8y ago

zimpenfish 8y ago
Yeah, they're fairly clear that you can't make service conditional on marketing et al consent. > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
- Kiro 8y ago
  What if your service requires the tracking?
  - floatingatoll 8y ago
    Then you’d be permitted to do so. Facebook Messenger’s chat with your friends service does not depend on tracking, for example, so this argument doesn’t apply to Facebook.
    - star-castle 8y ago
      What do you mean by "does not depend on tracking"? Do you mean that you can conceive of a way to implement the service as it appears to the user, without tracking? Because Facebook can certainly inject tracking into their chat app. Given Facebook, I assume it's already the case that if I type "let's get married" and then erase those words and never send them, that Facebook's going to start showing me advertisements for how to pop the question.
      - stedaniels 8y ago
        You assume that, I assume that, these thoughts are a few digits shy of the decimal point of the percentage of people in the world who understand this. It's not commonly known that Facebook track your every conscious and unconscious interactions with their sites, apps, and every other site that has one of their tracking pixels/logins. It's even less commonly known that they gather data from numerous data brokers to enhance the data they have on you.
      - floatingatoll 8y ago
        Tracking is not required to deliver a text message between two contacts who approved each other. Facebook might declare otherwise, but since SMS and IRC both stand as counterexamples of successful text chat services that do not inherently depend on tracking, they would likely lose their case.
    - jasonlotito 8y ago
      Define "doesn't depend on" because I could easily make the argument that Messenger's chat does require tracking location for example to increase security and to fight spam. By not opting in to tracking of location, you degrading the quality of the service and affecting other people. i.e. Without this tracking, the quality of Messenger is affected, and therefore, by definition, the service cannot be provided without it.
      - icebraining 8y ago
        That's fine, but then FB can only use that location for increasing security and fighting spam. Slurping information based on an excuse and then using it for something else is explicitly prohibited by the GDPR.
    - deleted 8y ago
      [deleted]
  - zdragnar 8y ago
    Consent isn't required for data collection that is necessary for the service to work. However, you have to be prepared to defend in court that it IS necessary. As such, trackers in 3rd-party advertising network code probably won't count as necessary; it's necessary for the ad network, but it is not necessary for the website displaying the advertisements, as proven by ad-blockers. Likewise, the facebook like button and other "plugin" components aren't "necessary", they merely add value to the existing content / features, and must therefor be entirely opt-in. At least, that's my understanding, which is entirely too facile to be taken as legal advice. EDIT: As petercooper pointed out below, in addition to proving necessity, you must still also prove in court that you have balanced the necessity against users' rights and interests. As such, I no longer feel confident to say I even have a clue as to what is legal and what is not, for FB or for anyone else, until there's a big enough court case to set precedent.
    - star-castle 8y ago
      > but it is not necessary for the website displaying the advertisements, as proven by ad-blockers. when I was a child I stole a toy from Wal-Mart. Wal-Mart is still around. Therefore, Wal-Mart's entire existence as a store does not depend on any kind of anti-theft measures, and it should be illegal for them to film my entrance and exit.
      - PuffinBlue 8y ago
        This is an interesting choice of counter-argument. Firstly three things: 1) Laws don't exist in isolation 2) Long standing law says theft is illegal and stores can take steps to limit it. 3) This new law (GDPR) says you can't take users details and use them unless necessary to provide your service. With this new GDPR law it's the little guy, the user, that get protection from something of value being taken from them and exploited - their personal details. So, extending the above counter-argument it is also true to say that like Walmart, the singular 'theft' of personal details might not be terminal for the user. But just like the law recognises the theft of material goods and it's potential harm (even in the case of a singal instance), it now recognises the 'taking' of personal data as harmful (also even a single instance). Extending the argument further, the GDPR takes the stance that one entity has been taking something of value from another without true compensation for the value of that something. When we realise that what has been taken from users has value and that users haven't been fairly compensated for that value, it becomes obvious that a set of entities have based a business model on profiting off another set without fair compensation. The GDPR now limits that behaviour and business model to return balance to the 'contract' between the two parties. Users get to use a service by providing the minimum needed for that service to be provided.
  - e12e 8y ago
    Required means for example that you need a shipping address to ship a product. Not that you need location data in order to build a profile used for various undeclared, vague purposes - or for an unrelated purpose. I don't use fb in order to watch ads. Fb shows ads on order to finance the service. They can offer a paid option to cover the cost of serving pictures of adorable kittens.
- okmaybeyesno 8y ago
  Facebook will argue that the data is necessary.
  - Lionsion 8y ago
    I can't see that argument going well: Since they let users opt-out of targeted advertising, which is probably the only thing "tracking" is useful for, they tacitly admit that "tracking" is not necessary for them to providing their service.
    - ucaetano 8y ago
      "We require tracking to pay for the costs of providing this free service". No such thing as a free lunch.
      - waisbrot 8y ago
        That would be interesting! That would probably mean they'd need to ban me, since I use an ad-blocker, right? What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...
        ucaetano 8y ago
        > That would probably mean they'd need to ban me, since I use an ad-blocker, right? Are you saying they should be forced by law to block you? > What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated... That is a flat-fee/pricing issue, just like someone binge watching Netflix might be using more resources than they generate in revenue. It isn't relevant to the discussion.
      - hedora 8y ago
        “We sell your credit card number on the black market to pay the costs of this free service”. Also illegal.
star-castle 8y ago
what? seriously? Do EU citizens have some kind of legal right to Facebook access, now? It's illegal for Facebook to not serve people they can't sell to advertisers? I'd love it if Facebook were nationalized (or destroyed), but none of the coverage of the GDPR made it sound like it was going in that direction. I thought it was just another stupid "click here to acknowledge our cookies" rule that was going to spam up the internet.
- deleted 8y ago
  [deleted]
- gonmf 8y ago
  There is no legal right to Facebook, but if Facebook wants to do business here, it has to abide by our rules. And our rules are very simple, you cannot deny service because the user doesn't allow tracking if tracking is not necessary for your service to work. And it isn't in this case, it's only necessary to deliver higher paying ads. Since they are being selective on the users they accept based on being tracked, they are now on track for another EU fine.
  - ovao 8y ago
    It's disconcerting to me that under the GDPR, online businesses appear to be losing the ability to deny services to a user who knowingly, and with clear consent, chooses to take personal responsibility over the data they provide to said businesses. Regardless of whether this is for the "greater good", this is deeply unsettling territory.
    - waisbrot 8y ago
      How did you determine "knowingly, and with clear consent"? I guess I'd agree that if someone wrote a 5 page paper describing all the ways that Facebook harvests their data and what might be done with it afterwards then they should be allowed to do what they want? But I suspect most people would be like "uhhh, I think they, um, know what pages I liked? And maybe they use that for ads?"
zerostar07 8y ago
What do you consider legal under GDPR? A lot of people think it's some kind of "revenge gun", but for what exactly? I wonder what people expected that would happen.
- adventured 8y ago
  Here's the program so far: EU targets Google, US then targets German automakers with emissions-gate, EU targets US tech companies with global revenue fines and data restrictions (Google + Facebook = $180b in revenue in the near future, an EU targeted pot of gold meant to be an offset for Ireland's tax policies). Next up: the US targets Germany's auto industry - a backbone to their economy - with tariffs or other import restrictions, seeking to damage BMW, Mercedes, and Volkswagen in any and all ways possible. Easy cover: Germany having the world's largest current account surplus, at 8% of GDP. Recourse after that: more restrictions, regulations, targeting of US tech giants in the EU, and tariffs on various US products. France says: Germany and its trade policies are a problem, seeks to reduce German dominance while trying to remain more neutral with the US: https://www.politico.eu/article/emmanuel-macron-says-german-surplus-hurts-europe/ https://www.politico.eu/article/emmanuel-macron-says-german-... It's going to be a very interesting year or two.
  - zerostar07 8y ago
    That would be fun indeed. But i think it's just one of those internet outrages, which at some point turns around and bites back , and in a few months people will be outraged certain aspects of GDPR itself.

I'm pretty sure that's illegal under GDPR.

by mtgx 8y ago

I'm pretty sure that's illegal under GDPR.

Yeah, they're fairly clear that you can't make service conditional on marketing et al consent. > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

Kiro 8y ago
What if your service requires the tracking?
- floatingatoll 8y ago
  Then you’d be permitted to do so. Facebook Messenger’s chat with your friends service does not depend on tracking, for example, so this argument doesn’t apply to Facebook.
  - star-castle 8y ago
    What do you mean by "does not depend on tracking"? Do you mean that you can conceive of a way to implement the service as it appears to the user, without tracking? Because Facebook can certainly inject tracking into their chat app. Given Facebook, I assume it's already the case that if I type "let's get married" and then erase those words and never send them, that Facebook's going to start showing me advertisements for how to pop the question.
    - stedaniels 8y ago
      You assume that, I assume that, these thoughts are a few digits shy of the decimal point of the percentage of people in the world who understand this. It's not commonly known that Facebook track your every conscious and unconscious interactions with their sites, apps, and every other site that has one of their tracking pixels/logins. It's even less commonly known that they gather data from numerous data brokers to enhance the data they have on you.
    - floatingatoll 8y ago
      Tracking is not required to deliver a text message between two contacts who approved each other. Facebook might declare otherwise, but since SMS and IRC both stand as counterexamples of successful text chat services that do not inherently depend on tracking, they would likely lose their case.
  - jasonlotito 8y ago
    Define "doesn't depend on" because I could easily make the argument that Messenger's chat does require tracking location for example to increase security and to fight spam. By not opting in to tracking of location, you degrading the quality of the service and affecting other people. i.e. Without this tracking, the quality of Messenger is affected, and therefore, by definition, the service cannot be provided without it.
    - icebraining 8y ago
      That's fine, but then FB can only use that location for increasing security and fighting spam. Slurping information based on an excuse and then using it for something else is explicitly prohibited by the GDPR.
  - deleted 8y ago
    [deleted]
- zdragnar 8y ago
  Consent isn't required for data collection that is necessary for the service to work. However, you have to be prepared to defend in court that it IS necessary. As such, trackers in 3rd-party advertising network code probably won't count as necessary; it's necessary for the ad network, but it is not necessary for the website displaying the advertisements, as proven by ad-blockers. Likewise, the facebook like button and other "plugin" components aren't "necessary", they merely add value to the existing content / features, and must therefor be entirely opt-in. At least, that's my understanding, which is entirely too facile to be taken as legal advice. EDIT: As petercooper pointed out below, in addition to proving necessity, you must still also prove in court that you have balanced the necessity against users' rights and interests. As such, I no longer feel confident to say I even have a clue as to what is legal and what is not, for FB or for anyone else, until there's a big enough court case to set precedent.
  - star-castle 8y ago
    > but it is not necessary for the website displaying the advertisements, as proven by ad-blockers. when I was a child I stole a toy from Wal-Mart. Wal-Mart is still around. Therefore, Wal-Mart's entire existence as a store does not depend on any kind of anti-theft measures, and it should be illegal for them to film my entrance and exit.
    - PuffinBlue 8y ago
      This is an interesting choice of counter-argument. Firstly three things: 1) Laws don't exist in isolation 2) Long standing law says theft is illegal and stores can take steps to limit it. 3) This new law (GDPR) says you can't take users details and use them unless necessary to provide your service. With this new GDPR law it's the little guy, the user, that get protection from something of value being taken from them and exploited - their personal details. So, extending the above counter-argument it is also true to say that like Walmart, the singular 'theft' of personal details might not be terminal for the user. But just like the law recognises the theft of material goods and it's potential harm (even in the case of a singal instance), it now recognises the 'taking' of personal data as harmful (also even a single instance). Extending the argument further, the GDPR takes the stance that one entity has been taking something of value from another without true compensation for the value of that something. When we realise that what has been taken from users has value and that users haven't been fairly compensated for that value, it becomes obvious that a set of entities have based a business model on profiting off another set without fair compensation. The GDPR now limits that behaviour and business model to return balance to the 'contract' between the two parties. Users get to use a service by providing the minimum needed for that service to be provided.
- e12e 8y ago
  Required means for example that you need a shipping address to ship a product. Not that you need location data in order to build a profile used for various undeclared, vague purposes - or for an unrelated purpose. I don't use fb in order to watch ads. Fb shows ads on order to finance the service. They can offer a paid option to cover the cost of serving pictures of adorable kittens.
okmaybeyesno 8y ago
Facebook will argue that the data is necessary.
- Lionsion 8y ago
  I can't see that argument going well: Since they let users opt-out of targeted advertising, which is probably the only thing "tracking" is useful for, they tacitly admit that "tracking" is not necessary for them to providing their service.
  - ucaetano 8y ago
    "We require tracking to pay for the costs of providing this free service". No such thing as a free lunch.
    - waisbrot 8y ago
      That would be interesting! That would probably mean they'd need to ban me, since I use an ad-blocker, right? What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...
      - ucaetano 8y ago
        > That would probably mean they'd need to ban me, since I use an ad-blocker, right? Are you saying they should be forced by law to block you? > What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated... That is a flat-fee/pricing issue, just like someone binge watching Netflix might be using more resources than they generate in revenue. It isn't relevant to the discussion.
    - hedora 8y ago
      “We sell your credit card number on the black market to pay the costs of this free service”. Also illegal.

star-castle 8y ago

what? seriously? Do EU citizens have some kind of legal right to Facebook access, now? It's illegal for Facebook to not serve people they can't sell to advertisers? I'd love it if Facebook were nationalized (or destroyed), but none of the coverage of the GDPR made it sound like it was going in that direction. I thought it was just another stupid "click here to acknowledge our cookies" rule that was going to spam up the internet.

deleted 8y ago
[deleted]
gonmf 8y ago
There is no legal right to Facebook, but if Facebook wants to do business here, it has to abide by our rules. And our rules are very simple, you cannot deny service because the user doesn't allow tracking if tracking is not necessary for your service to work. And it isn't in this case, it's only necessary to deliver higher paying ads. Since they are being selective on the users they accept based on being tracked, they are now on track for another EU fine.
- ovao 8y ago
  It's disconcerting to me that under the GDPR, online businesses appear to be losing the ability to deny services to a user who knowingly, and with clear consent, chooses to take personal responsibility over the data they provide to said businesses. Regardless of whether this is for the "greater good", this is deeply unsettling territory.
  - waisbrot 8y ago
    How did you determine "knowingly, and with clear consent"? I guess I'd agree that if someone wrote a 5 page paper describing all the ways that Facebook harvests their data and what might be done with it afterwards then they should be allowed to do what they want? But I suspect most people would be like "uhhh, I think they, um, know what pages I liked? And maybe they use that for ads?"

zerostar07 8y ago

What do you consider legal under GDPR? A lot of people think it's some kind of "revenge gun", but for what exactly? I wonder what people expected that would happen.

adventured 8y ago
Here's the program so far: EU targets Google, US then targets German automakers with emissions-gate, EU targets US tech companies with global revenue fines and data restrictions (Google + Facebook = $180b in revenue in the near future, an EU targeted pot of gold meant to be an offset for Ireland's tax policies). Next up: the US targets Germany's auto industry - a backbone to their economy - with tariffs or other import restrictions, seeking to damage BMW, Mercedes, and Volkswagen in any and all ways possible. Easy cover: Germany having the world's largest current account surplus, at 8% of GDP. Recourse after that: more restrictions, regulations, targeting of US tech giants in the EU, and tariffs on various US products. France says: Germany and its trade policies are a problem, seeks to reduce German dominance while trying to remain more neutral with the US: https://www.politico.eu/article/emmanuel-macron-says-german-surplus-hurts-europe/ https://www.politico.eu/article/emmanuel-macron-says-german-... It's going to be a very interesting year or two.
- zerostar07 8y ago
  That would be fun indeed. But i think it's just one of those internet outrages, which at some point turns around and bites back , and in a few months people will be outraged certain aspects of GDPR itself.