5 ms·

It's disconcerting to me that under the GDPR, online businesses appear to be losing the ability to deny services to a user who knowingly, and with clear consent

by ovao 8y ago

It's disconcerting to me that under the GDPR, online businesses appear to be losing the ability to deny services to a user who knowingly, and with clear consent, chooses to take personal responsibility over the data they provide to said businesses. Regardless of whether this is for the "greater good", this is deeply unsettling territory.

waisbrot 8y ago
How did you determine "knowingly, and with clear consent"? I guess I'd agree that if someone wrote a 5 page paper describing all the ways that Facebook harvests their data and what might be done with it afterwards then they should be allowed to do what they want? But I suspect most people would be like "uhhh, I think they, um, know what pages I liked? And maybe they use that for ads?"
- ovao 8y ago
  I'm not referring to Facebook specifically. The dialog that Facebook's displaying to EU users (according to the tweet) isn't actually very clear in itself about what they're asking users for. "Clear consent", in my mind, would be something along the lines of "we use tracking cookies and tracking on widgets third-party websites embed, as well as the data you provide to us in terms of posts, comments, photos and other content to personalize the ads you see". If you accept those terms, well, then you certainly can't be surprised when Facebook — or whoever — does precisely that.
icebraining 8y ago
Your phrasing is confusing. Why would the business want to deny services to a user who chooses to take personal responsibility over the data they provide?
- ovao 8y ago
  Sorry if it wasn't clear. I'm suggesting that a business should have some right to deny service to a user who chooses not to participate in tracking, so long as it's made abundantly and plainly clear to said user that they'd be tracked, and that the user consents to that. Based on my interpretation, the GDPR simply precludes that possibility.
  - dbrgn 8y ago
    I assume if you made a business where the user can sell their behavioral data for a service in return, and if the whole goal of the business was selling data in return for a service, then I would interpret the data collection to be strictly required for the business goal and thus legal under the GDPR (given explicit consent). The official goal of Facebook is not "buying your data" but "providing a social network". Thus, targeted ads are not strictly necessary for providing that service.
    - icebraining 8y ago
      I think the data must be actually necessary for the thing you're providing to the user. So if you're paying cash in exchange for data, that wouldn't be allowed, because you don't need someone's data in order to give them cash.
- deleted 8y ago
  [deleted]
mrweasel 8y ago
You're not allow to operate that way in most other businesses anyway. You can't sell leaded paint, even if clearly marked. You can't sell unsafe cars, even if you tell people that even low speed impacts will kill them. There's a ton of stuff you can't do, even with clear consent, because otherwise people who lack the means to understand the compromises or afford the safer choices will suffer.
- tlrobinson 8y ago
  Those are safety/environmental issues. Showing you ads based on your preferences is not.
  - mrweasel 8y ago
    You could easily argue that tracking users behaviour is a safety issue. But fair enough, how about the loan business, you aren't allowed to charge overly high interest on loans. That's neither a safety or environmental issue.
    - ovao 8y ago
      Predatory interest rates frankly don't concern or particularly bother me. I think, for me, that only becomes a point of concern if a person is simply mentally unfit to make such decisions for themselves. In such cases the general guidance that someone else deemed fit should be responsible for that person's decisions applies, which goes back to the point you made earlier.
      - rosser 8y ago
        Even when those usurious, predatory rates are disproportionately charged to poorer people, who can afford to bear them less? Because that's how it works: price discrimination against the people least able to bear it. But, hey. Why should I care, if I'm not getting charged those rates, right?
        8y ago
s73v3r_ 8y ago
I fail to see why. Without clauses like this, you'd be at the same place you were before, "Either agree to all of our completely invasive and probably unrelated terms, or go pound sand." The GDPR is shifting the balance of power back so that users do have some bargaining, not just the take it or leave it that's been so prevalent for so long.
- ovao 8y ago
  I think the issue is that it really hasn't been a "take it or leave it" environment in the past years. Things have been done against the interest of user privacy by burying the explanations in long privacy policies filled with legalese, and in the general underhandedness of data exchange between multiple parties. The inability to remove data you've provided to a website, too, I think is problematic in ways. I'm a big proponent of user control, and a similarly big proponent of businesses taking much greater responsibility for the data they collect (my data was part of the Equifax breach, so I certainly get it). I am, however, leery about laws that essentially bind a business's hands in terms of how they can and cannot monetize on users, even when as there's A) clarity and B) honest, plain and upfront disclosure about how they do that. If a business tells me to agree to onerous terms to which I could never agree or to go pound sand, I'll gladly go pound sand. As a consumer, I lose no power there whatsoever.
  - jkaplowitz 8y ago
    You lose the power to participate in Facebook-only groups, which are surprisingly prevalent in some places. I have very limited access to two communities here in Montreal that I'd otherwise get a lot of value out of, because their only online communication system is via Facebook. I've told Facebook to pound sand for roughly their entire existence - never had an account even though I had the chance right after they expand beyond Harvard - and am considering whether life circumstances will increasingly force me (in practical rather than literal terms) to sign up. A company in that semi-mandatory position deserves lots of binding rules to protect the rights of unwilling users, just as is true for electric companies since you rarely have much choice there. Plus, I don't think Facebook's massive wall of several huge interlinked policies with soft-pedaled descriptions of what they do meets either of your A and B criteria, especially not when it's modally interrupting the user.
briandear 8y ago
Government knows what’s best for you. Grown adults ought to be allowed to decide for themselves. But that can’t be allowed because there are fines to collect and people to control. Go ahead and downvote. We will never reconcile the opinion that adults need a government parent vs those of us that believe that informed consent should be enough.
crankylinuxuser 8y ago
Your account has been suspended for the foreseeable future for breaking the terms of service. No we will not tell you what you did. You already know what you did. Our automated systems found your policy violation and acted appropriately. They are beyond your comprehension or refutation. You may not talk to a person regarding your dismissal. It is against policy to discuss active or closed issues. You have no recourse other than social media or tech websites, and beg. And we still will likely not care. --Care of US tech companies. ....So, you want to live with rules for companies that allow this kind of egregious and arbitrary actions? I sure as hell don't. Want to see what this stuff devolves to? Look no further than Comcast and ilk.
- kazinator 8y ago
  > They are beyond your comprehension or refutation. Where by "your" we mean "one's", i.e. effectively "our".
  - crankylinuxuser 8y ago
    I was writing the first part as a US company would say to a user. "Your" in that context was from the company to the user they wronged.
- ovao 8y ago
  Either we’re not talking about the same thing, or I don’t quite understand how your comment relates to mine. I really can’t answer your question.
Marysville 8y ago
It's like seat belts. You cannot sell a car without seat belt regardless of customer's choice. The customer's choice come later whether or not he wants to put on the seat belt. Car = Service Seat belt = Tracking protection

by ovao 8y ago

waisbrot 8y ago

How did you determine "knowingly, and with clear consent"? I guess I'd agree that if someone wrote a 5 page paper describing all the ways that Facebook harvests their data and what might be done with it afterwards then they should be allowed to do what they want? But I suspect most people would be like "uhhh, I think they, um, know what pages I liked? And maybe they use that for ads?"

ovao 8y ago
I'm not referring to Facebook specifically. The dialog that Facebook's displaying to EU users (according to the tweet) isn't actually very clear in itself about what they're asking users for. "Clear consent", in my mind, would be something along the lines of "we use tracking cookies and tracking on widgets third-party websites embed, as well as the data you provide to us in terms of posts, comments, photos and other content to personalize the ads you see". If you accept those terms, well, then you certainly can't be surprised when Facebook — or whoever — does precisely that.

icebraining 8y ago

Your phrasing is confusing. Why would the business want to deny services to a user who chooses to take personal responsibility over the data they provide?

ovao 8y ago
Sorry if it wasn't clear. I'm suggesting that a business should have some right to deny service to a user who chooses not to participate in tracking, so long as it's made abundantly and plainly clear to said user that they'd be tracked, and that the user consents to that. Based on my interpretation, the GDPR simply precludes that possibility.
- dbrgn 8y ago
  I assume if you made a business where the user can sell their behavioral data for a service in return, and if the whole goal of the business was selling data in return for a service, then I would interpret the data collection to be strictly required for the business goal and thus legal under the GDPR (given explicit consent). The official goal of Facebook is not "buying your data" but "providing a social network". Thus, targeted ads are not strictly necessary for providing that service.
  - icebraining 8y ago
    I think the data must be actually necessary for the thing you're providing to the user. So if you're paying cash in exchange for data, that wouldn't be allowed, because you don't need someone's data in order to give them cash.
deleted 8y ago
[deleted]

mrweasel 8y ago

You're not allow to operate that way in most other businesses anyway. You can't sell leaded paint, even if clearly marked. You can't sell unsafe cars, even if you tell people that even low speed impacts will kill them. There's a ton of stuff you can't do, even with clear consent, because otherwise people who lack the means to understand the compromises or afford the safer choices will suffer.

tlrobinson 8y ago
Those are safety/environmental issues. Showing you ads based on your preferences is not.
- mrweasel 8y ago
  You could easily argue that tracking users behaviour is a safety issue. But fair enough, how about the loan business, you aren't allowed to charge overly high interest on loans. That's neither a safety or environmental issue.
  - ovao 8y ago
    Predatory interest rates frankly don't concern or particularly bother me. I think, for me, that only becomes a point of concern if a person is simply mentally unfit to make such decisions for themselves. In such cases the general guidance that someone else deemed fit should be responsible for that person's decisions applies, which goes back to the point you made earlier.
    - rosser 8y ago
      Even when those usurious, predatory rates are disproportionately charged to poorer people, who can afford to bear them less? Because that's how it works: price discrimination against the people least able to bear it. But, hey. Why should I care, if I'm not getting charged those rates, right?
      - 8y ago

s73v3r_ 8y ago

I fail to see why. Without clauses like this, you'd be at the same place you were before, "Either agree to all of our completely invasive and probably unrelated terms, or go pound sand." The GDPR is shifting the balance of power back so that users do have some bargaining, not just the take it or leave it that's been so prevalent for so long.

ovao 8y ago
I think the issue is that it really hasn't been a "take it or leave it" environment in the past years. Things have been done against the interest of user privacy by burying the explanations in long privacy policies filled with legalese, and in the general underhandedness of data exchange between multiple parties. The inability to remove data you've provided to a website, too, I think is problematic in ways. I'm a big proponent of user control, and a similarly big proponent of businesses taking much greater responsibility for the data they collect (my data was part of the Equifax breach, so I certainly get it). I am, however, leery about laws that essentially bind a business's hands in terms of how they can and cannot monetize on users, even when as there's A) clarity and B) honest, plain and upfront disclosure about how they do that. If a business tells me to agree to onerous terms to which I could never agree or to go pound sand, I'll gladly go pound sand. As a consumer, I lose no power there whatsoever.
- jkaplowitz 8y ago
  You lose the power to participate in Facebook-only groups, which are surprisingly prevalent in some places. I have very limited access to two communities here in Montreal that I'd otherwise get a lot of value out of, because their only online communication system is via Facebook. I've told Facebook to pound sand for roughly their entire existence - never had an account even though I had the chance right after they expand beyond Harvard - and am considering whether life circumstances will increasingly force me (in practical rather than literal terms) to sign up. A company in that semi-mandatory position deserves lots of binding rules to protect the rights of unwilling users, just as is true for electric companies since you rarely have much choice there. Plus, I don't think Facebook's massive wall of several huge interlinked policies with soft-pedaled descriptions of what they do meets either of your A and B criteria, especially not when it's modally interrupting the user.

briandear 8y ago

Government knows what’s best for you. Grown adults ought to be allowed to decide for themselves. But that can’t be allowed because there are fines to collect and people to control. Go ahead and downvote. We will never reconcile the opinion that adults need a government parent vs those of us that believe that informed consent should be enough.

crankylinuxuser 8y ago

Your account has been suspended for the foreseeable future for breaking the terms of service. No we will not tell you what you did. You already know what you did. Our automated systems found your policy violation and acted appropriately. They are beyond your comprehension or refutation. You may not talk to a person regarding your dismissal. It is against policy to discuss active or closed issues. You have no recourse other than social media or tech websites, and beg. And we still will likely not care. --Care of US tech companies. ....So, you want to live with rules for companies that allow this kind of egregious and arbitrary actions? I sure as hell don't. Want to see what this stuff devolves to? Look no further than Comcast and ilk.

kazinator 8y ago
> They are beyond your comprehension or refutation. Where by "your" we mean "one's", i.e. effectively "our".
- crankylinuxuser 8y ago
  I was writing the first part as a US company would say to a user. "Your" in that context was from the company to the user they wronged.
ovao 8y ago
Either we’re not talking about the same thing, or I don’t quite understand how your comment relates to mine. I really can’t answer your question.

Marysville 8y ago

It's like seat belts. You cannot sell a car without seat belt regardless of customer's choice. The customer's choice come later whether or not he wants to put on the seat belt. Car = Service Seat belt = Tracking protection