6 ms·

GDPR doesn't cover enough of the population using Facebook to warrant such a change to their business model where you can use the service without them using you

GDPR doesn't cover enough of the population using Facebook to warrant such a change to their business model where you can use the service without them using your data. They believe they are entrenched enough to just require this (and likely are for many EU residents).

deleted 8y ago
[deleted]
purple-again 8y ago
I'm really curious to find out if the GDPR privacy stance (I'm American, not well traveled, and with no non american social circle) is like the 'no JavaScript' community. Vastly over represented in the tech community and not really representative of the population as a whole. In other words, are 99% of European citizens going to just click through what ever annoying prompts they have to in order to get to their facebook (thats what I would do) or is there an actual widespread cultural difference in the EU that would stop large segments from agreeing to this.
- barrkel 8y ago
  The click-through is itself likely violating the regulation. All it takes is for someone to complain; it's not enough for 99% of people to click through.
  - frockington 8y ago
    How long would it take a EU court to notice, plan, and take action ? VW was blatantly lying about emissions for years and nobody seemed to care
    - icebraining 8y ago
      EU courts take notice when someone files a complaint. In the past, great people like Max Schrems have taken the mantle. I'd certainly support him or anyone else planning to follow up on his work. https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
- rorykoehler 8y ago
  I think most will just click through. I know I will. However there is probably a larger percentage of Europeans who won't compared to Americans.
- called_it 8y ago
  At least for some, it's the result of experiences with and/or knowledge about Stalinism, the Nazis, et al. For those, it doesn't matter what 99% of the people do, we don't derive the value of something from how many people do or think it, we derive the value of people from what they think and do in relations to these questions. It's fine to be "not well traveled", but I wouldn't put my hand into machinery I don't 100% understand. That you don't see what is the lioness and what are the cubs is not relevant to the lioness.
- r00fus 8y ago
  I think the current population that wants GDPR privacy stance is small but feared to be influential by Facebook. It also coincides with FB's recent privacy breach news and overall general public dissatisfaction with FB's policies. I know a lot of folks who simply don't use FB and are realizing that it's "really not free" in liability terms. So does this turn into a groundswell? Probably not, I agree with you. However, it does put some fences up that is probably causing FB to feel a bit more nervous. GDPR may be the first of many such efforts...
- Angostura 8y ago
  There are so many people undergoing GDPR workplace training at the moment that I think people may stop and think
  - tedunangst 8y ago
    So many people or so many people in the web service tech industry that frequents HN?
    - Angostura 8y ago
      To give you an idea, I work at a school. Every member of teaching staff all of admin, site-services and IT have had GDPR training. Getting consent for photos, for school trips, referral to outside agencies is a substantial issue, as is leaving student records on desks, keeping files with PII on encrypted sticks etc. This is a school.
      - tedunangst 8y ago
        That's interesting. So now a student can come back and demand you delete their permission slip for a field trip?
        Angostura 8y ago
        Schools collect data under several of the possible lawful bases https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... In the case of a permission slip - the school already holds lots of info that the school collects under the 'Public Task or 'Legal Obligation' bases. The slip then contains additional information that is only collect because the kid is going on a trip, but is necessary for the trip. This would be collected under the Contract basis 'If you want to go on this trip, the following info is necessary'. If the school also wants to take photos of the child on the trip, for example, then the parent will be asked for consent. So to answer your question, the parent (assuming the child is under 16) could ask for: 1. The photo consent to be removed - in which case the trip must continue 2. The info pertaining to the school trip to be removed (in which case the kid would no longer be going on the trip) But they cannot request the core data that the school holds to be removed, unless they take their kid to another school.
- rahoulb 8y ago
  In business circles there appears to be widespread panic about GDPR. Amongst "ordinary" people, there is a growing sense of unease about data collection - reflected in the "Facebook must be listening to my phone because they overheard a conversation I was having and now I'm seeing ads for it". I believe people are starting to understand the implications of data collection and are quite unhappy about it.
- deleted 8y ago
  [deleted]
- zerostar07 8y ago
  In reality, caring so much about their privacy seems to be a German/Nordic thing. There was no public outcry that led to GDPR , it seems to have popped up more through bureaucracy rather than popular demand. I think most europeans are just as oblivious/indifferent to privacy issues as americans, and we don't even have the CA scandal here. So yes, 99% will just press accept and forget about it. It's mainly the vocal proponents that you hear.
noja 8y ago
Are you talking with real knowledge of the facts, or is this a guess? Because my guess would be that it would be cheaper to adhere to the rules rather than let a competitor grow big in Europe and eat their market elsewhere.
- kungtotte 8y ago
  With over 500 million people in the EU that's a lot of potential market going to waste by not being GDPR compliant. Unless, of course, their central business model is incompatible with GDPR-compliance in the first place...
  - s_dev 8y ago
    In which case there can be no EU competitor.
    - jobigoud 8y ago
      You can have a competitor providing the same service using a different business model.
- _rpd 8y ago
  But the 'competitor' will have much lower revenue than Facebook because of the lack of targeted advertising.
  - rock_hard 8y ago
    And much less users too...because of less relevant ads and content in general!
- ClassAndBurn 8y ago
  Its a guess. Facebook also controls many of the "competitors" currently. Its also not about not being compliant, they want their customers, its just not worth reevaluating core aspects of the business when they believe people will sign whatever they have to to continue using Facebook.
KozmoNau7 8y ago
As far as I know, the GDPR stipulates that you cannot deny people access to you service if they do not opt-in to tracking, unless the service you provide is very specifically a tracking service. Tracking is not the primary service Facebook provides to their users, so the GDPR will not allow them to bar access for users who do not opt-in to being tracked.
- lainga 8y ago
  I believe the GDPR only forbids denying access to users' data if they don't opt-in (Art. 15), and that's why Facebook has the options to either - accept ToS and use Facebook, or - deny ToS, download user data and delete account (under 'More options'). https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/
  - KozmoNau7 8y ago
    No, because this ToS thing is not actually a GDPR-compliant opt-in. It's a routine ToS update, with a few tracking things tacked at the end of it. Companies have always been able to deny users access if they don't accept a ToS, but clicking "I Accept" to the ToS shown in the screenshots is not a GDPR opt-in, and I cannot stress that enough. It is just a ToS update, which does not cover GDPR-compliant opt-in to tracking. The tracking questions following it are also not GDPR-compliant. They will have to ask properly for opt-in when the 25th rolls around, or they will face fines for non-compliance. FB is trying to muddy the waters with this ToS update, probably to fool people into thinking "well, I already accepted a bunch of stuff a couple of weeks ago, I'll just accept this GDPR thing as well". It seems that you've bought in to their misinformation campaign. The GDPR stipulates that you cannot make access to your service contingent on opting in to tracking, unless you service cannot possibly function without tracking. Strava would be a good example, it cannot possibly work without tracking a user's GPS location. But FB works just fine with no tracking at all. The only thing that would be compromised is be FB's business model, and that's just tough luck, they'll have to come up with something better, a model that doesn't infringing on people's privacy. Source: I work for a telco/ISP and we are extremely aware of GDPR and the consequences, and we've been working diligently for ~2 years to make our entire business GDPR-compliant. Training courses and tests of our understanding of the rules are mandatory for everyone, from customer support to CEO.
Lionsion 8y ago
> GDPR doesn't cover enough of the population using Facebook to warrant such a change to their business model where you can use the service without them using your data. The real question isn't population, it's revenue per user. An typical American or a European will draw a lot more revenue to Facebook than a typical person from a 3rd world country accessing Facebook through "Free Basics." My educated guess is that Europe is Facebook's #2 market behind the US, and there's enough revenue there for them to change their business model.
- ihumanable 8y ago
  No need to guess, they are a public company and just released their 2018 Q1 Quarterly Earnings Report https://s21.q4cdn.com/399680738/files/doc_financials/2018/Q1/Q1-2018-Earnings-Presentation-(1).pdf https://s21.q4cdn.com/399680738/files/doc_financials/2018/Q1... From Slide 5: Q12018: Europe was #2 with $3.036B in revenue Q42017: Europe was #2 with $3.250B in revenue And so on, it looks like every quarter on this slide has Europe in spot #2 behind US & Canada.

deleted 8y ago

[deleted]

purple-again 8y ago

I'm really curious to find out if the GDPR privacy stance (I'm American, not well traveled, and with no non american social circle) is like the 'no JavaScript' community. Vastly over represented in the tech community and not really representative of the population as a whole. In other words, are 99% of European citizens going to just click through what ever annoying prompts they have to in order to get to their facebook (thats what I would do) or is there an actual widespread cultural difference in the EU that would stop large segments from agreeing to this.

barrkel 8y ago
The click-through is itself likely violating the regulation. All it takes is for someone to complain; it's not enough for 99% of people to click through.
- frockington 8y ago
  How long would it take a EU court to notice, plan, and take action ? VW was blatantly lying about emissions for years and nobody seemed to care
  - icebraining 8y ago
    EU courts take notice when someone files a complaint. In the past, great people like Max Schrems have taken the mantle. I'd certainly support him or anyone else planning to follow up on his work. https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
rorykoehler 8y ago
I think most will just click through. I know I will. However there is probably a larger percentage of Europeans who won't compared to Americans.
called_it 8y ago
At least for some, it's the result of experiences with and/or knowledge about Stalinism, the Nazis, et al. For those, it doesn't matter what 99% of the people do, we don't derive the value of something from how many people do or think it, we derive the value of people from what they think and do in relations to these questions. It's fine to be "not well traveled", but I wouldn't put my hand into machinery I don't 100% understand. That you don't see what is the lioness and what are the cubs is not relevant to the lioness.
r00fus 8y ago
I think the current population that wants GDPR privacy stance is small but feared to be influential by Facebook. It also coincides with FB's recent privacy breach news and overall general public dissatisfaction with FB's policies. I know a lot of folks who simply don't use FB and are realizing that it's "really not free" in liability terms. So does this turn into a groundswell? Probably not, I agree with you. However, it does put some fences up that is probably causing FB to feel a bit more nervous. GDPR may be the first of many such efforts...
Angostura 8y ago
There are so many people undergoing GDPR workplace training at the moment that I think people may stop and think
- tedunangst 8y ago
  So many people or so many people in the web service tech industry that frequents HN?
  - Angostura 8y ago
    To give you an idea, I work at a school. Every member of teaching staff all of admin, site-services and IT have had GDPR training. Getting consent for photos, for school trips, referral to outside agencies is a substantial issue, as is leaving student records on desks, keeping files with PII on encrypted sticks etc. This is a school.
    - tedunangst 8y ago
      That's interesting. So now a student can come back and demand you delete their permission slip for a field trip?
      - Angostura 8y ago
        Schools collect data under several of the possible lawful bases https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-the-general-da... In the case of a permission slip - the school already holds lots of info that the school collects under the 'Public Task or 'Legal Obligation' bases. The slip then contains additional information that is only collect because the kid is going on a trip, but is necessary for the trip. This would be collected under the Contract basis 'If you want to go on this trip, the following info is necessary'. If the school also wants to take photos of the child on the trip, for example, then the parent will be asked for consent. So to answer your question, the parent (assuming the child is under 16) could ask for: 1. The photo consent to be removed - in which case the trip must continue 2. The info pertaining to the school trip to be removed (in which case the kid would no longer be going on the trip) But they cannot request the core data that the school holds to be removed, unless they take their kid to another school.
rahoulb 8y ago
In business circles there appears to be widespread panic about GDPR. Amongst "ordinary" people, there is a growing sense of unease about data collection - reflected in the "Facebook must be listening to my phone because they overheard a conversation I was having and now I'm seeing ads for it". I believe people are starting to understand the implications of data collection and are quite unhappy about it.
deleted 8y ago
[deleted]
zerostar07 8y ago
In reality, caring so much about their privacy seems to be a German/Nordic thing. There was no public outcry that led to GDPR , it seems to have popped up more through bureaucracy rather than popular demand. I think most europeans are just as oblivious/indifferent to privacy issues as americans, and we don't even have the CA scandal here. So yes, 99% will just press accept and forget about it. It's mainly the vocal proponents that you hear.

noja 8y ago

Are you talking with real knowledge of the facts, or is this a guess? Because my guess would be that it would be cheaper to adhere to the rules rather than let a competitor grow big in Europe and eat their market elsewhere.

kungtotte 8y ago
With over 500 million people in the EU that's a lot of potential market going to waste by not being GDPR compliant. Unless, of course, their central business model is incompatible with GDPR-compliance in the first place...
- s_dev 8y ago
  In which case there can be no EU competitor.
  - jobigoud 8y ago
    You can have a competitor providing the same service using a different business model.
_rpd 8y ago
But the 'competitor' will have much lower revenue than Facebook because of the lack of targeted advertising.
- rock_hard 8y ago
  And much less users too...because of less relevant ads and content in general!
ClassAndBurn 8y ago
Its a guess. Facebook also controls many of the "competitors" currently. Its also not about not being compliant, they want their customers, its just not worth reevaluating core aspects of the business when they believe people will sign whatever they have to to continue using Facebook.

KozmoNau7 8y ago

As far as I know, the GDPR stipulates that you cannot deny people access to you service if they do not opt-in to tracking, unless the service you provide is very specifically a tracking service. Tracking is not the primary service Facebook provides to their users, so the GDPR will not allow them to bar access for users who do not opt-in to being tracked.

lainga 8y ago
I believe the GDPR only forbids denying access to users' data if they don't opt-in (Art. 15), and that's why Facebook has the options to either - accept ToS and use Facebook, or - deny ToS, download user data and delete account (under 'More options'). https://gdpr-info.eu/art-15-gdpr/ https://gdpr-info.eu/art-15-gdpr/
- KozmoNau7 8y ago
  No, because this ToS thing is not actually a GDPR-compliant opt-in. It's a routine ToS update, with a few tracking things tacked at the end of it. Companies have always been able to deny users access if they don't accept a ToS, but clicking "I Accept" to the ToS shown in the screenshots is not a GDPR opt-in, and I cannot stress that enough. It is just a ToS update, which does not cover GDPR-compliant opt-in to tracking. The tracking questions following it are also not GDPR-compliant. They will have to ask properly for opt-in when the 25th rolls around, or they will face fines for non-compliance. FB is trying to muddy the waters with this ToS update, probably to fool people into thinking "well, I already accepted a bunch of stuff a couple of weeks ago, I'll just accept this GDPR thing as well". It seems that you've bought in to their misinformation campaign. The GDPR stipulates that you cannot make access to your service contingent on opting in to tracking, unless you service cannot possibly function without tracking. Strava would be a good example, it cannot possibly work without tracking a user's GPS location. But FB works just fine with no tracking at all. The only thing that would be compromised is be FB's business model, and that's just tough luck, they'll have to come up with something better, a model that doesn't infringing on people's privacy. Source: I work for a telco/ISP and we are extremely aware of GDPR and the consequences, and we've been working diligently for ~2 years to make our entire business GDPR-compliant. Training courses and tests of our understanding of the rules are mandatory for everyone, from customer support to CEO.

Lionsion 8y ago

> GDPR doesn't cover enough of the population using Facebook to warrant such a change to their business model where you can use the service without them using your data. The real question isn't population, it's revenue per user. An typical American or a European will draw a lot more revenue to Facebook than a typical person from a 3rd world country accessing Facebook through "Free Basics." My educated guess is that Europe is Facebook's #2 market behind the US, and there's enough revenue there for them to change their business model.

ihumanable 8y ago
No need to guess, they are a public company and just released their 2018 Q1 Quarterly Earnings Report https://s21.q4cdn.com/399680738/files/doc_financials/2018/Q1/Q1-2018-Earnings-Presentation-(1).pdf https://s21.q4cdn.com/399680738/files/doc_financials/2018/Q1... From Slide 5: Q12018: Europe was #2 with $3.036B in revenue Q42017: Europe was #2 with $3.250B in revenue And so on, it looks like every quarter on this slide has Europe in spot #2 behind US & Canada.