4 ms·

One of the points of the GDPR is that you cannot make usage of your service contingent on giving up your privacy, unless your service very specifically requires

One of the points of the GDPR is that you cannot make usage of your service contingent on giving up your privacy, unless your service very specifically requires the user to give up personal details in order to it to even function. Strava is a good example, it does not work without GPS position, otherwise it cannot track your bike routes. But Facebook does not require tracking to work. It does not require you to give them any personal details at all in order to work. It would work just fine even if everyone gave them fake emails, phone numbers, birth dates and even fake names. Thus they cannot make giving up privacy a requirement for using their service. Besides that, this ToS update thing is absolutely not GDPR compliant. It does not list the things personal data will be used for. It hides the opt-out (to the face tracking) behind a dark pattern small "options" text and makes the default action opt-in. The list goes on. This is simply an effort from FB to muddy the waters and sow doubt about opt-in and GDPR consequences. They will have to provide proper GDPR opt-in screens come the 25th, or they will be fined for non-compliance.

cabaalis 9y ago
Thank you for the clarification. That makes sense, although I'm not 100% sure I agree that it doesn't need the information to function. It could be de-identified for the individual, sure. But to actually use the service you need to connect with others, whose identities you must know something about. By following pages or celebrities or whatever you indicate that you are interested in their subject material. So in order to properly use the application you must give up something.
- KozmoNau7 9y ago
  Yes, but clicking "like" on a celebrity's FB page is not personally identifiable information. You cannot use to it discover the person's identity. To connect to other users on a service, I don't need to know any personal details about them, only their chosen username, which can be completely random and have no relation to their identity.
rock_hard 9y ago
I disagree what FB would work fine if you gave it no data or fake data! The whole point of FB is for people to exchange data about themselves with their friends and family! If people don’t share any data or just fake data FB doesn’t work. For them to offer their service they also have to make money, so they run ads to do that. And to make the ads useful to people they need data for targeting! And now they allow users to either agree to this deal or download their data, delete Facebook and do whatever they want. Simple as that
- KozmoNau7 9y ago
  Facebook would work perfectly fine with fake data and without privacy violations. I can sign up with a fake date of birth and a throwaway email account, under a generic name (remove any identifying unique spelling or middle names, for instance) or a completely fake name. And I could still connect with friends and family, provided I know the names they've chosen to use on FB. According to the GDPR, anything you share publicly is basically fair game. So if you post something in a public post on your public wall, anyone can view and use that data for whatever they want. The issue is all of the secret data FB collects. They have disturbingly extensive profiles of every one of their users, including political standpoint, which phase of life they're in (eg. "stable established adult" or somesuch), their sexual preferences, sports teams, club memberships, medical history, the list goes on and on. They get this from your non-public account information and from tracking you across websites you visit. That is the issue here, the tracking and storage of personal information that people want to keep private. FB's tracking and privacy violations are not vital to the service they provide. Their business model may depend on (targeted) ads and privacy violations, but that is not an excuse. You cannot base your business model on breaking laws and hoping to get away with it. FB isn't "allowing" users to either agree to the ToS or go pound sand, they're basically saying "fuck you, we'll exploit your private information as much as we want, and you don't have a choice". They're doing this to muddy the waters and make people think "oh I already agreed to this, make it go away", when the actual GDPR consent form pops up after the 25th. But users do have a choice. The GDPR very specifically says that you cannot make access to your service contingent on opting in to private data collection and tracking, because consent has to be given freely, ie. not under threat of access denial. You can only do this if your service cannot possibly work without the collection of personal data. Something like Strava (which tracks bike rides via GPS) cannot function without collecting GPS locations. So they have a good argument that they cannot provide their service, if users do not opt in to location tracking. But they have to very clearly state what they will use this collected data for, and they cannot change it later without collecting new freely given consent from their users.

cabaalis 9y ago

Thank you for the clarification. That makes sense, although I'm not 100% sure I agree that it doesn't need the information to function. It could be de-identified for the individual, sure. But to actually use the service you need to connect with others, whose identities you must know something about. By following pages or celebrities or whatever you indicate that you are interested in their subject material. So in order to properly use the application you must give up something.

KozmoNau7 9y ago
Yes, but clicking "like" on a celebrity's FB page is not personally identifiable information. You cannot use to it discover the person's identity. To connect to other users on a service, I don't need to know any personal details about them, only their chosen username, which can be completely random and have no relation to their identity.

rock_hard 9y ago

I disagree what FB would work fine if you gave it no data or fake data! The whole point of FB is for people to exchange data about themselves with their friends and family! If people don’t share any data or just fake data FB doesn’t work. For them to offer their service they also have to make money, so they run ads to do that. And to make the ads useful to people they need data for targeting! And now they allow users to either agree to this deal or download their data, delete Facebook and do whatever they want. Simple as that

KozmoNau7 9y ago
Facebook would work perfectly fine with fake data and without privacy violations. I can sign up with a fake date of birth and a throwaway email account, under a generic name (remove any identifying unique spelling or middle names, for instance) or a completely fake name. And I could still connect with friends and family, provided I know the names they've chosen to use on FB. According to the GDPR, anything you share publicly is basically fair game. So if you post something in a public post on your public wall, anyone can view and use that data for whatever they want. The issue is all of the secret data FB collects. They have disturbingly extensive profiles of every one of their users, including political standpoint, which phase of life they're in (eg. "stable established adult" or somesuch), their sexual preferences, sports teams, club memberships, medical history, the list goes on and on. They get this from your non-public account information and from tracking you across websites you visit. That is the issue here, the tracking and storage of personal information that people want to keep private. FB's tracking and privacy violations are not vital to the service they provide. Their business model may depend on (targeted) ads and privacy violations, but that is not an excuse. You cannot base your business model on breaking laws and hoping to get away with it. FB isn't "allowing" users to either agree to the ToS or go pound sand, they're basically saying "fuck you, we'll exploit your private information as much as we want, and you don't have a choice". They're doing this to muddy the waters and make people think "oh I already agreed to this, make it go away", when the actual GDPR consent form pops up after the 25th. But users do have a choice. The GDPR very specifically says that you cannot make access to your service contingent on opting in to private data collection and tracking, because consent has to be given freely, ie. not under threat of access denial. You can only do this if your service cannot possibly work without the collection of personal data. Something like Strava (which tracks bike rides via GPS) cannot function without collecting GPS locations. So they have a good argument that they cannot provide their service, if users do not opt in to location tracking. But they have to very clearly state what they will use this collected data for, and they cannot change it later without collecting new freely given consent from their users.