20 ms·

Some frustrated publishers are sitting out Google’s GDPR meetings

76 points by ilamont 8y ago

Iv 8y ago
Judging by the ripples it causes, it feels like GDPR is a well done piece of legislation that will actually destroy some of the most invasive business models. Google should tread carefully there. It is the future of their cash cow that is at hand. It is somehow comforting to see an elected body being able and willing to cause such a stir.
- briandear 8y ago
  Is the EU Commission an elected body? I thought they were appointed.
  - oldcynic 8y ago
    Both the Council and Parliament had votes before adoption.
  - deleted 8y ago
    [deleted]
  - e12e 8y ago
    The commission is appointed and subject to the elected bodies; but afaik it can only propose legislation - it's the elected bodies that vote them into effect. The EU isn't particularly democratic or transparent - but it is nominally democratic. https://en.m.wikipedia.org/wiki/European_Commission#Legitimacy https://en.m.wikipedia.org/wiki/European_Commission#Legitima...
    - rndgermandude 8y ago
      The commission is appointed by the member state governments. Those governments in turn are elected. Commission members are therefore rather similar to regular cabinet members in member states which usually aren't directly elected by neither populus nor parliament, but chosen by the head of government. Personally, I think it would be better if the EU parliament chose the commission members. But it's not like the citizens of the EU had no say in who gets to be a commissioner at all: you can cast your vote differently in the next memberstate election if you don't like your government or the person it makes a commissioner.
      - ginko 8y ago
        At least Juncker was appointed president of the commission because his faction won the last EU parliamentary election.
      - jrnvs 8y ago
        Certainly not all EU Governments are elected. In The Netherlands, for example, you vote for Parliament. Parliamentary leaders then seek an agreement and propose a cabinet, which is formally instated by the King. When you cast your vote, you don't know who will be in government, nor do you have any say in it. I'm a proponent of this system, just wanted to point out that governments are not necessarily elected. I think the same holds in many other EU countries, e.g., Belgium and Germany.
        rndgermandude 8y ago
        Uh, you may not be able to directly elect a government, but you still elect the parliament which then chooses the government. So yes, you have a say in it, by casting your vote in the parliamentary elections for the party you want to see in government. And yes regarding Germany: Germans vote for parties in a parliamentary election; in the parliament a party or coalition of parties who can get the necessary majority votes will elect the Chancellor (head of government), who then is formally appointed by the President. The Chancellor then proposes cabinet members who are formally appointed by the President.
      - makomk 8y ago
        At least here in the UK, cabinet members are generally chosen from amongst the elected MPs, and if they're particularly terrible voters sometimes give them the boot at the next election, ending their career.
      - Vinnl 8y ago
        Of course, those regular cabinet members are the ones that appoint the commissioners, so it is one step further away :)0
  - deleted 8y ago
    [deleted]
- yuhong 8y ago
  I even mentioned the GDPR in the essay BTW.
  - saagarjha 8y ago
    I'm sorry, but how is this relevant?
    - yuhong 8y ago
      I mentioned for example that "Notice that AdWords comply if all “personalization” features are removed for example. This included things like “remarketing”. I suspect that AdWords when it was first created in 2000 did not have these features. " and linked to https://pagefair.com/blog/2017/gdpr_risk_to_the_duopoly/ https://pagefair.com/blog/2017/gdpr_risk_to_the_duopoly/
- Buge 8y ago
  I don't think causing a stir should be a goal. Trump caused quite a stir with his early immigration policies.
- piokoch 8y ago
  Hmm, I thought that too. I assumed that all banks, cell phone operators, etc. that I use would have to ask me for consent to sell my data, track me. But that did not happen, they just send a note with all those GDPR information what they do with my data and that they have a good news for me: I don't have to do anything, as all my "agreements" are still valid without any action from my side. They haven't given me an option to give consent for, say, calling me, but don't give consent for tracking and profiling. Looks like this is ok, unless Orange got GDPR wrongly and wants to risk fines but I don't believe that. One of the biggest Polish news portal (wp dot pl) has figure out the fantastic idea - they show a banner with a long, long text, that says at the end that if I close that banner, clicking on X button, I am automatically give them permission to track me and do virtually whatever they want with my data. If I don't agree for their terms and I don't close the banner (which is agreement as well) I am taken to "advanced settings" page that at the end gives me only one option - to agree for tracking and all the shady stuff they want to do with my data. It is impossible to enter their portal without agreeing for everything they want. WP dot PL is a big business owned by a big German media company, so I guess they figured out everything correctly, apparently the regulation has a lot of loopholes and anyone with smart lawyers can overcome GDPR easily.
  - Doxin 8y ago
    The "agree by closing this popup" tactic is, as far as I can tell, not allowed under GDPR. Here's hoping all the companies that do that get slapped with a fine.
    - Brotkrumen 8y ago
      This forever popup unless you accept should run afoul of the language in GDPR that forbids the degradation of a service if a user does not opt in.
    - jbrooksuk 8y ago
      Likewise "by continuing to browse this website, you agree" implied consent is no longer allowed.
    - zingmars 8y ago
- gcp 8y ago
  I wonder what the longer term consequences are. OK, sure it's nice that right now every site or company I ever had any interaction with no longer feels like they can keep my email on file to continuously spam me. But this state won't last right? I assume that everything I sign up for in the future will have a load of legalese to circumvent this as much as possible?
  - scaryclam 8y ago
    One of the nice things about the legislation is that it's quite specific about not allowing consent to be buried in legalese. While I imagine things will soften up a little as companies realise they're not going to immediately get slapped with a fine, most companies will at least be more careful since its simple for complaints to be made. Most do not want to bring the ICO's attention to themselves.
    - gcp 8y ago
      Thing is if everything puts up a big notice "YOU MUST AGREE TO BE TRACKED AND SOLD TO USE OUR SERVICE" then people will just click that.
      - e12e 8y ago
        There's provisions to make sure mandatory tracking, profiling is explicitly opt-in, and that there's a real alternative. That might be a fee (eg Gmail could let you pay x/month to disable all targeted ads - or rather; they might have an opt-in gratis/free service that had ads/tracking).
        icebraining 8y ago
        I don't think that's true; they can offer a paid version or a free version, but they can't offer a version "paid with tracking", even if there's an alternative.
      - krageon 8y ago
        That is coercive, and therefore does not comply (nor does it actually mean consent).
- throwawayqdhd 8y ago
  I wonder how many small businesses will be affected simply because every person right now has about 30 emails in their inboxes asking for GDPR permission I deleted most of them, even though ere might be a few businesses in there whose work I genuinely appreciate
  - gcp 8y ago
    Mostly they won't be able to send mailings around. Data portability and such are likely a much bigger hassle. Those are actual features you need to implement now if you stored PII.
- cultureulterior 8y ago
  I would rather have Google than the GDPR or most elected bodies.
  - ForHackernews 8y ago
    That opinion seems ill-considered, to say the least.
    - cultureulterior 8y ago
      The consumer surplus of search engines is like $17000 per year per person
      - theyinwhy 8y ago
        And you wouldn't see any of it if google was elected to govern you ;)
- whataretensors 8y ago
  These politicians created a new 'right' and exempted the government from it. This is bound to end well.
  - icebraining 8y ago
    The government is not exempted from the GDPR, as it wasn't from the Data Protection Directive that already granted most of the rights contained in the new regulation.
    - whataretensors 8y ago
      Of course they are, read (16) "This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as activities concerning national security. This Regulation does not apply to the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union. " I understand the confusion, as finding this involves reading the 88 pages you are defending.
      - icebraining 8y ago
        I did read the GDPR. A specific exemption for national defense (and by the way, you missed the one on health) is not the same as "exempting the government". The vast majority of governmental bodies have to comply. It's like saying that "governmental employees are allowed to pilot fighter jets" just because the army employs some pilots.
- some_account 8y ago
  I'm surprised it had some teeth. This shows that it's possible to change some very exploitable practices if EU wants to. Hopefully more of this will follow.
yuhong 8y ago
It is unfortunate that my essay didn't get much attention: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...
- ryanobjc 8y ago
  I'm sorry but your essay didn't get much attention because it is not particularly written well. I'm not really sure what you are arguing here, except that Google is bad maybe? You aren't clearly arguing an specific thesis, and there are many non sequitur paragraphs that don't flow. Why are you talking about OpenJDK in an essay about Google Adsense? Or is the essay about Doubleclick BMP? If the point of this essay is to provide an overview of the area, I am not sure you are well educated in this area. For example, most of doubleclick publishers dont do retargeted ads. They tend to do BMP only. You didn't mention programmatic at all. You don't talk about ad networks. Also you don't mention that Google has done a lot in the area of malware both on the web in general, and specifically has spent a lot of resources in getting malware off the ad network. This makes you seem disingenuous, because while Google isn't a fully "neutral" actor, they are overall a good citizen in the ad space. Ad targeting isn't inherently evil, a lot of ad targeting is geographically based -- in fact many people would probably argue that showing geographically inappropriate ads is even worse -- others are consumer segment (eg: women/men/age). I would like to have a non-advertisement internet, but it appears that people are just unwilling to do so. Also we may be facing very real cognitive limits, studies on microtransaction fatigue have demonstrated that is not likely to be a successful mechanism for funding webpages -- people just can't make that many monetary decisions every day.
  - yuhong 8y ago
    There are other known problems with the essay as well. For example, I mentioned storage costs but it turned out to be more complex than that. The point is not only to provide an overview though but more importantly to trace back the problems to Larry/Sergey, which is why it is so important. And yes I focus on ad tracking using cookies and nothing else. When I was writing the essay BTW, even tracing back when they began sharing the retargeting data took some time.
ysleepy 8y ago
And here I entertained the thought that for Google the legislation was a form of regulatory capture.
- gcp 8y ago
  It would seem that having to be GDPR compliant would dis-proportionally favor large companies with a lot of lawyers and engineers to implement the needed features company-wide. If this is not working out for Google, perhaps it's because the business is fundamentally incompatible? But I have problems believing that. The outcome would be too good :-)
  - yulaow 8y ago
    Honestly I think it favors more companies who just didn't do any shadow things with user data or just had not a business model built around it. If you were not one of those and maybe were already respecting the old eu privacy directive, being gdpr compliant is extremly easy and fast
  - Maarten88 8y ago
    > perhaps it's because the business is fundamentally incompatible? After having read most of the GDPR, that's my conclusion: all advertising other than 1990's style bannering now needs per publisher, per user, opt-in for anything that does tracking or is personalized, where the default should be set to 'no', denying should be as easy as consenting, and refusing access is not a valid publisher response. That means i.m.o. that using any form of modern advertising has become illegal under GDPR, unless you get users to consent in a compliant way, and I have seen just a few sites even try. I think Google is scrambling to understand that their business is now mostly illegal in EU.
    - Vinnl 8y ago
      I don't think that would mean that Google's business is fundamentally incompatible. If 90's-style bannering is the only thing that is allowed/feasible now, of all companies Google is in the best position to do that profitably.
nwellnhof 8y ago
FWIW, Google blatantly ignores the GDPR and continues to track all users from the European Economic Area unless they opt out. If you log out of Google, clear all Google cookies, and visit https://adssettings.google.com/anonymous https://adssettings.google.com/anonymous from the EEA, you'll find that "Ads Personalization on Google Search" is enabled by default and that the default state of "Ads Personalization Across the Web" is indiscernible.
- beberlei 8y ago
  It is not illegal to track users only if they opt out, by citing legitimate interest as the ground for processing not consent. That is how all privacy policy generators and lawyers handle google analytics, facebook pixel, even self hosted solutions like piwik/matomo. We will need to sit out what legimitate interests really mean, but at least in germany there are some state privacy agencies that put forth this approach where you allow to opt out.
  - BlackFly 8y ago
    While I think it may be easy to argue that use of Matomo is legitimate for the purposes of improving your service (and as a corollary, this can legitimately be outsourced), I think it is a stretch to conclude that it is legitimate for the third party to assemble a dossier of an individual by tracking them across multiple sites for which analytics are outsourced to the third party. This seems obvious since the third party is not going to expose details about the data subjects use of the other sites so it cannot be of legitimate interest to the primary controller. If they did share such data with the primary controller, the privacy violation is so egregious it cannot hope to pass a balancing test to be considered legitimate. So while something like piwik may be allowed to be opt out, I think google may be treading on thin ice.
    - beberlei 8y ago
      I agree, and Google is probably well aware that they tread on thin ice and they will probably fight their version of legimitate interst up to the European Court of Justice.

76 points by ilamont 8y ago

Iv 8y ago

Judging by the ripples it causes, it feels like GDPR is a well done piece of legislation that will actually destroy some of the most invasive business models. Google should tread carefully there. It is the future of their cash cow that is at hand. It is somehow comforting to see an elected body being able and willing to cause such a stir.

briandear 8y ago
Is the EU Commission an elected body? I thought they were appointed.
- oldcynic 8y ago
  Both the Council and Parliament had votes before adoption.
- deleted 8y ago
  [deleted]
- e12e 8y ago
  The commission is appointed and subject to the elected bodies; but afaik it can only propose legislation - it's the elected bodies that vote them into effect. The EU isn't particularly democratic or transparent - but it is nominally democratic. https://en.m.wikipedia.org/wiki/European_Commission#Legitimacy https://en.m.wikipedia.org/wiki/European_Commission#Legitima...
  - rndgermandude 8y ago
    The commission is appointed by the member state governments. Those governments in turn are elected. Commission members are therefore rather similar to regular cabinet members in member states which usually aren't directly elected by neither populus nor parliament, but chosen by the head of government. Personally, I think it would be better if the EU parliament chose the commission members. But it's not like the citizens of the EU had no say in who gets to be a commissioner at all: you can cast your vote differently in the next memberstate election if you don't like your government or the person it makes a commissioner.
    - ginko 8y ago
      At least Juncker was appointed president of the commission because his faction won the last EU parliamentary election.
    - jrnvs 8y ago
      Certainly not all EU Governments are elected. In The Netherlands, for example, you vote for Parliament. Parliamentary leaders then seek an agreement and propose a cabinet, which is formally instated by the King. When you cast your vote, you don't know who will be in government, nor do you have any say in it. I'm a proponent of this system, just wanted to point out that governments are not necessarily elected. I think the same holds in many other EU countries, e.g., Belgium and Germany.
      - rndgermandude 8y ago
        Uh, you may not be able to directly elect a government, but you still elect the parliament which then chooses the government. So yes, you have a say in it, by casting your vote in the parliamentary elections for the party you want to see in government. And yes regarding Germany: Germans vote for parties in a parliamentary election; in the parliament a party or coalition of parties who can get the necessary majority votes will elect the Chancellor (head of government), who then is formally appointed by the President. The Chancellor then proposes cabinet members who are formally appointed by the President.
    - makomk 8y ago
      At least here in the UK, cabinet members are generally chosen from amongst the elected MPs, and if they're particularly terrible voters sometimes give them the boot at the next election, ending their career.
    - Vinnl 8y ago
      Of course, those regular cabinet members are the ones that appoint the commissioners, so it is one step further away :)0
- deleted 8y ago
  [deleted]
yuhong 8y ago
I even mentioned the GDPR in the essay BTW.
- saagarjha 8y ago
  I'm sorry, but how is this relevant?
  - yuhong 8y ago
    I mentioned for example that "Notice that AdWords comply if all “personalization” features are removed for example. This included things like “remarketing”. I suspect that AdWords when it was first created in 2000 did not have these features. " and linked to https://pagefair.com/blog/2017/gdpr_risk_to_the_duopoly/ https://pagefair.com/blog/2017/gdpr_risk_to_the_duopoly/
Buge 8y ago
I don't think causing a stir should be a goal. Trump caused quite a stir with his early immigration policies.
piokoch 8y ago
Hmm, I thought that too. I assumed that all banks, cell phone operators, etc. that I use would have to ask me for consent to sell my data, track me. But that did not happen, they just send a note with all those GDPR information what they do with my data and that they have a good news for me: I don't have to do anything, as all my "agreements" are still valid without any action from my side. They haven't given me an option to give consent for, say, calling me, but don't give consent for tracking and profiling. Looks like this is ok, unless Orange got GDPR wrongly and wants to risk fines but I don't believe that. One of the biggest Polish news portal (wp dot pl) has figure out the fantastic idea - they show a banner with a long, long text, that says at the end that if I close that banner, clicking on X button, I am automatically give them permission to track me and do virtually whatever they want with my data. If I don't agree for their terms and I don't close the banner (which is agreement as well) I am taken to "advanced settings" page that at the end gives me only one option - to agree for tracking and all the shady stuff they want to do with my data. It is impossible to enter their portal without agreeing for everything they want. WP dot PL is a big business owned by a big German media company, so I guess they figured out everything correctly, apparently the regulation has a lot of loopholes and anyone with smart lawyers can overcome GDPR easily.
- Doxin 8y ago
  The "agree by closing this popup" tactic is, as far as I can tell, not allowed under GDPR. Here's hoping all the companies that do that get slapped with a fine.
  - Brotkrumen 8y ago
    This forever popup unless you accept should run afoul of the language in GDPR that forbids the degradation of a service if a user does not opt in.
  - jbrooksuk 8y ago
    Likewise "by continuing to browse this website, you agree" implied consent is no longer allowed.
  - zingmars 8y ago
gcp 8y ago
I wonder what the longer term consequences are. OK, sure it's nice that right now every site or company I ever had any interaction with no longer feels like they can keep my email on file to continuously spam me. But this state won't last right? I assume that everything I sign up for in the future will have a load of legalese to circumvent this as much as possible?
- scaryclam 8y ago
  One of the nice things about the legislation is that it's quite specific about not allowing consent to be buried in legalese. While I imagine things will soften up a little as companies realise they're not going to immediately get slapped with a fine, most companies will at least be more careful since its simple for complaints to be made. Most do not want to bring the ICO's attention to themselves.
  - gcp 8y ago
    Thing is if everything puts up a big notice "YOU MUST AGREE TO BE TRACKED AND SOLD TO USE OUR SERVICE" then people will just click that.
    - e12e 8y ago
      There's provisions to make sure mandatory tracking, profiling is explicitly opt-in, and that there's a real alternative. That might be a fee (eg Gmail could let you pay x/month to disable all targeted ads - or rather; they might have an opt-in gratis/free service that had ads/tracking).
      - icebraining 8y ago
        I don't think that's true; they can offer a paid version or a free version, but they can't offer a version "paid with tracking", even if there's an alternative.
    - krageon 8y ago
      That is coercive, and therefore does not comply (nor does it actually mean consent).
throwawayqdhd 8y ago
I wonder how many small businesses will be affected simply because every person right now has about 30 emails in their inboxes asking for GDPR permission I deleted most of them, even though ere might be a few businesses in there whose work I genuinely appreciate
- gcp 8y ago
  Mostly they won't be able to send mailings around. Data portability and such are likely a much bigger hassle. Those are actual features you need to implement now if you stored PII.
cultureulterior 8y ago
I would rather have Google than the GDPR or most elected bodies.
- ForHackernews 8y ago
  That opinion seems ill-considered, to say the least.
  - cultureulterior 8y ago
    The consumer surplus of search engines is like $17000 per year per person
    - theyinwhy 8y ago
      And you wouldn't see any of it if google was elected to govern you ;)
whataretensors 8y ago
These politicians created a new 'right' and exempted the government from it. This is bound to end well.
- icebraining 8y ago
  The government is not exempted from the GDPR, as it wasn't from the Data Protection Directive that already granted most of the rights contained in the new regulation.
  - whataretensors 8y ago
    Of course they are, read (16) "This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as activities concerning national security. This Regulation does not apply to the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union. " I understand the confusion, as finding this involves reading the 88 pages you are defending.
    - icebraining 8y ago
      I did read the GDPR. A specific exemption for national defense (and by the way, you missed the one on health) is not the same as "exempting the government". The vast majority of governmental bodies have to comply. It's like saying that "governmental employees are allowed to pilot fighter jets" just because the army employs some pilots.
some_account 8y ago
I'm surprised it had some teeth. This shows that it's possible to change some very exploitable practices if EU wants to. Hopefully more of this will follow.

yuhong 8y ago

It is unfortunate that my essay didn't get much attention: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozilla-essay-final.html http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...

ryanobjc 8y ago
I'm sorry but your essay didn't get much attention because it is not particularly written well. I'm not really sure what you are arguing here, except that Google is bad maybe? You aren't clearly arguing an specific thesis, and there are many non sequitur paragraphs that don't flow. Why are you talking about OpenJDK in an essay about Google Adsense? Or is the essay about Doubleclick BMP? If the point of this essay is to provide an overview of the area, I am not sure you are well educated in this area. For example, most of doubleclick publishers dont do retargeted ads. They tend to do BMP only. You didn't mention programmatic at all. You don't talk about ad networks. Also you don't mention that Google has done a lot in the area of malware both on the web in general, and specifically has spent a lot of resources in getting malware off the ad network. This makes you seem disingenuous, because while Google isn't a fully "neutral" actor, they are overall a good citizen in the ad space. Ad targeting isn't inherently evil, a lot of ad targeting is geographically based -- in fact many people would probably argue that showing geographically inappropriate ads is even worse -- others are consumer segment (eg: women/men/age). I would like to have a non-advertisement internet, but it appears that people are just unwilling to do so. Also we may be facing very real cognitive limits, studies on microtransaction fatigue have demonstrated that is not likely to be a successful mechanism for funding webpages -- people just can't make that many monetary decisions every day.
- yuhong 8y ago
  There are other known problems with the essay as well. For example, I mentioned storage costs but it turned out to be more complex than that. The point is not only to provide an overview though but more importantly to trace back the problems to Larry/Sergey, which is why it is so important. And yes I focus on ad tracking using cookies and nothing else. When I was writing the essay BTW, even tracing back when they began sharing the retargeting data took some time.

ysleepy 8y ago

And here I entertained the thought that for Google the legislation was a form of regulatory capture.

gcp 8y ago
It would seem that having to be GDPR compliant would dis-proportionally favor large companies with a lot of lawyers and engineers to implement the needed features company-wide. If this is not working out for Google, perhaps it's because the business is fundamentally incompatible? But I have problems believing that. The outcome would be too good :-)
- yulaow 8y ago
  Honestly I think it favors more companies who just didn't do any shadow things with user data or just had not a business model built around it. If you were not one of those and maybe were already respecting the old eu privacy directive, being gdpr compliant is extremly easy and fast
- Maarten88 8y ago
  > perhaps it's because the business is fundamentally incompatible? After having read most of the GDPR, that's my conclusion: all advertising other than 1990's style bannering now needs per publisher, per user, opt-in for anything that does tracking or is personalized, where the default should be set to 'no', denying should be as easy as consenting, and refusing access is not a valid publisher response. That means i.m.o. that using any form of modern advertising has become illegal under GDPR, unless you get users to consent in a compliant way, and I have seen just a few sites even try. I think Google is scrambling to understand that their business is now mostly illegal in EU.
  - Vinnl 8y ago
    I don't think that would mean that Google's business is fundamentally incompatible. If 90's-style bannering is the only thing that is allowed/feasible now, of all companies Google is in the best position to do that profitably.

nwellnhof 8y ago

FWIW, Google blatantly ignores the GDPR and continues to track all users from the European Economic Area unless they opt out. If you log out of Google, clear all Google cookies, and visit https://adssettings.google.com/anonymous https://adssettings.google.com/anonymous from the EEA, you'll find that "Ads Personalization on Google Search" is enabled by default and that the default state of "Ads Personalization Across the Web" is indiscernible.

beberlei 8y ago
It is not illegal to track users only if they opt out, by citing legitimate interest as the ground for processing not consent. That is how all privacy policy generators and lawyers handle google analytics, facebook pixel, even self hosted solutions like piwik/matomo. We will need to sit out what legimitate interests really mean, but at least in germany there are some state privacy agencies that put forth this approach where you allow to opt out.
- BlackFly 8y ago
  While I think it may be easy to argue that use of Matomo is legitimate for the purposes of improving your service (and as a corollary, this can legitimately be outsourced), I think it is a stretch to conclude that it is legitimate for the third party to assemble a dossier of an individual by tracking them across multiple sites for which analytics are outsourced to the third party. This seems obvious since the third party is not going to expose details about the data subjects use of the other sites so it cannot be of legitimate interest to the primary controller. If they did share such data with the primary controller, the privacy violation is so egregious it cannot hope to pass a balancing test to be considered legitimate. So while something like piwik may be allowed to be opt out, I think google may be treading on thin ice.
  - beberlei 8y ago
    I agree, and Google is probably well aware that they tread on thin ice and they will probably fight their version of legimitate interst up to the European Court of Justice.