35 ms·

"Whoops, we can't secretly sell your data anymore! That means you can't control your smart wifi lightbulbs from now on!" For me, this is a refutation of the "I

by Drakim 8y ago

"Whoops, we can't secretly sell your data anymore! That means you can't control your smart wifi lightbulbs from now on!" For me, this is a refutation of the "If you don't pay for the product, you are the product." There is no inherent reason why a company would only do that for a free product. If it works for free products, it works just the same for paid products. Even if GDPR has flaws, and is gonna cause some disruption, I think we really needed something like this.

matte_black 8y ago
You are not the product. Exposure to you is the product.
- some_account 8y ago
  No its not just showing you ads. Its selling any information they have on you to ad networks without you knowing about it.
  - matte_black 8y ago
    ...so that you can be shown more ads.
    - class4behavior 8y ago
      ...which is made possible by both directly and indirectly collecting, evaluating, sharing or trading, and concatenating data about you.
      - matte_black 8y ago
        ...just so you can block and ignore the ads, all the same.
        class4behavior 8y ago
        You're conflating control over personal data with one of the purposes for doing so, i.e., the presentation of ads. That is by far not what privacy or data protection is limited to. Not to mention that blocking or hiding ads or trackers is not the same as preventing the collection of personal information. Unless you avoid visiting a service entirely, depending on the implementation you may not be able to inhibit any of it.
bo1024 8y ago
I think you've confused "if" with "if and only if"
- Drakim 8y ago
  The implication is clearly that you ought to pay for the products, so that you aren't the product. But if the incentives for paid and free products to monetize your data is the same, switching from one to the other doesn't help. You have to specifically seek out products where your privacy and data is taken seriously. This can happen for both free (open source?) and paid products.
  - bo1024 8y ago
    I agree, that's a good point.
  - adrianmonk 8y ago
    I think it's true in a weak sense. If the customer is paying, that is one revenue source. If you sell data, that's a second revenue source. Adding the second revenue source might be worth it since it can increase profit. But it also adds business risk. Your customer might jump to a competitor that charges money but doesn't sell your data. Of course, that assumes competition is effective, which requires consumers to be informed that it's even a potential issue, to care, and to be able to assess which company is better or worse.
eli 8y ago
For sure, GDPR is causing headaches for companies that were secretly selling your data. But it's also a big problem for companies that were (perhaps sloppily) logging & storing data for their own reasons or maybe even for no real reason. I think the latter is much more common than the former.
- ghaff 8y ago
  A lot of smaller sites don't necessarily know everything that they're collecting. Arguably, this is a good opportunity to figure that out. However, it's equally arguable that in many cases it's just easier to cut off EU access if there's any doubt and the EU just isn't important to their business (or hobby). If I ran a US centric ecommerce site, for example, I'd be very tempted to just stop selling in the EU for now.
  - enginaar 8y ago
    What if EU citizens who are visiting US make purchases from your site?
    - ghaff 8y ago
      Almost certainly does not apply. [1] For that matter, the same FAQ suggests that it's probably not necessary to block IP addresses if you're not located in the EU and aren't actively marketing to EU residents. But I can certainly understand small companies taking a better safe than sorry approach if they don't do material EU business. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/
      - merinowool 8y ago
        It wouldn't apply if you explicitly ask user if he/she is an EU resident, preferably by checking ID and route to /dev/null if user is.
    - merinowool 8y ago
      It does apply. All EU residents are covered regardless where they are.
Silhouette 8y ago
That one's more interesting because under the new regime, consent means meaningful, genuine consent. Demanding consent for one purpose in return for providing something important but unrelated is one of the big no-nos.
HelloNurse 8y ago
Even if you pay for the product, you are the product.

by Drakim 8y ago

matte_black 8y ago

You are not the product. Exposure to you is the product.

some_account 8y ago
No its not just showing you ads. Its selling any information they have on you to ad networks without you knowing about it.
- matte_black 8y ago
  ...so that you can be shown more ads.
  - class4behavior 8y ago
    ...which is made possible by both directly and indirectly collecting, evaluating, sharing or trading, and concatenating data about you.
    - matte_black 8y ago
      ...just so you can block and ignore the ads, all the same.
      - class4behavior 8y ago
        You're conflating control over personal data with one of the purposes for doing so, i.e., the presentation of ads. That is by far not what privacy or data protection is limited to. Not to mention that blocking or hiding ads or trackers is not the same as preventing the collection of personal information. Unless you avoid visiting a service entirely, depending on the implementation you may not be able to inhibit any of it.

bo1024 8y ago

I think you've confused "if" with "if and only if"

Drakim 8y ago
The implication is clearly that you ought to pay for the products, so that you aren't the product. But if the incentives for paid and free products to monetize your data is the same, switching from one to the other doesn't help. You have to specifically seek out products where your privacy and data is taken seriously. This can happen for both free (open source?) and paid products.
- bo1024 8y ago
  I agree, that's a good point.
- adrianmonk 8y ago
  I think it's true in a weak sense. If the customer is paying, that is one revenue source. If you sell data, that's a second revenue source. Adding the second revenue source might be worth it since it can increase profit. But it also adds business risk. Your customer might jump to a competitor that charges money but doesn't sell your data. Of course, that assumes competition is effective, which requires consumers to be informed that it's even a potential issue, to care, and to be able to assess which company is better or worse.

eli 8y ago

For sure, GDPR is causing headaches for companies that were secretly selling your data. But it's also a big problem for companies that were (perhaps sloppily) logging & storing data for their own reasons or maybe even for no real reason. I think the latter is much more common than the former.

ghaff 8y ago
A lot of smaller sites don't necessarily know everything that they're collecting. Arguably, this is a good opportunity to figure that out. However, it's equally arguable that in many cases it's just easier to cut off EU access if there's any doubt and the EU just isn't important to their business (or hobby). If I ran a US centric ecommerce site, for example, I'd be very tempted to just stop selling in the EU for now.
- enginaar 8y ago
  What if EU citizens who are visiting US make purchases from your site?
  - ghaff 8y ago
    Almost certainly does not apply. [1] For that matter, the same FAQ suggests that it's probably not necessary to block IP addresses if you're not located in the EU and aren't actively marketing to EU residents. But I can certainly understand small companies taking a better safe than sorry approach if they don't do material EU business. [1] https://www.gdpreu.org/the-regulation/who-must-comply/ https://www.gdpreu.org/the-regulation/who-must-comply/
    - merinowool 8y ago
      It wouldn't apply if you explicitly ask user if he/she is an EU resident, preferably by checking ID and route to /dev/null if user is.
  - merinowool 8y ago
    It does apply. All EU residents are covered regardless where they are.

Silhouette 8y ago

That one's more interesting because under the new regime, consent means meaningful, genuine consent. Demanding consent for one purpose in return for providing something important but unrelated is one of the big no-nos.

HelloNurse 8y ago

Even if you pay for the product, you are the product.