14 ms·

Google and Facebook accused of breaking GDPR laws

329 points by nemoniac 8y ago

testplzignore 8y ago
This is the crux of the problems with how companies are interpreting the GDPR. Every service I've seen with a privacy policy pop up within the last 24 hours has basically justified all of their current data collecting practices as being necessary for their business. The spirit of the GDPR is to improve privacy, not just make Terms of Service pages longer.
- tomrod 8y ago
  Yeah, but the law of unintended consequences is sure to apply. The GDPR hits adtech companies fundamentally.
  - Certhas 8y ago
    This is not "unintended consequences", it is explicitly anticipated by the law. Which is why people can and are suing. We'll see how it shakes out in the courts.
    - tomrod 8y ago
      The law explicitly said "within hours of taking effect, these specific companies are to be sued due to not preparing sufficiently for GDPR"?
      - tzahola 8y ago
        “Within hours” You mean “within the 2 years probation period + a few hours”
        peteretep 8y ago
        GDPR has been law for two years, since 25 May 2016, a point your downvoters seem to be missing.
        NullPrefix 8y ago
        Yeah, that may be true, but it doesn't matter. Nobody was talking about it back then. /s
        tzahola 8y ago
        Let them downvote. I’d be downvoting left and right too, if those pesky EU bureaucrats had ruined my moneymaking scamvertising scheme.
      - salvar 8y ago
        What a refreshingly honest question.
        tomrod 8y ago
        I know it seems like a stupid question, but I wanted to make sure I understood the parent commenter's point.
      - pjc50 8y ago
        The law is explicitly aimed at direct marketing. It's mentioned in the text: (article 21) "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. 3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." (also I think "In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications." means that suddenly people are required to respect Do Not Track, which will be .. entertaining) All laws enable action to be taken against people who are not following them at the time they come into effect. That's what "coming into effect" means.
        tomrod 8y ago
        Fair. I appreciate the input.
    - craigsmansion 8y ago
      People are not "suing," they're filing complaints. It's a small but important difference, since a lot of the uncertainty and doubt around the GDPR seems to revolve around being sued out of existence in courts of law, which is not a thing: you can't get sued randomly by disgruntled users.
      - Certhas 8y ago
        You are absolutely right, sorry for the imprecise/misleading language.
    - henrikschroder 8y ago
      They're not being sued, and it's not a case for the courts. They're being reported to the Data Protection Agencies in various EU countries.
      - akie 8y ago
        Yes, but that's the first step to being sued.
        henrikschroder 8y ago
        No, if a company gets reported, the DPA is supposed to investigate, and help the company get compliant if it finds that it isn't. If the company is willfully refusing to become compliant, the DPA can slap the company with a proportional fine to make non-compliance more expensive than complying. And if the company is fined, the company can probably sue the DPA in question if they think the fine was unreasonable or unapplicable or no good very bad and unfair.
        frockington 8y ago
        Does the DPA also get to choose who is making a strong effort and who isn't. Reporters can probably start pre-typing the corruption scandal articles.
  - jonathanstrange 8y ago
    > The GDPR hits adtech companies fundamentally. Hopefully...
    - Ygg2 8y ago
      I'm not holding my breath. To paraphrase Jurassic Park "Money finds a way".
- sleepyhead 8y ago
  Actually the spirit of GDPR is also to make Terms of Service shorter by being clear and understandable. If you as a user is unable to understand what you are agreeing to then it is a violation of GDPR.
  - mirko22 8y ago
    > unable to understand What if he is not very smart? Or even better, what if he is very dumb? At which level should those be written then?
    - contravariant 8y ago
      The literal text of the GDPR is as follows: >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language
      - mirko22 8y ago
        Yes, and before that it says ` If the data subject's consent is given in the context of a written declaration which also concerns other matters,` which means i can use legalese but only if it does not concern other matters in the same document? :)
        contravariant 8y ago
        You'd hope not, but I also thought the phrasing in that sentence was sloppy.
        mirko22 8y ago
        that’s the whole issue with the regulation unfortunately :(
  - sontek 8y ago
    Our policies got much longer with GDPR. We only collect information for legitimate reasons (i.e we need it for the service they are using), we ask for it, and we never target it / sell the data. It helps that our customers are paying customers and not using a free service. So our TOS used to be quite simple in plain english that all the data we request is only for the purpose of providing the service. Now we had to outline all the information we collection (even though they are the ones who provide it, so they know what we collect) and outline all our services we use where that data we collect ends up (AWS, Sentry, Loggly, etc... the services we need to run our system and support them). Most of our clients have no idea what any of the information we added is because its all technical details about how we are providing the service to them. GDPR required us to do a lot of work that ended up costing us time and money and literally nothing changed because we were already making sure we protected our users privacy. Hopefully some bad actors get hit but for now GDPR has left a bad impression on me.
- jacquesm 8y ago
  Twitter got it right.
AndyMcConachie 8y ago
I'm gonna need more popcorn :)
yostrovs 8y ago
Considering that large sites with teams of lawyers are failing to follow the rules, how does a small site run by a few regular folks supposed to comply?
- seba_dos1 8y ago
  "large sites with business models developed around shady stuff GDPR is supposed to protect from" - there, FIFY.
- notahacker 8y ago
  their business model probably isn't selling user data
- quohM0Ho 8y ago
  The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.
  - VMG 8y ago
    or anyone who has a public httpd with default log settings
    - dboreham 8y ago
      Default logging settings retain log files forever?
      - VMG 8y ago
        I don't know how long you are allowed to store PII under GDPR (I'm not a lawyer) This article indicates that default settings are problematic: https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs > All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website).
deleted 8y ago
[deleted]
ckastner 8y ago
> "The GDPR explicitly allows any data processing that is strictly necessary for the service - but using the data additionally for advertisement or to sell it on needs the users' free opt-in consent" This is the key point. As the saying goes, on Facebook, you aren't the customer, you are the product. The GDPR just changed this -- rightfully, in my opinion.
- zerostar07 8y ago
  yeah but now the product is not free.
  - tazjin 8y ago
    It'd be great if companies offered a "buy back your privacy" subscription model. For the services I really don't want to stop using (Twitter ...) I'd definitely be using that.
    - gaius 8y ago
      They would take your money and track you anyway, and everyone knows it
      - tazjin 8y ago
        And be fined into oblivion.
        amelius 8y ago
        How would anyone find out, and provide proof for this? Can we expect a EU government agency to validate companies on a regular basis? And if not, would they even cooperate with white-hat hackers to find offenders? Also, from what I read, data protection agencies have been understaffed and overworked for years now.
        pjc50 8y ago
narrator 8y ago
I am trying to think what the secondary consequences of GDPR are going to be. If any user can see their data on any service than any government can quickly plug-in to access all user data on any service. This is like NSA Prism for everything. If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete. Account takeovers by hackers will lead to much more severe data breaches, since all data on that user in the system is easily accessible. The information apocalypse is made all that more easy because acount takeover + deep fakes + lyrebird plus all that easily accessible juicy data = impersonate anyone. Data renting will create a way to monetize account takeover. The account takeover will include all possible information used to identify a person so how are the data brokers supposed to know it isn't you and how are you supposed to get your data back once it's out there getting monetized?
- camillomiller 8y ago
  The option to monetize your own data is an amazing idea: a startup that pays you to upload the data you can download from your google, apple, facebook, BIGNAME account, basically renting it daily until you revoke consent, then uses it to do all sort of shit you can with it. You’ll get hypeprofiled and harassed with all sorts of advertising, but you’re actually getting real money for that.
  - gregknicholson 8y ago
    When “you are the product”, you can sell that product.
    - zerostar07 8y ago
      you would have to find a market for them first. realistically private data is useless outside of a marketing platform like google or facebook. Maybe you can fill up some forms or polls for a few cents, that's it.
  - scrollaway 8y ago
Oras 8y ago
It's about time to see no-win no-fee services to file a complaint against companies for GDPR breach. How long will it take?
- GuB-42 8y ago
  It is not how it works in Europe. No-win no-fee is a typical American thing. We don't have class actions either. It doesn't mean it won't happen, but that would be unusual.
  - chopin 8y ago
    That's not exactly true. There are services which take your cases for delayed or canceled flights for keeping a percentage of the redeemed money. It must be said that carriers brought that to themselves by stonewalling customers despite pretty clear laws. But this is rather an exemption. Personally I would love to see similar services for GDPR. However the structuring of the law makes this unlikely, I believe.
- xxs 8y ago
  The proceeding would be undertaken by the state and the companies might be fined.
  - ptaipale 8y ago
    All in all, GDPR reminds me of how legislation and regulation was constructed in USSR and now in Russia. The rules are such that it is practically impossibly to comply; it is then left to the powers-that-be to decide which ones of those in breach are investigated and prosecuted. It's the perfect setup for arbitrary and selective application of justice system to attack political opponents, dissidents etc.
    - mirko22 8y ago
      Exactly how politicians like it
    - 8y ago
camillomiller 8y ago
If this is what Online Marketing Hell looks like, please tell me where one can apply for a job as Junior Devil
lordlarm 8y ago
The 'loophole' here would be the definition of 'legitimate intrests', where businesses can defend not giving users a choice in many of these matters due to the activity being critical for the service to work or the business to survive. I.e. Facebook _could_ argue that users would have to have their data collected and analysed, as this would enable them to sell ads which in turn is their core interest. Another example could be automatic enrollment into newsletters or data collection/analyzation with the option to opt-out by going to settings. You don't _have_ to give users the explicit consent checkbox during signup if you can defend the activity by it being in your legitimate interests. This article goes into more detail: https://medium.com/mydata/five-loopholes-in-the-gdpr-367443c4248b https://medium.com/mydata/five-loopholes-in-the-gdpr-367443c...
- tazjin 8y ago
  Somebody on Reddit posted a list of Tumblr's "partners" that they share data with by default: https://i.imgur.com/YCNvEMa.png https://i.imgur.com/YCNvEMa.png I'm finding it difficult to believe that they can come up with a "legitimate interest" for all of those that would also actually hold up in court.
  - BonesJustice 8y ago
    Good lord. I’m glad we’re finally getting the chance to see just how pervasive this problem is.
  - dmitriid 8y ago
    Twitter’s “partners” are the same (you can request a list from your privacy settings)
    - chopin 8y ago
      Google's as well.
  - eli 8y ago
    I think those are just the members of the new IAB consent framework. This is how programmatic ads work, you "partner" with a bunch of ad networks and serve an ad from whichever is paying the most at that moment.
mikekchar 8y ago
My big problem with this is that the complaints are too quick (unless Google, Facebook, et al are stupid, which I don't think they are). First you have to make a request to see what they are using the data for. Then you can complain that it is being used for the wrong things. Unless the aforementioned companies are blatantly saying "We're sharing your data for targeted advertising without consent", then I think we have to wait a month for real complaints.
- TallGuyShort 8y ago
  Isn't the tracking a claim they make to advertisers, and can I opt out without declining the entire ToS?
  - mikekchar 8y ago
    Edit: Just to be clear. I'm not in the EU, so I can't check the ToS. If they are being stupid, then that's pretty stupid of them ;-) The thing is, it is possible that as of today they have stopped tracking. I agree that it's very unlikely, but unless they actually tell you that they are tracking you, how would you know? You get ads, but they could be completely random. Who knows? As of today, maybe all EU residents are getting random ads? Until you make a request, I think you can't quite complain (again, unless they are stupid and actually telling that they are tracking you).
    - olivierduval 8y ago
      FYI: GDPR provide a framework allowing investigations from the EU... So the EU might ask to get enough informations on algorithms - and even to audit code - to check if there's some hidden targeting ads. And then...
- draw_down 8y ago
  I can’t inagine anyone being surprised by this. It was explicitly said the deadline of yesterday (or today, I forget) represented the end of the grace period, which lasted the last two years. If laws don’t have effects then what are they good for? Companies are going to get in trouble and get fined because of this law, that means it’s working.
enedil 8y ago
It was expected that activist groups will say that these two companies are breaking GDPR, it is not so obvious that they will be actually fined (as the requests need to be processed by specific institution and might be found unwarranted).
lloydsparkes 8y ago
I am reading through the complaints, The first one: https://noyb.eu/wp-content/uploads/2018/05/complaint-android.pdf https://noyb.eu/wp-content/uploads/2018/05/complaint-android... The User sets up a "new" (non Google) phone, and isn't given an option to decline consent to Googles ToS. Now how does this work with a physical product? It needs to be compliant on the 25th of May 2018, but the version of Android may be old and not updated (given its Android). Even if there was an update waiting to resolve GDPR related issues, you would need to agree to the ToS to get that update, to enable opt-out? In that point of view, it seems a rather unfair complaint. I havn't checked the other's yet, but I start to feel that perhaps these have been filed too early, without enough thought and examination, just to get headlines?
- neffy 8y ago
  Companies have had two years to get their act sorted out on this.
  - itake 8y ago
    I can still purchase a "new" 2 year old phone. I think that is a valid question.
    - sveme 8y ago
      Aren‘t the ToS pulled from the web when you set it up with a google account? I doubt you‘re agreeing to two year old ToS.
      - ldjb 8y ago
        Possibly, but it still might not be possible for Google to provide a means to decline the ToS without issuing an update (which, as has been pointed out, wouldn't be possible to install anyway without accepting the ToS).
        madez 8y ago
        Then it's a device that does not comply the regulation and must not be sold.
GordonS 8y ago
> forcing people to accept wide-ranging data collection in exchange for using a service is prohibited under GDPR Erm... I don't think that's true. As long as you are open and transparent about what you are doing, and give users the right to request, update and delete the data you hold on them, then AFAIK this is allowed
- martin_bech 8y ago
  Nope thats actually true. You cant force say tracking, if its not absolutely needed, for the product to work. And i think thats why a lot of the popups have dark patterns, to hide the fact, that you can no opt out to these things.
  - GordonS 8y ago
    Hmm, seems you are right, I just found this PDF from the ICO: https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf https://ico.org.uk/media/about-the-ico/consultations/2013551... "Avoid making consent a precondition of a service" "consent requests must be separate from other terms and conditions. Consent should not be a precondition of signing up to a service unless necessary for that service" I assume Facebook et al will simply find a way to make everything 'necessary'.
    - martin_bech 8y ago
      They have, and thats why they are going to be sued.. they made tracking a precondition for using the service.
    - mjewtoo 8y ago
      For consent this is true, but there are other legal ways for you to collect the data. One is legitimate interest, this one is more abstract but requires a bit more work from you. I think a lot of the future court cases will be around trying what one can use legitimate interest for. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
brianmcc 8y ago
Targeted advertising has become such a big deal, and implemented at such high cost, that I wonder if the trade off is even worth it now. I could imagine Apple or Samsung simply "sponsoring" Facebook for a week or month at a time with banners and messaging - tastefully done of course! - and how much less hassle that would all be, rather than aggregating millions upon millions of cookies and chasing people around the internet, winding them up, etc. Targeting ads for anonymous searches, fine: search for cars, see car adverts. Simple! I'm sure there is plenty of data that shows how terrible this whole idea is in terms of wasted ad spend, missed opportunities, so it'll never happen, but it's a nice dream :-)
- SmellyGeekBoy 8y ago
  If this were the case I'd genuinely turn off my adblocker.
  - brianmcc 8y ago
    I possibly would too; I wouldn't begrudge the more innocent revenue generation tbh, provided ads were sufficiently unobjectionable!
- dangerface 8y ago
  Targeted advertising has always seemed pretty dumb, to me most advertising is done by Coke and their target is every where.
  - brianmcc 8y ago
    Exactly - traditional advertising has long been about product and brand awareness and giving people the warm fuzzies about their logos, slogans, imagery etc. Treat online as exactly that with clickthroughs as a bonus!
  - kinsomo 8y ago
    > Targeted advertising has always seemed pretty dumb, to me most advertising is done by Coke and their target is every where. Doc Searls made a good point: targeted advertising isn't advertising, it's really direct marketing (like spam and junk mail). Coke is doing advertising, but the adtech "targeted" advertisers are just spamming you using new technology. https://blogs.harvard.edu/doc/2018/05/12/gdpr/comment-page-1/ https://blogs.harvard.edu/doc/2018/05/12/gdpr/comment-page-1...
kisstheblade 8y ago
Absoultely every site that has had a new GDPR warning is just the same as the old cookie banner. "By using the site you agree..." Some have updated privacy pages which describes how you can delete or deny cookies... An absolute joke, nobody is following the law. It should be simple. A new banner that asks "allow tracking", yes, no. Either option allows you to use the site freely.
whyagaindavid 8y ago
Are they also planning to sue Apple? I can get it activated without creating account.
amelius 8y ago
Aside, I've found an interesting thread on GDPR in Mastodon (an open-source "Facebook competitor") here: https://github.com/tootsuite/mastodon/issues/7280 https://github.com/tootsuite/mastodon/issues/7280
MarkMc 8y ago
I think Facebook's lawyers have determined that they can use the 'legitimate interest' basis for showing targeted ads to their users [0]. This basis does not require consent from users except as part of the take-it-or-leave-it initial terms of service. Here are the parts of the 'legitimate interest' basis which are most useful to Facebook: The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business. So Facebook's lawyers can simply say, "It's in our legitimate interest to maximise advertising revenue". You need to demonstrate that the processing is necessary for the purposes of the legitimate interests you have identified. This doesn’t mean that it has to be absolutely essential, but it must be a targeted and proportionate way of achieving your purpose. Facebook's lawyers can say, "It is necessary for us to use personal information about our users, such as their age and location, in order to maximise our advertising revenue". The GDPR is clear that the interests of the individual could in particular override your legitimate interests if you intend to process personal data in ways the individual does not reasonably expect. Facebook's lawyers can say, "People expect that we use their personal information such as age and location to determine what ads to show them, so the interest of the user does not override our legitimate interest of maximising advertising revenue." [0] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-the-general-da...
- lovich 8y ago
  If companies successfully argue that maximising revenue is a legitimate interest and thus, don't need users consent, then the GPDR will worth less the paper it was written on. I would be extremely surprised if the EU goes through all this tome, effort, and money just to let corporations continue with business as usual
  - merb 8y ago
    > I would be extremely surprised if the EU goes through all this tome, effort, and money just to let corporations continue with business as usual trust me, you didn't see what the eu already gone through, just to keep existing.
whyagaindavid 8y ago
Serious question: How is this compatible with new GDPR? https://apple.stackexchange.com/questions/144551/how-to-delete-my-account-on-icloud-com?rq=1 https://apple.stackexchange.com/questions/144551/how-to-dele...
zzzcpan 8y ago
It appears many companies try not to comply to the spirit of the law. Stack Overflow, for example, sent an e-mail claiming to have opt-in permissions to promotional messages, while not actually having them and only providing opt-out settings: "With your continued permission, we will send you promotional messages based on your preferences. To see and change your opt-in preferences, manage your Email Settings." I guess with such attitudes it's not going to be enforced much, otherwise there will be no one left to enforce it on.
kerng 8y ago
Solution: Pay a few bucks a year or see ads. What's so difficult about that? That could solve the problem somewhat at least...
- zerostar07 8y ago
  for europe it would be around $20 i believe.
oblio 8y ago
Oh, one thing important to note that people might forget/ignore: this is just the beginning. See: https://en.wikipedia.org/wiki/Brussels_effect https://en.wikipedia.org/wiki/Brussels_effect A lot of countries look up to the EU, have trade agreements with it. Unless the GDPR totally falls flat on its face (unlikely), more and more countries will realize the benefits of this kind of legislation. Also the GDPR will act as an icebreaker and it will "soften up" company stance on this matter. As a result it will be easier for the second line of countries adopting such laws to demand things from companies. I'd say: get used to it. It's not going away, it's not going to become easier to use and sell personal data.
- ocdtrekkie 8y ago
  The Facebook/Cambridge Analytica thing definitely seemed to open up more US legislators to the idea. Between the EU taking the lead on antitrust against tech monopolies, and now privacy laws, it honestly makes them look bad: The EU is doing the job most people would've expected the US to take the lead on back in the day. As GDPR will not end the world or pop the tech bubble or whatever, it's increasingly likely that the US will just go "yeah, we want all that too".
stevespang 8y ago
The EU is eager to "clean the clocks" of these big liberal, privacy destroying California based megaliths. Go Max go.
csomar 8y ago
And here I'm hoping for the EU GDPR to kick all of these guys in the balls pretty hard. In the last few hours, I have been getting dozens of emails. Basically: Take it or leave. Some of them sent an email "if you don't leave, you are taking it". And you are not given a choice to download your data or temporarily access your account to sort out things. Your hands are getting forced to accept the rules or potentially be locked out of your account. I'm taking note of these little evil services. And in all fairness, my banking provider actually gave two options: one is required and the other is optional (marketing data collection). I was able to unselect it successfully.
troybanks 8y ago
I used Hope Fulwood to confirm the infidelity of my ex-wife and i am forever grateful to him. He helped my hack her phone which he held so dearly and i found out-numerous dating sites she was registered to, her emails, all her social network apps and even text messages. I was heartbroken but its better to know and act upon your knowledge than being played a fool. i will recommend Hope Fulwood and you can contact him via email... GMAIL: trusthackerslounge2018 WEBSITE: https://trusthackerslounge.wixsite.com/mysite https://trusthackerslounge.wixsite.com/mysite
cromwellian 8y ago
There seems to be a fundamental dichotomy on HN that is either intellectually dishonest, or the result of hyperbolic reasoning. Everyone accepts that services have costs, and so someone has to pay for them. They're either paid for by user fees, paid for by ads, or paid for by charity (e.g. Wikipedia) Every time a publisher converts to user fees (paywall), people react angrily. Yet, people complain loudly over ads too, and others complain loudly over ad tracking. Now, there's not necessarily overlap between these groups, but there must be some. So either people want to get away with paying nothing (one form of dishonestly), or they are virtue signaling over things they don't care as strongly about as they say (another form of dishonesty), or they are mad at something else. I think it's a mix of both. Many people will say they care a lot of privacy and security, but behave in ways that show they really don't. From poor operational security, to bad passwords, to continuing business with firms that have already been hacked and exposed their personal information. A lot of people complain also loudly over what they imagine is serious harm being done to them by ad tracking, but I would bet they are more annoyed by ads themselves, than by the theoretical and abstract (if distant background threat) of their info being harvested for harm. Because human being's reward system in their brain favors minimizing immediate pain. Ads, whether targeted or not, are an annoyance, just like paywall dialogs, and people would rather see neither. I think this is the real nitty gritty, people unwilling to put up with the monetary cost of services, the hassle of signing up and paying, the performance detriments of ads, or the annoyance of having their attention interrupted by them and this is far and above the concerns over privacy. No doubt, many people will say no, I'm wrong, they truly care extremely strongly about data mining, but I think the people who care that strongly as a small minority like the people who are rabid anti-vaxxers, or anti-GMO, hyperbolic fears of tiny risks, not shared by the mainstream.
mdekkers 8y ago
Where do I sign up? I was forced today to accept Facebook's new settings and I was presented with an option to either allow facebook to process my data for face recognition or not. Choosing not does not allow you to move forward in the settings, and it is deeply confusing - there is an "accept and continue" button, but there is some rather small text that states choosing accept and continue will enable face recognition. Closing the browser and reopening it at this point shows the same text, and only the option to accept and continue. Doing so and then checking settings will show face recognition to be disabled, but I am no longer sure what I accepted and continued with. The whole scheme is scammy as anything. The text presented is something along the lines of "disabling this feature will allow other people to impersonate you" which at best is nasty fear mongering. Fuck those assholes.

329 points by nemoniac 8y ago

This is the crux of the problems with how companies are interpreting the GDPR. Every service I've seen with a privacy policy pop up within the last 24 hours has basically justified all of their current data collecting practices as being necessary for their business. The spirit of the GDPR is to improve privacy, not just make Terms of Service pages longer.

tomrod 8y ago
Yeah, but the law of unintended consequences is sure to apply. The GDPR hits adtech companies fundamentally.
- Certhas 8y ago
  This is not "unintended consequences", it is explicitly anticipated by the law. Which is why people can and are suing. We'll see how it shakes out in the courts.
  - tomrod 8y ago
    The law explicitly said "within hours of taking effect, these specific companies are to be sued due to not preparing sufficiently for GDPR"?
    - tzahola 8y ago
      “Within hours” You mean “within the 2 years probation period + a few hours”
      - peteretep 8y ago
        GDPR has been law for two years, since 25 May 2016, a point your downvoters seem to be missing.
        NullPrefix 8y ago
        Yeah, that may be true, but it doesn't matter. Nobody was talking about it back then. /s
        tzahola 8y ago
        Let them downvote. I’d be downvoting left and right too, if those pesky EU bureaucrats had ruined my moneymaking scamvertising scheme.
    - salvar 8y ago
      What a refreshingly honest question.
      - tomrod 8y ago
        I know it seems like a stupid question, but I wanted to make sure I understood the parent commenter's point.
    - pjc50 8y ago
      The law is explicitly aimed at direct marketing. It's mentioned in the text: (article 21) "Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. 3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes." (also I think "In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications." means that suddenly people are required to respect Do Not Track, which will be .. entertaining) All laws enable action to be taken against people who are not following them at the time they come into effect. That's what "coming into effect" means.
      - tomrod 8y ago
        Fair. I appreciate the input.
  - craigsmansion 8y ago
    People are not "suing," they're filing complaints. It's a small but important difference, since a lot of the uncertainty and doubt around the GDPR seems to revolve around being sued out of existence in courts of law, which is not a thing: you can't get sued randomly by disgruntled users.
    - Certhas 8y ago
      You are absolutely right, sorry for the imprecise/misleading language.
  - henrikschroder 8y ago
    They're not being sued, and it's not a case for the courts. They're being reported to the Data Protection Agencies in various EU countries.
    - akie 8y ago
      Yes, but that's the first step to being sued.
      - henrikschroder 8y ago
        No, if a company gets reported, the DPA is supposed to investigate, and help the company get compliant if it finds that it isn't. If the company is willfully refusing to become compliant, the DPA can slap the company with a proportional fine to make non-compliance more expensive than complying. And if the company is fined, the company can probably sue the DPA in question if they think the fine was unreasonable or unapplicable or no good very bad and unfair.
        frockington 8y ago
        Does the DPA also get to choose who is making a strong effort and who isn't. Reporters can probably start pre-typing the corruption scandal articles.
- jonathanstrange 8y ago
  > The GDPR hits adtech companies fundamentally. Hopefully...
  - Ygg2 8y ago
    I'm not holding my breath. To paraphrase Jurassic Park "Money finds a way".
sleepyhead 8y ago
Actually the spirit of GDPR is also to make Terms of Service shorter by being clear and understandable. If you as a user is unable to understand what you are agreeing to then it is a violation of GDPR.
- mirko22 8y ago
  > unable to understand What if he is not very smart? Or even better, what if he is very dumb? At which level should those be written then?
  - contravariant 8y ago
    The literal text of the GDPR is as follows: >the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language
    - mirko22 8y ago
      Yes, and before that it says ` If the data subject's consent is given in the context of a written declaration which also concerns other matters,` which means i can use legalese but only if it does not concern other matters in the same document? :)
      - contravariant 8y ago
        You'd hope not, but I also thought the phrasing in that sentence was sloppy.
        mirko22 8y ago
        that’s the whole issue with the regulation unfortunately :(
- sontek 8y ago
  Our policies got much longer with GDPR. We only collect information for legitimate reasons (i.e we need it for the service they are using), we ask for it, and we never target it / sell the data. It helps that our customers are paying customers and not using a free service. So our TOS used to be quite simple in plain english that all the data we request is only for the purpose of providing the service. Now we had to outline all the information we collection (even though they are the ones who provide it, so they know what we collect) and outline all our services we use where that data we collect ends up (AWS, Sentry, Loggly, etc... the services we need to run our system and support them). Most of our clients have no idea what any of the information we added is because its all technical details about how we are providing the service to them. GDPR required us to do a lot of work that ended up costing us time and money and literally nothing changed because we were already making sure we protected our users privacy. Hopefully some bad actors get hit but for now GDPR has left a bad impression on me.
jacquesm 8y ago
Twitter got it right.

AndyMcConachie 8y ago

I'm gonna need more popcorn :)

yostrovs 8y ago

Considering that large sites with teams of lawyers are failing to follow the rules, how does a small site run by a few regular folks supposed to comply?

seba_dos1 8y ago
"large sites with business models developed around shady stuff GDPR is supposed to protect from" - there, FIFY.
notahacker 8y ago
their business model probably isn't selling user data
quohM0Ho 8y ago
The easiest way to comply is to not collect any PII. That is only a problem for companies that make data collection their core business.
- VMG 8y ago
  or anyone who has a public httpd with default log settings
  - dboreham 8y ago
    Default logging settings retain log files forever?
    - VMG 8y ago
      I don't know how long you are allowed to store PII under GDPR (I'm not a lawyer) This article indicates that default settings are problematic: https://www.ctrl.blog/entry/gdpr-web-server-logs https://www.ctrl.blog/entry/gdpr-web-server-logs > All of these logs contains personal information by default under the new regulation. IP addresses are specifically defined as personal data per Article 4, Point 1; and Recital 49. The logs can also contain usernames if your web service use them as part of their URL structure, and even the referral information that is logged by default can contain personal information (e.g. unintended collection of sensitive data; like being referred from a sensitive-subject website).

deleted 8y ago

[deleted]

ckastner 8y ago

> "The GDPR explicitly allows any data processing that is strictly necessary for the service - but using the data additionally for advertisement or to sell it on needs the users' free opt-in consent" This is the key point. As the saying goes, on Facebook, you aren't the customer, you are the product. The GDPR just changed this -- rightfully, in my opinion.

zerostar07 8y ago
yeah but now the product is not free.
- tazjin 8y ago
  It'd be great if companies offered a "buy back your privacy" subscription model. For the services I really don't want to stop using (Twitter ...) I'd definitely be using that.
  - gaius 8y ago
    They would take your money and track you anyway, and everyone knows it
    - tazjin 8y ago
      And be fined into oblivion.
      - amelius 8y ago
        How would anyone find out, and provide proof for this? Can we expect a EU government agency to validate companies on a regular basis? And if not, would they even cooperate with white-hat hackers to find offenders? Also, from what I read, data protection agencies have been understaffed and overworked for years now.
        pjc50 8y ago

narrator 8y ago

I am trying to think what the secondary consequences of GDPR are going to be. If any user can see their data on any service than any government can quickly plug-in to access all user data on any service. This is like NSA Prism for everything. If a user can export their data easily from any service, they can easily resell their own data for money to services that seek to monetize that data. They could even rent out their data by the day for model training using the right to delete. Account takeovers by hackers will lead to much more severe data breaches, since all data on that user in the system is easily accessible. The information apocalypse is made all that more easy because acount takeover + deep fakes + lyrebird plus all that easily accessible juicy data = impersonate anyone. Data renting will create a way to monetize account takeover. The account takeover will include all possible information used to identify a person so how are the data brokers supposed to know it isn't you and how are you supposed to get your data back once it's out there getting monetized?

camillomiller 8y ago
The option to monetize your own data is an amazing idea: a startup that pays you to upload the data you can download from your google, apple, facebook, BIGNAME account, basically renting it daily until you revoke consent, then uses it to do all sort of shit you can with it. You’ll get hypeprofiled and harassed with all sorts of advertising, but you’re actually getting real money for that.
- gregknicholson 8y ago
  When “you are the product”, you can sell that product.
  - zerostar07 8y ago
    you would have to find a market for them first. realistically private data is useless outside of a marketing platform like google or facebook. Maybe you can fill up some forms or polls for a few cents, that's it.
- scrollaway 8y ago

Oras 8y ago

It's about time to see no-win no-fee services to file a complaint against companies for GDPR breach. How long will it take?

GuB-42 8y ago
It is not how it works in Europe. No-win no-fee is a typical American thing. We don't have class actions either. It doesn't mean it won't happen, but that would be unusual.
- chopin 8y ago
  That's not exactly true. There are services which take your cases for delayed or canceled flights for keeping a percentage of the redeemed money. It must be said that carriers brought that to themselves by stonewalling customers despite pretty clear laws. But this is rather an exemption. Personally I would love to see similar services for GDPR. However the structuring of the law makes this unlikely, I believe.
xxs 8y ago
The proceeding would be undertaken by the state and the companies might be fined.
- ptaipale 8y ago
  All in all, GDPR reminds me of how legislation and regulation was constructed in USSR and now in Russia. The rules are such that it is practically impossibly to comply; it is then left to the powers-that-be to decide which ones of those in breach are investigated and prosecuted. It's the perfect setup for arbitrary and selective application of justice system to attack political opponents, dissidents etc.
  - mirko22 8y ago
    Exactly how politicians like it
  - 8y ago

camillomiller 8y ago

If this is what Online Marketing Hell looks like, please tell me where one can apply for a job as Junior Devil

lordlarm 8y ago

The 'loophole' here would be the definition of 'legitimate intrests', where businesses can defend not giving users a choice in many of these matters due to the activity being critical for the service to work or the business to survive. I.e. Facebook _could_ argue that users would have to have their data collected and analysed, as this would enable them to sell ads which in turn is their core interest. Another example could be automatic enrollment into newsletters or data collection/analyzation with the option to opt-out by going to settings. You don't _have_ to give users the explicit consent checkbox during signup if you can defend the activity by it being in your legitimate interests. This article goes into more detail: https://medium.com/mydata/five-loopholes-in-the-gdpr-367443c4248b https://medium.com/mydata/five-loopholes-in-the-gdpr-367443c...

tazjin 8y ago
Somebody on Reddit posted a list of Tumblr's "partners" that they share data with by default: https://i.imgur.com/YCNvEMa.png https://i.imgur.com/YCNvEMa.png I'm finding it difficult to believe that they can come up with a "legitimate interest" for all of those that would also actually hold up in court.
- BonesJustice 8y ago
  Good lord. I’m glad we’re finally getting the chance to see just how pervasive this problem is.
- dmitriid 8y ago
  Twitter’s “partners” are the same (you can request a list from your privacy settings)
  - chopin 8y ago
    Google's as well.
- eli 8y ago
  I think those are just the members of the new IAB consent framework. This is how programmatic ads work, you "partner" with a bunch of ad networks and serve an ad from whichever is paying the most at that moment.

mikekchar 8y ago

My big problem with this is that the complaints are too quick (unless Google, Facebook, et al are stupid, which I don't think they are). First you have to make a request to see what they are using the data for. Then you can complain that it is being used for the wrong things. Unless the aforementioned companies are blatantly saying "We're sharing your data for targeted advertising without consent", then I think we have to wait a month for real complaints.

TallGuyShort 8y ago
Isn't the tracking a claim they make to advertisers, and can I opt out without declining the entire ToS?
- mikekchar 8y ago
  Edit: Just to be clear. I'm not in the EU, so I can't check the ToS. If they are being stupid, then that's pretty stupid of them ;-) The thing is, it is possible that as of today they have stopped tracking. I agree that it's very unlikely, but unless they actually tell you that they are tracking you, how would you know? You get ads, but they could be completely random. Who knows? As of today, maybe all EU residents are getting random ads? Until you make a request, I think you can't quite complain (again, unless they are stupid and actually telling that they are tracking you).
  - olivierduval 8y ago
    FYI: GDPR provide a framework allowing investigations from the EU... So the EU might ask to get enough informations on algorithms - and even to audit code - to check if there's some hidden targeting ads. And then...
draw_down 8y ago
I can’t inagine anyone being surprised by this. It was explicitly said the deadline of yesterday (or today, I forget) represented the end of the grace period, which lasted the last two years. If laws don’t have effects then what are they good for? Companies are going to get in trouble and get fined because of this law, that means it’s working.

enedil 8y ago

It was expected that activist groups will say that these two companies are breaking GDPR, it is not so obvious that they will be actually fined (as the requests need to be processed by specific institution and might be found unwarranted).

lloydsparkes 8y ago

I am reading through the complaints, The first one: https://noyb.eu/wp-content/uploads/2018/05/complaint-android.pdf https://noyb.eu/wp-content/uploads/2018/05/complaint-android... The User sets up a "new" (non Google) phone, and isn't given an option to decline consent to Googles ToS. Now how does this work with a physical product? It needs to be compliant on the 25th of May 2018, but the version of Android may be old and not updated (given its Android). Even if there was an update waiting to resolve GDPR related issues, you would need to agree to the ToS to get that update, to enable opt-out? In that point of view, it seems a rather unfair complaint. I havn't checked the other's yet, but I start to feel that perhaps these have been filed too early, without enough thought and examination, just to get headlines?

neffy 8y ago
Companies have had two years to get their act sorted out on this.
- itake 8y ago
  I can still purchase a "new" 2 year old phone. I think that is a valid question.
  - sveme 8y ago
    Aren‘t the ToS pulled from the web when you set it up with a google account? I doubt you‘re agreeing to two year old ToS.
    - ldjb 8y ago
      Possibly, but it still might not be possible for Google to provide a means to decline the ToS without issuing an update (which, as has been pointed out, wouldn't be possible to install anyway without accepting the ToS).
      - madez 8y ago
        Then it's a device that does not comply the regulation and must not be sold.

GordonS 8y ago

> forcing people to accept wide-ranging data collection in exchange for using a service is prohibited under GDPR Erm... I don't think that's true. As long as you are open and transparent about what you are doing, and give users the right to request, update and delete the data you hold on them, then AFAIK this is allowed

martin_bech 8y ago
Nope thats actually true. You cant force say tracking, if its not absolutely needed, for the product to work. And i think thats why a lot of the popups have dark patterns, to hide the fact, that you can no opt out to these things.
- GordonS 8y ago
  Hmm, seems you are right, I just found this PDF from the ICO: https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf https://ico.org.uk/media/about-the-ico/consultations/2013551... "Avoid making consent a precondition of a service" "consent requests must be separate from other terms and conditions. Consent should not be a precondition of signing up to a service unless necessary for that service" I assume Facebook et al will simply find a way to make everything 'necessary'.
  - martin_bech 8y ago
    They have, and thats why they are going to be sued.. they made tracking a precondition for using the service.
  - mjewtoo 8y ago
    For consent this is true, but there are other legal ways for you to collect the data. One is legitimate interest, this one is more abstract but requires a bit more work from you. I think a lot of the future court cases will be around trying what one can use legitimate interest for. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

brianmcc 8y ago

Targeted advertising has become such a big deal, and implemented at such high cost, that I wonder if the trade off is even worth it now. I could imagine Apple or Samsung simply "sponsoring" Facebook for a week or month at a time with banners and messaging - tastefully done of course! - and how much less hassle that would all be, rather than aggregating millions upon millions of cookies and chasing people around the internet, winding them up, etc. Targeting ads for anonymous searches, fine: search for cars, see car adverts. Simple! I'm sure there is plenty of data that shows how terrible this whole idea is in terms of wasted ad spend, missed opportunities, so it'll never happen, but it's a nice dream :-)

SmellyGeekBoy 8y ago
If this were the case I'd genuinely turn off my adblocker.
- brianmcc 8y ago
  I possibly would too; I wouldn't begrudge the more innocent revenue generation tbh, provided ads were sufficiently unobjectionable!
dangerface 8y ago
Targeted advertising has always seemed pretty dumb, to me most advertising is done by Coke and their target is every where.
- brianmcc 8y ago
  Exactly - traditional advertising has long been about product and brand awareness and giving people the warm fuzzies about their logos, slogans, imagery etc. Treat online as exactly that with clickthroughs as a bonus!
- kinsomo 8y ago
  > Targeted advertising has always seemed pretty dumb, to me most advertising is done by Coke and their target is every where. Doc Searls made a good point: targeted advertising isn't advertising, it's really direct marketing (like spam and junk mail). Coke is doing advertising, but the adtech "targeted" advertisers are just spamming you using new technology. https://blogs.harvard.edu/doc/2018/05/12/gdpr/comment-page-1/ https://blogs.harvard.edu/doc/2018/05/12/gdpr/comment-page-1...

kisstheblade 8y ago

Absoultely every site that has had a new GDPR warning is just the same as the old cookie banner. "By using the site you agree..." Some have updated privacy pages which describes how you can delete or deny cookies... An absolute joke, nobody is following the law. It should be simple. A new banner that asks "allow tracking", yes, no. Either option allows you to use the site freely.

whyagaindavid 8y ago

Are they also planning to sue Apple? I can get it activated without creating account.

amelius 8y ago

Aside, I've found an interesting thread on GDPR in Mastodon (an open-source "Facebook competitor") here: https://github.com/tootsuite/mastodon/issues/7280 https://github.com/tootsuite/mastodon/issues/7280

MarkMc 8y ago

I think Facebook's lawyers have determined that they can use the 'legitimate interest' basis for showing targeted ads to their users [0]. This basis does not require consent from users except as part of the take-it-or-leave-it initial terms of service. Here are the parts of the 'legitimate interest' basis which are most useful to Facebook: The GDPR does not define what factors to take into account when deciding if your purpose is a legitimate interest. It could be as simple as it being legitimate to start up a new business activity, or to grow your business. So Facebook's lawyers can simply say, "It's in our legitimate interest to maximise advertising revenue". You need to demonstrate that the processing is necessary for the purposes of the legitimate interests you have identified. This doesn’t mean that it has to be absolutely essential, but it must be a targeted and proportionate way of achieving your purpose. Facebook's lawyers can say, "It is necessary for us to use personal information about our users, such as their age and location, in order to maximise our advertising revenue". The GDPR is clear that the interests of the individual could in particular override your legitimate interests if you intend to process personal data in ways the individual does not reasonably expect. Facebook's lawyers can say, "People expect that we use their personal information such as age and location to determine what ads to show them, so the interest of the user does not override our legitimate interest of maximising advertising revenue." [0] https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/ https://ico.org.uk/for-organisations/guide-to-the-general-da...

lovich 8y ago
If companies successfully argue that maximising revenue is a legitimate interest and thus, don't need users consent, then the GPDR will worth less the paper it was written on. I would be extremely surprised if the EU goes through all this tome, effort, and money just to let corporations continue with business as usual
- merb 8y ago
  > I would be extremely surprised if the EU goes through all this tome, effort, and money just to let corporations continue with business as usual trust me, you didn't see what the eu already gone through, just to keep existing.

whyagaindavid 8y ago

Serious question: How is this compatible with new GDPR? https://apple.stackexchange.com/questions/144551/how-to-delete-my-account-on-icloud-com?rq=1 https://apple.stackexchange.com/questions/144551/how-to-dele...

zzzcpan 8y ago

It appears many companies try not to comply to the spirit of the law. Stack Overflow, for example, sent an e-mail claiming to have opt-in permissions to promotional messages, while not actually having them and only providing opt-out settings: "With your continued permission, we will send you promotional messages based on your preferences. To see and change your opt-in preferences, manage your Email Settings." I guess with such attitudes it's not going to be enforced much, otherwise there will be no one left to enforce it on.

kerng 8y ago

Solution: Pay a few bucks a year or see ads. What's so difficult about that? That could solve the problem somewhat at least...

zerostar07 8y ago
for europe it would be around $20 i believe.

oblio 8y ago

Oh, one thing important to note that people might forget/ignore: this is just the beginning. See: https://en.wikipedia.org/wiki/Brussels_effect https://en.wikipedia.org/wiki/Brussels_effect A lot of countries look up to the EU, have trade agreements with it. Unless the GDPR totally falls flat on its face (unlikely), more and more countries will realize the benefits of this kind of legislation. Also the GDPR will act as an icebreaker and it will "soften up" company stance on this matter. As a result it will be easier for the second line of countries adopting such laws to demand things from companies. I'd say: get used to it. It's not going away, it's not going to become easier to use and sell personal data.

ocdtrekkie 8y ago
The Facebook/Cambridge Analytica thing definitely seemed to open up more US legislators to the idea. Between the EU taking the lead on antitrust against tech monopolies, and now privacy laws, it honestly makes them look bad: The EU is doing the job most people would've expected the US to take the lead on back in the day. As GDPR will not end the world or pop the tech bubble or whatever, it's increasingly likely that the US will just go "yeah, we want all that too".

stevespang 8y ago

The EU is eager to "clean the clocks" of these big liberal, privacy destroying California based megaliths. Go Max go.

csomar 8y ago

And here I'm hoping for the EU GDPR to kick all of these guys in the balls pretty hard. In the last few hours, I have been getting dozens of emails. Basically: Take it or leave. Some of them sent an email "if you don't leave, you are taking it". And you are not given a choice to download your data or temporarily access your account to sort out things. Your hands are getting forced to accept the rules or potentially be locked out of your account. I'm taking note of these little evil services. And in all fairness, my banking provider actually gave two options: one is required and the other is optional (marketing data collection). I was able to unselect it successfully.

troybanks 8y ago

I used Hope Fulwood to confirm the infidelity of my ex-wife and i am forever grateful to him. He helped my hack her phone which he held so dearly and i found out-numerous dating sites she was registered to, her emails, all her social network apps and even text messages. I was heartbroken but its better to know and act upon your knowledge than being played a fool. i will recommend Hope Fulwood and you can contact him via email... GMAIL: trusthackerslounge2018 WEBSITE: https://trusthackerslounge.wixsite.com/mysite https://trusthackerslounge.wixsite.com/mysite

cromwellian 8y ago

There seems to be a fundamental dichotomy on HN that is either intellectually dishonest, or the result of hyperbolic reasoning. Everyone accepts that services have costs, and so someone has to pay for them. They're either paid for by user fees, paid for by ads, or paid for by charity (e.g. Wikipedia) Every time a publisher converts to user fees (paywall), people react angrily. Yet, people complain loudly over ads too, and others complain loudly over ad tracking. Now, there's not necessarily overlap between these groups, but there must be some. So either people want to get away with paying nothing (one form of dishonestly), or they are virtue signaling over things they don't care as strongly about as they say (another form of dishonesty), or they are mad at something else. I think it's a mix of both. Many people will say they care a lot of privacy and security, but behave in ways that show they really don't. From poor operational security, to bad passwords, to continuing business with firms that have already been hacked and exposed their personal information. A lot of people complain also loudly over what they imagine is serious harm being done to them by ad tracking, but I would bet they are more annoyed by ads themselves, than by the theoretical and abstract (if distant background threat) of their info being harvested for harm. Because human being's reward system in their brain favors minimizing immediate pain. Ads, whether targeted or not, are an annoyance, just like paywall dialogs, and people would rather see neither. I think this is the real nitty gritty, people unwilling to put up with the monetary cost of services, the hassle of signing up and paying, the performance detriments of ads, or the annoyance of having their attention interrupted by them and this is far and above the concerns over privacy. No doubt, many people will say no, I'm wrong, they truly care extremely strongly about data mining, but I think the people who care that strongly as a small minority like the people who are rabid anti-vaxxers, or anti-GMO, hyperbolic fears of tiny risks, not shared by the mainstream.

mdekkers 8y ago

Where do I sign up? I was forced today to accept Facebook's new settings and I was presented with an option to either allow facebook to process my data for face recognition or not. Choosing not does not allow you to move forward in the settings, and it is deeply confusing - there is an "accept and continue" button, but there is some rather small text that states choosing accept and continue will enable face recognition. Closing the browser and reopening it at this point shows the same text, and only the option to accept and continue. Doing so and then checking settings will show face recognition to be disabled, but I am no longer sure what I accepted and continued with. The whole scheme is scammy as anything. The text presented is something along the lines of "disabling this feature will allow other people to impersonate you" which at best is nasty fear mongering. Fuck those assholes.