6 ms·

Page 14: [edit: number corrected, thanks] > As the screenshots below illustrate, the Facebook GDPR popup requires users to go into “Manage data settings” to tu

Page 14: [edit: number corrected, thanks] > As the screenshots below illustrate, the Facebook GDPR popup requires users to go into “Manage data settings” to turn off ads based on data from third parties. If the user simply clicks “Accept and continue”, the setting is automatically turned on. This is not privacy by default. Beautiful! A minimal demonstration of a clear violation of the principal of data protection by default (article 25 of the GDPR). It will we really hard to talk oneself out of this one.

scrollaway 8y ago
That flow was really scummy. I remember going through it. The entry point was an email claiming you have to "read and accept the updated policies in order to continue using the site". And the first thing you're presented with was that two-choice "Manage data settings" / "Accept and continue", implying for the user who is less than extremely careful that if you don't "Accept and continue", you won't be able to use the site anymore. It's only after that modal that you're presented with the updated T&Cs which you indeed need to either accept or delete your account. And of course all the various things people have noted: - A red dot in the fake-header to make you think you have pending notifications - A complete disregard for "privacy by default" All this right after Mark testified in congress saying "no we used to be bad and we made mistakes but now we really care, you see". For a site that despises transparency, Facebook has never been so transparent about how little it gives a crap about its users. I have some friends working at Facebook who will probably read this and be upset I think so little of their place of work. Folks, I have a huge respect for some of the excellent work that goes on at Facebook, especially in open source. But that doesn't change how scummy the core site itself is.
- malka 8y ago
  Facebook will never care about Privacy. People like Zuckerberg are scum, and deserve jail. As an individual, I really do NOT want to live in the same society as this kind of person.
  - CaptainZapp 8y ago
    Mr. Zuckerberg cares a lot about privacy. Privacy for him and his family, that is.
- lancewiggs 8y ago
  By staying at Facebook your friends are explicitly supporting these and other scummy actions. They have decided to hold their noses and prioritise themselves over humanity. Think less of them.
  - fsloth 8y ago
    "Think less of them." That's a horrible metric to apply measuring 'human worth', whatever that is. Humans are by default wired to do what everyone else is doing. Just using Facebook because everyone else is doing it as well is what humans do. They flock to the communities and forums where the action is. They cannot comprehend graph theory intuitively and what power Facebook potentially wields in interfering in their lives. Governments are supposed to protect people from threats the masses cannot comprehend. Like example taking care of vaccinations.
  - scrollaway 8y ago
    This is a totally inappropriate thing to ask of anyone. Please rethink your view on life. Edit: Also, that's not what "explicitly" means. I think you meant "implicitly".
    - TheSpiceIsLife 8y ago
      Superior orders, often known as the Nuremberg defense, lawful orders or by the German phrase Befehl ist Befehl ("an order is an order"), is a plea in a court of law that a person—whether a member of the military, law enforcement, a firefighting force, or the civilian population—not be held guilty for actions ordered by a superior officer or an official.[1] The Nuremberg defence is widely regarded as invalid. 1. https://en.m.wikipedia.org/wiki/Superior_orders https://en.m.wikipedia.org/wiki/Superior_orders
    - rickycook 8y ago
      some people work for charities, some people work for facebook. the employees make the company, and are complicit if they don’t react harshly to decisions made by their board like google employees did... if nobody wants to support the scummy tactics that “the company” is pushing, it won’t get done. sometimes you need to have a spine to get anything changed otherwise we are just heading for a blade runner distopia, and we in the tech industry are pushing us there as fast as our pay cheques can. people quit google over the military project because they didn’t agree with it. i don’t think it’s crazy to do the same over facebooks disgusting manipulation of their user base.
dannyw 8y ago
Note that Facebook still refuses to let you opt out of personalised advertising based on Facebook activity. This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB?
- tehabe 8y ago
  The paper deals with this, it even says this gives the users the false impression of control. I remember this weird pop up if you allow Facebook applications of friends to access your information. It was never really clear if you agree or disagree to it by checking the check boxes.
- adventured 8y ago
  > This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB? The GDPR fans on HN have said over and over again that GDPR wouldn't result in instant fines, that companies would be given a warning and an opportunity to make changes. We'll soon find out if that's true or not.
  - rickycook 8y ago
    facebook made their changes, and failed. they’ve played their hand, now it’s time for the law to tell them what utter bull it is. do you think facebook is going to change anything from now? the point of “no instant fines” is to give companies a chance to change and develop their GDPR systems. if those systems are both complete, and in violation, why shouldn’t they be fined?
    - fauigerzigerk 8y ago
      >facebook made their changes, and failed. That is yet to be determined by the regulator and the courts. Facebook has made their changes. Now someone will complain to the regulator. Then the regulator will make a determination and maybe ask Facebook to make further changes. Then Facebook has another opportunity to comply. If they refuse to make those changes they will get fined and can go to court to fight the regulator's decision. At least that is my understanding of how this system works.
Arn_Thor 8y ago
* page 14
pfortuny 8y ago
Oh: we made mistakes. They will not happen again.
WorkLifeBalance 8y ago
I noticed Twitch is doing the same thing, if you "manage your choices" you get the banner to "manage your choices" on every page load, the only way to get rid of the banner was to "accept" which accepts everything. (I hope it was just a 'bug' but it didn't feel like it.) I don't get it though, if companies are so scared of being fined 4% of revenue that they put up these banners, aren't they inviting the worse end of the punishment scale by trying to weasel around the law rather than just ignoring it completely?
- ckastner 8y ago
  The worst offender I've encountered is imgur.com, where "click here to manage your privacy settings" brings you to a page with literally hundreds of advertisers. About half are on "allowed" by default. If you want to disallow, you have to select each entry individually. The other half only specify "requires opt-out", apparently imgur expects you to contact some third party to do so. How on earth they expect to weasel around the law with this ham-fisted approach is beyond me.
  - okanesen 8y ago
    Same goes with Tumblr and Yahoo for example, where everything is enabled by default and you have to go one (I'm not talking about 10-20, it's more like +300) by one to enable the tracking done by advertising/marketing companies. One of the better thing is, though I don't want to advocate the behavior of auto opt-in at all, that most of these sites are at least using something like TRUSTe or Oath, where you only have to disable hundreds of marketing services once and are done with all the sites, which are using the same service for cookie consent. It's against the law to make the options opt-out but these companies are still trying hard to don't obey by the law, it's really comical.
  - fauigerzigerk 8y ago
    >How on earth they expect to weasel around the law with this ham-fisted approach is beyond me. They reckon, perhaps correctly, that almost all websites weasel around the law and only very few of them will ever be fined. Privacy activists will go after the big fish first and there will be time for the small sites to correct course once it becomes clear what is and isn't permitted.
passwd 8y ago
> It will we really hard to talk oneself out of this one. I'm reasonably sure they knew it's a violation. So it feels like they're either prepared to fight over it, or testing the ground to see what the consequences are... After all, I would have guessed that they're in for major losses in ad revenue if most people sign out. So it's worth almost any risk.
mort96 8y ago
I would like to point out this message I got on the mobile Facebook website a month ago: https://i.redd.it/hh6xerkskmx01.jpg https://i.redd.it/hh6xerkskmx01.jpg "To personalise content, tailor and measure ads and provide a safer experience, we use cookies. By tapping on the site, you agree to our use of cookies on and off Facebook." Agreeing to something by tapping anywhere on the site doesn't sound enforceable...

scrollaway 8y ago

That flow was really scummy. I remember going through it. The entry point was an email claiming you have to "read and accept the updated policies in order to continue using the site". And the first thing you're presented with was that two-choice "Manage data settings" / "Accept and continue", implying for the user who is less than extremely careful that if you don't "Accept and continue", you won't be able to use the site anymore. It's only after that modal that you're presented with the updated T&Cs which you indeed need to either accept or delete your account. And of course all the various things people have noted: - A red dot in the fake-header to make you think you have pending notifications - A complete disregard for "privacy by default" All this right after Mark testified in congress saying "no we used to be bad and we made mistakes but now we really care, you see". For a site that despises transparency, Facebook has never been so transparent about how little it gives a crap about its users. I have some friends working at Facebook who will probably read this and be upset I think so little of their place of work. Folks, I have a huge respect for some of the excellent work that goes on at Facebook, especially in open source. But that doesn't change how scummy the core site itself is.

malka 8y ago
Facebook will never care about Privacy. People like Zuckerberg are scum, and deserve jail. As an individual, I really do NOT want to live in the same society as this kind of person.
- CaptainZapp 8y ago
  Mr. Zuckerberg cares a lot about privacy. Privacy for him and his family, that is.
lancewiggs 8y ago
By staying at Facebook your friends are explicitly supporting these and other scummy actions. They have decided to hold their noses and prioritise themselves over humanity. Think less of them.
- fsloth 8y ago
  "Think less of them." That's a horrible metric to apply measuring 'human worth', whatever that is. Humans are by default wired to do what everyone else is doing. Just using Facebook because everyone else is doing it as well is what humans do. They flock to the communities and forums where the action is. They cannot comprehend graph theory intuitively and what power Facebook potentially wields in interfering in their lives. Governments are supposed to protect people from threats the masses cannot comprehend. Like example taking care of vaccinations.
- scrollaway 8y ago
  This is a totally inappropriate thing to ask of anyone. Please rethink your view on life. Edit: Also, that's not what "explicitly" means. I think you meant "implicitly".
  - TheSpiceIsLife 8y ago
    Superior orders, often known as the Nuremberg defense, lawful orders or by the German phrase Befehl ist Befehl ("an order is an order"), is a plea in a court of law that a person—whether a member of the military, law enforcement, a firefighting force, or the civilian population—not be held guilty for actions ordered by a superior officer or an official.[1] The Nuremberg defence is widely regarded as invalid. 1. https://en.m.wikipedia.org/wiki/Superior_orders https://en.m.wikipedia.org/wiki/Superior_orders
  - rickycook 8y ago
    some people work for charities, some people work for facebook. the employees make the company, and are complicit if they don’t react harshly to decisions made by their board like google employees did... if nobody wants to support the scummy tactics that “the company” is pushing, it won’t get done. sometimes you need to have a spine to get anything changed otherwise we are just heading for a blade runner distopia, and we in the tech industry are pushing us there as fast as our pay cheques can. people quit google over the military project because they didn’t agree with it. i don’t think it’s crazy to do the same over facebooks disgusting manipulation of their user base.

dannyw 8y ago

Note that Facebook still refuses to let you opt out of personalised advertising based on Facebook activity. This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB?

tehabe 8y ago
The paper deals with this, it even says this gives the users the false impression of control. I remember this weird pop up if you allow Facebook applications of friends to access your information. It was never really clear if you agree or disagree to it by checking the check boxes.
adventured 8y ago
> This is the most blatant malcompliance with GDPR IMO, when will data protection authorities start fining FB? The GDPR fans on HN have said over and over again that GDPR wouldn't result in instant fines, that companies would be given a warning and an opportunity to make changes. We'll soon find out if that's true or not.
- rickycook 8y ago
  facebook made their changes, and failed. they’ve played their hand, now it’s time for the law to tell them what utter bull it is. do you think facebook is going to change anything from now? the point of “no instant fines” is to give companies a chance to change and develop their GDPR systems. if those systems are both complete, and in violation, why shouldn’t they be fined?
  - fauigerzigerk 8y ago
    >facebook made their changes, and failed. That is yet to be determined by the regulator and the courts. Facebook has made their changes. Now someone will complain to the regulator. Then the regulator will make a determination and maybe ask Facebook to make further changes. Then Facebook has another opportunity to comply. If they refuse to make those changes they will get fined and can go to court to fight the regulator's decision. At least that is my understanding of how this system works.

Arn_Thor 8y ago

* page 14

pfortuny 8y ago

Oh: we made mistakes. They will not happen again.

WorkLifeBalance 8y ago

I noticed Twitch is doing the same thing, if you "manage your choices" you get the banner to "manage your choices" on every page load, the only way to get rid of the banner was to "accept" which accepts everything. (I hope it was just a 'bug' but it didn't feel like it.) I don't get it though, if companies are so scared of being fined 4% of revenue that they put up these banners, aren't they inviting the worse end of the punishment scale by trying to weasel around the law rather than just ignoring it completely?

ckastner 8y ago
The worst offender I've encountered is imgur.com, where "click here to manage your privacy settings" brings you to a page with literally hundreds of advertisers. About half are on "allowed" by default. If you want to disallow, you have to select each entry individually. The other half only specify "requires opt-out", apparently imgur expects you to contact some third party to do so. How on earth they expect to weasel around the law with this ham-fisted approach is beyond me.
- okanesen 8y ago
  Same goes with Tumblr and Yahoo for example, where everything is enabled by default and you have to go one (I'm not talking about 10-20, it's more like +300) by one to enable the tracking done by advertising/marketing companies. One of the better thing is, though I don't want to advocate the behavior of auto opt-in at all, that most of these sites are at least using something like TRUSTe or Oath, where you only have to disable hundreds of marketing services once and are done with all the sites, which are using the same service for cookie consent. It's against the law to make the options opt-out but these companies are still trying hard to don't obey by the law, it's really comical.
- fauigerzigerk 8y ago
  >How on earth they expect to weasel around the law with this ham-fisted approach is beyond me. They reckon, perhaps correctly, that almost all websites weasel around the law and only very few of them will ever be fined. Privacy activists will go after the big fish first and there will be time for the small sites to correct course once it becomes clear what is and isn't permitted.

passwd 8y ago

> It will we really hard to talk oneself out of this one. I'm reasonably sure they knew it's a violation. So it feels like they're either prepared to fight over it, or testing the ground to see what the consequences are... After all, I would have guessed that they're in for major losses in ad revenue if most people sign out. So it's worth almost any risk.

mort96 8y ago

I would like to point out this message I got on the mobile Facebook website a month ago: https://i.redd.it/hh6xerkskmx01.jpg https://i.redd.it/hh6xerkskmx01.jpg "To personalise content, tailor and measure ads and provide a safer experience, we use cookies. By tapping on the site, you agree to our use of cookies on and off Facebook." Agreeing to something by tapping anywhere on the site doesn't sound enforceable...