19 ms·

Brave files adtech complaint against Google

464 points by petethomas 8y ago

forapurpose 8y ago
They are arguing that the surveillance core of adtech is a GDPR violation, if I understand correctly. > The complaint argues that when a person visits a website, intimate personal data that describe them and what they are doing online is broadcast to tens or hundreds of companies without their knowledge in order to auction and place ads. It would be great if someone with real expertise in GDPR or adtech could provide context: Isn't this violation obvious and therefore don't the adtech companies have a strategy prepared? Could a ruling effectively outlaw the modern surveillance-based online business model and therefore wouldn't this issue be existential for adtech? I don't know the details of GDPR and its application; perhaps this issue is narrower than it appears or maybe there are substantial ways to workaround a ruling and preserve the adtech model.
- vkou 8y ago
  Generally speaking, ad networks don't sell personal data. That's their secret sauce - selling it is largely counterproductive. I can't call up Yahoo, and ask to buy the personal data of "forapurpose". If I could, it would take me a few million dollars to build a clone of their most valuable asset - their user database. What they sell is ad spots in webpages, when those webpages are visited by people who satisfy some demographic matrix. The data itself, generally, does not get sold.
  - forapurpose 8y ago
    Thanks. How does that apply in this case? Does GDPR allow the collection but ban the selling of data? Also, per the article, the complaint claims that the collected information is shared with many other companies. How does that square with what you are saying? Are they sharing it with partners but not selling it to them? Does that make a difference under GDPR?
    - kasey_junk 8y ago
      The OpenRTB spec does contain data that many assume will be found to be personal under GDPR. The IAB is an industry group for people that use OpenRTB. They have built a standard on how to gather and transmit the GDPR consent requirements from publisher through the OpenRTB ecosystem. You can find it at http://advertisingconsent.eu/ http://advertisingconsent.eu/
    - idunno2468 8y ago
      Used to be in adtech- google didn’t provide these things to us. Maybe there were other products we could have purchased, but google just gave us a userid and all the tracking was done on our side. There are definitely third parties we could buy this data from. I left pre gdpr but my vague understanding is google has nothing to worry about in rtb but the adtech companies are at fault here if anyone. Especially if you consider the amount of lawyers google pays vs brave
  - pacala 8y ago
    While it is technically correct that ad networks don't sell personal data, it is also irrelevant. It's not the bits that matter, it's what one does informed by the bits. Ad networks sell _actionable insights_ informed by personal data. An ad network answers the question 'what is the best way to spend $$$ and win this election' _using_ personal data of millions of people, but not _revealing_ the personal data to the paying customer. The paying customer is highly unlikely to have the technical acumen to turn personal data into actionable insights anyways, service readily provided by the ad network. The fact that personal data was not revealed is irrelevant, the end effect was bought by anyways. The evil is in collecting personal data to begin with, not in the technical manner it is used against the people it belongs to.
    - fixermark 8y ago
      We're going off into the weeds of philosophy, but... Do you mean it's evil to collect the personal data for the purpose of selling ad impressions of it's evil to collect personal data, full-stop? I want companies like Google collecting my personal data to, for example, provide me context-relevant search and map navigation results and voice-assistant actions. So it doesn't seem like evil-full-stop passes the smell test.
    - Nasrudith 8y ago
      While there is some evil involved with targetted advertising there is a significant difference between that and direct data selling. The latter would be way worse. One tries to sell you weird stuff after you look up the infamous giant barrel of lube after hearing about all of the joke reviews. The other gives the lines of an honest man to hang you with to anyone willing to pay and spin you as a colossal pervert. It is why video rentals were protected information. That and the sublime trolling of reading Robert Bork's video rentals into official record after he stated there was no constitutional right to privacy.
      - pacala 8y ago
        Fair enough. N:M surveillance is worse than N:1 surveillance from a personal perspective. Though unclear if that also holds at scale. They are still both evil and much worse than no surveillance.
  - kevin_thibedeau 8y ago
    The trackers that generate analytics data for the ad networks do sell personal data and it is made available to anyone who wants to pay.
- stvswn 8y ago
  So the publisher, through a platform, issues a bid request to an exchange with a lot of information in it. The parameters of that bid request contain all kinds of context like the site, the browser or device, etc. Critically, it also includes the cookie. The way GDPR has been interpreted by Google (btw Google is considered to be overly conservative in its approach by the adtech world): Cookies can only be passed by publishers who get consent to collect and pass them, and they must get consent for each adtech vendor. Furthermore, Google will not pass those cookies to anyone else because it can't be sure that the vendor receiving them was given consent by the user. Other platforms haven't done that last part; and some publishers are even saying that they refuse to collect affirmative consent. This is because people interpret it differently. From my reading, Brave seems to be trying to drive for a new interpretation: it's not only a matter of cookies, which is the parameter associated with a user, it's a matter of ALL the info even when it's not related to tracking a single user. My guess is that Eich's hoping to get a court to adopt this new stricter interpretation, but if that were to happen it would mean that the regulators' guidance thus far would be moot and all of the mitigations the adtech world has gone through to prepare would be out the window.
  - icebraining 8y ago
    Is that guidance publicly available? As a layman, Brave's interpretation makes perfect sense - those parameters are related "to an identified or identifiable natural person".
    - stvswn 8y ago
      Article 4.1 itself, as it goes on, defines personal data in a way that it relates specifically to that which can identify someone, so it doesn't mean literally anything about the ad placement simply because a person is seeing the ad. Definition of personal data: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."
- frabcus 8y ago
  Currently the adtech companies trying to rely on the legal basis of Consent - they get the user to explicitly agree to the processing required for targeted advertising with a popup advert. There is a great NGO of lawyers called NOYB (None of Your Business) in Austria who has filed complaints with Facebook, WhatsApp, Instagram and Android about the consent dialogs not being valid under GDPR. The complaint PDFs are worth glancing through to see how disingenuous the adtech companies are in their attempts to appear to comply with consent, when I think anyone reasonable would agree they are not. https://noyb.eu/ https://noyb.eu/ I'm curious as to the detail of Brave's complaint, which seems to add even more to this.
_xgw 8y ago
This comes at the same time that Malwarebytes starts flagging Brave as malware[1]. [1] https://twitter.com/lukesawczak/status/1039854898068815873 https://twitter.com/lukesawczak/status/1039854898068815873
- sam_goody 8y ago
  Malwarebytes has had a few (seemingly) false positives lately. Anecdotally, I was just hit by it falsely flagging BeyondCompare and my password manager. I assume they have just upped the ante of their heuristics, but am still concerned about the fallout, since I am starting to ignore them. Not related, but considering that it does not scan except on demand, why is it ALWAYS running? Who vouches for Mr. Malwarebytes?
  - whoopdedo 8y ago
    Not to mention more aggressive upselling in the free version via popups. Closing the application sends it to the system tray where it will later remind you to "update" MalwareBytes by buying a license.
  - styfle 8y ago
    In June, I too had an auto-update from Beyond Compare failing due to Malwarebytes and it made me think their servers were compromised. Nope, false positive. It looks like this happens often enough, there is a whole page dedicated to false positives. https://www.scootersoftware.com/support.php?zz=kb_virus https://www.scootersoftware.com/support.php?zz=kb_virus
  - jonathansampson 8y ago
    It was indeed a false-positive: https://twitter.com/thomasareed/status/1039939712704819200 https://twitter.com/thomasareed/status/1039939712704819200. As for vouching for MB, I know some of the people behind the project, and they're spectacular. For years I have assisted with deobfuscating malicious JavaScript and more. They seem, to me, to have the purest of intentions. (Not an official Brave endorsement, but I personally like their team)
- 8y ago
_red 8y ago
Its admirable what brave is trying to do. Practically speaking, its one of the best chance we have of creating a new internet where the incentives are more privacy focused. Hope they succeed.
- snaky 8y ago
  A new internet where $273 billion advertising industry does not exist?
  - legatus 8y ago
    Can I ask what the amount of money that can be made has to do with this? First of all: they make a case against a particular type of advertising, not all of them. While I honestly believe an argument can be made against any type of advertisement, that's not what they're doing. Second: if an industry is based on immoral practices, what do we care if they make a lot of money? It's like saying "we should not go against slavery, it's a $X billions industry". If they make the money by using data the users did not know they were giving, then I don't care how much money they make: they should not be making it.
    - fixermark 8y ago
      Human weighting of incentive signals differs. "We should not go against slavery, it's an $X billions industry" isn't precisely how the US South thought about the problem, but ultimately they did go to war because they recognized that chnage in the status quo would bring utter economic ruin to a powerful sector of the populace with the political and social clout to goad the rest into war. So yeah, "That industry makes an awful lot of cash" is useful to factor into one's thought process when one tries to reason through how one could tear it down. If nothing else, it's a first-approximation barometer of how much people will spend to oppose your efforts.
      - bduerst 8y ago
        Slavery is a bad analogy. The increased buying power of the new consumers (freed slaves) is economically more beneficial than having them locked in as non-consumers (slaves).
atomical 8y ago
A few typos in the article: > Were the regulator to find in favor of the plaintiffs, that could undermine the foundations of the data-driven model on with the online ad industry - forecast by research firm eMarketer to grow to $273 billion this year - depends. with = which The GDPR is the first data privacy regime that foresees heavy fines for serious violations - of up to 4 percent of a company’s global turnover. foresees = oversees ?
- dmix 8y ago
  foresees is perfectly fine in that sentence.
  - atomical 8y ago
    Are they actually predicting that outcome?
martindale 8y ago
Brave's strategy of replacing ads with other ads isn't going to do anyone any good. They could've used payment channels to build a content distribution network, but alas...
- atomical 8y ago
  Why? They are ensuring user privacy by doing all machine learning locally. Google had the unofficial "don't be evil" motto and Brave has "can't be evil" as a motto.
  - deleted 8y ago
    [deleted]
- jonathansampson 8y ago
  I'd like to respond, as a developer on the Brave project. We don't simply replace ads with other ads. The entire ad landscape has been co-opted by those who aim to collect as much data about you as is possible. Over 600 million devices were running some form of ad-blocking software in 2017, and that was an increase of 30% from the year prior. This number keeps growing, year over year. Something has to be done. Users who come to Brave are already blocking ads. They understand the risk involved in letting third-party software collect information about them, their person, their browsing habits, and more. Further, the risk of drive-by downloads is on the rise (or the growing popularity of crypto-jacking). Brave blocks ads and trackers for safety and privacy reasons. But we are not so naive to miss the impact this has on well-meaning publishers. This is why we created the User Growth Pool, and the Brave Payments system. Every month we pour hundreds of thousands of dollars back into the pockets of content creators by way of BAT (Basic Attention Token) grants, distributed freely to users of the Brave browser. But grants won't last forever, something sustainable has be erected in place of the incumbent digital advertising system. This is where Brave Ads comings into play. For users who opt in, Brave can deliver better quality ads, without the risk of personal data leakage. We do this by using local machine-learning to understand the user better, and making local decisions as to which ads should or should not be shown, and when (the user controls all of this). Furthermore, the user gets 70% of the ad revenue for browser-private ads. When you consider the amount of money lost to digital ad fraud each year (over $20,000,000,000 I believe), you can see how the Brave system would lead to a much better, and more sustainable future for the web. We're not simply replacing ads. We're rescuing an industry.
kingbirdy 8y ago
Seems like a strange choice to file a GDRP complaint in a country that will stop being an EU member state in less than a year, but I'm sure their lawyers know more than I do
- fixermark 8y ago
  I wonder if they're gambling that Brexit will implode? Seems like a lot of people are. ;)
- frabcus 8y ago
  The UK Government has said GDPR will continue to apply after Brexit, and passed the laws to make that the case. http://www.blplaw.com/expert-legal-insights/articles/gdpr-and-brexit-uk-government-unveils-data-protection-plans http://www.blplaw.com/expert-legal-insights/articles/gdpr-an... The official reason given being: "Over 70% of all trade in services are enabled by data flows, meaning that data protection is critical to international trade." While Britain is on course to leave the EU (one specific body), it will continue to co-operate at a European (continent) level in all sorts of ways. Common data protection legislation being one example. I'm curious though why Brave chose Britain and Ireland as the two places to complain. Maybe because English speaking?
  - floatingatoll 8y ago
    Google EU routes all revenue through an Irish shell corporation, right?
manigandham 8y ago
Google (and Facebook) already have consent from the majority of users who don't care about this and would rather keep access to gmail, youtube, and social networks. Nice try, like GDPR itself, but the intent does not match the implementation. There are trillions in market cap standing in the way and this will end in nothing but a waste of legal fees.
- tjoff 8y ago
  GDPR consent doesn't work like that...
  - blub 8y ago
    OP is working in the ad space and he's been complaining about the GDPR forever. They're still in the denial phase.
    - 3K7m7bUZyWA1KCD 8y ago
      As a European I can't help but wonder if other proposed reforms, such as Article 11 and Article 13, will do more good to the end user than not, just like what happened with GDPR. I've seen so many enraged comments related to the new copyright laws, that my instinct says it will be a good thing.
    - manigandham 8y ago
      I'm sure you think you know something about me from a cursory browsing of my comment history, but that wouldn't reveal anything important like the fact that I'm one of the top 5 people in the ad industry who has called for regulation for years, and actually spent the time and money on trying to make it happen, and also did so in the US market which completely dwarfs anything in Europe. But since you're operating on assumptions and have nothing better to offer than saying "denial", then I'll just go ahead and assume that your experience with both adtech and GDPR amounts to something less than insignificant and that your future comments on this topic will remain lacking.
  - manigandham 8y ago
fiatjaf 8y ago
The Basic Attention Token is an idea waiting to be reimplemented with Bitcoin and Lightning.
- nil_pointer 8y ago
  What is special about implementing anything Bitcoin+Lightning? BAT clones are already being developed on EOS and IOTA (both speedy networks with 0 cost transactions). Here's the IOTA advertising project: https://oysterprotocol.com/ https://oysterprotocol.com/
  - fiatjaf 8y ago
    Didn't know that. It's good news people are willing to reimplement BAT. Special about Bitcoin+Lightning is that these are probably going to last and truly function as money while these others you cited don't.
    - sincerely 8y ago
      This is a really strange claim, from the perspective of someone not invested in any specific implementation of crypto or blockchains...why would the first product in a given (tech) category be the one that lasts the longest? That would be like expecting WebCrawler to be the dominant search engine or Six Degrees to be the dominant online social media site, or Mosaic to be the browser with the highest usage %. I can't figure out why someone would make this argument unless they have a personal interest in keeping Bitcoin's value high.
      - fiatjaf 8y ago
        Basically you think Bitcoin cannot ever be "the one that lasts the longest" just because it was the first implementation? That's a valid argument, but it makes no sense to think that all other arguments that claim the contrary are invalid and can only be made by people with evil intentions of enriching themselves.
        8y ago
jimbokun 8y ago
"The GDPR is the first data privacy regime that foresees heavy fines for serious violations - of up to 4 percent of a company’s global turnover." What would happen if a company decided that 4 percent of turnover is much cheaper than properly securing all of their data, and just chooses to pay the fine every year?
- Kalium 8y ago
  For a public company? Probably rapid replacement of the C-suite. Almost nobody has margins fat enough to put up with that.
  - devmunchies 8y ago
    Would pulling out of EU be a better decision in this scenario?
    - bassman9000 8y ago
      Good. Then someone with a different business model, not relying on selling the user, would fill the gap. And make billions.
    - jimnotgym 8y ago
      The EU is a huge market. Why would you not want to sell to them?
    - Kalium 8y ago
      Depends on how large the company's expected market is there. In most cases, the sheer size and wealth of the EU makes this also a bad idea. Of course, there are hypothetical scenarios - though I can't think of a realistic one right now - where the EU division is only profitable with the economies of scale enabled by worldwide data-sharing. The assumption that anything and everything can be done profitable in a GDPR-compliant way is naive at best, deluded at worst, but not universally wrong. Though between GDPR and the link tax proposal I can see news aggregators ceasing to exist entirely within the EU. Which seems very likely to do a great deal of harm to a lot of newspapers.
yuhong 8y ago
In the mean time, I just posted a new draft: http://yuhongbao.blogspot.com/2018/09/google-doubleclick-mozilla-overview_92.html http://yuhongbao.blogspot.com/2018/09/google-doubleclick-moz...
losvedir 8y ago
I used Brave for a while, and still like it, but ultimately this bug[0] prompted me to move back to mobile Chrome, unfortunately. Hope they fix it soon! [0] https://github.com/brave/browser-android-tabs/issues/459 https://github.com/brave/browser-android-tabs/issues/459
- therealdrag0 8y ago
  Ya. I like the idea, but it was took buggy for me on iOS.
  - jonathansampson 8y ago
    I love to invite the two of you to try the desktop builds; we recently announced the developer preview builds of our brave-core version (on track to be our 1.0 release). This version will also bring some unity to the desktop, iOS, and Android versions. You can find this version online at brave.com/download-dev Also, thanks for the bug link. If there are any other items on iOS and/or Android that I can review, please do share.
- andirk 8y ago
  I use Brave primarily on mobile. Saves maybe >50% battery. Chrome when i need to. Set Brave as the default so other apps use it. So fast.
deleted 8y ago
[deleted]
dkhenry 8y ago
Maybe they can get Netflix working on Linux in addition to trying to use governments to shut down their competition. I _want_ to use brave, but without a fully working browser its hard to switch off firefox.
- jonathansampson 8y ago
  Can you elaborate as to what issue(s) you're seeing with Netflix? I know that we use WideVine for DMR content; it could be that this simply isn't an option for the time being. If you can share more information, I'll do my best to address it in a timely manner. Also, version information would be helpful. In brave-muon you can find this in about:brave. In brave-core, it's in about:version. Thank you!
  - dkhenry 8y ago
    Netflix reports widevine isn't available. I am running stock ubuntu and I installed Brave from the official brave-apt. Here is the github issue where you are tracking when it will be done https://github.com/brave/brave-browser/issues/413 https://github.com/brave/brave-browser/issues/413 Also for good measure my version info Brave: 0.23.105 V8: 6.8.275.24 rev: 9a46f8f5cb22a9daf2af21989aed25911aa6f839 Muon: 8.0.9 OS Release: 4.15.0-29-generic Update Channel: Release OS Architecture: x64 OS Platform: Linux Node.js: 7.9.0 Brave Sync: v1.4.2 libchromiumcontent: 68.0.3440.84
    - jonathansampson 8y ago
      Thank you for the excellent response, and for linking to the issue on file. Glad to hear that it's already on our radar, and being tracked. All the best!
- andirk 8y ago
  Use Brave by default and use other browsers when necessary.
testACCT321 8y ago
This is one of the best test comments ever. Its bigly.
GuB-42 8y ago
Good, whatever the result will be, it will hopefully clarify what GDPR is all about.
DevKoala 8y ago
Brave is trying to fix the broken ad-tech industry with a monopoly on the decision of what gets tracked and what doesn't. I am not behind it at all.
- jonathansampson 8y ago
  Respectfully, you're not at all correct. Brave is aiming to cut out the tracking entirely. No user tracking. That's our default, out of the box behavior. Brave Ads, which is an optional component, also will not track the user. Local machine-learning will decide what willing users are interested in, and whether or not to show them particular ads. The Brave Ads system is antithetical to the current form of digital advertising. Rather than radiating personal information to innumerable third parties, you secure your data on your device, and let your device privately and securely determine what you would like, or would not like, to see.
  - DevKoala 8y ago
    "Local machine-learning will decide what willing users are interested in, and whether or not to show them particular ads." How are you countering my claim? It is trying to establish a monopoly on the ad-targeting protocol. Brave is not a regulated party, and as well-intended as Brave could be, all it essentially doing is moving one part of the architecture to the client, and granting control over it to a single party. Google used to "do no evil" what guarantees Brave will not?
    - jonathansampson 8y ago
      You're downplaying the implication of "moving one part of the architecture to the client". This inversion of the model means the user is sovereign over their data. It means ad fraud (responsible for billions lost) is dealt a massive blow. It means the publisher doesn't have to watch hand after hand take from their revenue before it reaches them. It means the user, finally, can get paid for the limited commodity called "Attention". As for what guarantees Brave won't do evil, look at our design principles. When it came to syncing data from one device to another, we designed it in such a way that we could never see what data was moving from device to device. Encryption on the machine shields all eyes, including our own, from your data. Consider also Payments--the user's ability to support content creators. Even here we implemented the ANONIZE protocol to protect your anonymity and privacy. That alone wasn't satisfactory, so we also channel the info through a VPN to mask your location as well. All that we do remains open, and engineered in such a way that Brave couldn't abuse your trust even if we wanted to. This future friendly principle ensures that Brave couldn't turn sour on you in the future; not without a massive re-engineering effort beforehand. But even then, all of our code is open and auditable. Google was "Don't be evil," but Brave is "Can't be evil." The difference is subtle, yet profound.
buboard 8y ago
I 'm all for the EU trying to enact protectionist measures against the US invaders, but I'd rather they would do it in a straightforward, china-firewall way, than with these firework-like regulations that don't benefit the EU at all y (I mean, let's admit it after 20 years, EU just can't compete). On the one hand, GDPR has not reduced my ad revenue (Nor google's), despite not having tracked ads (which reinforces my belief that tracking is marketed as way more effective than it is). Now, this directive will not deprive Google of any revenue, while it will actively hurt the eu publishers big time (which google will drop).
nightsd01 8y ago
From what I understand, Google isn’t actually giving away people’s data to “hundreds of companies” for advertising purposes. When an advertiser wants to target a specific group of people, Google doesn’t say “here’s everyone’s private data, good luck”. GOOGLE does the filtering and targeting internally. I’m sorry but that isn’t evil or bad. Unless we want to start paying for google searches and Facebook, this is how it’s going to be. And personally, I actually like getting ads relevant to my life. For example, I even got my current job based off a highly relevant Facebook ad. My personal suspicion is that people are just jealous of how much success Google and Facebook have had.
- Jaepa 8y ago
  or this is just a PR stunt on a company who's trying to trumpet their "we block trackers like Google" functionality.
  - nostrademons 8y ago
    I'd bet it's a PR stunt. They're getting all kinds of publicity from this. ...that said, I installed Brave this weekend and am posting this comment from it, and I gotta say that it's really nice viewing a web without ads. I'd forgotten how pleasant browsing the web can be when you're not downloading the 100 or so ads & trackers on a typical news article and playing cat-and-mouse with their anti-AdBlock code. So from my selfish user's POV, this is a win.
    - andirk 8y ago
      Saves more than half your phone's battery life too. And content creators get paid.
    - BurningCycles 8y ago
      Or you can just install uBlock Origin. I don't see what Brave brings to the table.
      - nostrademons 8y ago
cjhanks 8y ago
I am not familiar with everything relevant here but... Often sites using ads will have JavaScript enabled. If I wanted to extract private information about my users - I need only scrape the content of sponsored advertisement. Google does the hard work of aggregating and anonymizing the data, I simple scrape their results on my page.
MarkMc 8y ago
The problem with GDPR is that it allows the website to decide how to ask the user for permission. That means the website can have a big bold button saying "I agree" next to a small gray link saying "I do not agree". Moreover if the user clicks "I do not agree" the website can nag the user often until he or she chooses the 'correct' option.
andirk 8y ago
Via advertising networks, I have been able to send messages to my friends via vanilla advertising campaigns. If you are not aware, understand that your internet activity can pinpoint you exact via simple ad networks and nothing else. I like Brave.
- harryh 8y ago
  I would love to read more about how you did this. I bet it would be illuminating for many HN readers.
  - berbec 8y ago
    No GP, but [1] How I targeted the Reddit CEO with Facebook ads to get an interview at Reddit) may be of interest to you. 1: https://news.ycombinator.com/item?id=17110385 https://news.ycombinator.com/item?id=17110385
lwansbrough 8y ago
Where can I file my adtech complaint against Google? (No where, trust me.) Their "algorithms" think an SVG on my site is malware (it's downloaded from the Apple website -- you know those "Get it on the app store" buttons?) Now we can't even show an in-house ad without getting an error about the site having "malware".

464 points by petethomas 8y ago

They are arguing that the surveillance core of adtech is a GDPR violation, if I understand correctly. > The complaint argues that when a person visits a website, intimate personal data that describe them and what they are doing online is broadcast to tens or hundreds of companies without their knowledge in order to auction and place ads. It would be great if someone with real expertise in GDPR or adtech could provide context: Isn't this violation obvious and therefore don't the adtech companies have a strategy prepared? Could a ruling effectively outlaw the modern surveillance-based online business model and therefore wouldn't this issue be existential for adtech? I don't know the details of GDPR and its application; perhaps this issue is narrower than it appears or maybe there are substantial ways to workaround a ruling and preserve the adtech model.

vkou 8y ago
Generally speaking, ad networks don't sell personal data. That's their secret sauce - selling it is largely counterproductive. I can't call up Yahoo, and ask to buy the personal data of "forapurpose". If I could, it would take me a few million dollars to build a clone of their most valuable asset - their user database. What they sell is ad spots in webpages, when those webpages are visited by people who satisfy some demographic matrix. The data itself, generally, does not get sold.
- forapurpose 8y ago
  Thanks. How does that apply in this case? Does GDPR allow the collection but ban the selling of data? Also, per the article, the complaint claims that the collected information is shared with many other companies. How does that square with what you are saying? Are they sharing it with partners but not selling it to them? Does that make a difference under GDPR?
  - kasey_junk 8y ago
    The OpenRTB spec does contain data that many assume will be found to be personal under GDPR. The IAB is an industry group for people that use OpenRTB. They have built a standard on how to gather and transmit the GDPR consent requirements from publisher through the OpenRTB ecosystem. You can find it at http://advertisingconsent.eu/ http://advertisingconsent.eu/
  - idunno2468 8y ago
    Used to be in adtech- google didn’t provide these things to us. Maybe there were other products we could have purchased, but google just gave us a userid and all the tracking was done on our side. There are definitely third parties we could buy this data from. I left pre gdpr but my vague understanding is google has nothing to worry about in rtb but the adtech companies are at fault here if anyone. Especially if you consider the amount of lawyers google pays vs brave
- pacala 8y ago
  While it is technically correct that ad networks don't sell personal data, it is also irrelevant. It's not the bits that matter, it's what one does informed by the bits. Ad networks sell _actionable insights_ informed by personal data. An ad network answers the question 'what is the best way to spend $$$ and win this election' _using_ personal data of millions of people, but not _revealing_ the personal data to the paying customer. The paying customer is highly unlikely to have the technical acumen to turn personal data into actionable insights anyways, service readily provided by the ad network. The fact that personal data was not revealed is irrelevant, the end effect was bought by anyways. The evil is in collecting personal data to begin with, not in the technical manner it is used against the people it belongs to.
  - fixermark 8y ago
    We're going off into the weeds of philosophy, but... Do you mean it's evil to collect the personal data for the purpose of selling ad impressions of it's evil to collect personal data, full-stop? I want companies like Google collecting my personal data to, for example, provide me context-relevant search and map navigation results and voice-assistant actions. So it doesn't seem like evil-full-stop passes the smell test.
  - Nasrudith 8y ago
    While there is some evil involved with targetted advertising there is a significant difference between that and direct data selling. The latter would be way worse. One tries to sell you weird stuff after you look up the infamous giant barrel of lube after hearing about all of the joke reviews. The other gives the lines of an honest man to hang you with to anyone willing to pay and spin you as a colossal pervert. It is why video rentals were protected information. That and the sublime trolling of reading Robert Bork's video rentals into official record after he stated there was no constitutional right to privacy.
    - pacala 8y ago
      Fair enough. N:M surveillance is worse than N:1 surveillance from a personal perspective. Though unclear if that also holds at scale. They are still both evil and much worse than no surveillance.
- kevin_thibedeau 8y ago
  The trackers that generate analytics data for the ad networks do sell personal data and it is made available to anyone who wants to pay.
stvswn 8y ago
So the publisher, through a platform, issues a bid request to an exchange with a lot of information in it. The parameters of that bid request contain all kinds of context like the site, the browser or device, etc. Critically, it also includes the cookie. The way GDPR has been interpreted by Google (btw Google is considered to be overly conservative in its approach by the adtech world): Cookies can only be passed by publishers who get consent to collect and pass them, and they must get consent for each adtech vendor. Furthermore, Google will not pass those cookies to anyone else because it can't be sure that the vendor receiving them was given consent by the user. Other platforms haven't done that last part; and some publishers are even saying that they refuse to collect affirmative consent. This is because people interpret it differently. From my reading, Brave seems to be trying to drive for a new interpretation: it's not only a matter of cookies, which is the parameter associated with a user, it's a matter of ALL the info even when it's not related to tracking a single user. My guess is that Eich's hoping to get a court to adopt this new stricter interpretation, but if that were to happen it would mean that the regulators' guidance thus far would be moot and all of the mitigations the adtech world has gone through to prepare would be out the window.
- icebraining 8y ago
  Is that guidance publicly available? As a layman, Brave's interpretation makes perfect sense - those parameters are related "to an identified or identifiable natural person".
  - stvswn 8y ago
    Article 4.1 itself, as it goes on, defines personal data in a way that it relates specifically to that which can identify someone, so it doesn't mean literally anything about the ad placement simply because a person is seeing the ad. Definition of personal data: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."
frabcus 8y ago
Currently the adtech companies trying to rely on the legal basis of Consent - they get the user to explicitly agree to the processing required for targeted advertising with a popup advert. There is a great NGO of lawyers called NOYB (None of Your Business) in Austria who has filed complaints with Facebook, WhatsApp, Instagram and Android about the consent dialogs not being valid under GDPR. The complaint PDFs are worth glancing through to see how disingenuous the adtech companies are in their attempts to appear to comply with consent, when I think anyone reasonable would agree they are not. https://noyb.eu/ https://noyb.eu/ I'm curious as to the detail of Brave's complaint, which seems to add even more to this.

_xgw 8y ago

This comes at the same time that Malwarebytes starts flagging Brave as malware[1]. [1] https://twitter.com/lukesawczak/status/1039854898068815873 https://twitter.com/lukesawczak/status/1039854898068815873

sam_goody 8y ago
Malwarebytes has had a few (seemingly) false positives lately. Anecdotally, I was just hit by it falsely flagging BeyondCompare and my password manager. I assume they have just upped the ante of their heuristics, but am still concerned about the fallout, since I am starting to ignore them. Not related, but considering that it does not scan except on demand, why is it ALWAYS running? Who vouches for Mr. Malwarebytes?
- whoopdedo 8y ago
  Not to mention more aggressive upselling in the free version via popups. Closing the application sends it to the system tray where it will later remind you to "update" MalwareBytes by buying a license.
- styfle 8y ago
  In June, I too had an auto-update from Beyond Compare failing due to Malwarebytes and it made me think their servers were compromised. Nope, false positive. It looks like this happens often enough, there is a whole page dedicated to false positives. https://www.scootersoftware.com/support.php?zz=kb_virus https://www.scootersoftware.com/support.php?zz=kb_virus
- jonathansampson 8y ago
  It was indeed a false-positive: https://twitter.com/thomasareed/status/1039939712704819200 https://twitter.com/thomasareed/status/1039939712704819200. As for vouching for MB, I know some of the people behind the project, and they're spectacular. For years I have assisted with deobfuscating malicious JavaScript and more. They seem, to me, to have the purest of intentions. (Not an official Brave endorsement, but I personally like their team)
8y ago

_red 8y ago

Its admirable what brave is trying to do. Practically speaking, its one of the best chance we have of creating a new internet where the incentives are more privacy focused. Hope they succeed.

snaky 8y ago
A new internet where $273 billion advertising industry does not exist?
- legatus 8y ago
  Can I ask what the amount of money that can be made has to do with this? First of all: they make a case against a particular type of advertising, not all of them. While I honestly believe an argument can be made against any type of advertisement, that's not what they're doing. Second: if an industry is based on immoral practices, what do we care if they make a lot of money? It's like saying "we should not go against slavery, it's a $X billions industry". If they make the money by using data the users did not know they were giving, then I don't care how much money they make: they should not be making it.
  - fixermark 8y ago
    Human weighting of incentive signals differs. "We should not go against slavery, it's an $X billions industry" isn't precisely how the US South thought about the problem, but ultimately they did go to war because they recognized that chnage in the status quo would bring utter economic ruin to a powerful sector of the populace with the political and social clout to goad the rest into war. So yeah, "That industry makes an awful lot of cash" is useful to factor into one's thought process when one tries to reason through how one could tear it down. If nothing else, it's a first-approximation barometer of how much people will spend to oppose your efforts.
    - bduerst 8y ago
      Slavery is a bad analogy. The increased buying power of the new consumers (freed slaves) is economically more beneficial than having them locked in as non-consumers (slaves).

atomical 8y ago

A few typos in the article: > Were the regulator to find in favor of the plaintiffs, that could undermine the foundations of the data-driven model on with the online ad industry - forecast by research firm eMarketer to grow to $273 billion this year - depends. with = which The GDPR is the first data privacy regime that foresees heavy fines for serious violations - of up to 4 percent of a company’s global turnover. foresees = oversees ?

dmix 8y ago
foresees is perfectly fine in that sentence.
- atomical 8y ago
  Are they actually predicting that outcome?

martindale 8y ago

Brave's strategy of replacing ads with other ads isn't going to do anyone any good. They could've used payment channels to build a content distribution network, but alas...

atomical 8y ago
Why? They are ensuring user privacy by doing all machine learning locally. Google had the unofficial "don't be evil" motto and Brave has "can't be evil" as a motto.
- deleted 8y ago
  [deleted]
jonathansampson 8y ago
I'd like to respond, as a developer on the Brave project. We don't simply replace ads with other ads. The entire ad landscape has been co-opted by those who aim to collect as much data about you as is possible. Over 600 million devices were running some form of ad-blocking software in 2017, and that was an increase of 30% from the year prior. This number keeps growing, year over year. Something has to be done. Users who come to Brave are already blocking ads. They understand the risk involved in letting third-party software collect information about them, their person, their browsing habits, and more. Further, the risk of drive-by downloads is on the rise (or the growing popularity of crypto-jacking). Brave blocks ads and trackers for safety and privacy reasons. But we are not so naive to miss the impact this has on well-meaning publishers. This is why we created the User Growth Pool, and the Brave Payments system. Every month we pour hundreds of thousands of dollars back into the pockets of content creators by way of BAT (Basic Attention Token) grants, distributed freely to users of the Brave browser. But grants won't last forever, something sustainable has be erected in place of the incumbent digital advertising system. This is where Brave Ads comings into play. For users who opt in, Brave can deliver better quality ads, without the risk of personal data leakage. We do this by using local machine-learning to understand the user better, and making local decisions as to which ads should or should not be shown, and when (the user controls all of this). Furthermore, the user gets 70% of the ad revenue for browser-private ads. When you consider the amount of money lost to digital ad fraud each year (over $20,000,000,000 I believe), you can see how the Brave system would lead to a much better, and more sustainable future for the web. We're not simply replacing ads. We're rescuing an industry.

kingbirdy 8y ago

Seems like a strange choice to file a GDRP complaint in a country that will stop being an EU member state in less than a year, but I'm sure their lawyers know more than I do

fixermark 8y ago
I wonder if they're gambling that Brexit will implode? Seems like a lot of people are. ;)
frabcus 8y ago
The UK Government has said GDPR will continue to apply after Brexit, and passed the laws to make that the case. http://www.blplaw.com/expert-legal-insights/articles/gdpr-and-brexit-uk-government-unveils-data-protection-plans http://www.blplaw.com/expert-legal-insights/articles/gdpr-an... The official reason given being: "Over 70% of all trade in services are enabled by data flows, meaning that data protection is critical to international trade." While Britain is on course to leave the EU (one specific body), it will continue to co-operate at a European (continent) level in all sorts of ways. Common data protection legislation being one example. I'm curious though why Brave chose Britain and Ireland as the two places to complain. Maybe because English speaking?
- floatingatoll 8y ago
  Google EU routes all revenue through an Irish shell corporation, right?

manigandham 8y ago

Google (and Facebook) already have consent from the majority of users who don't care about this and would rather keep access to gmail, youtube, and social networks. Nice try, like GDPR itself, but the intent does not match the implementation. There are trillions in market cap standing in the way and this will end in nothing but a waste of legal fees.

tjoff 8y ago
GDPR consent doesn't work like that...
- blub 8y ago
  OP is working in the ad space and he's been complaining about the GDPR forever. They're still in the denial phase.
  - 3K7m7bUZyWA1KCD 8y ago
    As a European I can't help but wonder if other proposed reforms, such as Article 11 and Article 13, will do more good to the end user than not, just like what happened with GDPR. I've seen so many enraged comments related to the new copyright laws, that my instinct says it will be a good thing.
  - manigandham 8y ago
    I'm sure you think you know something about me from a cursory browsing of my comment history, but that wouldn't reveal anything important like the fact that I'm one of the top 5 people in the ad industry who has called for regulation for years, and actually spent the time and money on trying to make it happen, and also did so in the US market which completely dwarfs anything in Europe. But since you're operating on assumptions and have nothing better to offer than saying "denial", then I'll just go ahead and assume that your experience with both adtech and GDPR amounts to something less than insignificant and that your future comments on this topic will remain lacking.
- manigandham 8y ago

fiatjaf 8y ago

The Basic Attention Token is an idea waiting to be reimplemented with Bitcoin and Lightning.

nil_pointer 8y ago
What is special about implementing anything Bitcoin+Lightning? BAT clones are already being developed on EOS and IOTA (both speedy networks with 0 cost transactions). Here's the IOTA advertising project: https://oysterprotocol.com/ https://oysterprotocol.com/
- fiatjaf 8y ago
  Didn't know that. It's good news people are willing to reimplement BAT. Special about Bitcoin+Lightning is that these are probably going to last and truly function as money while these others you cited don't.
  - sincerely 8y ago
    This is a really strange claim, from the perspective of someone not invested in any specific implementation of crypto or blockchains...why would the first product in a given (tech) category be the one that lasts the longest? That would be like expecting WebCrawler to be the dominant search engine or Six Degrees to be the dominant online social media site, or Mosaic to be the browser with the highest usage %. I can't figure out why someone would make this argument unless they have a personal interest in keeping Bitcoin's value high.
    - fiatjaf 8y ago
      Basically you think Bitcoin cannot ever be "the one that lasts the longest" just because it was the first implementation? That's a valid argument, but it makes no sense to think that all other arguments that claim the contrary are invalid and can only be made by people with evil intentions of enriching themselves.
      - 8y ago

jimbokun 8y ago

"The GDPR is the first data privacy regime that foresees heavy fines for serious violations - of up to 4 percent of a company’s global turnover." What would happen if a company decided that 4 percent of turnover is much cheaper than properly securing all of their data, and just chooses to pay the fine every year?

Kalium 8y ago
For a public company? Probably rapid replacement of the C-suite. Almost nobody has margins fat enough to put up with that.
- devmunchies 8y ago
  Would pulling out of EU be a better decision in this scenario?
  - bassman9000 8y ago
    Good. Then someone with a different business model, not relying on selling the user, would fill the gap. And make billions.
  - jimnotgym 8y ago
    The EU is a huge market. Why would you not want to sell to them?
  - Kalium 8y ago
    Depends on how large the company's expected market is there. In most cases, the sheer size and wealth of the EU makes this also a bad idea. Of course, there are hypothetical scenarios - though I can't think of a realistic one right now - where the EU division is only profitable with the economies of scale enabled by worldwide data-sharing. The assumption that anything and everything can be done profitable in a GDPR-compliant way is naive at best, deluded at worst, but not universally wrong. Though between GDPR and the link tax proposal I can see news aggregators ceasing to exist entirely within the EU. Which seems very likely to do a great deal of harm to a lot of newspapers.

yuhong 8y ago

In the mean time, I just posted a new draft: http://yuhongbao.blogspot.com/2018/09/google-doubleclick-mozilla-overview_92.html http://yuhongbao.blogspot.com/2018/09/google-doubleclick-moz...

losvedir 8y ago

I used Brave for a while, and still like it, but ultimately this bug[0] prompted me to move back to mobile Chrome, unfortunately. Hope they fix it soon! [0] https://github.com/brave/browser-android-tabs/issues/459 https://github.com/brave/browser-android-tabs/issues/459

therealdrag0 8y ago
Ya. I like the idea, but it was took buggy for me on iOS.
- jonathansampson 8y ago
  I love to invite the two of you to try the desktop builds; we recently announced the developer preview builds of our brave-core version (on track to be our 1.0 release). This version will also bring some unity to the desktop, iOS, and Android versions. You can find this version online at brave.com/download-dev Also, thanks for the bug link. If there are any other items on iOS and/or Android that I can review, please do share.
andirk 8y ago
I use Brave primarily on mobile. Saves maybe >50% battery. Chrome when i need to. Set Brave as the default so other apps use it. So fast.

deleted 8y ago

[deleted]

dkhenry 8y ago

Maybe they can get Netflix working on Linux in addition to trying to use governments to shut down their competition. I _want_ to use brave, but without a fully working browser its hard to switch off firefox.

jonathansampson 8y ago
Can you elaborate as to what issue(s) you're seeing with Netflix? I know that we use WideVine for DMR content; it could be that this simply isn't an option for the time being. If you can share more information, I'll do my best to address it in a timely manner. Also, version information would be helpful. In brave-muon you can find this in about:brave. In brave-core, it's in about:version. Thank you!
- dkhenry 8y ago
  Netflix reports widevine isn't available. I am running stock ubuntu and I installed Brave from the official brave-apt. Here is the github issue where you are tracking when it will be done https://github.com/brave/brave-browser/issues/413 https://github.com/brave/brave-browser/issues/413 Also for good measure my version info Brave: 0.23.105 V8: 6.8.275.24 rev: 9a46f8f5cb22a9daf2af21989aed25911aa6f839 Muon: 8.0.9 OS Release: 4.15.0-29-generic Update Channel: Release OS Architecture: x64 OS Platform: Linux Node.js: 7.9.0 Brave Sync: v1.4.2 libchromiumcontent: 68.0.3440.84
  - jonathansampson 8y ago
    Thank you for the excellent response, and for linking to the issue on file. Glad to hear that it's already on our radar, and being tracked. All the best!
andirk 8y ago
Use Brave by default and use other browsers when necessary.

testACCT321 8y ago

This is one of the best test comments ever. Its bigly.

GuB-42 8y ago

Good, whatever the result will be, it will hopefully clarify what GDPR is all about.

DevKoala 8y ago

Brave is trying to fix the broken ad-tech industry with a monopoly on the decision of what gets tracked and what doesn't. I am not behind it at all.

jonathansampson 8y ago
Respectfully, you're not at all correct. Brave is aiming to cut out the tracking entirely. No user tracking. That's our default, out of the box behavior. Brave Ads, which is an optional component, also will not track the user. Local machine-learning will decide what willing users are interested in, and whether or not to show them particular ads. The Brave Ads system is antithetical to the current form of digital advertising. Rather than radiating personal information to innumerable third parties, you secure your data on your device, and let your device privately and securely determine what you would like, or would not like, to see.
- DevKoala 8y ago
  "Local machine-learning will decide what willing users are interested in, and whether or not to show them particular ads." How are you countering my claim? It is trying to establish a monopoly on the ad-targeting protocol. Brave is not a regulated party, and as well-intended as Brave could be, all it essentially doing is moving one part of the architecture to the client, and granting control over it to a single party. Google used to "do no evil" what guarantees Brave will not?
  - jonathansampson 8y ago
    You're downplaying the implication of "moving one part of the architecture to the client". This inversion of the model means the user is sovereign over their data. It means ad fraud (responsible for billions lost) is dealt a massive blow. It means the publisher doesn't have to watch hand after hand take from their revenue before it reaches them. It means the user, finally, can get paid for the limited commodity called "Attention". As for what guarantees Brave won't do evil, look at our design principles. When it came to syncing data from one device to another, we designed it in such a way that we could never see what data was moving from device to device. Encryption on the machine shields all eyes, including our own, from your data. Consider also Payments--the user's ability to support content creators. Even here we implemented the ANONIZE protocol to protect your anonymity and privacy. That alone wasn't satisfactory, so we also channel the info through a VPN to mask your location as well. All that we do remains open, and engineered in such a way that Brave couldn't abuse your trust even if we wanted to. This future friendly principle ensures that Brave couldn't turn sour on you in the future; not without a massive re-engineering effort beforehand. But even then, all of our code is open and auditable. Google was "Don't be evil," but Brave is "Can't be evil." The difference is subtle, yet profound.

buboard 8y ago

I 'm all for the EU trying to enact protectionist measures against the US invaders, but I'd rather they would do it in a straightforward, china-firewall way, than with these firework-like regulations that don't benefit the EU at all y (I mean, let's admit it after 20 years, EU just can't compete). On the one hand, GDPR has not reduced my ad revenue (Nor google's), despite not having tracked ads (which reinforces my belief that tracking is marketed as way more effective than it is). Now, this directive will not deprive Google of any revenue, while it will actively hurt the eu publishers big time (which google will drop).

nightsd01 8y ago

From what I understand, Google isn’t actually giving away people’s data to “hundreds of companies” for advertising purposes. When an advertiser wants to target a specific group of people, Google doesn’t say “here’s everyone’s private data, good luck”. GOOGLE does the filtering and targeting internally. I’m sorry but that isn’t evil or bad. Unless we want to start paying for google searches and Facebook, this is how it’s going to be. And personally, I actually like getting ads relevant to my life. For example, I even got my current job based off a highly relevant Facebook ad. My personal suspicion is that people are just jealous of how much success Google and Facebook have had.

Jaepa 8y ago
or this is just a PR stunt on a company who's trying to trumpet their "we block trackers like Google" functionality.
- nostrademons 8y ago
  I'd bet it's a PR stunt. They're getting all kinds of publicity from this. ...that said, I installed Brave this weekend and am posting this comment from it, and I gotta say that it's really nice viewing a web without ads. I'd forgotten how pleasant browsing the web can be when you're not downloading the 100 or so ads & trackers on a typical news article and playing cat-and-mouse with their anti-AdBlock code. So from my selfish user's POV, this is a win.
  - andirk 8y ago
    Saves more than half your phone's battery life too. And content creators get paid.
  - BurningCycles 8y ago
    Or you can just install uBlock Origin. I don't see what Brave brings to the table.
    - nostrademons 8y ago

cjhanks 8y ago

I am not familiar with everything relevant here but... Often sites using ads will have JavaScript enabled. If I wanted to extract private information about my users - I need only scrape the content of sponsored advertisement. Google does the hard work of aggregating and anonymizing the data, I simple scrape their results on my page.

MarkMc 8y ago

The problem with GDPR is that it allows the website to decide how to ask the user for permission. That means the website can have a big bold button saying "I agree" next to a small gray link saying "I do not agree". Moreover if the user clicks "I do not agree" the website can nag the user often until he or she chooses the 'correct' option.

andirk 8y ago

Via advertising networks, I have been able to send messages to my friends via vanilla advertising campaigns. If you are not aware, understand that your internet activity can pinpoint you exact via simple ad networks and nothing else. I like Brave.

harryh 8y ago
I would love to read more about how you did this. I bet it would be illuminating for many HN readers.
- berbec 8y ago
  No GP, but [1] How I targeted the Reddit CEO with Facebook ads to get an interview at Reddit) may be of interest to you. 1: https://news.ycombinator.com/item?id=17110385 https://news.ycombinator.com/item?id=17110385

lwansbrough 8y ago

Where can I file my adtech complaint against Google? (No where, trust me.) Their "algorithms" think an SVG on my site is malware (it's downloaded from the Apple website -- you know those "Get it on the app store" buttons?) Now we can't even show an in-house ad without getting an error about the site having "malware".