4 ms·

They are arguing that the surveillance core of adtech is a GDPR violation, if I understand correctly. > The complaint argues that when a person visits a websit

They are arguing that the surveillance core of adtech is a GDPR violation, if I understand correctly. > The complaint argues that when a person visits a website, intimate personal data that describe them and what they are doing online is broadcast to tens or hundreds of companies without their knowledge in order to auction and place ads. It would be great if someone with real expertise in GDPR or adtech could provide context: Isn't this violation obvious and therefore don't the adtech companies have a strategy prepared? Could a ruling effectively outlaw the modern surveillance-based online business model and therefore wouldn't this issue be existential for adtech? I don't know the details of GDPR and its application; perhaps this issue is narrower than it appears or maybe there are substantial ways to workaround a ruling and preserve the adtech model.

vkou 8y ago
Generally speaking, ad networks don't sell personal data. That's their secret sauce - selling it is largely counterproductive. I can't call up Yahoo, and ask to buy the personal data of "forapurpose". If I could, it would take me a few million dollars to build a clone of their most valuable asset - their user database. What they sell is ad spots in webpages, when those webpages are visited by people who satisfy some demographic matrix. The data itself, generally, does not get sold.
- forapurpose 8y ago
  Thanks. How does that apply in this case? Does GDPR allow the collection but ban the selling of data? Also, per the article, the complaint claims that the collected information is shared with many other companies. How does that square with what you are saying? Are they sharing it with partners but not selling it to them? Does that make a difference under GDPR?
  - kasey_junk 8y ago
    The OpenRTB spec does contain data that many assume will be found to be personal under GDPR. The IAB is an industry group for people that use OpenRTB. They have built a standard on how to gather and transmit the GDPR consent requirements from publisher through the OpenRTB ecosystem. You can find it at http://advertisingconsent.eu/ http://advertisingconsent.eu/
  - idunno2468 8y ago
    Used to be in adtech- google didn’t provide these things to us. Maybe there were other products we could have purchased, but google just gave us a userid and all the tracking was done on our side. There are definitely third parties we could buy this data from. I left pre gdpr but my vague understanding is google has nothing to worry about in rtb but the adtech companies are at fault here if anyone. Especially if you consider the amount of lawyers google pays vs brave
- pacala 8y ago
  While it is technically correct that ad networks don't sell personal data, it is also irrelevant. It's not the bits that matter, it's what one does informed by the bits. Ad networks sell _actionable insights_ informed by personal data. An ad network answers the question 'what is the best way to spend $$$ and win this election' _using_ personal data of millions of people, but not _revealing_ the personal data to the paying customer. The paying customer is highly unlikely to have the technical acumen to turn personal data into actionable insights anyways, service readily provided by the ad network. The fact that personal data was not revealed is irrelevant, the end effect was bought by anyways. The evil is in collecting personal data to begin with, not in the technical manner it is used against the people it belongs to.
  - fixermark 8y ago
    We're going off into the weeds of philosophy, but... Do you mean it's evil to collect the personal data for the purpose of selling ad impressions of it's evil to collect personal data, full-stop? I want companies like Google collecting my personal data to, for example, provide me context-relevant search and map navigation results and voice-assistant actions. So it doesn't seem like evil-full-stop passes the smell test.
  - Nasrudith 8y ago
    While there is some evil involved with targetted advertising there is a significant difference between that and direct data selling. The latter would be way worse. One tries to sell you weird stuff after you look up the infamous giant barrel of lube after hearing about all of the joke reviews. The other gives the lines of an honest man to hang you with to anyone willing to pay and spin you as a colossal pervert. It is why video rentals were protected information. That and the sublime trolling of reading Robert Bork's video rentals into official record after he stated there was no constitutional right to privacy.
    - pacala 8y ago
      Fair enough. N:M surveillance is worse than N:1 surveillance from a personal perspective. Though unclear if that also holds at scale. They are still both evil and much worse than no surveillance.
- kevin_thibedeau 8y ago
  The trackers that generate analytics data for the ad networks do sell personal data and it is made available to anyone who wants to pay.
stvswn 8y ago
So the publisher, through a platform, issues a bid request to an exchange with a lot of information in it. The parameters of that bid request contain all kinds of context like the site, the browser or device, etc. Critically, it also includes the cookie. The way GDPR has been interpreted by Google (btw Google is considered to be overly conservative in its approach by the adtech world): Cookies can only be passed by publishers who get consent to collect and pass them, and they must get consent for each adtech vendor. Furthermore, Google will not pass those cookies to anyone else because it can't be sure that the vendor receiving them was given consent by the user. Other platforms haven't done that last part; and some publishers are even saying that they refuse to collect affirmative consent. This is because people interpret it differently. From my reading, Brave seems to be trying to drive for a new interpretation: it's not only a matter of cookies, which is the parameter associated with a user, it's a matter of ALL the info even when it's not related to tracking a single user. My guess is that Eich's hoping to get a court to adopt this new stricter interpretation, but if that were to happen it would mean that the regulators' guidance thus far would be moot and all of the mitigations the adtech world has gone through to prepare would be out the window.
- icebraining 8y ago
  Is that guidance publicly available? As a layman, Brave's interpretation makes perfect sense - those parameters are related "to an identified or identifiable natural person".
  - stvswn 8y ago
    Article 4.1 itself, as it goes on, defines personal data in a way that it relates specifically to that which can identify someone, so it doesn't mean literally anything about the ad placement simply because a person is seeing the ad. Definition of personal data: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."
frabcus 8y ago
Currently the adtech companies trying to rely on the legal basis of Consent - they get the user to explicitly agree to the processing required for targeted advertising with a popup advert. There is a great NGO of lawyers called NOYB (None of Your Business) in Austria who has filed complaints with Facebook, WhatsApp, Instagram and Android about the consent dialogs not being valid under GDPR. The complaint PDFs are worth glancing through to see how disingenuous the adtech companies are in their attempts to appear to comply with consent, when I think anyone reasonable would agree they are not. https://noyb.eu/ https://noyb.eu/ I'm curious as to the detail of Brave's complaint, which seems to add even more to this.

vkou 8y ago

Generally speaking, ad networks don't sell personal data. That's their secret sauce - selling it is largely counterproductive. I can't call up Yahoo, and ask to buy the personal data of "forapurpose". If I could, it would take me a few million dollars to build a clone of their most valuable asset - their user database. What they sell is ad spots in webpages, when those webpages are visited by people who satisfy some demographic matrix. The data itself, generally, does not get sold.

forapurpose 8y ago
Thanks. How does that apply in this case? Does GDPR allow the collection but ban the selling of data? Also, per the article, the complaint claims that the collected information is shared with many other companies. How does that square with what you are saying? Are they sharing it with partners but not selling it to them? Does that make a difference under GDPR?
- kasey_junk 8y ago
  The OpenRTB spec does contain data that many assume will be found to be personal under GDPR. The IAB is an industry group for people that use OpenRTB. They have built a standard on how to gather and transmit the GDPR consent requirements from publisher through the OpenRTB ecosystem. You can find it at http://advertisingconsent.eu/ http://advertisingconsent.eu/
- idunno2468 8y ago
  Used to be in adtech- google didn’t provide these things to us. Maybe there were other products we could have purchased, but google just gave us a userid and all the tracking was done on our side. There are definitely third parties we could buy this data from. I left pre gdpr but my vague understanding is google has nothing to worry about in rtb but the adtech companies are at fault here if anyone. Especially if you consider the amount of lawyers google pays vs brave
pacala 8y ago
While it is technically correct that ad networks don't sell personal data, it is also irrelevant. It's not the bits that matter, it's what one does informed by the bits. Ad networks sell _actionable insights_ informed by personal data. An ad network answers the question 'what is the best way to spend $$$ and win this election' _using_ personal data of millions of people, but not _revealing_ the personal data to the paying customer. The paying customer is highly unlikely to have the technical acumen to turn personal data into actionable insights anyways, service readily provided by the ad network. The fact that personal data was not revealed is irrelevant, the end effect was bought by anyways. The evil is in collecting personal data to begin with, not in the technical manner it is used against the people it belongs to.
- fixermark 8y ago
  We're going off into the weeds of philosophy, but... Do you mean it's evil to collect the personal data for the purpose of selling ad impressions of it's evil to collect personal data, full-stop? I want companies like Google collecting my personal data to, for example, provide me context-relevant search and map navigation results and voice-assistant actions. So it doesn't seem like evil-full-stop passes the smell test.
- Nasrudith 8y ago
  While there is some evil involved with targetted advertising there is a significant difference between that and direct data selling. The latter would be way worse. One tries to sell you weird stuff after you look up the infamous giant barrel of lube after hearing about all of the joke reviews. The other gives the lines of an honest man to hang you with to anyone willing to pay and spin you as a colossal pervert. It is why video rentals were protected information. That and the sublime trolling of reading Robert Bork's video rentals into official record after he stated there was no constitutional right to privacy.
  - pacala 8y ago
    Fair enough. N:M surveillance is worse than N:1 surveillance from a personal perspective. Though unclear if that also holds at scale. They are still both evil and much worse than no surveillance.
kevin_thibedeau 8y ago
The trackers that generate analytics data for the ad networks do sell personal data and it is made available to anyone who wants to pay.

stvswn 8y ago

So the publisher, through a platform, issues a bid request to an exchange with a lot of information in it. The parameters of that bid request contain all kinds of context like the site, the browser or device, etc. Critically, it also includes the cookie. The way GDPR has been interpreted by Google (btw Google is considered to be overly conservative in its approach by the adtech world): Cookies can only be passed by publishers who get consent to collect and pass them, and they must get consent for each adtech vendor. Furthermore, Google will not pass those cookies to anyone else because it can't be sure that the vendor receiving them was given consent by the user. Other platforms haven't done that last part; and some publishers are even saying that they refuse to collect affirmative consent. This is because people interpret it differently. From my reading, Brave seems to be trying to drive for a new interpretation: it's not only a matter of cookies, which is the parameter associated with a user, it's a matter of ALL the info even when it's not related to tracking a single user. My guess is that Eich's hoping to get a court to adopt this new stricter interpretation, but if that were to happen it would mean that the regulators' guidance thus far would be moot and all of the mitigations the adtech world has gone through to prepare would be out the window.

icebraining 8y ago
Is that guidance publicly available? As a layman, Brave's interpretation makes perfect sense - those parameters are related "to an identified or identifiable natural person".
- stvswn 8y ago
  Article 4.1 itself, as it goes on, defines personal data in a way that it relates specifically to that which can identify someone, so it doesn't mean literally anything about the ad placement simply because a person is seeing the ad. Definition of personal data: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person."

frabcus 8y ago

Currently the adtech companies trying to rely on the legal basis of Consent - they get the user to explicitly agree to the processing required for targeted advertising with a popup advert. There is a great NGO of lawyers called NOYB (None of Your Business) in Austria who has filed complaints with Facebook, WhatsApp, Instagram and Android about the consent dialogs not being valid under GDPR. The complaint PDFs are worth glancing through to see how disingenuous the adtech companies are in their attempts to appear to comply with consent, when I think anyone reasonable would agree they are not. https://noyb.eu/ https://noyb.eu/ I'm curious as to the detail of Brave's complaint, which seems to add even more to this.