7 ms·

The author of this article didn't bother to read even a summary of the GDPR law. It doesn't matter what the user consents to, you cannot use their personal data

The author of this article didn't bother to read even a summary of the GDPR law. It doesn't matter what the user consents to, you cannot use their personal data ad hoc. You need to justify its collection, storage and transfer to the regulator, not the user. This is in contrast to the ill thought out cookie law where websites could get away with it by irritating consent banners. Sort of like, but not exactly the same as, those consent forms you sign when you go river rafting. They do not legally protect the rafting company from negligence. In fact, they're almost a waste of paper.

sarabande 8y ago
I bet rafting consent forms are still useful in the sense that they discourage most people with trivial-to-moderate injuries from thinking about holding the company liable.
- ghaff 8y ago
  As someone who leads outdoor trips, I've been told (not sure how true) that one of the supposed benefits is that it informs about dangers. So someone who suffers an injury--not through negligence on the part of the trip leader--would have a tougher case arguing that no one told them that the activity was other than completely safe and they wouldn't have done it had they known. On the other hand, I've also been told by lawyers that the usual scrawl your signature at the bottom of a paper after a quick glance probably doesn't make much of a difference.
- justtopost 8y ago
  Same as 'Stay Back 500ft, Not responsible for damage' signs on the back of gravel trucks. Youd better bet they are 100% liable for anything that flies out. But it discourages the unmotivated and the uneducated from seeking their entitled legal relief.
paganel 8y ago
> It doesn't matter what the user consents to, you cannot use their personal data ad hoc. You need to justify its collection, storage and transfer to the regulator, not the user. I think one of the points is that there are very few companies that have the financial resources to do that, one of those companies that can afford it being Google. The next retort is "but then those companies should stop using trackers all-together" which leaves most of those companies that don't have Google's financial resources without ad money, meaning they're most likely to go out of business, practically creating an oligopoly where a handful of companies control most of what's published on the Internet. Granted, we would have gotten there regardless, only that legislation like GDPR is accelerating this process.
- rypskar 8y ago
  >but then those companies should stop using trackers all-together Yes, why do they have to track their users? Why don't use real targeted advertisement instead? If I go to a car forum, car related ads would be relevant for me. Using ML, tracking and profiling to give me ads for the fridge I did buy last week is not relevant
  - Klathmon 8y ago
    >Using ML, tracking and profiling to give me ads for the fridge I did buy last week is not relevant Come on, that's not what they are trying to do and you know it. There's so many valid arguments you could make, why use a strawman? But the answer to your first question, is because ads targeted to users pay more, get more clicks, and overall perform better than those that are targeted to the page.
    - dlor 8y ago
      patio11 had a great back of the envelope calculation awhile ago on this. Turns out showing ads for a fridge right after you just bought one might be highly successful. Say the average person buys a fridge once every 10-20 years, the probability you're looking for a fridge this month is something like 1/120-1/240, call it .75 percent. Some percentage of fridge purchases end up being returned. Let's say 2 percent of them. If you return a fridge, you pretty much are guaranteed to need a new one, so around 2 percent of people that just purchased a fridge are very likely to buy a new one. That's over double the likelihood of someone that didn't just buy a fridge!
      - tjoff 8y ago
        > ... might be highly successful. Only in the context of the disastrous relevance of tracking. Does tracking earn companies more than it costs users in added electricity? I doubt it.
        Klathmon 8y ago
nwellnhof 8y ago
> It doesn't matter what the user consents to That's not entirely true. If a user really consents to being tracked for advertising purposes, the GDPR allows tracking. Whether the consent banners inform users honestly about the extent of tracking is another question. I think they don't. What's worse is that Google still tracks users by default, even if they never visited an actual Google property, let alone have a Google account. That's an obvious violation of the GDPR but Google will probably try to shift the blame on publishers.
- mtgx 8y ago
  I think the biggest issue with GDPR so far is enforcement. It's still early days, but many companies don't even follow GDPR as they're supposed to, including Google and Facebook. That will only be settled after an enforcement wave against both large and average-sized companies (GDPR is more lenient towards small companies).
- brennebeck 8y ago
  Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?
  - nwellnhof 8y ago
    GitLab seems to use the Cookiebot solution. I like that "Marketing" cookies are disabled by default, although they should be labeled as "Advertising". Also, even if you bother to read the purposes of all the 80 advertising cookies, the descriptions are incomplete and dishonest. For example: Doubleclick cookie notice: "Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user." Facebook cookie notice: "Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers." These descriptions fail to mention that the collected data will be combined with information from thousands of other websites you visit which allows to create sophisticated user profiles. From these profiles, you can infer things like gender, age, socio-economic status, interests, or hobbies with relatively high accuracy. Even if you asked them, Google and Facebook couldn't tell which hidden categories their machine learning models can discover.

sarabande 8y ago

I bet rafting consent forms are still useful in the sense that they discourage most people with trivial-to-moderate injuries from thinking about holding the company liable.

ghaff 8y ago
As someone who leads outdoor trips, I've been told (not sure how true) that one of the supposed benefits is that it informs about dangers. So someone who suffers an injury--not through negligence on the part of the trip leader--would have a tougher case arguing that no one told them that the activity was other than completely safe and they wouldn't have done it had they known. On the other hand, I've also been told by lawyers that the usual scrawl your signature at the bottom of a paper after a quick glance probably doesn't make much of a difference.
justtopost 8y ago
Same as 'Stay Back 500ft, Not responsible for damage' signs on the back of gravel trucks. Youd better bet they are 100% liable for anything that flies out. But it discourages the unmotivated and the uneducated from seeking their entitled legal relief.

paganel 8y ago

> It doesn't matter what the user consents to, you cannot use their personal data ad hoc. You need to justify its collection, storage and transfer to the regulator, not the user. I think one of the points is that there are very few companies that have the financial resources to do that, one of those companies that can afford it being Google. The next retort is "but then those companies should stop using trackers all-together" which leaves most of those companies that don't have Google's financial resources without ad money, meaning they're most likely to go out of business, practically creating an oligopoly where a handful of companies control most of what's published on the Internet. Granted, we would have gotten there regardless, only that legislation like GDPR is accelerating this process.

rypskar 8y ago
>but then those companies should stop using trackers all-together Yes, why do they have to track their users? Why don't use real targeted advertisement instead? If I go to a car forum, car related ads would be relevant for me. Using ML, tracking and profiling to give me ads for the fridge I did buy last week is not relevant
- Klathmon 8y ago
  >Using ML, tracking and profiling to give me ads for the fridge I did buy last week is not relevant Come on, that's not what they are trying to do and you know it. There's so many valid arguments you could make, why use a strawman? But the answer to your first question, is because ads targeted to users pay more, get more clicks, and overall perform better than those that are targeted to the page.
  - dlor 8y ago
    patio11 had a great back of the envelope calculation awhile ago on this. Turns out showing ads for a fridge right after you just bought one might be highly successful. Say the average person buys a fridge once every 10-20 years, the probability you're looking for a fridge this month is something like 1/120-1/240, call it .75 percent. Some percentage of fridge purchases end up being returned. Let's say 2 percent of them. If you return a fridge, you pretty much are guaranteed to need a new one, so around 2 percent of people that just purchased a fridge are very likely to buy a new one. That's over double the likelihood of someone that didn't just buy a fridge!
    - tjoff 8y ago
      > ... might be highly successful. Only in the context of the disastrous relevance of tracking. Does tracking earn companies more than it costs users in added electricity? I doubt it.
      - Klathmon 8y ago

nwellnhof 8y ago

> It doesn't matter what the user consents to That's not entirely true. If a user really consents to being tracked for advertising purposes, the GDPR allows tracking. Whether the consent banners inform users honestly about the extent of tracking is another question. I think they don't. What's worse is that Google still tracks users by default, even if they never visited an actual Google property, let alone have a Google account. That's an obvious violation of the GDPR but Google will probably try to shift the blame on publishers.

mtgx 8y ago
I think the biggest issue with GDPR so far is enforcement. It's still early days, but many companies don't even follow GDPR as they're supposed to, including Google and Facebook. That will only be settled after an enforcement wave against both large and average-sized companies (GDPR is more lenient towards small companies).
brennebeck 8y ago
Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?
- nwellnhof 8y ago
  GitLab seems to use the Cookiebot solution. I like that "Marketing" cookies are disabled by default, although they should be labeled as "Advertising". Also, even if you bother to read the purposes of all the 80 advertising cookies, the descriptions are incomplete and dishonest. For example: Doubleclick cookie notice: "Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user." Facebook cookie notice: "Used by Facebook to deliver a series of advertisement products such as real time bidding from third party advertisers." These descriptions fail to mention that the collected data will be combined with information from thousands of other websites you visit which allows to create sophisticated user profiles. From these profiles, you can infer things like gender, age, socio-economic status, interests, or hobbies with relatively high accuracy. Even if you asked them, Google and Facebook couldn't tell which hidden categories their machine learning models can discover.