3 ms·

I think this is going to continue until both a few of the app developers and some of the DMPs get bankrupted through GDPR fines for not obtaining proper consent

I think this is going to continue until both a few of the app developers and some of the DMPs get bankrupted through GDPR fines for not obtaining proper consent. The entire business model is infeasible under GDPR.

derefr 8y ago
You don’t have to collect that much data from users in a given market (Europe), if you’ve already collected [and continue to collect] so much other data from users in other markets (America) that you’ve built up predictive models that only need a few hints in order to map a user to one of a well-known constellation of “profiles” that advertisers target their ads towards. Basically, GDPR only prevents DMPs from training their models using your app’s data (i.e. exfiltrating the user’s personal details from the client to a backend.) If, on the other hand, the DMP comes to you with an advertising library that runs entirely client-side and embeds a pre-trained model; where, when you call this library, it decides what profile of theirs a user slots into by doing things like e.g. “young or old based on how they type on a touch keyboard” (but in a much more clever ML-dictated fashion)... then there’s no violation here. You’re using the user’s personal data to derive a category to place them into; but you’re not recording or sending the user’s personal data anywhere. And when you, as an app, turn around and make a request to an ad network for ad media to display based on that profile, that’s not a violation of GDPR either: the derived profile is no longer information about a particular user, but is rather just a group that the user belongs to, with each profiling group being so large that that assertion-of-fact doesn’t help to de-anonymize the user any more than saying “they’re a human being” does—it’s not information that could be mapped back to the individual user. So it’s fine to send out. It can be taken a level further, as well; such “statistics that convert to a profile” can be aggregated into one per-app profile. At that point, you’re doing exactly what magazine publishers do: looking at the audience for a given magazine, building a summary profile of said audience, and then selling ad space to advertisers who want to target that summary profile. Of course, that same library will probably do a region check, and in the case that you’re not in the GDPR-affected area of the world, it will skip its (slightly crap) client-side detection logic and instead feed all your clicks and taps back to its (much smarter) backend, just like the previous version of the library was doing unilaterally.
- keepmesmall 8y ago
  Derived user data is still user data? Up to the point where the client sends something mathematically indistinguishable from random noise to the server. At which point it's useless except for yet-to-be-discovered quantum effects. Which will then be outlawed. Either way, the whole advertising revenue model is sickening pile of "they technically didn't object and it's not technically illegal", luckily it will die along with DRM and copyright. In the meantime I sincerely wish all parties who profit from it a stomachache proportional to their standard of living.

derefr 8y ago

You don’t have to collect that much data from users in a given market (Europe), if you’ve already collected [and continue to collect] so much other data from users in other markets (America) that you’ve built up predictive models that only need a few hints in order to map a user to one of a well-known constellation of “profiles” that advertisers target their ads towards. Basically, GDPR only prevents DMPs from training their models using your app’s data (i.e. exfiltrating the user’s personal details from the client to a backend.) If, on the other hand, the DMP comes to you with an advertising library that runs entirely client-side and embeds a pre-trained model; where, when you call this library, it decides what profile of theirs a user slots into by doing things like e.g. “young or old based on how they type on a touch keyboard” (but in a much more clever ML-dictated fashion)... then there’s no violation here. You’re using the user’s personal data to derive a category to place them into; but you’re not recording or sending the user’s personal data anywhere. And when you, as an app, turn around and make a request to an ad network for ad media to display based on that profile, that’s not a violation of GDPR either: the derived profile is no longer information about a particular user, but is rather just a group that the user belongs to, with each profiling group being so large that that assertion-of-fact doesn’t help to de-anonymize the user any more than saying “they’re a human being” does—it’s not information that could be mapped back to the individual user. So it’s fine to send out. It can be taken a level further, as well; such “statistics that convert to a profile” can be aggregated into one per-app profile. At that point, you’re doing exactly what magazine publishers do: looking at the audience for a given magazine, building a summary profile of said audience, and then selling ad space to advertisers who want to target that summary profile. Of course, that same library will probably do a region check, and in the case that you’re not in the GDPR-affected area of the world, it will skip its (slightly crap) client-side detection logic and instead feed all your clicks and taps back to its (much smarter) backend, just like the previous version of the library was doing unilaterally.

keepmesmall 8y ago
Derived user data is still user data? Up to the point where the client sends something mathematically indistinguishable from random noise to the server. At which point it's useless except for yet-to-be-discovered quantum effects. Which will then be outlawed. Either way, the whole advertising revenue model is sickening pile of "they technically didn't object and it's not technically illegal", luckily it will die along with DRM and copyright. In the meantime I sincerely wish all parties who profit from it a stomachache proportional to their standard of living.