5 ms·

This is totally insane. Stop ruining the internet before it's too late, EU.

jraph 7y ago
This is totally sane. I don't ever want my browser to contact Facebook and Twitter when I'm visiting unrelated websites. This was bullshit from day one. Please do continue! edit: I hope that this will also hold for Google with reCAPTCHA and Analytics.
- luckylion 7y ago
  That part won't change, though. It's now just that the website owners need either your consent or legitimate interest as defined in GDPR + they need to have a data processing agreement with Facebook. It adds a formality, but it won't have a lasting impact.
  - jraph 7y ago
    Well, I hope that at least some websites will opt for using an image they host themselves instead of adding this formality. This has to hurt user experience, no? On the other hand, I guess this is only one more checkbox to tick among the checkboxes we already have to tick.
    - luckylion 7y ago
      A self-hosted image + link adds friction, so I don't think that a lot of the mainstream sites (that aren't privacy conscious and do it already) will do it. And, of course, many shops already use Facebook tracking pixels to target visitors that didn't buy anything, so they have very little interest in keep FB out.
  - eitland 7y ago
    > the website owners need either your consent or legitimate interest as defined in GDPR Well the part companies doesn't seem to "get" is that this consent should be informed and voluntary, which means opt-in and not only available after 3 minutes of jumping through ridiculous hoops to opt out.
    - luckylion 7y ago
      The problem is the or part. They will generally claim legitimate interest ("we need this to fund our operation, FB helps") just as they do with analytics and ads. When they can show legitimate interest, they don't need consent, they only need to inform about the collection and inform you about your rights. I'm with you that consent before action would be the right way to go. But since we can't rely on sites to be ethical, it'll stay the browser's business to protect the user. I don't know how other countries are doing, but Germany's officials are apparently very understaffed, so complaints will regularly sit for months and they won't have a lot of time to understand the details, so I don't put my trust in oversight for the foreseeable future.
      - eitland 7y ago
        > "we need this to fund our operation, FB helps" As far as I am aware, and I'm fairly certain about this: funding is not a valid legitimate interest under GDPR. If it was it would be a loophole big enough for a medium sized planet ;-)
        luckylion 7y ago
        Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. "We need this to make money" is basically all they have to say - it's why Google/FB Remarketing, Cross-Network ID-Sync so all the networks have a unique ID of you when they talk to each other etc is still a thing. The difference is that they now have to inform you that they are doing it, who is involved and who to direct requests for information / deletion to.
        eitland 7y ago
        > Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. I think "legitimate interest" has a different meaning in the context of GDPR. I'm fairly certain about this, but you don't need to take my word for it: https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h_&ia=web https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h... As I said: if your interpretation was correct (in this context) it would be a loophole so big it would make the rule meaningless. > The difference is that they now have to inform you that they are doing it... I don't think so. AFAIK the difference is they now need to make it opt in and voluntary.
  - mr_toad 7y ago
    > It adds a formality It’s more than a formality, it means that either party could get sued if they violate the terms of the agreement. Having contractual relationships in place is common in this type of legislation. HIPAA regulations require formal contractual relationships with suppliers and contractors.
  - realusername 7y ago
    I don't see any legitimate interest of contacting Facebook on every page.

This is totally sane. I don't ever want my browser to contact Facebook and Twitter when I'm visiting unrelated websites. This was bullshit from day one. Please do continue! edit: I hope that this will also hold for Google with reCAPTCHA and Analytics.

luckylion 7y ago
That part won't change, though. It's now just that the website owners need either your consent or legitimate interest as defined in GDPR + they need to have a data processing agreement with Facebook. It adds a formality, but it won't have a lasting impact.
- jraph 7y ago
  Well, I hope that at least some websites will opt for using an image they host themselves instead of adding this formality. This has to hurt user experience, no? On the other hand, I guess this is only one more checkbox to tick among the checkboxes we already have to tick.
  - luckylion 7y ago
    A self-hosted image + link adds friction, so I don't think that a lot of the mainstream sites (that aren't privacy conscious and do it already) will do it. And, of course, many shops already use Facebook tracking pixels to target visitors that didn't buy anything, so they have very little interest in keep FB out.
- eitland 7y ago
  > the website owners need either your consent or legitimate interest as defined in GDPR Well the part companies doesn't seem to "get" is that this consent should be informed and voluntary, which means opt-in and not only available after 3 minutes of jumping through ridiculous hoops to opt out.
  - luckylion 7y ago
    The problem is the or part. They will generally claim legitimate interest ("we need this to fund our operation, FB helps") just as they do with analytics and ads. When they can show legitimate interest, they don't need consent, they only need to inform about the collection and inform you about your rights. I'm with you that consent before action would be the right way to go. But since we can't rely on sites to be ethical, it'll stay the browser's business to protect the user. I don't know how other countries are doing, but Germany's officials are apparently very understaffed, so complaints will regularly sit for months and they won't have a lot of time to understand the details, so I don't put my trust in oversight for the foreseeable future.
    - eitland 7y ago
      > "we need this to fund our operation, FB helps" As far as I am aware, and I'm fairly certain about this: funding is not a valid legitimate interest under GDPR. If it was it would be a loophole big enough for a medium sized planet ;-)
      - luckylion 7y ago
        Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. "We need this to make money" is basically all they have to say - it's why Google/FB Remarketing, Cross-Network ID-Sync so all the networks have a unique ID of you when they talk to each other etc is still a thing. The difference is that they now have to inform you that they are doing it, who is involved and who to direct requests for information / deletion to.
        eitland 7y ago
        > Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. I think "legitimate interest" has a different meaning in the context of GDPR. I'm fairly certain about this, but you don't need to take my word for it: https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h_&ia=web https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h... As I said: if your interpretation was correct (in this context) it would be a loophole so big it would make the rule meaningless. > The difference is that they now have to inform you that they are doing it... I don't think so. AFAIK the difference is they now need to make it opt in and voluntary.
- mr_toad 7y ago
  > It adds a formality It’s more than a formality, it means that either party could get sued if they violate the terms of the agreement. Having contractual relationships in place is common in this type of legislation. HIPAA regulations require formal contractual relationships with suppliers and contractors.
- realusername 7y ago
  I don't see any legitimate interest of contacting Facebook on every page.