4 ms·

> the website owners need either your consent or legitimate interest as defined in GDPR Well the part companies doesn't seem to "get" is that this consent shou

> the website owners need either your consent or legitimate interest as defined in GDPR Well the part companies doesn't seem to "get" is that this consent should be informed and voluntary, which means opt-in and not only available after 3 minutes of jumping through ridiculous hoops to opt out.

luckylion 7y ago
The problem is the or part. They will generally claim legitimate interest ("we need this to fund our operation, FB helps") just as they do with analytics and ads. When they can show legitimate interest, they don't need consent, they only need to inform about the collection and inform you about your rights. I'm with you that consent before action would be the right way to go. But since we can't rely on sites to be ethical, it'll stay the browser's business to protect the user. I don't know how other countries are doing, but Germany's officials are apparently very understaffed, so complaints will regularly sit for months and they won't have a lot of time to understand the details, so I don't put my trust in oversight for the foreseeable future.
- eitland 7y ago
  > "we need this to fund our operation, FB helps" As far as I am aware, and I'm fairly certain about this: funding is not a valid legitimate interest under GDPR. If it was it would be a loophole big enough for a medium sized planet ;-)
  - luckylion 7y ago
    Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. "We need this to make money" is basically all they have to say - it's why Google/FB Remarketing, Cross-Network ID-Sync so all the networks have a unique ID of you when they talk to each other etc is still a thing. The difference is that they now have to inform you that they are doing it, who is involved and who to direct requests for information / deletion to.
    - eitland 7y ago
      > Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. I think "legitimate interest" has a different meaning in the context of GDPR. I'm fairly certain about this, but you don't need to take my word for it: https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h_&ia=web https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h... As I said: if your interpretation was correct (in this context) it would be a loophole so big it would make the rule meaningless. > The difference is that they now have to inform you that they are doing it... I don't think so. AFAIK the difference is they now need to make it opt in and voluntary.
      - luckylion 7y ago
        > As I said: if your interpretation was correct (in this context) it would be a loophole so big it would make the rule meaningless. That's my point - actually, not a lot has changed. There's just larger fines and more bureaucratic hoops. It's why you still do see all kinds of tracking - but you'll now get information about it.
        eitland 7y ago
        Did you try the search I gave you?
        luckylion 7y ago
        Yes, and I've also talked about this on multiple occasions with a lawyer friend who works in privacy law. A typical claim to legitimate interests would be for optimizing the website and ads on the website for example. It's so commonly used exactly because it's a very simple one-size-fits-all approach. I have not heard statements going against this from any lawyers.
        eitland 7y ago
        Was this a European or American lawyer? I'm interested because my understanding has been most Europeans understood it the same way I did.
- NeedMoreTea 7y ago
  "It makes us more profitable, tough" is patently not a legitimate interest, and would fail the balancing test (the individual's interest overrides the legitimate interest). If it were as simple as "it helps fund our operation", the whole of the GDPR would be instantly rendered toothless as why else would they gather unnecessary data? It would open a "loophole" that lets everything through. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Don't know of Germany's position but the UK's ICO added significant staff and budget when the switch from Data Protection to GDPR came in.
  - luckylion 7y ago
    From all I've heard, making a profit isn't overridden by the individual's interest not to be tracked - otherwise, Google Ads wouldn't exist in Europe, at all, and Remarketing especially not. It's not unnecessary data - FB needs that data to target users with ads, the shop needs FB to show ads to people that are likely to buy what they've been shown. I do agree with you that this would be very different if there was no business interest in tracking users, but there is.
    - NeedMoreTea 7y ago
      As far as I know, remarketing hasn't yet been shown to be valid at all under GDPR. Someone probably needs to make a test complaint. There may already be one in the works. It's but a detail within the general case of Google or FB advertising in general. Google Ads have already been fined €44m under GDPR, and I believe there is another case already in the French system. Showing ads is not the service provided as no one at all would accept them optionally. FB, and Google, should be targeting in non-personal ways even where that necessitates less targeting. That was part of the point on which Google got their €44m fine. As seen in TFA, the web of third party tracking appears more liable, and in need of consent than many, particularly American companies with a vested interest, have claimed whilst hiding behind those.

luckylion 7y ago

The problem is the or part. They will generally claim legitimate interest ("we need this to fund our operation, FB helps") just as they do with analytics and ads. When they can show legitimate interest, they don't need consent, they only need to inform about the collection and inform you about your rights. I'm with you that consent before action would be the right way to go. But since we can't rely on sites to be ethical, it'll stay the browser's business to protect the user. I don't know how other countries are doing, but Germany's officials are apparently very understaffed, so complaints will regularly sit for months and they won't have a lot of time to understand the details, so I don't put my trust in oversight for the foreseeable future.

eitland 7y ago
> "we need this to fund our operation, FB helps" As far as I am aware, and I'm fairly certain about this: funding is not a valid legitimate interest under GDPR. If it was it would be a loophole big enough for a medium sized planet ;-)
- luckylion 7y ago
  Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. "We need this to make money" is basically all they have to say - it's why Google/FB Remarketing, Cross-Network ID-Sync so all the networks have a unique ID of you when they talk to each other etc is still a thing. The difference is that they now have to inform you that they are doing it, who is involved and who to direct requests for information / deletion to.
  - eitland 7y ago
    > Funding is a legitimate interest, it's at the very foundation of legitimate interests: companies need to make money to exist. I think "legitimate interest" has a different meaning in the context of GDPR. I'm fairly certain about this, but you don't need to take my word for it: https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h_&ia=web https://duckduckgo.com/?q=gdpr+%22legitimate+interest%22&t=h... As I said: if your interpretation was correct (in this context) it would be a loophole so big it would make the rule meaningless. > The difference is that they now have to inform you that they are doing it... I don't think so. AFAIK the difference is they now need to make it opt in and voluntary.
    - luckylion 7y ago
      > As I said: if your interpretation was correct (in this context) it would be a loophole so big it would make the rule meaningless. That's my point - actually, not a lot has changed. There's just larger fines and more bureaucratic hoops. It's why you still do see all kinds of tracking - but you'll now get information about it.
      - eitland 7y ago
        Did you try the search I gave you?
        luckylion 7y ago
        Yes, and I've also talked about this on multiple occasions with a lawyer friend who works in privacy law. A typical claim to legitimate interests would be for optimizing the website and ads on the website for example. It's so commonly used exactly because it's a very simple one-size-fits-all approach. I have not heard statements going against this from any lawyers.
        eitland 7y ago
        Was this a European or American lawyer? I'm interested because my understanding has been most Europeans understood it the same way I did.
NeedMoreTea 7y ago
"It makes us more profitable, tough" is patently not a legitimate interest, and would fail the balancing test (the individual's interest overrides the legitimate interest). If it were as simple as "it helps fund our operation", the whole of the GDPR would be instantly rendered toothless as why else would they gather unnecessary data? It would open a "loophole" that lets everything through. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/legitimate-interests/ https://ico.org.uk/for-organisations/guide-to-data-protectio... Don't know of Germany's position but the UK's ICO added significant staff and budget when the switch from Data Protection to GDPR came in.
- luckylion 7y ago
  From all I've heard, making a profit isn't overridden by the individual's interest not to be tracked - otherwise, Google Ads wouldn't exist in Europe, at all, and Remarketing especially not. It's not unnecessary data - FB needs that data to target users with ads, the shop needs FB to show ads to people that are likely to buy what they've been shown. I do agree with you that this would be very different if there was no business interest in tracking users, but there is.
  - NeedMoreTea 7y ago
    As far as I know, remarketing hasn't yet been shown to be valid at all under GDPR. Someone probably needs to make a test complaint. There may already be one in the works. It's but a detail within the general case of Google or FB advertising in general. Google Ads have already been fined €44m under GDPR, and I believe there is another case already in the French system. Showing ads is not the service provided as no one at all would accept them optionally. FB, and Google, should be targeting in non-personal ways even where that necessitates less targeting. That was part of the point on which Google got their €44m fine. As seen in TFA, the web of third party tracking appears more liable, and in need of consent than many, particularly American companies with a vested interest, have claimed whilst hiding behind those.