35 ms·

Google’s GDPR Workaround

• priansh 7y ago
  EDIT: since everyone seems to be mentioning the 4% rule, I'd just like to point out that I'm not denying the existence of this, just denying that it is actually effective. Google has violated antitrust before, and walked away with a "big" fine that's a slap on the wrist. They've violated GDPR before as well once or twice, and got a "record breaking" 57MM$ fine. The 4% rule exists and clearly isn't enforced well. I know a lot of people love GDPR but I would be beyond shocked if the EU actually managed to hit Google with something that sticks. I very much hope I'm proved wrong! This sort of resolution was inevitable. I said it before and I'll say it again: GDPR is an annoying measure for developers, small businesses and startups. It doesn't do much other than put in place so many steps that growth tools for startups become risky to use. For big businesses that (ab)use big data, it's not much of a hassle because they can afford the legal steps as well as the change in infrastructure. They can even work around it and keep abusing data without consequences. If they're able to beat Google's lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that'll be more than covered by their daily revs.
  • kd5bjo 7y ago
    From my (admittedly limited) understanding, this is not actually legal under the GDPR. Certainly the alleged (but not demonstrated) behind-the-scenes trading of personal info isn’t, but the shared id is also personally-identifying information, and directly regulated.
    • hexadec 7y ago
      It is very not legal, but I think the parent was saying these regulations are more onerous to small dev shops rather than Google and the fine for this will be minuscule. Hopefully companies will find paths to revenue that do not require selling out there users to this level, maybe by just having ad auctions without any identifying information at all.
      • estel 7y ago
        The first GDPR fines handed down by the ICO have been hundreds of millions of pounds for negligent breaches - I don't think it would be out of the realm of possibility for breaches by _design_ to result in multi-billion pound fines.
        • priansh 7y ago
          Several billion pounds is still not much! They already broke GDPR once (or twice I think?) And received a 57MM$ fine. 57MM$ is nothing to Google. They've escaped even antitrust cases with minimal injury, it would be a truly shocking event if the EU actually managed to touch them.
      • ntp85 7y ago
        From gdpr.eu: "The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher." For Google that would be 4% of its worldwide annual revenue, I'd assume. Taking into account that it's not one infringement but multiple that could mean a pretty hefty fine.
        • hexadec 7y ago
          That is the worst case, no GDPR fines have been near there maximum yet.
      • v7p1Qbt1im 7y ago
        Like it or not. Currently the internet would not exist without the ad-supported business model. Regular users expect everything on the internet to be free. I know people that categorically refuse to buy a 1-dollar app. It‘s starting to change now with people getting used to subscription models (Netflix, etc). But it will take a while until we start paying for news again, for example. Apple news + and google news initiative are a step in the right direction. Even if it‘s just for aggregate sub management.
    • priansh 7y ago
      It's not legal but there isn't much the EU can really do. It would be shocking if they actually managed to prosecute Google which has so far avoided much hassle in antitrust and the like, taking I think a billion dollar fine which sounds like a lot but is basically a slap on the wrist. That's why, IMO, GDPR sucks for small businesses that can be outed to the ICO for a minor oversight and not so much for big data abusers that can take on GDPR and come out unscathed.
      • yifanl 7y ago
        That sounds like something fairly trivially avoided by having the punishment be proportional to revenue. And I believe this is already the case for GDPR? A quick search indicates "Up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher" https://www.gdpreu.org/compliance/fines-and-penalties/ https://www.gdpreu.org/compliance/fines-and-penalties/
        • hvidgaard 7y ago
          EU have shown that it's willing to scale up the fines all the way if the company in question keep on violating the law. Alphabet global revenue 2018 was $136.8 billion, so the maximum fine is $5.5 billion which is in the vicinity of fines they've already received. It's a separate post in their yearly financial report. The gain must be significant if they continually keep violating the laws.
        • priansh 7y ago
          This is being quoted in every comment but if you have enough lawyers anything is possible. Google has come out of antitrust cases relatively unscathed. They've even violated GDPR itself once before explicitly, and got out with a 57MM$ fine. This case won't be any different than all the other times that Google has blatantly violated laws and walked away with a slap on the wrist. I would be very very very shocked if the EU actually managed to touch Google. I welcome and hope to be proved wrong.
          • yifanl 7y ago
  • simias 7y ago
    And I'm very annoyed that your initial reaction to reading this article is to blame the GDPR instead of blaming Google for these shady practices. Boycott that crap, move to other services. This shouldn't be acceptable. I'm very happy that the GDPR exist, if only because it forced all these websites from explicitly giving me a list of the literally hundreds of partners they want to share my data with, along with a way to say "hell no". Of course Google and friends will try to work around it but hopefully that won't come to pass and they'll have to actually bother changing their crappy business model. I think the spirit of the law is fairly clear, I wonder why Google thinks this scheme can work. Maybe they're just trying to buy some time. As for startups that sink because they can't be bothered to sanely handle my personal data: good riddance.
    • priansh 7y ago
      - my initial reaction is to blame GDPR, yes, because it's just security theater that does so little to actually ensure privacy. Sure Google is at fault but GDPR was supposed to regulate this and it is clearly failing to do so. And if you want to boycott it you're welcome to but they've built an empire with their cloud, search, email, etc to the point where that would be pretty difficult and annoying to the average consumer. They're effectively too big to be boycotted at this point. - It doesn't explicitly force them to do that. And most sites aren't explicitly sharing the data either; i.e. almost every site uses Google analytics which doesn't really comply with do not track all too well, and Google will then share their data with everybody else (which is part of their violations in this article). Also saying "no" doesn't do much either as most of these big sites either already stored the cookie or won't do much to delete it. And it's not that they'll try to work around it, they either don't put forth the effort because GDPR is like a pebble for them, or they already worked around it in a way that changes nothing. Their business model is still the exact same. I think the spirit of this law is fine, but the actual law does nothing and is just privacy theater. Google isn't buying time, almost 4 years later nothing has changed -- they just know they can't be touched. - They're not going to sink, they'll just grow much slower and thus won't be an alternative to the big data abusers you hate so much. And they're not failing to handle your data, most of the time startups aren't selling you out they're just trying to figure out who their customer is internally. To do this they collect some data that is usually optional and very much with your consent; GDPR just puts a bunch of hoops in front of this so that it's an enormous pain to do so. I run a startup that collects basically no data (literally, we do not have a database for 2 of our products). It was a pain for us to become GDPR compliant because that disables our metrics entirely and requires a bunch of banners and checkboxes everywhere even though we literally store nothing. I'm all for the spirit of the law. I just think the execution sucks and they definitely didn't think it through enough. I think the evidence for this is clear based on the sheer number of privacy violations we've had since GDPR was enacted alone, and how little enforcement and regulation has actually gone on.
  • mola 7y ago
    The European Union has decided that growth based on clandestine tracking of users, selling their PII without consent is not a legitimate growth tool. You know, like the way we outlawed violence as a "growth tool" Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be.
    • Sean1708 7y ago
      Unless I'm misunderstanding what you mean by absolute and relative, I think the law is already relative: > The maximum fine under the GDPR is up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements. From here: https://www.itgovernance.co.uk/dpa-and-gdpr-penalties https://www.itgovernance.co.uk/dpa-and-gdpr-penalties
      • sokoloff 7y ago
        In context, "relatively bigger" would mean something like a progressive tax bracket. $20MM up to $500MM rev, 4% up to $1BB rev, 5% up to $2BB rev, 6% up to $5BB rev, etc... A straight 4% would be absolutely bigger, but relatively the same (once beyond $500M).
        • mamon 7y ago
          I think it's not about "income brackets", it is about profit margins which can vary a lot between industries. 4% of revenue is enough to bankrupt traditional business, like Wallmart with profit margins of 2,48%. Google is a low-cost business, with profit margin of 25%, so even the maximum GDPR fine is something they can just write off.
          • inlined 7y ago
            So just make the fine a portion of profit? Maybe a three layer system that takes into account flat euro rate, a percent of revenue, or a bigger percent of profit; whichever is highest.
  • ceejayoz 7y ago
    > If they're able to beat Google's lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that'll be more than covered by their daily revs. This is why the 4% of global annual revenue fine option exists. A few of those add up quick.
    • ht_th 7y ago
      Furthermore, if organizations are explicitly accepting penalties to keep on violating the law, that law will be adjusted accordingly. It might take a while, but it will happen. Laws with the intention to change behavior / culture cannot "work" from day one. This is a continuous process steered by politics, courts, governments, and public opinion.
      • fmajid 7y ago
        Penalties can be applied repeatedly if the violation continues. It's not a 4% lifetime cap, it's 4% per enforcement action. The DPA can just churn them once a week and then we're at 204% of annual turnover.
• deleted 7y ago
  [deleted]
• hexadec 7y ago
  This some great work on tracking down all of these measures to track users. I really hope we get to the point where dumb ads rules the web once more. Hopefully this results in more than a slap on the wrist, but I doubt it.
  • intopieces 7y ago
    Why should ads rule the web at all? Surely the cleverest engineers to walk the planet can come up with a new way of making money that doesn’t involve psychological manipulation.
    • hexadec 7y ago
      I agree with you in theory, but until we can figure out micro-transactional payments that work globally it seems ads are good stepping stone. People want to get paid for work, some users are willing to pay (cash) some with attention to ads. We should not give up our privacy or anonymity for this attention though.
      • tzs 7y ago
        Micro-transaction payments are probably a long way away, for non-tech reasons. Briefly, you might have to deal with collecting and remitting sales taxes or VAT in any jurisdiction in which you have paying readers. Until there is some sort of agreement among the relevant jurisdictions to greatly reduce the pain of this, direct micro-transactions with your site's visitors are likely to be a bureaucratic nightmare.
        • jeremyjh 7y ago
          These platforms already exist. They fail because most people won’t pay for content, full stop.
    • tsumnia 7y ago
      I think there are simply engineers that are fine with the current state of things. You mention specifically "come up with a new way of making money"; however, for extrinsically motivated people, why reinvent the wheel? Problem solving can mean thinking up a solution or implementing a solution. In the same vein, there may be engineers that enjoy working on this type of problem - how to identify someone that is actively avoiding you. The current iteration of Do Not Track mentality only makes the problem more interesting by putting up restrictions.
• rvz 7y ago
  It's really funny to see that yesterday, I was branded as a 'privacy nut' after the release of Android 10 as I was concerned about the privacy issues that are in Android. Then the Go modules proxy issue around the Go Programming language that raised suspicions about tracking usage statistics around downloading modules turned on by default without any consent and now this. I think there are some folks at Google who have just read too deep into both 1984 and The Google Book to go on to think that privacy violations like this is a normal thing. But what do I know? I'm just another 'privacy lunatic' on the net that wears a metal helmet (tinfoil hats are just not good enough) trying to protect my privacy.
  • zdw 7y ago
    The Go module hash checking seems to be more about avoiding the problems encountered by other language repos integrity and versioning issues (cough NPM), and in terms of tracking it seems about as invasive as Debian's popcon. Enabled by default can and should be the default for security-related features. I tend to agree about the rest of the creepiness, especially anything personally behavioral.
    • ptx 7y ago
      Debian's popcon is not enabled by default.
      • dsr_ 7y ago
        Debian's popcon is really irritating because Debian actually uses it as a source of evidence... systematically eliminating those of us who keep it off for privacy/security reasons.
        • calcifer 7y ago
          Let me get this straight. You have an opt-in way of telling them what you use, which you don't use and then get upset because your use isn't considered? What should do they do, send a surveyor to your house? Sound decision making requires metrics. If you opt-out of metrics, you don't get to participate in decisions.
• cj 7y ago
  Snippets from the article: > The evidence further reveals that Google allowed [...] > Google has no control over what happens to these data once broadcast [...] Is it possible that Google does have "control" over the data after broadcast, albeit legal control via contracts with advertisers (as opposed to technical control)? Perhaps Google's GDPR compliance strategy relies on the participating advertisers to comply with their contract with Google. If that assumption is accurate, perhaps Google's advertisers are in breach of their contract with Google which makes it appear as though Google itself is in breach? I could be off-base, the details in the article aren't incredibly clear to me. (For the record, I don't like Google's business model and I don't like Google's pervasive tracking -- I'm playing devil's advocate to better understand the issue)
  • deleted 7y ago
    [deleted]
  • jjoonathan 7y ago
    > "control" over the data after broadcast, albeit legal control via contracts with advertisers Now there's a claim only a court would buy! A court probably would buy it, though. Sigh.
    • deleted 7y ago
      [deleted]
    • luckylion 7y ago
      That is the GDPR-default though. You're still allowed to give data to third parties, you just need to have contracts with them regarding the handling, deletion etc of that data. Of course, mostly that's for data processors, which I don't think ad networks working with Google would fall under.
      • gmueckl 7y ago
        No, a data processor is any entity that collected personal data gets passed on to and where it is processed as part of the business arrangement. An ad network that receives personal data is definitely a data processor.
• deleted 7y ago
  [deleted]
• wtdata 7y ago
  What is sad is that the EU commission doesn't take real action against Google. At best we are to expect a slap in the hand, at worst, the investigations will drag on and nothing will happen.
  • Barrin92 7y ago
    Google has been fined a 5 billion dollar fine already last year, that claim simply isn't true. But I agree with the implicit demand, they clearly haven't gotten the message. The EU should slap them with billion dollar fines again until they learn their lesson.
    • moomin 7y ago
      Q4 2018 earnings were around $40 billion. EU will have to try significantly harder.
      • mlthoughts2018 7y ago
        It will have to be executive jailtime and personal fines or it will never matter.
      • icebraining 7y ago
        That's the revenue, not profit.
        • inetknght 7y ago
          That's also the point. Profit shouldn't have anything to do with fines. Redress and compensation should. A fine is supposed to make business-as-usual unpalatable.
          • icebraining 7y ago
            Sure, I'm just pointing it out because "earnings" usually means "profit".
    • 7y ago
• whenchamenia 7y ago
  Maybe someone will finally take googles abusive practices to task.
• sam1r 7y ago
  Just learned about Brave for the first time. Pretty neat stuff.
  • Kiro 7y ago
    Only if you're into cryptocurrencies. I wish there was an alternative without the BAT stuff.
    • buboard 7y ago
      BAT is traded in all crypto exchanges. you can instantly exchange it for a stablecoin or even write a script to exchange it to USD every day in e.g. coinbase. I don't see why the fuss
    • colordrops 7y ago
      That makes no sense. BAT is opt-in and isn't even mentioned when you install the browser.
      • Kiro 7y ago
        I would argue that the whole reason for Brave's existence is BAT. It's their business model and I'm surprised that HN normally hates cryptocurrencies with a passion but gives Brave a pass.
        • colordrops 7y ago
          First, HN isn't some hive mind that takes stances as a collective. Second, cryptocurrencies are a technology and can be used for good or bad. To hate them is like hating linked lists. Third, there is plenty of (undeserved) hate for Brave here on HN. Lastly, "the whole reason for their existence" is a subjective judgement. As long as they remain open source and don't force me to use their cryptocurrency, I am completely fine with it.
    • deleted 7y ago
      [deleted]
  • 7y ago
• Temasik 7y ago
  brave token is shit and not needed
• NullPrefix 7y ago
  >I was branded as a 'privacy nut' Companies do actually employ shills to go on forums and try to sway public opinion. They call them something like public advocates, doesn't change the idea though.
  • kaolti 7y ago
    I get the feeling this is much more prevalent than any of us realize. Would explain why most comments seem ridiculous.
    • tboyd47 7y ago
      You mean how there are somehow always commenters in every topic ready to leap to the defense of China and major US tech companies?
      • dpkonofa 7y ago
        Meh. I would probably be considered (and have been called) a shill for Apple because I tend to defend them way more than most and it's very popular in tech communities to host anti-Apple circlejerks. I have yet to be paid by them for any of my pro-Apple posts.
      • derefr 7y ago
        I would guess that those are, more often than not, not paid shills but rather just people who like taking devil’s-advocate sides in arguments “for fun”, i.e. just for the challenge of seeing if they can construct a valid rebuttal to a comment. (I say this because I believe I’ve done this myself more than once, and I know my personality-type isn’t uncommon on HN.)
        • mannykannot 7y ago
          A simpler explanation is that they are individuals defending against what they perceive as a personal attack via 'tribal' affiliations.
• _pmf_ 7y ago
  Slap on the wrist incoming. But looks like a solid case with a EU national (?) as plaintiff.
• deleted 7y ago
  [deleted]
• amelius 7y ago
  Targeted ads are already a serious leak of information. If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me. Also, if a malicious actor targets an ad to a group of people, and some of these people buy the advertised items, then the actor can infer things about those people not necessarily related to the items sold.
  • billyc74 7y ago
    if someone looked over your shoulder and saw you browsing HN they could infer things too
    • thebouv 7y ago
      Yet, they choose to surf to HN. They're not choosing to have targeted ads that share their info around the web and cause someone over their shoulder to infer things about them. That's the point -- we should have that choice. And the default should be "no".
      • kupiakos 7y ago
        I understand the opt-in rather than opt-out, but does disabling Ads Personalization [1] not do what you're asking? [1]: https://adssettings.google.com/authenticated?hl=en https://adssettings.google.com/authenticated?hl=en
        • tgragnato 7y ago
          No, a Google account shouldn’t be required.
          • drusepth 7y ago
            Why not? How else would Google know who not to track? It's not like they can identify you and remember that preference without a Google account...
• therealmarv 7y ago
  Surprise... I'm thinking every state outside of EU does not even need that sophisticated workarounds... just go directly to the target (you).
• juanbyrge 7y ago
  Kind of a ratty move by Brave to leverage all of Google's tech in their browser (blink, v8, etc..) while simultaneously suing them as a PR tactic.
  • ummonk 7y ago
    Google didn't have to open source it. They open sourced it knowing it would encourage adoption.
    • juanbyrge 7y ago
      Regardless this is a very calculated PR move by Brave. And the privacy zealots and anti-google cadre on HN and elsewhere are eating this up. They are effectively giving Brave free advertising and playing right into their hands.
      • trpc 7y ago
        To be honest this is the only useful comment in this entire thread and that's why you're getting mass downvoted by the online army of Brave shills (they are employing shills all around 4chan and reddit too). Brave has been repeatedly exploiting this website (or maybe YC just has business interest in it?) by attacking the company that made the product Brave contributed nothing to but theming and rebranding it and selling it as if it were built from scratch.
        • jeffk_teh_haxor 7y ago
          Spawn a cryptotoken (BAT, in this case) and you're rewarded with true believer shill army. Pumping their coin and FUDing the competition. https://www.reddit.com/r/BATProject/ https://www.reddit.com/r/BATProject/
        • dang 7y ago
          Accusing others of astroturfing and shilling breaks the site guidelines. You don't know why other users downvoted a comment, and jumping to public accusations about that degrades this site badly. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting here, we'd be grateful. You've been breaking them a lot and we've had to warn you many times already. We don't micromanage HN according to YC's particular investments in startups; what's in YC's business interests is to make HN as good as we can, because that's what keeps the community coming here. But if it helps, I don't think YC has any investment in Brave.
• mfer 7y ago
  Free startup idea: An ad service that did things simply without any targeted stalking involved.
  • alkonaut 7y ago
    These exist. But so long as adivertisers can buy ads with tracking, fraud detection etc, they will. The key to getting reasonable ads back is making the bad ads impossible for advertisers to buy.
    • mfer 7y ago
      Do you have a reference? Looking around I didn't see anything. I might have missed it though.
      • edoceo 7y ago
        Maybe Carbon ads?
        • carstenhag 7y ago
          Yeah, carbon seems to be pretty good. I used to see it on codepen and some other design website. Always relevant, but carbon seems limited to developers and designers. Some other ad thing which doesn't need tracking: Sponsored posts or targeting people who follow someone on Instagram.
        • alkonaut 7y ago
          Yes, carbon is probably the biggest one.
    • rpastuszak 7y ago
      Also, curious to see how an ad network can guarantee that its creatives don’t misbehave, this is brand safety played on “godlike” (sorry for bad Unreal reference).
  • rishav_sharan 7y ago
• lanevorockz 7y ago
  Google has been very naughty in the past few years. It does look like they removed the “don’t” be evil motto for a clear reason. And people thought that Investment Banks were bad.
• DrScientist 7y ago
  Are Google engineers quietly working on alternatives? What is this repo? https://github.com/PolymerLabs/arcs https://github.com/PolymerLabs/arcs Also there was an interesting story a while back about a clash between advertising and the Fuchsia engineering team https://9to5google.com/2018/07/20/fuchsia-friday-respecting-user-privacy/ https://9to5google.com/2018/07/20/fuchsia-friday-respecting-...
  • colordrops 7y ago
    What is Arcs
    • ChoGGi 7y ago
      It seems to be 'an open ecosystem for privacy-preserving, AI-first computing'?
      • lol768 7y ago
        Legitimately a meaningless description. I find it very odd the README and repository description are completely devoid of any meaingful information.
        • DrScientist 7y ago
          Maybe they value their privacy :-) More seriously this article might shed some light: https://internetfreedomhack.org/re-decentralise-the-commercial-web https://internetfreedomhack.org/re-decentralise-the-commerci...
  • carapace 7y ago
    > Fuchsia’s engineers wanted to create a secure platform, but the advertising team, at the time, believed that privacy “goes against everything [they] stood for.”
• csours 7y ago
  Do they have to prove that the RTB ID can be used to retrieve PII? Or only that the RTB ID is correlated with personally protected information? Is it enough that a RTB ID is pseudo-anonymous? (it always identifies the same person, but cannot be used to find that person's real information) - OR - is a RTB ID not even pseudo-anonymous?
  • simpss 7y ago
    GDPR definitions are slightly different. A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII. the ID would be pseudo-anonymous if one would need some extra data, to which they don't have access to, for linking the ID to one specific user in the whole dataset[2]. So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them. [1] It's also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. https://www.lexico.com/en/definition/identifiable https://www.lexico.com/en/definition/identifiable [2] Definition of pseudonymisation, 5'th bullet-point: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ sheds some light on this.
    • csours 7y ago
      Awesome, thanks. (5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
• metalliqaz 7y ago
  Just 17 days ago I was downvoted into the abyss for suggesting that Google's GDPR "compliance" doesn't protect my privacy. And now this.
• teamspirit 7y ago
  I think the HN community, and most consumers, tend to look at things from only one angle. Imagine you start work at some small shop that manufacturers widgets for consumers. What would you do when you have to advertise your product? You'd have to turn to Google is a similar company. Are there any real alternatives? (I am asking because I really want to know) I say this because I am in this position now. I have to figure out how to advertise my company's products and am torn on how to go about it.
  • dleslie 7y ago
    For actual, physical widgets the traditional advertising markets still work: trade magazines and trade shows. Contacting vendors who specialize in your market of interest and running promotions with them also works. However, it's all a whole lot more expensive and effortful than running some Google ads.
    • teamspirit 7y ago
      And there lies the problem. The cost in both time and money is much higher. I'd love to run TV and magazine ads on all the shows and in all the magazines my customers are reading, it just costs a whole lot more. Way more than we have just starting out.
    • samtheprogram 7y ago
      I think the point that's missing from the discussion is that adtech companies should be targeting solely on placement (i.e. what ads should show up on a particular website based on the content of the website), and not select individuals (i.e. based on user interests regardless of the place on the web an ad is shown), when faced with this kind of legislation. This is exactly how marketing worked before and how people can go about it now, as you describe, through traditional advertising markets. I'd personally prefer it that way in general, but legislation is necessary for them to optimize on those restrictions.
  • deleted 7y ago
    [deleted]
  • 7y ago
• idlerig 7y ago
  This is exactly what happened in the McDonald's "hot coffee" lawsuit. It wasn't some "Karen" who hit a bump while driving. It was an elderly woman (in her 70s, IIRC), sitting in the passenger seat. McDonalds already had complaints (and some lawsuits) over the (significantly higher than industry standard) temperature of their coffee, so this wasn't exactly out of the blue. She ended up with 3rd degree burns on her legs and crotch. She asked only for her medical bills to be paid. McDonald's refused, so she eventually took them to court. Even then, she only asked for medical bills (and now legal expenses). The jury decided that McDonalds was not only liable for those costs, but had treated the woman so poorly that they should pay punitive damages. The massive amount you heard about in the news was based on the amount of money McDonalds makes selling coffee in one day. But that's not the story that was spread by the shills...
  • fmajid 7y ago
    And the money went to Shriners' Hospital, not the burn victim (I saw the photos, they are beyond horrific). What's more, McDonalds had been advised their coffee temperature was dangerous, but decided to ignore this for marketing reasons, because people like the look of steaming coffee.
    • WrtCdEvrydy 7y ago
      Not even that... if you put the coffee that high, people would be less likely to ask for a refill as the coffee took longer to cool off.
  • deleted 7y ago
    [deleted]
  • mumblemumble 7y ago
    The most interesting thing to me about that McDonald's "hot coffee" lawsuit is how different the narrative is in popular circles vs. in legal circles. It's a little bit like in Rashomon. In popular circles, the story is framed in a way that does make the lawsuit look frivolous. But this is also a case that has made it into the legal textbooks as an example of corporate negligence that's clear-cut enough to use for demonstrating the concept in introductory textbooks. Of course, in the legal textbooks, the version of the story that's told includes a lot of details that, as you point out, get excluded from the popular version.
• tbodt 7y ago
  There's some documentation for this mechanism: https://developers.google.com/authorized-buyers/rtb/cookie-guide https://developers.google.com/authorized-buyers/rtb/cookie-g...
• bogomipz 7y ago
  The article states: >"The primary targets of this campaign are Google and the IAB, which control the RTB system." Can someone say who makes up the IAB exactly? Is this just an industry trade group?
  • singron 7y ago
    Yes. Take a look at their board of directors: https://www.iab.com/our-story/#board-of-directors https://www.iab.com/our-story/#board-of-directors It's a mix of the major players in the digital advertising industry. Historically the IAB has taken actions that are good for the industry overall. It focuses on standardization/interoperability in the ad-tech space. It generally isn't a watchdog and doesn't regulate the industry except when the industry as a whole would benefit (e.g. self-regulatory programs that have no real effect but stave off state regulation).
• trpc 7y ago
  Brave is certainly the most shameless tech company I've ever seen in my entire life. Shame on HN to repeatedly allow such a scummy company exploits its ranking algorithm again and again. This kind of systematic exploitation used to happen before with DuckDuckGo, but it seems that Brave took shamelessness to a whole new level.
  • ngngngng 7y ago
    Could you expound? Exploits it's ranking algorithm? What does that mean.
    • topspin 7y ago
      > What does that mean. It doesn't mean anything. This 'trpc' account is the resident Brave hater; every HN story about Brave features trpc making stuff up or just impugning Brave as a scam. [1] https://news.ycombinator.com/item?id=20830663 [2] https://news.ycombinator.com/item?id=19980046 [3] https://news.ycombinator.com/item?id=19832464 [4] https://news.ycombinator.com/item?id=19615220
      • trpc 7y ago
        thanks for highlighting my opinion on this scam, I am too lazy to write the same argument every time.
  • aloknnikhil 7y ago
    This makes no sense. Brave's a browser, not a search engine. Are you claiming they manipulate search results? How would they even do that?
  • aphextim 7y ago
    You say >Brave is certainly the most shameless tech company I've ever seen in my entire life. without any supporting comparisons or an explanation of why. When you say >Shame on HN to repeatedly allow such a scummy company exploits its ranking algorithm again and again. are you talking about people posting about Brave on HN and exploiting up-votes for it to gain attention? If this is the case again it is just a statement without any proof.
• la_barba 7y ago
  Is there any way to improve the matching of ads to the viewer without violating their privacy?
  • fmajid 7y ago
    The matching is in itself a violation of privacy, at least if you interpret the right of privacy as "The right to be left alone", as former Supreme Court Justice Louis Brandeis put it.
    • rpastuszak 7y ago
      I think that’s incorrect, relevant ads could be displayed based purely on the site content, without user info attached to ad calls. We’ve been there.
      • rpastuszak 7y ago
        Why the downvote? Care to provide a reason?
        • aeorgnoieang 7y ago
          From [the guidelines](https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html): > Please don't comment about the voting on comments. It never does any good, and it makes boring reading.
          • rpastuszak 7y ago
            Thanks, didn’t know about that. I wish I had received a better feedback there, though, as I’m deeply interested in the topic and generally it’s quite hard for me to find negative opinions, counterarguments I could work on. I find negative feedback more helpful, if it’s constructive.
            • aeorgnoieang 7y ago
• lpgauth 7y ago
  I really doubt Google Adx would pass buyer_uid to buyers in EU28 countries. They were the first ones to truncate IPs in EU for privacy reasons. We've stopped cookie matching in EU28 countries so I can't verify if they do pass the buyer_uid.
• notatoad 7y ago
  can somebody explain in simple terms what Brave is actually accusing Google of doing? The article seems to be written in a way that matches the language of the GDPR legistlation, instead of language actually meant to be read by people, and i can't figure out what the "workaround" actually is.
  • unityByFreedom 7y ago
    Agreed, this is so wordy, this is what I got, > Google claims to prevent the many companies ... from combining their profiles about those visitors > Brave’s new evidence reveals that Google allowed not only one additional party, but many, to match with Google identifiers. The evidence further reveals that Google allowed multiple parties to match their identifiers for the data subject with each other. BTW, many comments in here seem quick to agree w/this headline given how buried the details are. If someone has better detail, please share it.
    • gundmc 7y ago
      I take exception with Brave's phrasing here. Essentially, Google assigns an anonymized identifier to a user and sends that to prospective ad buyers. The idea is that the ad buyer can use this to target ads to people who have visited their site as they browse other areas of the internet participating in Google's auction. This is called remarketing. An example. You go to footlocker.com and put a pair of sneakers in your shopping cart but decide not to buy. When you go read an article on the New York Times site, a potential advertiser recognizes your anonymized id and bids to serve you an ad for the sneakers. The issue Brave is raising is that the same anonymized id is served to each potential ad buyer. This isn't an issue with data Google collects or exposes, but Brave states that buyers could theoretically collude to build profiles by sharing the data collected on their own sites with each other joining by Google's identifier. There is no evidence of this actually happening and Google's contract with ad buyers specifically prohibits this activity.
      • nocturnial 7y ago
        > essentially, Google assigns an anonymized identifier to a user and sends that to prospective ad buyers. If it's anonymized then how could they send targeted ads to you? I think you're using a slightly different version of the word anonymous. How I use the word anonymous it means, roughly speaking, that it can't be traced back to you. Or in this context, google wouldn't be selling anonymized data to third parties who in turn could contact you. If they were selling data like X persons like product Y more then Z, there would be less of an uproar about this.
• cavneb 7y ago
  I am so glad that this violation is being exposed. Well done Brave! I invite any developer / blogger to check out https://CodeFund.io https://CodeFund.io. We are a non-tracking 100% open source ethical ad platform that focuses on funding open source.
  • dang 7y ago
    It's ok to occasionally link to one's own site in relevant contexts, but only as a small part of using HN as intended—i.e. for gratifying intellectual curiosity: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html But it looks like you've been using HN primarily to do this. That crosses into spamming, so please don't.
• gnud 7y ago
  Is it really a "workaround" if they're just breaking the law? I mean, if the allegations are correct, Google didn't find any loophole, they're just hiding the fact that they're selling person identifiers.
  • TheArcane 7y ago
    EU should raise the 4% annual turnover rule to 10%. Google doesn't seem to be deterred
    • rat9988 7y ago
      There is a reason they didn't. They fear the US government's reaction. Edit: Why downvote? Do you really think that the US government will stay silent if the European Union threatens with such fines? Political tensions are something you take heavily into account.
      • panpanna 7y ago
        EU should ignore the fines this time and start an "information campaign" regarding behavior of Google and others. I bet that hurts Google 10 times more.
        • poutrathor 7y ago
          /s ??
        • nocturnial 7y ago
          They could also do both. I'm _really_ tempted to write that they could use the fine to finance the information campaign, but I know that government finances doesn't work that way.
          • gowld 7y ago
            Gov finances do work that way. That's how the anti-tobacco campaigns are funded in USA.
• jiveturkey 7y ago
  > This, combined with other cookies supplied by Google, allows companies to pseudonymously identify the person in circumstances where this would not otherwise be possible. At first glance, I would have thought this isn't a workaround at all. GDPR allows for pseudonymisation as a method of data protection. But, Recital 26 of the GDPR disallows this: > The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. [...] That said, I don't think this is cut and dried, because Google themselves isn't providing the linkage to an identifiable natural person. The person that can make that linkage necessarily already has the identifying information. Get ready for a major legal battle.
• bluesign 7y ago
  I checked the sample log provided. Below is the google_gid for different publishers, there is no proof of overlap, they have different google_gid for same person. Which is exactly what google describes. [1] I don't understand what Brave claims. d.agkn.com CAESEP-S3Zs5f0_kq11XTCZP_mE id.rlcdn.com CAESEPpf2T4-2AsAR_4rer3RfNs image6.pubmatic.com CAESEB9H3qdV26kxEiz-BJ_TY-M pippio.com CAESEJyqG1Pg1j-_scqW8kDzTkg token.rubiconproject.com CAESEE1DyZ245WggYaQZEWpQWI8 us-u.openx.net CAESEPIJ9jHcY2j4jK3-DPmfar4 [1] https://developers.google.com/authorized-buyers/rtb/cookie-guide https://developers.google.com/authorized-buyers/rtb/cookie-g...
  • ggg3 7y ago
    which is the "workaround" to the gdpr the article badly describes (probably because brave upcoming ad network will do the same but more workaroundily) now those are used to match a 3rd party id. you just need a gdpr_workaround schema in your data base with two columns user-id, google-random-id with N-1 records indexed both ways. gdpr has restrictions on pin pointing a single person. this is effectively doing that, but claim it is not, because random ids. apple is just a little better with how device-advertiser-id works.
    • halr9000 7y ago
      Well, the “right” workaround is an opt-in system. But that would drastically reduce the number of qualified ad prospects, reducing their wholesale value, killing the online ad business, drying up the websites themselves who exist for this revenue (some/many of which are trash, but not nearly all). I don’t think we can have it both ways, or at least it is very difficult and we don’t have a great compromise solution.
      • frenchyatwork 7y ago
        I don't think the EU, or consumers in general, are terribly interested in "compromising" with the ad-tech industry.
        • 7y ago
• rtbthrowaway 7y ago
  I've worked in the sector for years and honestly thought this was well documented, common knowledge: https://developers.google.com/authorized-buyers/rtb/cookie-guide https://developers.google.com/authorized-buyers/rtb/cookie-g... The only thing Google did in regards to GPRR was limit the number of parties in RTB they're including by default for syncing to a "trusted set" of parties.
  • annoyingnoob 7y ago
    I think the silent/invisible nature of cookie sync'ing is what upsets people when they discover it. T he diagrams in your link show a single hop for the 302, in my experience that can be many hops going between different advertisers. The same thing happens on non-google platforms, like TradeDesk and others. The sync scenario can make it next to impossible to delete cookies when those cookies can be rebuilt using data from others.
• matempo33 7y ago
  Sad that Brave did not do their work correctly, the google_push parameter they are talking about is not an identifier. Otherwise it’s true that RTB should not exist and violate GDPR, but it’s so complex that even Brave was not able to correctly state the workflow. See their release note (15 April 2013); https://developers.google.com/authorized-buyers/rtb/relnotes https://developers.google.com/authorized-buyers/rtb/relnotes “Starting in mid-April, we will begin assigning a URL-safe string value to the google_push parameter in our pixel match requests and we will expect that same URL-safe string to be returned in the google_push parameter you set. This change will help us with our latency troubleshooting efforts and improve our pixel match efficiency.”
  • deleted 7y ago
    [deleted]
  • mintplant 7y ago
    Okay, but the `google_push` parameter seems to be the same for all adtech providers swarming on the same user in the same RTB session. Nothing in your comment contradicts the claim that this allows them to sync up profiles for that user across providers, in the way that the switch to per-provider `google_gid` values supposedly blocks.
    • matempo33 7y ago
      Well, for 2 page views (same session), I have 2 different ‘google_push’ (Chrome with default parameters, no extensions).
      • mintplant 7y ago
        Sure, but as long as the adtech providers each have their own stable IDs for you, they can still use `google_push` to link their corresponding stable IDs together, uniquely identify you, and merge their respective profiles. ==== Page View #1: - Acorp: google_gid=qwerty, google_push=foo - Bcorp: google_gid=asdfgh, google_push=foo - Ccorp: google_gid=zxcvbn, google_push=foo By exchanging their `google_gid` values corresponding to the page load with shared `google_push` value foo, Acorp, Bcorp, and Ccorp can identify you as user qwerty-asdfgh-zxcvbn. ==== Page View #2: - Acorp: google_gid=qwerty, google_push=bar - Bcorp: google_gid=asdfgh, google_push=bar - Ccorp: google_gid=zxcvbn, google_push=bar By exchanging their `google_gid` values corresponding to the page load with shared `google_push` value bar, Acorp, Bcorp, and Ccorp can still identify you as user qwerty-asdfgh-zxcvbn, even though the `google_push` value has changed.
• thiccly 7y ago
  Tl;dr Brave (a chromium skin) is learning how Google services work as they work to provide more than a theme, plugins and scamcoin. Luckily, the Brave team are true blackhatters, as evidenced by this ridiculous clickbait going viral on HN. Sigh..
• a_imho 7y ago
  Google has been violating GDPR from day one.
  • drusepth 7y ago
    That's not surprising seeing as how GDPR was pretty much drafted explicitly against Google.
    • a_imho 7y ago
      That's just your bias and no grounds for violating it. In fact, if it was true the more reason to comply. But it is obviously false, seeing Google can still do whatever they wish without serious repercussions.
• deleted 7y ago
  [deleted]
• panpanna 7y ago
  Friendly reminder that this is all to show you "targeted ads". You can fight back by providing fake and bogus data. For example, there are browser extensions that do this for you.
• aledalgrande 7y ago
  After this, do you still want to use Chrome? Who knows what data they are sending when they control your desktop experience.
• nautilus12 7y ago
  "Don't worry about being evil"
• joefkelley 7y ago
  I'm an engineer who has worked on ad systems like this and I'm really struggling to make sense of this article - what hope does a layman have? Here's my understanding: Google runs real-time bidding ad auctions by sending anonymized profiles to marketers, who bid on those impressions. The anonymous id used in each auction was the same for each bidder, which is in violation of GDPR. If Google were to send different ids for each bidder, it would be ok? Is this correct? Why would it matter that the bidders are able to match up the IDs with each other, aren't they all receiving the same profile anyway? Wouldn't privacy advocates consider the sending of the profiles at all an issue?
  • aeorgnoieang 7y ago
    > Why would it matter that the bidders are able to match up the IDs with each other, aren't they all receiving the same profile anyway? I would guess that yes, they're all receiving – _from Google_ – the "same profile" but they also are collecting additional info that they can then share with each other and, because they can match profiles exactly, they can access each other's info about specific people. > Wouldn't privacy advocates consider the sending of the profiles at all an issue? I'd imagine that the profile Google has and shares is by itself fairly anodyne, but I could be (very) wrong about that. The problem seems to be more (if not entirely) that different advertisers can share info using a common profile ID. I'd imagine that even a single advertiser would be able to perform a similar 'attack' by, e.g. running multiple different campaigns, but I may be misunderstanding exactly what info is being shared. It's possible advertisers are able to match the Google profiles to specific unique identities and thus are sharing much more than just the info they're collecting directly from their ads.
    • chii 7y ago
      If it's the different advertisers who are going to share info, then why aren't they responsible for their own adherence to GDPR, rather than Google?
      • mirimir 7y ago
        As I understand it, Google is responsible for not sharing information that would allow them to violate GDPR. Without explicit user opt-in, that is.
• redder2 7y ago
  Note: Brave boasts itself with helping you against tracking. Yet they build their own crypto to specifically let advertisers TRACK YOU! Oh the iroty. They may newer get your name and very personal details but your interests and browsing habits are BEING SOLD by Brave if you use BAT. Its quite the irony really.
• stunt 7y ago
  I remember they dropped "Don't be evil" from their code of conduct a couple of years ago.
• crtlaltdel 7y ago
  brave is incentivized to push this narrative, accurate or inaccurate as it may be. i am not ad-tech guru, nor digital marketer. i do know that brave's entire premise hangs on traditional ad-tech strategy remaining static, consumer sentiment around "big tech" to sour and a groundswell of "privacy focused consumers" to materialize. that groundswell is their identified target market for their product.
  • trpc 7y ago
    What's funnier is that Brave """product""" is nothing more but a theme over Chrome that any 12 yo kid can do in 2 hours, an adblocker based on FOSS blacklists and some compilation flags that prevent Google from enabling its own server features and tracking system and redirecting the tracking system to their own servers. Yet their entire PR and marketing is based on "Google is evil!". In any other industry this scam would have been shut down and the management would have been sued to probably jail time. But in tech, many things are blurry.
    • Ayesh 7y ago
      I also see how Brave likes to thrive on anti-Google pro-privacy camp and I personally pick Firefox over Brave any day if the week. There is de-Googled Chromium OS project, but Brave takes a few steps sideways by making further changes such as proxying location services, safe browsing API, etc. I doubt a 12 y/o could compile it though, let alone in 2 hours.
  • danis1 7y ago
    Which is the reason Brave is in a good position to do this kind of work. They represent a growing portion of web users, and their research helps to give these users a voice.
• jwildeboer 7y ago
  Hundreds of deflecting comments about coffee at McDonalds and astroturfing. Well done! Can we now talk about how Google uses creepy tactics to undermine privacy and the GDPR?
• senegoid 7y ago
  The sharing of data is what makes RTB valuable and most likely viable. Because what Google are doing is not dissimilar to how any other RTB participant is acting, saying this is a Google workaround seems disingenuous. Unfortunately I fear this will only embolden Google to further monopolize digital advertising.
• downandout 7y ago
  Yeah. Brave is desperately trying to compete with Chrome and can’t figure out why they aren’t making much headway, despite having better privacy (hint: users just don’t care about privacy, except for the HN crowd). These complaints filed by Brave, with their own employees posing as professional “victims” intentionally grasping at straws for evidence of privacy violations, smack of desperation. This is not the first claim they have filed, and sadly, it won’t be the last. Their claims thus far have been disingenuous at best, downright dishonest at worst. GDPR was not meant as a weapon with which one could hobble their far more successful competitors. It’s sad to see that a company that claims to care so much about privacy is undermining GDPR by bringing the worst fears of those that opposed it to life.
  • rhizome 7y ago
    (hint: users just don’t care about privacy, except for the HN crowd). I'm not sure that's true: uBlock Origin has twice as many installations as Brave does. You might say "oh, but that's just blocking ads!" But if you don't block ads, privacy problems are going to spring out of the woodwork like nobody's business. That is, they might not care about privacy by name, but they certainly care about it in effect.
    • downandout 7y ago
      I’d say the vast majority of uBlock users care about user experience. The current ad experience sucks. Most local newspaper sites, for example, are unusable because of ads. But if it still preserved their privacy behind the scenes and didn’t significantly improve their experience, the install base on uBlock and other ad blockers would be near 0.
      • donohoe 7y ago
        Highly doubtful
      • girvo 7y ago
        And I'd say the opposite. My grandfather just wanted ads gone; user experience isn't even on his radar. I've seen the thesis you've presented here before, and while it sounds plausible, I don't think it's as cut and dried as it seems. People really do hate ads. We're inundated with them, constantly. Low grade psychological assault, at all times. I don't blame people for wanting a respite.
• gtallen1187 7y ago
  I'm glad this story was reported, and I'm thankful to the author for putting in the work required to report this story. But after the first five paragraphs, the author's shameless, repetitive self-promotion and insistence on referring to himself in the third person almost made this unreadable. The headline was enough to pique my curiosity to explore Brave's product offering. Unfortunately, actually reading the article had the exact opposite affect.
  • dvcrn 7y ago
    I thought the exact same thing after reading the first few paragraphs but didn't even notice that the author IS Johnny Ryan, the person mentioned in the story, until you pointed it out. I didn't make it to the end, closed the tab and went over to HN comments for a summary.
  • phnofive 7y ago
    Welcome to any article sponsored by Brave. Comments on such posts are a reliable place to read the latest spin from the Brave team.
• laythea 7y ago
  Presumably ads are so valuable because people click through them and go on to purchase. I realise I am in a minority, but I have never clicked on a digital ad and went through to buy something, and I never will. The minute I see ads on a webpage, I automatically associate that site with trash. (Please take note HN :)) It is as if humanity cannot be trusted with technology. This creates a certain "ceiling" for us in terms of development as a species. Such a shame.
  • tapland 7y ago
    > The minute I see ads on a webpage, I automatically associate that site with trash. You might want to reconsider
    • laythea 7y ago
      Care to elaborate a little?
      • tapland 7y ago
        I've visited plenty of sites made by small developers who simply use them to try to offset hosting costs with a banner ad. Hosting isn't a negligible cost for everyone and content should be judged based of content, but you can of course judge a site as a whole with ads included.
        • laythea 7y ago
          That does not excuse it in my book.
  • craftinator 7y ago
    You might not want to reconsider.
  • bduerst 7y ago
    The ads you're referring to here are called display ads. Most of these ads are not about getting you to click, but about awareness. It's the same thing as a full-page advert in a magazine that you flip through. For some readers, they will stop an read it, raising awareness to that brand/product/company etc.
• erichocean 7y ago
  Does GDPR only apply to individuals, or can I find out all of the information that is being held by Google (or anyone else) on my EU-based business?
• afarviral 7y ago
  At this point I'm just waiting for some of these tech companies to drop their analytics and drop targeted advertising, and just ask users for their advertising preferences or do advertising the traditional way... why do we HAVE to have targeted advertising? It's either hit or miss, or too creepy anyway...
• banku_brougham 7y ago
  People are missing the point. Google is trying to manage GDPR and their previous business model which is selling all that user data. They are not going succeed and GDPR is going to prevail.
• decide1000 7y ago
  The article claims that personal data is shared along 2000 companies. As far I understand those companies do not receive personal information. I do not see real proof.
• falsedan 7y ago
  I think a large cause of impedance for engineers to understand the issue is: randomly-assigned ids don’t anonymise users, because you can still attribute an action uniquely to one user (even if you don’t know their name/personal details). I think of it like the UID I get on a UNIX machine: it identifies me, and anyone with /etc/passed can get my name, and things that don’t have access to it can still see “oh uid 1099 is logging in again to play nethack”.
• leegr 7y ago
  Cringe