5 ms·

I checked the sample log provided. Below is the google_gid for different publishers, there is no proof of overlap, they have different google_gid for same pers

I checked the sample log provided. Below is the google_gid for different publishers, there is no proof of overlap, they have different google_gid for same person. Which is exactly what google describes. [1] I don't understand what Brave claims. d.agkn.com CAESEP-S3Zs5f0_kq11XTCZP_mE id.rlcdn.com CAESEPpf2T4-2AsAR_4rer3RfNs image6.pubmatic.com CAESEB9H3qdV26kxEiz-BJ_TY-M pippio.com CAESEJyqG1Pg1j-_scqW8kDzTkg token.rubiconproject.com CAESEE1DyZ245WggYaQZEWpQWI8 us-u.openx.net CAESEPIJ9jHcY2j4jK3-DPmfar4 [1] https://developers.google.com/authorized-buyers/rtb/cookie-guide https://developers.google.com/authorized-buyers/rtb/cookie-g...

ggg3 7y ago
which is the "workaround" to the gdpr the article badly describes (probably because brave upcoming ad network will do the same but more workaroundily) now those are used to match a 3rd party id. you just need a gdpr_workaround schema in your data base with two columns user-id, google-random-id with N-1 records indexed both ways. gdpr has restrictions on pin pointing a single person. this is effectively doing that, but claim it is not, because random ids. apple is just a little better with how device-advertiser-id works.
- halr9000 7y ago
  Well, the “right” workaround is an opt-in system. But that would drastically reduce the number of qualified ad prospects, reducing their wholesale value, killing the online ad business, drying up the websites themselves who exist for this revenue (some/many of which are trash, but not nearly all). I don’t think we can have it both ways, or at least it is very difficult and we don’t have a great compromise solution.
  - frenchyatwork 7y ago
    I don't think the EU, or consumers in general, are terribly interested in "compromising" with the ad-tech industry.
    - filoleg 7y ago
      Not that I support the ad-tech industry, but those consumers probably are interested in having their favorite websites being kept alive. Which implies that they might indeed be interested in "compromising" with ad-tech industry.
      - kevingadd 7y ago
        Given the popularity of ad-blockers these days I'm not sure they're as interested as you think they are.
        takeda 7y ago
        With current ad industry it's more about whether you are ok with being bullied or not.
      - girvo 7y ago
        Why should we give ad-tech their one millionth chance to "do the right thing"? They've proven time and time again they cannot be trusted.
        filoleg 7y ago
        it isn't about giving ad-tech any chance of anything, it is about websites that are liked and used by people (most of whom have either no means or no desire to support those websites with money directly) being able to sustain themselves in order to exist.
        CodeMage 7y ago
        That's pretty much a false dichotomy: a site must either support itself via ads, or cease to exist. There are other ways to get money to support your work, and if those ways are too painful right now, that's just an opportunity for disruption. Even better, it's an opportunity to prove that disruption doesn't have to be exploitative.
- jancsika 7y ago
  > probably because brave upcoming ad network will do the same but more workaroundily AFAICT Brave's plan is to send a block of potential ads to the client and use a client-side machine learning algorithm to choose specific ads. So the claim is that none of client events, inferences from the algo, nor ad choices travel from the client to the ad networks. (But ad networks retain their crazy microtargetting which I guess is the selling point.) Even if Brave were to choose the blocks of ads based on geolocation and other install-time/runtime data which they then sell to third parties, it's still significantly less data leaking from the client's browser compared to, say, a default Chrome install. But them storing/selling that would be a clear GDPR violation as well as going directly against all their explicit public claims so far. What is your understanding of Brave's upcoming ad network that leads you to believe it requires a surreptitious GDPR violation?
mintplant 7y ago
This log [0], right? Did you miss in the article that it's the `google_push` identifier that's being used for syncing between adtech companies? If you search for it (AHNF13KKSmBxGD6oDK9GEw5O0kvgmFa3qM30zpNaKl72Og), you can see it being included in requests to lots of different adtech firms' domains. [0] https://brave.com/wp-content/uploads/files_2019-9-2/sample_push_page_from_session.txt https://brave.com/wp-content/uploads/files_2019-9-2/sample_p...
- bluesign 7y ago
  There is unfortunately no way to prevent that part. BidRequest Data [0] and Request Time is already enough to fingerprint the user. "Google prohibits multiple buyers from joining their match tables." part is not technical, it is contract based. [0] Sample Data from Bid Request ip: "F\303\006" user_agent: "Mozilla/5.0 (Linux; Android 7.1.1; Pixel XL Build/NOF26V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36" url: "http://www.myfitnesspal.com/food/calories/popeyes-buttermilk-biscuit-29980768" cookie_version: 1 google_user_id: "CAESEIMlaNwMN-rtiDFzjwNIX6Y" timezone_offset: -360 detected_content_label: 39 mobile { is_app: false 3: "android" 8: 1 12: "google" 13: "pixel xl" 14 { 1: 7 2: 1 3: 1 } 15: 412 16: 732 18: 70092 19: 3500 } cookie_age_seconds: 12960000 geo_criteria_id: 9023221 device { device_type: HIGHEND_PHONE platform: "android" brand: "google" model: "pixel xl" os_version { major: 7 minor: 1 micro: 1 } carrier_id: 70092 screen_width: 412 screen_height: 732 screen_pixel_ratio_millis: 3500 }
  - foxhill 7y ago
    > There is unfortunately no way to prevent that part. “there is no way for google to operate under the GDPR and provide targeted advertising” ? i’m inclined to agree :/
  - rhizome 7y ago
    There is unfortunately no way to prevent that part. Well there's absolutely a way: single-source JS and no CORS.
    - 7y ago

ggg3 7y ago

which is the "workaround" to the gdpr the article badly describes (probably because brave upcoming ad network will do the same but more workaroundily) now those are used to match a 3rd party id. you just need a gdpr_workaround schema in your data base with two columns user-id, google-random-id with N-1 records indexed both ways. gdpr has restrictions on pin pointing a single person. this is effectively doing that, but claim it is not, because random ids. apple is just a little better with how device-advertiser-id works.

halr9000 7y ago
Well, the “right” workaround is an opt-in system. But that would drastically reduce the number of qualified ad prospects, reducing their wholesale value, killing the online ad business, drying up the websites themselves who exist for this revenue (some/many of which are trash, but not nearly all). I don’t think we can have it both ways, or at least it is very difficult and we don’t have a great compromise solution.
- frenchyatwork 7y ago
  I don't think the EU, or consumers in general, are terribly interested in "compromising" with the ad-tech industry.
  - filoleg 7y ago
    Not that I support the ad-tech industry, but those consumers probably are interested in having their favorite websites being kept alive. Which implies that they might indeed be interested in "compromising" with ad-tech industry.
    - kevingadd 7y ago
      Given the popularity of ad-blockers these days I'm not sure they're as interested as you think they are.
      - takeda 7y ago
        With current ad industry it's more about whether you are ok with being bullied or not.
    - girvo 7y ago
      Why should we give ad-tech their one millionth chance to "do the right thing"? They've proven time and time again they cannot be trusted.
      - filoleg 7y ago
        it isn't about giving ad-tech any chance of anything, it is about websites that are liked and used by people (most of whom have either no means or no desire to support those websites with money directly) being able to sustain themselves in order to exist.
        CodeMage 7y ago
        That's pretty much a false dichotomy: a site must either support itself via ads, or cease to exist. There are other ways to get money to support your work, and if those ways are too painful right now, that's just an opportunity for disruption. Even better, it's an opportunity to prove that disruption doesn't have to be exploitative.
jancsika 7y ago
> probably because brave upcoming ad network will do the same but more workaroundily AFAICT Brave's plan is to send a block of potential ads to the client and use a client-side machine learning algorithm to choose specific ads. So the claim is that none of client events, inferences from the algo, nor ad choices travel from the client to the ad networks. (But ad networks retain their crazy microtargetting which I guess is the selling point.) Even if Brave were to choose the blocks of ads based on geolocation and other install-time/runtime data which they then sell to third parties, it's still significantly less data leaking from the client's browser compared to, say, a default Chrome install. But them storing/selling that would be a clear GDPR violation as well as going directly against all their explicit public claims so far. What is your understanding of Brave's upcoming ad network that leads you to believe it requires a surreptitious GDPR violation?

mintplant 7y ago

This log [0], right? Did you miss in the article that it's the `google_push` identifier that's being used for syncing between adtech companies? If you search for it (AHNF13KKSmBxGD6oDK9GEw5O0kvgmFa3qM30zpNaKl72Og), you can see it being included in requests to lots of different adtech firms' domains. [0] https://brave.com/wp-content/uploads/files_2019-9-2/sample_push_page_from_session.txt https://brave.com/wp-content/uploads/files_2019-9-2/sample_p...

bluesign 7y ago
There is unfortunately no way to prevent that part. BidRequest Data [0] and Request Time is already enough to fingerprint the user. "Google prohibits multiple buyers from joining their match tables." part is not technical, it is contract based. [0] Sample Data from Bid Request ip: "F\303\006" user_agent: "Mozilla/5.0 (Linux; Android 7.1.1; Pixel XL Build/NOF26V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36" url: "http://www.myfitnesspal.com/food/calories/popeyes-buttermilk-biscuit-29980768" cookie_version: 1 google_user_id: "CAESEIMlaNwMN-rtiDFzjwNIX6Y" timezone_offset: -360 detected_content_label: 39 mobile { is_app: false 3: "android" 8: 1 12: "google" 13: "pixel xl" 14 { 1: 7 2: 1 3: 1 } 15: 412 16: 732 18: 70092 19: 3500 } cookie_age_seconds: 12960000 geo_criteria_id: 9023221 device { device_type: HIGHEND_PHONE platform: "android" brand: "google" model: "pixel xl" os_version { major: 7 minor: 1 micro: 1 } carrier_id: 70092 screen_width: 412 screen_height: 732 screen_pixel_ratio_millis: 3500 }
- foxhill 7y ago
  > There is unfortunately no way to prevent that part. “there is no way for google to operate under the GDPR and provide targeted advertising” ? i’m inclined to agree :/
- rhizome 7y ago
  There is unfortunately no way to prevent that part. Well there's absolutely a way: single-source JS and no CORS.
  - 7y ago