4 ms·

> It says the websites had Google cookies and others. OK, anybody using Google Analytics has Google cookies. Anyone using FB plugins has FB cookies. It's not t

> It says the websites had Google cookies and others. OK, anybody using Google Analytics has Google cookies. Anyone using FB plugins has FB cookies. It's not that complicated: certain websites, dealing in certain kinds of sensitive information, may be legally required to seek explicit user consent before even using Google Analytics or Facebook Plugins. Yes, Google Analytics use is damn near ubiquitous right now. That does not mean it is unambiguously OK to slap it on ever website under the sun. > What is the evidence of "mental health" being treated in some scary specific way? No evidence is required. The law is clear. That someone subject to GDPR regulations has the information that they were seeking information related to depression transmitted to google and facebook in the form of a Google Analytics and Facebook scripts on page, without their explicit consent to that, is in and of itself a violation of the law.

kodablah 7y ago
I'm not sure it's clear that generic page analytics necessarily means that ones presence on certain pages is any more sensitive than Google maps knowing that you zoomed in on a depression clinic. I can understand this is easy with third party analytics on specific-subject pages, but the waters may appear muddier on web server logs, dns lookups/caches, browser history, search results etc where generic approaches may only be illegal depending on what's visited or looked up. What if the analytics scripts promised not to collect URL or page content (not saying that's the case here)? If not already clarified somewhere (pardon my ignorance on the bodies/law involved), I think these common cases should be listed as clearly illegal not in canon, but as a helper to these services. Keeping a list containing things like "it's illegal for sites remotely related to health to use third party analytics of any kind sans prior consent" (or "it's illegal for sites remotely related to health to let the URL or content of the page be known to third parties sans prior consent") could help. I too struggled w/ some of the sensationalizing in the article, because I read: > Sensitive personal information about mental health is routinely being traded to advertisers around the web as a bold headline, only to read: > This was problematic because sensitive information could be broadcast to all of those bidding, PI said I couldn't really tell what was really being sold routinely, personal info or ad space. And I couldn't separate what "could be broadcast" vs what was.
- msbarnett 7y ago
  > I couldn't really tell what was really being sold routinely, personal info or ad space It’s the same thing. Look, the website deals in mental health information, right? And health information is part of a class of information that’s protected under the GDPR. Under that protection, explicit user consent is required before that info can be shared with anyone. When the website invokes the Google ad APIs, that results in Google learning that this user, who they build an identity around via tracking cookies, is reading a website with information about a health condition. Google isn’t the website the user visited, it’s a third-party the website just informed without explicitly asking for the user’s permission. That violates the GDPR. The website makes money off of informing Google about this. That’s “selling user health information” to an advertiser — Google. Google turns around to its ad bid network and solicits bids to show an ad to google push_id abcdefghihk123, who is visiting a website about mental health. That, again, is a GDPR violation, because disclosing information about a pseudonym ID still counts under the GDPR (and the info can be de-anonymize easily by aggregation networks). That, again, is Google selling personal info to advertisers. What it boils down to is you’re thinking about this is all wrong; the way Google sells ads, there’s no difference between selling personal info and selling ad space because you’re always bidding to show an individual you’re given data about an ad. The bids are based on how much the person’s profile matches the bidder’s interests, and anything new learned about the person that can be gleaned from the current website visit is added to that profile. Advertisers are literally being told “here: this person with id 12345 and these characteristics matching your target profile is currently reading about depression. How much to show them an ad?” The bid request data they’re given in turn is enough to identify the user in any number of data aggregation services — most of which require “share and share alike” participation — so the bidder looks up the bid request data and discovers probable email address, location, income, marital status, interests, etc, and in return tells the aggregation service “this user is currently visiting doihavedepression.com”. Again, GDPR violation. That’s the nature of modern online advertising. You’re never bidding to just show N ads on site Y. There is no such thing, in using Google’s advertising system, as selling an ad space on your site to Google that isn’t also a sale of personal information to Google and by Google to the advertisers bidding to fill that spot. As such there are entire classes of websites that probably should not be showing Google ads.

kodablah 7y ago

I'm not sure it's clear that generic page analytics necessarily means that ones presence on certain pages is any more sensitive than Google maps knowing that you zoomed in on a depression clinic. I can understand this is easy with third party analytics on specific-subject pages, but the waters may appear muddier on web server logs, dns lookups/caches, browser history, search results etc where generic approaches may only be illegal depending on what's visited or looked up. What if the analytics scripts promised not to collect URL or page content (not saying that's the case here)? If not already clarified somewhere (pardon my ignorance on the bodies/law involved), I think these common cases should be listed as clearly illegal not in canon, but as a helper to these services. Keeping a list containing things like "it's illegal for sites remotely related to health to use third party analytics of any kind sans prior consent" (or "it's illegal for sites remotely related to health to let the URL or content of the page be known to third parties sans prior consent") could help. I too struggled w/ some of the sensationalizing in the article, because I read: > Sensitive personal information about mental health is routinely being traded to advertisers around the web as a bold headline, only to read: > This was problematic because sensitive information could be broadcast to all of those bidding, PI said I couldn't really tell what was really being sold routinely, personal info or ad space. And I couldn't separate what "could be broadcast" vs what was.

msbarnett 7y ago
> I couldn't really tell what was really being sold routinely, personal info or ad space It’s the same thing. Look, the website deals in mental health information, right? And health information is part of a class of information that’s protected under the GDPR. Under that protection, explicit user consent is required before that info can be shared with anyone. When the website invokes the Google ad APIs, that results in Google learning that this user, who they build an identity around via tracking cookies, is reading a website with information about a health condition. Google isn’t the website the user visited, it’s a third-party the website just informed without explicitly asking for the user’s permission. That violates the GDPR. The website makes money off of informing Google about this. That’s “selling user health information” to an advertiser — Google. Google turns around to its ad bid network and solicits bids to show an ad to google push_id abcdefghihk123, who is visiting a website about mental health. That, again, is a GDPR violation, because disclosing information about a pseudonym ID still counts under the GDPR (and the info can be de-anonymize easily by aggregation networks). That, again, is Google selling personal info to advertisers. What it boils down to is you’re thinking about this is all wrong; the way Google sells ads, there’s no difference between selling personal info and selling ad space because you’re always bidding to show an individual you’re given data about an ad. The bids are based on how much the person’s profile matches the bidder’s interests, and anything new learned about the person that can be gleaned from the current website visit is added to that profile. Advertisers are literally being told “here: this person with id 12345 and these characteristics matching your target profile is currently reading about depression. How much to show them an ad?” The bid request data they’re given in turn is enough to identify the user in any number of data aggregation services — most of which require “share and share alike” participation — so the bidder looks up the bid request data and discovers probable email address, location, income, marital status, interests, etc, and in return tells the aggregation service “this user is currently visiting doihavedepression.com”. Again, GDPR violation. That’s the nature of modern online advertising. You’re never bidding to just show N ads on site Y. There is no such thing, in using Google’s advertising system, as selling an ad space on your site to Google that isn’t also a sale of personal information to Google and by Google to the advertisers bidding to fill that spot. As such there are entire classes of websites that probably should not be showing Google ads.