17 ms·

New study: The advertising industry is systematically breaking EU law

454 points by robin_reala 7y ago

blakesterz 7y ago
The technical report is pretty interesting. They break down what's going where: https://fil.forbrukerradet.no/wp-content/uploads/2020/01/mnemonic-security-test-report-v1.0.pdf https://fil.forbrukerradet.no/wp-content/uploads/2020/01/mne...
- dgellow 7y ago
  Also, the non-technical(?) report is also a great read, and can a good one to share around to managers/non-engineers: https://fil.forbrukerradet.no/wp-content/uploads/2020/01/2020-01-14-out-of-control-final-version.pdf https://fil.forbrukerradet.no/wp-content/uploads/2020/01/202...
  - mkarlsch 7y ago
    Agree! Both reports are a pretty good and reflect the status quo in the industry. There is an overcollection and oversharing of data without proper consent and that has to stop. For Europe - forcing the ad-tech industry to adhere to the GDPR is the correct next step as self regulation did not work. Having said that the report paints a pretty dark and one-sided picture. Let's see how far the authorities will follow their argumentation / conclusion. (full disclosure: I work in that industry.)
lidHanteyk 7y ago
CCPA cannot kick in fast enough. We need consumer protection in the USA too.
- PeterisP 7y ago
  I haven't delved into a lot of detail of how CCPA works, but it seems to me as a step in the right direction that won't achieve much practical change. It's worth to look at this from the perspective of EU privacy legislation before GDPR - it already included all the things that data should be safeguarded, customers should be informed, that consent matters, etc. However, it didn't really have a meaningful effect on actual privacy before GDPR (and IMHO we'll need a GDPRv2 not that long in the future), because companies were able to comply simply by adding legalese, privacy policies and notifications without actually changing the privacy-relevant behavior. One aspect that I feel that CCPA is getting wrong and GDPR got right is the "default condition". According to GDPR, companies are prohibited to process your data unless they can provide a specific legal basis that allows them to do so, one of which is opt-in consent. According to CCPA (correct me if I'm wrong) the default position is that companies are allowed to do whatever they want with your data, but they are required to inform you and honor opt-out requests. This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. The second difference is the distinction between having the data and using it for a specific purpose. It is a very common scenario where certain private data are clearly needed for a specific purpose (e.g. your address to deliver some goods), but we'd want to restrict the company's ability to use the same data for other purposes e.g. targeted advertising. With the way how GDPR is structured, this separation is built in; but CCPA doesn't make such a distinction, so (for example) the company is able to share data with a third party that's needed for fulfilling some business purpose (even if the customer had the opt-out for selling data, because it's not selling), then (as far as I understand - correct me if I'm wrong) according to CCPA the third party is legally free to use data for whatever other things it wants. And we should expect that business arrangements will be intentionally designed to 'accidentally' make transferring such data (without a sale) to be part of many deals, so that the big data aggregators would still continue to get all the same information that they had; that companies will be able to comply while continuing to do the same thing.
  - lmkg 7y ago
    > This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. CCPA requires you to have a link with the exact words "DO NOT SELL MY INFORMATION" visible on the homepage. That is an explicit provision. This somewhat limits company's ability to legalese their way around it.
    - mondoshawan 7y ago
      Still pretty crappy requiring users to take action to stop the selling of that information. Worse, it should be stopping the collection of it. Ugh. :-/
      - mgreg 7y ago
        While that is true - a consumer must take action to protect their individual information - it may be that if enough people do this that the cost of compliance (responding to the ccpa requests) will make it less profitable to hold on to a consumer's information. There are also lists with links and contact info of important businesses to exercise your CCPA opt-out or delete rights with like data brokers such as Experian, Epsilon, TransUnion as a start. Even ccpa email templates that may be easier to use rather than going through a form (not sure if they will work).
      - lidHanteyk 7y ago
        It actually is opt-in, not opt-out, by default. In order to do opt-out, a business has to demonstrate that their users are all above 13 and able to consent, which is a hard requirement that will force nearly all data brokers to do opt-in instead. To completely stop collection is difficult. But the legislative will is clearly manifest, so it might happen.
    - sparker72678 7y ago
      And yet... https://twitter.com/dhh/status/1216054342920200193 https://twitter.com/dhh/status/1216054342920200193 (thread)
bsenftner 7y ago
I realize we need formalized reports to produce legal action, but this sure reads like "News! Water is wet!"
- Finnucane 7y ago
  The overall conclusion is hardly surprising, but the details matter in formulating a response.
- GhettoMaestro 7y ago
  And the inverse of not having this type of investigative data? People rightfully saying "source please" or "citiation needed" when we claim that apps are tracking us. Kinda surprised you don't want data - even if you don't have time to review the data yourself.
Mirioron 7y ago
I wish GDPR had some exemption for small companies or companies that are starting out. Maybe limitations on revenue, amount of users and scope of data, eg strict rules still apply (to a small company) when dealing with sensitive data such as health information, but email addresses are not as strictly governed. Perhaps require a plan of action to abide by the full rules by X future date even. Take for example some one person indie developer. A common way to monetize that is through ads and in app purchases that turn ads off. With the current rules it's difficult for a single person to know that they abide by all of that while still monetizing in such a way.
- cnorthwood 7y ago
  The problem is really that the indie developer doesn't really have any monetisation options other than those which break the law, but in theory it's not overly onerous to pick one that at least claims to be GDPR compliant. They should be able to trust that their suppliers aren't providing them illegal products tbh.
  - criddell 7y ago
    You're forgetting the most legitimate monetization option: If you make something great, people will pay for it.
    - mrweasel 7y ago
      That seem like a lot work, go for VC funding and sell to Google, Facebook, Microsoft or Apple in two years.
    - Mirioron 7y ago
      That's not how it works at all though. The games on the app store that make a lot of money are those that mercilessly try to rip people off. Gacha games are essentially gambling, whereas proper games with a story and gameplay earn very little.
      - criddell 7y ago
Jolter 7y ago
"– Every time you open an app like Grindr advertisement networks get your GPS location, device identifiers and even the fact that you use a gay dating app. This is an insane violation of users’ EU privacy rights, says Max Schrems, founder of the European privacy non-profit NGO noyb." Yes, insane seem like it's not actually an overstatement for once.
- toohotatopic 7y ago
  In which way is this a violation? It is not illegal for companies to process the data which you have signed away with a contract. It is allowed if [1] >they have a contract with you – for example, a contract to supply goods or services (i.e. when you buy something online), or an employee contract You just have the right to request that your data is deleted but as long as you don't do that, why should your data not be processed? Additionally, it is allowed to process private data without a contract if it is necessary. Then, an excessive use of private data is illegal. But most services will have a contract and thus it is legal. Minor detail: services cannot be restricted if you don't agree to share your private data. But that doesn't touch sharing the data that was signed away with a contract. [1] https://europa.eu/youreurope/citizens/consumers/internet-telecoms/data-protection-online-privacy/index_en.htm https://europa.eu/youreurope/citizens/consumers/internet-tel...
  - grabeh 7y ago
    The concept of processing necessary for the performance of a contract is interpreted extremely narrowly by data protection law. Rightly so, because otherwise it would give entities far too much latitude to stuff as many different processing activities as possible within that ground, even though certain processing activities aren't at all necessary to provide the service. With Grindr, they only need to process data to provide the service by making it available to you and to other users. What they definitely don't need to do in order to provide the core service is to share your data with third parties who can then use it for their own purposes. Any argument that the processing is necessary because it's an ad-funded service would not be acceptable under data protection law. On that basis, performance of a contract would not be a relevant ground. You're also looking at e-Privacy Directive considerations in the EU where either a cookie or similar is essential to provide the service, or you need consent. Similar for location data, you will generally need consent. So you not only have GDPR issues but also e-Privacy Directive issues where your processing grounds are actually incredibly limited anyway.
fergie 7y ago
The world is beginning to rely more and more on Scandinavia to defend human rights and democracy.
- mrweasel 7y ago
  That's not really the failing you get living here. I'm not saying it other don't have it much much worse, but at least the Danish government really like invading peoples privacy.
  - Gwypaas 7y ago
    In what ways do they invade peoples' privacy? Swede considering moving across the sound.
    - mrweasel 7y ago
      Currently telcos are required to collect data on EVERYONE, not just criminals. That's clearly illegal, according to EU law, but the Danish government and minister of justice have basically said that they don't care. There's an increased interest in CCTV and privacy concerns are ignored, even though crime rates are lower than they ever have been, but you know: Terror! You can't drive around the country without the police knowing where you are, because license plate scanners are everywhere. Oh, and the Danish government have exempted itself from the GDPR.
brootstrap 7y ago
I have family in the industry (digital ads, bidding for ads) and some of the stuff they have explained to me is pretty gnarly. One cousin was explaining an idea he had for a new business and it was essentially just about collecting as much personal data as possible. Imagine a simple DB table with 'user_id' as primary key. Then you just start adding data on top of data with new columns or joins. After a while you have hundreds (thousands) of datapoints per person, then you start selling that data. So i want to help my family out b/c i have the tech skills and building some prototypes would be easy. But i'm also not sure i want to feed the advertising beast. Shit is whack right now man they listen to you talking to your wife through your phone about buying a mattress, going to a concert, taking a trip somewhere. Next time you open the browser you are bombarded with relevant ads. too creepy no thanks!
- cj 7y ago
  > they listen to you talking to your wife through your phone about buying a mattress, going to a concert, taking a trip somewhere. Next time you open the browser you are bombarded with relevant ads. I've heard this from non-tech family/friends. Is this actually happening though? If so, who is doing it and how? Edit: I'm referring specifically to ad tech that targets ads based on overheard conversations.
  - crwfshndndls 7y ago
    No, it's not.
  - ourlordcaffeine 7y ago
    I don't know if mainstream apps are doing that, but I don't see why someone couldn't create a "trojan horse" app that requires the microphone, and starts monitoring and sending back recordings if it detects a conversation, it probably would be eventually spotted though if it gets any populartity. Or, perhaps microphones in public that try to tie overheard conversations with beacon or location data to find out who it heard.
  - Tenoke 7y ago
    >Is this actually happening though? If so, who is doing it and how? It's possible but a lot of the reports are clearly coincidences. Take this example of someone watching 'Catch Me If You Can' 2 days ago, and then yesterday seeing a HN posting about the main character and finding it hard to accept as coincidental.[0] 0. https://news.ycombinator.com/item?id=22048337 https://news.ycombinator.com/item?id=22048337
wpietri 7y ago
Wait, an industry based on manipulating people into spending money regardless of need or value delivered is perhaps not totally ethical? Hold on while I practice my shocked face.
aguyfromnb 7y ago
Every time there's a corporate scandal of sorts (Boeing and Wells Fargo come to mind as recents), the people here scream for accountability. So what say ye, Googlers, Facebook employees and others? Should fines or prison fall on your shoulders? Why do you continue to do it, knowing you are breaking the law? Knowing you are harming people? Glass houses and all that...
- stjohnswarts 7y ago
  No but the government should start some crippling fines like "google thou shalt be broken into 3 companies and pay 50% of last years revenues". If it's just a couple million bucks that's nothing to google but permanent damage to the company would put the fear of Dog into them.
  - harry8 7y ago
    Probability of succeding in that aim is small. Probability of making that an immaterial expense to google by burying it with lawyers and taking it as far as the supreme court is close to 100%. Personal accoutability or bust. It's a very different management analysis if "I could go to jail."
- harry8 7y ago
  Until senior management and boards of directors are facing the very real prospect of prison all criminal behavior will be treated with statistical analysis of expected values; expected gain versus exected loss with being caught simply a business expense that probably won't even need to be paid. Even the most egrarious action resulting in extreme cases such as preventable death will be in a spreadsheet. How is whistle blowing going for engineers who hate this? Who could you report it to? Who would write the proper story without burying it for political friends (NYT, WSJ) or burning you as the source (Guardian)? Is there anywhere who will publish credible material they've received no matter what while doing everything to protect sources?
jka 7y ago
The proposed ePrivacy Regulation[0] looked like it was set to introduce some very positive recommendations to curb the worst of advertising cookies and pop-up dialogs. Article 10 of the draft regulation suggested moving consent settings into the browser so that you could specify whether you will accept various forms of cookies centrally and then have those settings apply to all sites. A ruling[1] related to shady consent practices by a website called Planet49 seems to have shifted the regulatory window towards the idea that users have to definitively prove informed consent. Meanwhile the latest draft[2] of the ePrivacy regulation has removed Article 10 and the mention of browser-based controls for cookies entirely and thus consent stays per-website. I really wish the choice of privacy related to advertising was baked into the browser and enforced there. Given the above developments, it's the only route I can see that avoids pop-up fatigue for users. The number of pop-ups everyone has to deal with causes user experience friction and wastes everyone's time. It'd seem reasonable to me for sites to be allowed to pair with advertisers to request additional consent via pop-ups if they want, but with the defaults in the browser. That way a site would have to make a conscious decision that it's worth getting consent from a user in order to monetize them -- and users would only need to be informed and provide their consent when something outside their expectations is being requested. I'd love to hear from anyone who's tracking this - I'm not a lawyer and all this is the bits and pieces I've picked up while reading on the web and trying to determine an analytics consent strategy for a project I'm developing. Edit: NB: I realize there's a context of apps rather than websites in the article, but I'd hope and suggest that the fundamentals are the same, especially if & when PWA's blur the distinction between browser/mobile-OS as host. [0] - https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_Union) https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_... [1] - https://www.cookiebot.com/en/active-consent-and-the-case-of-planet49/ https://www.cookiebot.com/en/active-consent-and-the-case-of-... [2] - https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_13808_2019_INIT&qid=1577719123146&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS...
iamaelephant 7y ago
All this invasion of privacy and still little evidence that user targeted advertising is substantially more effective than simple content based advertising.
- alanlovestea 7y ago
  It has been proven very effective. Quote: "So successful, by the way, that between 2000 and 2004 with their IPO [Initial Public Offering] documents going public, the first time we got to learn exactly what the impact of this new logic was. And the impact was a revenue increase of 3,590%, just during those years 2000-2004." source: https://www.econtalk.org/shoshana-zuboff-on-surveillance-capitalism/ https://www.econtalk.org/shoshana-zuboff-on-surveillance-cap...
  - airstrike 7y ago
    The way we use internet has also been changing at a significant rate since 2000 so we don't really have the counterfactual to show that content-based advertising wouldn't have experienced similar growth rates, unless we find a report covering revenue growth over the same period from a company (or better yet, a set of companies) that focuses on content-based ads
  - iamaelephant 7y ago
    That's comparing tracking advertising with bad data to tracking advertising with good data. Where's the comparison of tracking to non tracking advertising? Tracking advertising costs the advertiser more (and makes the ad provider a lot more), but there's little evidence to suggest it's significantly more effective than content advertising. And this isn't even accounting for the enormous social cost of private surveillance. https://techcrunch.com/2019/01/20/dont-be-creepy/ https://techcrunch.com/2019/01/20/dont-be-creepy/
- erezsh 7y ago
  I'm still "waiting" for ads that are actually relevant for me, and not just based on something I randomly watched a few days ago.
sixtypoundhound 7y ago
Get ready for ads to get more annoying. The hidden benefit of using personalized data to target and track prospects was an advertiser could use "soft sell" to build a brand over time. As that market gets shut off, we're back to aggressively using interruption marketing "shock jock" ads and auto-play video. Click now or forever hold your peace... The problem with contextually targeted ads is there is no real guarantee of repetition and brand building...
- therealdrag0 7y ago
  That's an interesting point. I do rather have hiking shoe/soylent ads snuck into my feed than random gaudy shit trying to get my attention.
- NeedMoreTea 7y ago
  Excellent, as that will prompt a reaction. First to push even more non technical folks to join most techies using no exceptions ad blocking. Second to provoke even more onerous regulations.
  - qvrjuec 7y ago
    And even more importantly this will eventually foster more palatable/unavoidable kinds of advertising to avoid the arms race entirely, e.g. product placement and endorsements.
- matheusmoreira 7y ago
  > we're back to aggressively using interruption marketing "shock jock" ads and auto-play video Advertisers thought they could get away with pop-ups until browsers shut them down by shipping pop-up blockers by default. I have no doubt ad blockers will shut down that market as well. Hopefully it will shut all of it down, driving advertisers out of the internet forever.
  - mjevans 7y ago
    I am only OK with one type of advertising. 1) I have a problem or a need that I am looking to fulfill. 2) I ask (E.G. a search engine) about fulfilling that need. 3) The results are no BS, no hidden fees, directly up-front responses that tell me how much something is going to cost, where it is, and maybe why that will solve my needs/desires. That is the only place at all that 'ads' belong, informative messages that are intended to actually help BOTH the consumer and any service provider.
Cartonju 7y ago
Another source: https://noyb.eu/three-gdpr-complaints-filed-against-grindr-twitter-and-the-adtech-companies-smaato-openx-adcolony-and-atts-appnexus/ https://noyb.eu/three-gdpr-complaints-filed-against-grindr-t... Research by the Norwegian Consumer Council (Forbrukerrådet) shows that many smartphone apps send highly personal data to thousands of advertising partners. The report uncovers how a large number of shadowy entities are receiving personal data about our interests, habits, and behavior, every time we use certain apps on our phones. This information is used to create comprehensive profiles about us, which can be used for targeted advertising and other purposes. “These practices are out of control and are rife with privacy violations and breaches of European law. The extent of tracking makes it impossible for us to make informed choices about how our personal data is collected, shared and used. Consequently, this massive commercial surveillance is systematically at odds with our fundamental rights”, says Finn Myrstad, director of digital policy in the Norwegian Consumer Council. “Every time you open an app like Grindr advertisement networks get your GPS location, device identifiers and even the fact that you use a gay dating app. This is an insane violation of users’ EU privacy rights”, says Max Schrems, founder of the European privacy non-profit noyb.
shadowgovt 7y ago
Yep. It's almost like the privacy law in the EU was written with no mind paid to how the world of online interactions actually works. I anticipate enforcement will go about as well as enforcement of drug policy goes in the United States.
- stubish 7y ago
  The products are not illegal, just the business model. If the businesses can't follow the law, they will get blocked or banned, and their market share will become available for the same or similar product backed by a legal business model. Unlike drugs, where the product itself is illegal.
  - shadowgovt 7y ago
    I don't think it's nearly so clear that the product isn't illegal.
fnord77 7y ago
thanks for reminding me to reset my advertising identifier on my iphone.

454 points by robin_reala 7y ago

The technical report is pretty interesting. They break down what's going where: https://fil.forbrukerradet.no/wp-content/uploads/2020/01/mnemonic-security-test-report-v1.0.pdf https://fil.forbrukerradet.no/wp-content/uploads/2020/01/mne...

dgellow 7y ago
Also, the non-technical(?) report is also a great read, and can a good one to share around to managers/non-engineers: https://fil.forbrukerradet.no/wp-content/uploads/2020/01/2020-01-14-out-of-control-final-version.pdf https://fil.forbrukerradet.no/wp-content/uploads/2020/01/202...
- mkarlsch 7y ago
  Agree! Both reports are a pretty good and reflect the status quo in the industry. There is an overcollection and oversharing of data without proper consent and that has to stop. For Europe - forcing the ad-tech industry to adhere to the GDPR is the correct next step as self regulation did not work. Having said that the report paints a pretty dark and one-sided picture. Let's see how far the authorities will follow their argumentation / conclusion. (full disclosure: I work in that industry.)

lidHanteyk 7y ago

CCPA cannot kick in fast enough. We need consumer protection in the USA too.

PeterisP 7y ago
I haven't delved into a lot of detail of how CCPA works, but it seems to me as a step in the right direction that won't achieve much practical change. It's worth to look at this from the perspective of EU privacy legislation before GDPR - it already included all the things that data should be safeguarded, customers should be informed, that consent matters, etc. However, it didn't really have a meaningful effect on actual privacy before GDPR (and IMHO we'll need a GDPRv2 not that long in the future), because companies were able to comply simply by adding legalese, privacy policies and notifications without actually changing the privacy-relevant behavior. One aspect that I feel that CCPA is getting wrong and GDPR got right is the "default condition". According to GDPR, companies are prohibited to process your data unless they can provide a specific legal basis that allows them to do so, one of which is opt-in consent. According to CCPA (correct me if I'm wrong) the default position is that companies are allowed to do whatever they want with your data, but they are required to inform you and honor opt-out requests. This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. The second difference is the distinction between having the data and using it for a specific purpose. It is a very common scenario where certain private data are clearly needed for a specific purpose (e.g. your address to deliver some goods), but we'd want to restrict the company's ability to use the same data for other purposes e.g. targeted advertising. With the way how GDPR is structured, this separation is built in; but CCPA doesn't make such a distinction, so (for example) the company is able to share data with a third party that's needed for fulfilling some business purpose (even if the customer had the opt-out for selling data, because it's not selling), then (as far as I understand - correct me if I'm wrong) according to CCPA the third party is legally free to use data for whatever other things it wants. And we should expect that business arrangements will be intentionally designed to 'accidentally' make transferring such data (without a sale) to be part of many deals, so that the big data aggregators would still continue to get all the same information that they had; that companies will be able to comply while continuing to do the same thing.
- lmkg 7y ago
  > This means that it's plausible for a company which currently is doing shady stuff to legally continue doing so, as long as they can write up some fancy words to 'inform' and ensure that most people don't do the opt-out process. CCPA requires you to have a link with the exact words "DO NOT SELL MY INFORMATION" visible on the homepage. That is an explicit provision. This somewhat limits company's ability to legalese their way around it.
  - mondoshawan 7y ago
    Still pretty crappy requiring users to take action to stop the selling of that information. Worse, it should be stopping the collection of it. Ugh. :-/
    - mgreg 7y ago
      While that is true - a consumer must take action to protect their individual information - it may be that if enough people do this that the cost of compliance (responding to the ccpa requests) will make it less profitable to hold on to a consumer's information. There are also lists with links and contact info of important businesses to exercise your CCPA opt-out or delete rights with like data brokers such as Experian, Epsilon, TransUnion as a start. Even ccpa email templates that may be easier to use rather than going through a form (not sure if they will work).
    - lidHanteyk 7y ago
      It actually is opt-in, not opt-out, by default. In order to do opt-out, a business has to demonstrate that their users are all above 13 and able to consent, which is a hard requirement that will force nearly all data brokers to do opt-in instead. To completely stop collection is difficult. But the legislative will is clearly manifest, so it might happen.
  - sparker72678 7y ago
    And yet... https://twitter.com/dhh/status/1216054342920200193 https://twitter.com/dhh/status/1216054342920200193 (thread)

bsenftner 7y ago

I realize we need formalized reports to produce legal action, but this sure reads like "News! Water is wet!"

Finnucane 7y ago
The overall conclusion is hardly surprising, but the details matter in formulating a response.
GhettoMaestro 7y ago
And the inverse of not having this type of investigative data? People rightfully saying "source please" or "citiation needed" when we claim that apps are tracking us. Kinda surprised you don't want data - even if you don't have time to review the data yourself.

Mirioron 7y ago

I wish GDPR had some exemption for small companies or companies that are starting out. Maybe limitations on revenue, amount of users and scope of data, eg strict rules still apply (to a small company) when dealing with sensitive data such as health information, but email addresses are not as strictly governed. Perhaps require a plan of action to abide by the full rules by X future date even. Take for example some one person indie developer. A common way to monetize that is through ads and in app purchases that turn ads off. With the current rules it's difficult for a single person to know that they abide by all of that while still monetizing in such a way.

cnorthwood 7y ago
The problem is really that the indie developer doesn't really have any monetisation options other than those which break the law, but in theory it's not overly onerous to pick one that at least claims to be GDPR compliant. They should be able to trust that their suppliers aren't providing them illegal products tbh.
- criddell 7y ago
  You're forgetting the most legitimate monetization option: If you make something great, people will pay for it.
  - mrweasel 7y ago
    That seem like a lot work, go for VC funding and sell to Google, Facebook, Microsoft or Apple in two years.
  - Mirioron 7y ago
    That's not how it works at all though. The games on the app store that make a lot of money are those that mercilessly try to rip people off. Gacha games are essentially gambling, whereas proper games with a story and gameplay earn very little.
    - criddell 7y ago

Jolter 7y ago

"– Every time you open an app like Grindr advertisement networks get your GPS location, device identifiers and even the fact that you use a gay dating app. This is an insane violation of users’ EU privacy rights, says Max Schrems, founder of the European privacy non-profit NGO noyb." Yes, insane seem like it's not actually an overstatement for once.

toohotatopic 7y ago
In which way is this a violation? It is not illegal for companies to process the data which you have signed away with a contract. It is allowed if [1] >they have a contract with you – for example, a contract to supply goods or services (i.e. when you buy something online), or an employee contract You just have the right to request that your data is deleted but as long as you don't do that, why should your data not be processed? Additionally, it is allowed to process private data without a contract if it is necessary. Then, an excessive use of private data is illegal. But most services will have a contract and thus it is legal. Minor detail: services cannot be restricted if you don't agree to share your private data. But that doesn't touch sharing the data that was signed away with a contract. [1] https://europa.eu/youreurope/citizens/consumers/internet-telecoms/data-protection-online-privacy/index_en.htm https://europa.eu/youreurope/citizens/consumers/internet-tel...
- grabeh 7y ago
  The concept of processing necessary for the performance of a contract is interpreted extremely narrowly by data protection law. Rightly so, because otherwise it would give entities far too much latitude to stuff as many different processing activities as possible within that ground, even though certain processing activities aren't at all necessary to provide the service. With Grindr, they only need to process data to provide the service by making it available to you and to other users. What they definitely don't need to do in order to provide the core service is to share your data with third parties who can then use it for their own purposes. Any argument that the processing is necessary because it's an ad-funded service would not be acceptable under data protection law. On that basis, performance of a contract would not be a relevant ground. You're also looking at e-Privacy Directive considerations in the EU where either a cookie or similar is essential to provide the service, or you need consent. Similar for location data, you will generally need consent. So you not only have GDPR issues but also e-Privacy Directive issues where your processing grounds are actually incredibly limited anyway.

fergie 7y ago

The world is beginning to rely more and more on Scandinavia to defend human rights and democracy.

mrweasel 7y ago
That's not really the failing you get living here. I'm not saying it other don't have it much much worse, but at least the Danish government really like invading peoples privacy.
- Gwypaas 7y ago
  In what ways do they invade peoples' privacy? Swede considering moving across the sound.
  - mrweasel 7y ago
    Currently telcos are required to collect data on EVERYONE, not just criminals. That's clearly illegal, according to EU law, but the Danish government and minister of justice have basically said that they don't care. There's an increased interest in CCTV and privacy concerns are ignored, even though crime rates are lower than they ever have been, but you know: Terror! You can't drive around the country without the police knowing where you are, because license plate scanners are everywhere. Oh, and the Danish government have exempted itself from the GDPR.

brootstrap 7y ago

I have family in the industry (digital ads, bidding for ads) and some of the stuff they have explained to me is pretty gnarly. One cousin was explaining an idea he had for a new business and it was essentially just about collecting as much personal data as possible. Imagine a simple DB table with 'user_id' as primary key. Then you just start adding data on top of data with new columns or joins. After a while you have hundreds (thousands) of datapoints per person, then you start selling that data. So i want to help my family out b/c i have the tech skills and building some prototypes would be easy. But i'm also not sure i want to feed the advertising beast. Shit is whack right now man they listen to you talking to your wife through your phone about buying a mattress, going to a concert, taking a trip somewhere. Next time you open the browser you are bombarded with relevant ads. too creepy no thanks!

cj 7y ago
> they listen to you talking to your wife through your phone about buying a mattress, going to a concert, taking a trip somewhere. Next time you open the browser you are bombarded with relevant ads. I've heard this from non-tech family/friends. Is this actually happening though? If so, who is doing it and how? Edit: I'm referring specifically to ad tech that targets ads based on overheard conversations.
- crwfshndndls 7y ago
  No, it's not.
- ourlordcaffeine 7y ago
  I don't know if mainstream apps are doing that, but I don't see why someone couldn't create a "trojan horse" app that requires the microphone, and starts monitoring and sending back recordings if it detects a conversation, it probably would be eventually spotted though if it gets any populartity. Or, perhaps microphones in public that try to tie overheard conversations with beacon or location data to find out who it heard.
- Tenoke 7y ago
  >Is this actually happening though? If so, who is doing it and how? It's possible but a lot of the reports are clearly coincidences. Take this example of someone watching 'Catch Me If You Can' 2 days ago, and then yesterday seeing a HN posting about the main character and finding it hard to accept as coincidental.[0] 0. https://news.ycombinator.com/item?id=22048337 https://news.ycombinator.com/item?id=22048337

wpietri 7y ago

Wait, an industry based on manipulating people into spending money regardless of need or value delivered is perhaps not totally ethical? Hold on while I practice my shocked face.

aguyfromnb 7y ago

Every time there's a corporate scandal of sorts (Boeing and Wells Fargo come to mind as recents), the people here scream for accountability. So what say ye, Googlers, Facebook employees and others? Should fines or prison fall on your shoulders? Why do you continue to do it, knowing you are breaking the law? Knowing you are harming people? Glass houses and all that...

stjohnswarts 7y ago
No but the government should start some crippling fines like "google thou shalt be broken into 3 companies and pay 50% of last years revenues". If it's just a couple million bucks that's nothing to google but permanent damage to the company would put the fear of Dog into them.
- harry8 7y ago
  Probability of succeding in that aim is small. Probability of making that an immaterial expense to google by burying it with lawyers and taking it as far as the supreme court is close to 100%. Personal accoutability or bust. It's a very different management analysis if "I could go to jail."
harry8 7y ago
Until senior management and boards of directors are facing the very real prospect of prison all criminal behavior will be treated with statistical analysis of expected values; expected gain versus exected loss with being caught simply a business expense that probably won't even need to be paid. Even the most egrarious action resulting in extreme cases such as preventable death will be in a spreadsheet. How is whistle blowing going for engineers who hate this? Who could you report it to? Who would write the proper story without burying it for political friends (NYT, WSJ) or burning you as the source (Guardian)? Is there anywhere who will publish credible material they've received no matter what while doing everything to protect sources?

jka 7y ago

The proposed ePrivacy Regulation[0] looked like it was set to introduce some very positive recommendations to curb the worst of advertising cookies and pop-up dialogs. Article 10 of the draft regulation suggested moving consent settings into the browser so that you could specify whether you will accept various forms of cookies centrally and then have those settings apply to all sites. A ruling[1] related to shady consent practices by a website called Planet49 seems to have shifted the regulatory window towards the idea that users have to definitively prove informed consent. Meanwhile the latest draft[2] of the ePrivacy regulation has removed Article 10 and the mention of browser-based controls for cookies entirely and thus consent stays per-website. I really wish the choice of privacy related to advertising was baked into the browser and enforced there. Given the above developments, it's the only route I can see that avoids pop-up fatigue for users. The number of pop-ups everyone has to deal with causes user experience friction and wastes everyone's time. It'd seem reasonable to me for sites to be allowed to pair with advertisers to request additional consent via pop-ups if they want, but with the defaults in the browser. That way a site would have to make a conscious decision that it's worth getting consent from a user in order to monetize them -- and users would only need to be informed and provide their consent when something outside their expectations is being requested. I'd love to hear from anyone who's tracking this - I'm not a lawyer and all this is the bits and pieces I've picked up while reading on the web and trying to determine an analytics consent strategy for a project I'm developing. Edit: NB: I realize there's a context of apps rather than websites in the article, but I'd hope and suggest that the fundamentals are the same, especially if & when PWA's blur the distinction between browser/mobile-OS as host. [0] - https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_Union) https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_... [1] - https://www.cookiebot.com/en/active-consent-and-the-case-of-planet49/ https://www.cookiebot.com/en/active-consent-and-the-case-of-... [2] - https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL:ST_13808_2019_INIT&qid=1577719123146&from=EN https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONS...

iamaelephant 7y ago

All this invasion of privacy and still little evidence that user targeted advertising is substantially more effective than simple content based advertising.

alanlovestea 7y ago
It has been proven very effective. Quote: "So successful, by the way, that between 2000 and 2004 with their IPO [Initial Public Offering] documents going public, the first time we got to learn exactly what the impact of this new logic was. And the impact was a revenue increase of 3,590%, just during those years 2000-2004." source: https://www.econtalk.org/shoshana-zuboff-on-surveillance-capitalism/ https://www.econtalk.org/shoshana-zuboff-on-surveillance-cap...
- airstrike 7y ago
  The way we use internet has also been changing at a significant rate since 2000 so we don't really have the counterfactual to show that content-based advertising wouldn't have experienced similar growth rates, unless we find a report covering revenue growth over the same period from a company (or better yet, a set of companies) that focuses on content-based ads
- iamaelephant 7y ago
  That's comparing tracking advertising with bad data to tracking advertising with good data. Where's the comparison of tracking to non tracking advertising? Tracking advertising costs the advertiser more (and makes the ad provider a lot more), but there's little evidence to suggest it's significantly more effective than content advertising. And this isn't even accounting for the enormous social cost of private surveillance. https://techcrunch.com/2019/01/20/dont-be-creepy/ https://techcrunch.com/2019/01/20/dont-be-creepy/
erezsh 7y ago
I'm still "waiting" for ads that are actually relevant for me, and not just based on something I randomly watched a few days ago.

sixtypoundhound 7y ago

Get ready for ads to get more annoying. The hidden benefit of using personalized data to target and track prospects was an advertiser could use "soft sell" to build a brand over time. As that market gets shut off, we're back to aggressively using interruption marketing "shock jock" ads and auto-play video. Click now or forever hold your peace... The problem with contextually targeted ads is there is no real guarantee of repetition and brand building...

therealdrag0 7y ago
That's an interesting point. I do rather have hiking shoe/soylent ads snuck into my feed than random gaudy shit trying to get my attention.
NeedMoreTea 7y ago
Excellent, as that will prompt a reaction. First to push even more non technical folks to join most techies using no exceptions ad blocking. Second to provoke even more onerous regulations.
- qvrjuec 7y ago
  And even more importantly this will eventually foster more palatable/unavoidable kinds of advertising to avoid the arms race entirely, e.g. product placement and endorsements.
matheusmoreira 7y ago
> we're back to aggressively using interruption marketing "shock jock" ads and auto-play video Advertisers thought they could get away with pop-ups until browsers shut them down by shipping pop-up blockers by default. I have no doubt ad blockers will shut down that market as well. Hopefully it will shut all of it down, driving advertisers out of the internet forever.
- mjevans 7y ago
  I am only OK with one type of advertising. 1) I have a problem or a need that I am looking to fulfill. 2) I ask (E.G. a search engine) about fulfilling that need. 3) The results are no BS, no hidden fees, directly up-front responses that tell me how much something is going to cost, where it is, and maybe why that will solve my needs/desires. That is the only place at all that 'ads' belong, informative messages that are intended to actually help BOTH the consumer and any service provider.

Cartonju 7y ago

Another source: https://noyb.eu/three-gdpr-complaints-filed-against-grindr-twitter-and-the-adtech-companies-smaato-openx-adcolony-and-atts-appnexus/ https://noyb.eu/three-gdpr-complaints-filed-against-grindr-t... Research by the Norwegian Consumer Council (Forbrukerrådet) shows that many smartphone apps send highly personal data to thousands of advertising partners. The report uncovers how a large number of shadowy entities are receiving personal data about our interests, habits, and behavior, every time we use certain apps on our phones. This information is used to create comprehensive profiles about us, which can be used for targeted advertising and other purposes. “These practices are out of control and are rife with privacy violations and breaches of European law. The extent of tracking makes it impossible for us to make informed choices about how our personal data is collected, shared and used. Consequently, this massive commercial surveillance is systematically at odds with our fundamental rights”, says Finn Myrstad, director of digital policy in the Norwegian Consumer Council. “Every time you open an app like Grindr advertisement networks get your GPS location, device identifiers and even the fact that you use a gay dating app. This is an insane violation of users’ EU privacy rights”, says Max Schrems, founder of the European privacy non-profit noyb.

shadowgovt 7y ago

Yep. It's almost like the privacy law in the EU was written with no mind paid to how the world of online interactions actually works. I anticipate enforcement will go about as well as enforcement of drug policy goes in the United States.

stubish 7y ago
The products are not illegal, just the business model. If the businesses can't follow the law, they will get blocked or banned, and their market share will become available for the same or similar product backed by a legal business model. Unlike drugs, where the product itself is illegal.
- shadowgovt 7y ago
  I don't think it's nearly so clear that the product isn't illegal.

fnord77 7y ago

thanks for reminding me to reset my advertising identifier on my iphone.