4 ms·

>which improves everyone's privacy, that's a good thing! Except it does not affect Google, because Google has this install ID to use both for tracking and prev

>which improves everyone's privacy, that's a good thing! Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. Which means Google competitors are terribly disadvantaged, as they cannot use that. Which not only reduces market diversity (contrary to TAG philosophy) but represents a significant conflict of interest for an organization proposing a major web standard change. These issues are very relevant to the original proposal, especially in light of the fact that Noone outside of Google is terribly interested in this change. Any time a dominant player is the strongest (or only) advocate for a change that would coincidentally and disproportionately benefit its corporate interests, the proposal should be viewed very skeptically.

d1zzy 7y ago
> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?
- dessant 7y ago
  Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.
  - joshuamorton 7y ago
    This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.
    - dessant 7y ago
      GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is needed for a service to function. This is not the case here, Google services function without receiving that header, the data is used by Google to gain a technical advantage over other web services.
      - joshuamorton 7y ago
        > GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. IOW, the theoretical capability to make changes to a system to use info in a non-GDPR compliant way doesn't make the information or system noncompliant. You actually have to do the noncompliant things.
        dessant 7y ago
        An IP address is itself personal data, it does not have to be associated with other personal data. https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... > Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. See my comment about consent not being required when the data is needed to provide a service. Logging is reasonably required to provide a service. > and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. The transmission of data is already covered by GDPR, you don't have to store the data to be bound by the law.
    - deleted 7y ago
      [deleted]
- BoorishBears 7y ago
  Of course we'd say "except it doesn't affect Apple"... If there's a privacy gap, (and Apple is actively exploiting that gap) When Apple patches it, (while leaving it open for themselves) They'll get called out.

d1zzy 7y ago

> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?

dessant 7y ago
Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.
- joshuamorton 7y ago
  This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.
  - dessant 7y ago
    GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is needed for a service to function. This is not the case here, Google services function without receiving that header, the data is used by Google to gain a technical advantage over other web services.
    - joshuamorton 7y ago
      > GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. IOW, the theoretical capability to make changes to a system to use info in a non-GDPR compliant way doesn't make the information or system noncompliant. You actually have to do the noncompliant things.
      - dessant 7y ago
        An IP address is itself personal data, it does not have to be associated with other personal data. https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... > Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. See my comment about consent not being required when the data is needed to provide a service. Logging is reasonably required to provide a service. > and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. The transmission of data is already covered by GDPR, you don't have to store the data to be bound by the law.
  - deleted 7y ago
    [deleted]
BoorishBears 7y ago
Of course we'd say "except it doesn't affect Apple"... If there's a privacy gap, (and Apple is actively exploiting that gap) When Apple patches it, (while leaving it open for themselves) They'll get called out.