4 ms·

> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy featu

by d1zzy 7y ago

> Except it does not affect Google, because Google has this install ID to use both for tracking and preventing ad-fraud. So when Apple releases a privacy feature, that doesn't affect them as a business, we praise the feature or we say "except it doesn't affect Apple" and somehow try to argue how the feature is less valuable because of that?

dessant 7y ago
Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.
- joshuamorton 7y ago
  This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.
  - dessant 7y ago
    GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is needed for a service to function. This is not the case here, Google services function without receiving that header, the data is used by Google to gain a technical advantage over other web services.
    - joshuamorton 7y ago
      > GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. IOW, the theoretical capability to make changes to a system to use info in a non-GDPR compliant way doesn't make the information or system noncompliant. You actually have to do the noncompliant things.
      - dessant 7y ago
        An IP address is itself personal data, it does not have to be associated with other personal data. https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... > Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. See my comment about consent not being required when the data is needed to provide a service. Logging is reasonably required to provide a service. > and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. The transmission of data is already covered by GDPR, you don't have to store the data to be bound by the law.
        joshuamorton 7y ago
        See my edit. There's conflicting information on this. A dynamic IP, for example, isn't directly related to or relatable to a specific natural person without other context. But even if that's the case, if you don't tie the pseudonymous ID to the IP, it isn't personal data. As far as I can tell, the transfer rules you reference are about transferring data out of the EU, and can be summarized as "you can't transfer data to a non-EU country and then process it in a way that violates the GDPR". Article 46 notes that transferring data is fine as long as appropriate safeguards are in place[1], and article 47[2] defines what constitutes those safeguards (in general, contractually/legally binding agreements with appropriate enforcement policies). This goes back to what I said before: The theoretical capability to do noncompliant things doesn't make a system GDPR-noncompliant. You have to actually do noncompliant things to not comply. [1]: https://gdpr-info.eu/art-46-gdpr/ https://gdpr-info.eu/art-46-gdpr/ [2]: https://gdpr-info.eu/art-47-gdpr/ https://gdpr-info.eu/art-47-gdpr/
        acqq 7y ago
        To help other readers: "The European Commission maintains this website to enhance public access to information about its initiatives and European Union policies in general." https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... "Home > Law > Law by topic > Data protection > Reform > What is personal data?" "Examples of personal data ... - an Internet Protocol (IP) address;"
  - deleted 7y ago
    [deleted]
BoorishBears 7y ago
Of course we'd say "except it doesn't affect Apple"... If there's a privacy gap, (and Apple is actively exploiting that gap) When Apple patches it, (while leaving it open for themselves) They'll get called out.

by d1zzy 7y ago

dessant 7y ago

Apple is not engaged in illegal data harvesting to gain a competitive advantage over other services in the same space. Google's collection of personal data with the x-client-data header without user consent is illegal under GDPR.

joshuamorton 7y ago
This relies on the (unfounded) assumption that this pseudonymous ID is being used for tracking purposes and that Google is actively lying about it.
- dessant 7y ago
  GDPR treats an IP address as personal data. The data is not transmitted through an anonymizing network, so Google has access to the user's IP address when they receive the data. Anything that is associated with personal data also becomes personal information, therefore Google is transmitting personal data without user consent, which is illegal. Asking for consent is not required under GDPR when the data collection is needed for a service to function. This is not the case here, Google services function without receiving that header, the data is used by Google to gain a technical advantage over other web services.
  - joshuamorton 7y ago
    > GDPR treats an IP address as personal data. No it doesn't. GDPR only treats IP address as personal data if it is associated with actual identifying information (like name or address). Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. Edit: and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. IOW, the theoretical capability to make changes to a system to use info in a non-GDPR compliant way doesn't make the information or system noncompliant. You actually have to do the noncompliant things.
    - dessant 7y ago
      An IP address is itself personal data, it does not have to be associated with other personal data. https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... > Collecting IP address alone, and not associating it with anything else, is completely fine (otherwise nginx and apache's default configs would violate GDPR), and through them basically every website would violate GDPR. See my comment about consent not being required when the data is needed to provide a service. Logging is reasonably required to provide a service. > and furthermore, even if it did (I see conflicting reports), if you collect IP Address and another pseudonymous ID and don't join them, the ID isn't personal data. The transmission of data is already covered by GDPR, you don't have to store the data to be bound by the law.
      - joshuamorton 7y ago
        See my edit. There's conflicting information on this. A dynamic IP, for example, isn't directly related to or relatable to a specific natural person without other context. But even if that's the case, if you don't tie the pseudonymous ID to the IP, it isn't personal data. As far as I can tell, the transfer rules you reference are about transferring data out of the EU, and can be summarized as "you can't transfer data to a non-EU country and then process it in a way that violates the GDPR". Article 46 notes that transferring data is fine as long as appropriate safeguards are in place[1], and article 47[2] defines what constitutes those safeguards (in general, contractually/legally binding agreements with appropriate enforcement policies). This goes back to what I said before: The theoretical capability to do noncompliant things doesn't make a system GDPR-noncompliant. You have to actually do noncompliant things to not comply. [1]: https://gdpr-info.eu/art-46-gdpr/ https://gdpr-info.eu/art-46-gdpr/ [2]: https://gdpr-info.eu/art-47-gdpr/ https://gdpr-info.eu/art-47-gdpr/
      - acqq 7y ago
        To help other readers: "The European Commission maintains this website to enhance public access to information about its initiatives and European Union policies in general." https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... "Home > Law > Law by topic > Data protection > Reform > What is personal data?" "Examples of personal data ... - an Internet Protocol (IP) address;"
- deleted 7y ago
  [deleted]

BoorishBears 7y ago

Of course we'd say "except it doesn't affect Apple"... If there's a privacy gap, (and Apple is actively exploiting that gap) When Apple patches it, (while leaving it open for themselves) They'll get called out.