36 ms·

Formal GDPR complaint against Google’s internal data free-for-all

313 points by hadrien01 7y ago

andrewljohnson 7y ago
Typo in article: “for hundreds ill-defined processing purposes.”
- gentaro 7y ago
  Good to know.
tqi 7y ago
This reads like bad content marketing. Why am I being asked to tweet every quick fact? Why do I need to download a PDF to read what is ‘Inside the Black Box’? Is this a privacy/data use complaint or an antitrust complaint?
- kleiba 7y ago
  Interesting. To me, it didn't feel like I was asked to tweet these quick facts, it felt more like I was given the option for my convenience. I chose to ignore it, however, I understand that they want to encourage people to get exposure.
  - pdpi 7y ago
    It's somewhat disingenuous to say that repeatedly "giving me the option for my convenience" is anything other than pushing me to take action.
    - kleiba 7y ago
      That might then lie in the eye of the beholder - I certainly didn't feel like being pushed or pressured at all but naturally your mileage might vary.
      - venatiodecorus 7y ago
        i'd bet you're in the minority there. anyone could just copy and paste the text to tweet it if they wanted to. multiple "calls-to-action" are definitely trying to drive user behavior
      - _jal 7y ago
        It might. (Buy now!) But I think (Buy now!) one can certainly (Buy now!) feel (Buy now!) differently. (Buy now!)
    - rmrfstar 7y ago
      Transparently soliciting a specific desired behavior doesn't fall within the traditional definition of disingenuous. Does it bother you that a commercial entity with "a dog in the fight" is asking you to take action on its behalf?
      - rmrfstar 7y ago
        I am new to HN. If you down-vote me, please let me know why. I'd like to understand what drives decisions around these parts.
        bryanrasmussen 7y ago
        I just upvoted you as I didn't see a problem with what you said, but asking people to tell you why they downvoted around here seems a losing battle. I've asked often enough without response.
        cyphar 7y ago
        The reason you won't get a response to such questions (and follow-up comments about downvotes get flagged and downvoted) is because discussion of voting is against the HN Guidelines[1]: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. [1]: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
      - lmkg 7y ago
        The Greek Data Protection Authority provided some guidance on online tracking last month. In particular, the following was called out explicitly as a non-compliant practice: > In the event of rejecting trackers, the user is constantly invited to make a new choice through a pop-up window, while the same does not apply if the user accepts trackers, in which case their choice is maintained for a longer period. https://iapp.org/resources/article/cookie-guidance-from-greece/ https://iapp.org/resources/article/cookie-guidance-from-gree... That's not necessarily same context, but the main point still stands: By law, if you're invoking "consent" as the legal basis for collecting and processing data, consent must be freely given and as easy to withdraw as to provide. Provoking people to change their mind from "no" to "yes" but not the opposite is not considered to be freely-given.
- kasey_junk 7y ago
  It _is_ content marketing. Brave is in direct competition with Google for both browser eyeballs and ad revenue. That doesn’t make it wrong but you are definitely seeing a marketing push.
- jariel 7y ago
  "Why do I need to download a PDF to read what is ‘Inside the Black Box’? This is a little disingenuous to the point of almost gaslighting. You need to 'click on a PDF' because it's 60 full pages of dense data in a spreadsheet. It's 100% reasonable to provide a link to that data, it's exactly the right thing to do. It's also fully reasonable to provide links to tweeting about specific issues, that's how information is shared in 2020. Though on a level it's 'marketing' - the claims are that Google is in existential violation the law, this is not Walmart proclaiming they have 'lower prices and better service than Target'.
  - wizzwizz4 7y ago
    I know more people who use Mastodon than Twitter, and “only” a few hundred thousand people are really active on Mastodon.
    - jariel 7y ago
      So that's great, but there are a Billion people on Twitter, it's used universally worldwide, which is why they use it. It 'won't work' for me because I hate twitter and don't use it, it 'won't work for you' because you use Mastodon, but that's fine, 'Twitter' is the ideal, broadly convenient choice.
  - tqi 7y ago
    "Gaslighting"? I opened the PDF. If by "dense data in a spreadsheet" you mean rows like the very first one: Category: Accounting Purported processing purpose: “purposes such as accounting...” Other discoverable processing purposes: “…such as…” is vague language that may conflate or omit many distinct processing purposes. Data collected: BLANK Data shared externally: BLANK Explanation and examples: For example, when you purchase apps from the Play Store or products from the Google Store. Purported legal basis: Unknown Give me a break, the legal reason in the first column. To me obvious reason this is a 60 page PDF is because they hope people don't open it and discover that they are full of shit.
    - lmkg 7y ago
- amelius 7y ago
  When you're fighting against a marketing giant, don't you think that a little bit of marketing is justified?
- drusepth 7y ago
  I clicked the link and closed the tab the second I saw it was from Brave. They put out an anti-Google piece pretty much every other week, and they rarely have any substance. This one might (someone who isn't jaded by their track record can probably tell you in the comments here), but I'd be surprised. They just want you to use their browser instead of Chrome's, and constant attacks on Google/Chrome is their primary marketing strategy (35 mentions of Brave on-page, Brave branding everywhere, giant "Download Brave" button at the end of the page, etc).
  - ehsankia 7y ago
    The irony is that their entire business would not exist if it wasn't for Google developing and open sourcing Chromium, yet they seem hell-bent on destroying the very hand that feeds them.
    - jjeaff 7y ago
      Isn't Firefox also open source? Google isn't the hand that feeds them because of chromium. It's the hand that feeds them because of Google's privacy track record. If they weren't so invasive, then there would be no reason for brave to exist.
      - ehsankia 7y ago
        Well then why didn't they use Firefox as their base?
deleted 7y ago
[deleted]
SpicyLemonZest 7y ago
It should be noted that Brave is not an advocacy group; they're a medium size for-profit company, with a business model that stands to gain if Google is cut down to size. So even if their complaint seems valid, calling on regulators to shut down your business rivals is shady, and you should take any representations they make with a pile of salt. I also maintain my general skepticism that Google's business model is illegal under the GDPR. If the regulators had intended to make Google illegal, I'd think they would have said that.
- rob74 7y ago
  First, they're not calling on regulators to shut down Google, but to make sure they respect the GDPR (and thus their users' privacy). Second, the regulators didn't intend to make Google illegal, they intended to establish respect and moderation in the processing of users' data. Of course, it's obvious for everyone that the companies doing the massive data gathering are mostly American (Google, Facebook etc.) and that European competitors to these giants could potentially profit from this, but that's just a (very welcome) side-effect...
  - SpicyLemonZest 7y ago
    It seems very clear to me from the content and tone of their article that their goal is to get regulators to hurt Google. There's a lot of discussion about how dastardly Google's being, and of how different their business will have to be after the enforcement action, but very little about which specific wrong things Google is doing.
    - gnud 7y ago
      Let's assume they're just trying to get Google to follow the GDPR. How would the report look different, compared to 'wanting to hurt google'?
      - SpicyLemonZest 7y ago
        They would say something along the lines of "I gave Google my data for purpose X, but they're using it for Y and/or claiming the right to use it for Z, what's up with that?". They would not have a "Purported Legal Basis: Unknown" column with a scary red background in their spreadsheet.
ptasci67 7y ago
Not saying that Google is or isn't breaking the intention of GDPR here but thinking as a critical reader: - this complaint is lodged by an upstart privacy-based browser which directly competes with a Google product (Chrome) so they are not objective players here - reading through the PDF linked in the blog post, it seems there is no "canary in the coal mine". It is a spreadsheet with a lot of empty cells and red backgrounds. The post and the facade of the spreadsheet scream "look at this, something's wrong" but the content doesn't match that at all. The impression is that they have found Google to be doing something wrong but the reality is that they want regulators to check and see if Google is doing something wrong. Is there presumed innocence in this circumstance (really asking here because I don't know)? As with most things, the truth often lies in the middle. It seems to me at least that this is both a click-baity blog post and complaint meant to drum up media and press for Brave as much as it is a spotlight on Google's data practices. Both are bad.
- JadeNB 7y ago
  > As with most things, the truth often lies in the middle. It seems to me at least that this is both a click-baity blog post and complaint meant to drum up media and press for Brave as much as it is a spotlight on Google's data practices. Both are bad. I agree on this, but if there's a company trying to make a name for itself by attacking privacy violators, and if the benefits of that accrue even to people who aren't customers of the company, then I don't overly begrudge the company a little (or, let's be honest, a lot of) breathless self-generated PR in the process.
  - shadowgovt 7y ago
    The penalties will also accrue even to people who aren't customers of the company. It may be harder to see when that occurs. Google's speech model, for example, was bootstrapped on the audio collected from GOOG-411. Is the GDPR intended to prevent things like that? Then it's "intended" to hinder development of practical speech models the likes of which hadn't been seen from decades of research that lacked access to hundreds of hours of input from users asking real questions in real environments.
londons_explore 7y ago
It's a bold move to attack the main contributor of the opensource project upon which your business is based...
- JadeNB 7y ago
  > It's a bold move to attack the main contributor of the opensource project upon which your business is based... Is it? Part of the point of open source is that you're not beholden to any individual contributor. They can't be cut out from existing code; I don't know if they try to roll in future code developments, but, if they do, then Google can't keep them out of those, either, without a license change.
  - yjftsjthsd-h 7y ago
    > Part of the point of open source is that you're not beholden to any individual contributor. I am skeptical of this being the case with Google's idea of "open source"; does anyone other than Google actually have any material say in any of its projects? Or is it like Apple's open source: code dumps with no path to upstream?
    - jiveturkey 7y ago
      Sure, it isn't open source in that way. But another important part is that the code is there, relatively freely (depending on license), for others to use as they will. In the sense that the parent meant his comment, this is the critical component of open source that matters. To put it in classic terms: don't bite the hand that feeds you.
    - londons_explore 7y ago
      Chromium has a pretty open leadership process. Each subsystem has a small number of people who make technical decisions about the roadmap, and for some subsystems of the browser, none of those people are Google employees. Qualcomm, Microsoft, and Nvidia all have direct leadership control over some Chromium subsystems.
  - 7y ago
nostrademons 7y ago
My understanding (based only on investor filings, I left Google long before GDPR was drafted) is that Google's plan is basically just to set aside several billion dollars every quarter for GDPR fines and pay them as a cost of doing business. Many of Google's critical product features wouldn't work without the "internal data free-for-all". If EU regulators really make a stink about it (rather than just setting fines that can be covered by profit) they'd likely just pull out of the EU.
- saagarjha 7y ago
  Can Google afford your pull out of the EU? How about California, which seems to be following suit?
  - shadowgovt 7y ago
    Personal prediction: California will continue to follow the GDPR up until the point it threatens Google's core business, at which point someone will pull the legislature and the governor aside and have a frank conversation about the state GDP tradeoffs of constraining the R&D of their major technical companies.
  - nostrademons 7y ago
    EU, sure. They make about ~$50B of a total $161B in annual revenue from Europe. It'd hurt their stock price - at least temporarily - but there's nothing fundamental about the service they're offering worldwide that'd disappear if they no longer did business in Europe. They'd treat it as a simple economic decision: when the cost of operating in Europe exceeds the revenue generated from it, it's time to pull out of Europe. I also suspect that Project Dragonfly (Google's re-entry into China) might've been partially to blunt the effect of a European exit - Europe hasn't really liked Google since about 2010, and the regulatory climate keeps getting worse for them, so at some point it'll become not worth it for them to continue. They already pulled Google News out of several European countries when regulations made it too much trouble to continue offering the service, and then reinstated it when the regulations were rescinded because local publishers realized how much traffic they'd lose if Google News no longer featured their articles. California is trickier because many key employees work at their Mountain View, San Francisco, and Santa Monica offices. I suspect that that's changing - they've been expanding rapidly in offices in other locations, perhaps as insurance against this (and the rising cost of living in California), and there's probably less of a concept of a "key employee" now that the main services are written, not really innovating, and mostly in maintenance mode.
brunoTbear 7y ago
It seems that the people who made Firefox back in the day are still mad that Google launched a more performant and secure browser that ate their marketshare.
random3 7y ago
GDPR weaponizing privacy-oriented companies and the ability of the EU to walk the GDPR talk (as opposed to simply producing legislation) is going to be an interesting development to watch.
Hokusai 7y ago
> hundreds of ill-defined processing purposes, and unknown legal bases I have worked in regulated markets for quite a long time. I can understand that many companies do not understand what it means to be compliant. For many years the tech industry has avoided many requirements that affect other engineering companies. Software is at the core of our society and cannot have a free pass any more. Now it's more important to be reliable than to move as fast as possible. I hope this is the end of the era of move fast and break things, software is now too critical for that.
- whatshisface 7y ago
  What are you hoping to get as a result of increased regulation? Not as in "more careful software," I mean, what software are you hoping will be made more carefully?
  - DSingularity 7y ago
    For me, everything actuated by opaque models trained with user data and evaluated based on profit-oriented metrics (clicks, attention, ...). One can dream.
  - Hokusai 7y ago
    GDPR is a good example on how treating information carefully is important. Facebook, YouTube, etc spreading of missinformation is something that needs to be fixed for democracy to survive. Apps like Uber that do not recognize its own employees and follow the strategy of running faster than laws are also a good example of something that is damaging our society. Addictive loot boxes that prey on teenagers is another ugly one. I will need more time to think to make a better list, but these are some of the ones I think need stronger regulation.
    - dagenix 7y ago
      > Apps like Uber that ... follow the strategy of running faster than laws are also a good example of something that is damaging our society. Re just the part about running faster than the laws: As best as I can tell, app based taxis exist solely because Uber ignored the laws - and good (in some cases) that they did as the laws were designed to protect the entrenched businesses that had no incentive to change regardless of how well they were working. Anecdotally, I've seen a huge increase in people taking Uber or Lyft to or from a happy hour when 10 years ago those same people would likely have decided to drive because calling a traditional Taxi was so much of a pain. Ignoring the laws is a weak criticism when sometimes that is the only way to achieve progress. No comment on how they treat their employees - that is its own complicated issue that I won't comment on here.
shadowgovt 7y ago
This complaint is going to be an interesting test, because if it ends up with legs it could go two ways: 1) it fails, and the GDPR has some precedent to constrain its application in the future 2) it succeeds, and Google actually pulls out of the European markets completely. Internal responsible data-sharing and data-aggregation is extremely core to Google's entire business model (it is the "special sauce" that drives the entire application suite, from search to speech), and if the GDPR is incompatible with that business model, Google is incompatible with Europe.
- mongol 7y ago
  Google will not pull out of Europe. As long as it can make a profit in Europe it will stay. There is a demand for many of the services it offers and it is well positioned to sell them, regardless of GDPR.
  - shadowgovt 7y ago
    Possibly. Depends on what the cost-benefit tradeoff is. Google tends to be a long-term-thinking-oriented company, and requiring them to silo internal data (under the rules of a third-party oversight, not their own rules) strikes at their ability to do R&D. They know that in the long-term, the survival of a technical company is hinged on what they deliver in the future, not what they're delivering now.
    - disgruntledphd2 7y ago
      Ok, so there are two parts of the work rich enough to support advertising companies. They are the US and Europe. It's super implausible that Google will pull out of Europe (the EU at least), because they are forced to implement the laws. It's as likely as them pulling out of the US because they are forced to refuse to deal with countries under US sanctions.
      - shadowgovt 7y ago
        > They are the US and Europe ... and China. And the refusal of the ability to deal with countries under US sanctions doesn't strike at the core of Google's R&D techniques and resources.
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
robertpelloni 7y ago
I want Google to use my data in a "free for all." They have done incredible and useful things with it and in my opinion have been extremely responsible about it. If Google had a waiver I could sign allowing my data to be used for future developments I would sign it. I hope they continue doing more cool stuff and measures like these don't end up limiting any future developments. If anything I just wish I could more easily see what internal data all the advertising companies have on me. I'm sure they know more about me than I know about myself.
- pmoriarty 7y ago
  "They have done incredible and useful things with it and in my opinion have been extremely responsible about it" It's impossible to know everything that they've actually done with your data, so I don't see how you can maintain that they've been responsible with it.
  - creato 7y ago
    It's pretty easy to see data "leakage" from other services when it happens. Maybe google is just better at hiding this, but I doubt it.
- fangorn 7y ago
  That's great, you should have that option. "Option" implies choice, however. I should have an option to meaningfully not agree to it. And "don't use Google services" doesn't actually cause Google to stop collecting data about an individual. Nothing short of "don't use internet" does, and even then only to an extent. I've started reading "privacy agreement" for Google's "do not track me" browser extension the other day and it just seemed grotesque.
- 2OEH8eoCRo0 7y ago
  Same. I give my data to Google and I know this. I wish there were more transparency about the people I don't actually give permission to or there is no workaround. Credit card companies, web trackers, ISPs, etc.
- jariel 7y ago
izacus 7y ago
It's worth noting that this is a COMPLAINT, not a RULING (e.g. as opposed to the fine that Google just got in Sweden, which is a ruling). The allegiations that Googles browser competitor Brave is making will have to be actually proven first. Until then, it's just one competitor accusing another competitor of wrongdoing on their own web page.
alkonaut 7y ago
I use google and don’t even want them to use my last search query when answering my next one. I have no idea if they do or where I’d change it, but I’d like that to be the default. If they use e.g content of a gmail email or something I did on another site as a clue for what and to show in my search result then I don’t just want a better option and default, I’d like to see them fined.
- drusepth 7y ago
  Why wouldn't you want your search engine to use what contextual information it knows about you when attempting to provide you quality, relevant answers to the questions you're asking it?
  - alkonaut 7y ago
    I’m ok with seeing a shoe ad if I google shoes. It’s fine to do a geo lookup of my up to show a local offer too. That’s context from the request. That should be enough. I’m not ok with seeing anything that requires them storing information I don’t want them to store (eg search history, behavior on other sites such as past purchases). I’d rather have worse results. Google works great in a private browser using a vpn, I don’t need whatever extra they can bring with my info.
open-source-ux 7y ago
I am glad to see someone, even if it is a competitor to Google, raising important questions about the data Google captures. The amount of data Google collects about users is quite simply of unimaginable scale. Who sees this information at Google? Are they able to identify an individual and browse or analyse their online activity (which for millions of people will include some of their most personal and private details)? Who has access to this data should be stated clearly in Google's Privacy Policy [1]. Instead we have this vague and generic paragraph: "We restrict access to personal information to Google employees, contractors, and agents who need that information in order to process it. Anyone with this access is subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations." I'll repeat that this is a company that holds the private and personal online behaviour of millions of people, and yet the only detail they reveal about who sees that data internally and which user details are exposed is the purposefully vague and unspecific paragraph above. The fact that the "tech community" has never chosen to challenge Google on their internal usage of people data shows how little developers care about privacy (as this thread amply demonstrates). [1] https://policies.google.com/privacy?hl=en-US https://policies.google.com/privacy?hl=en-US
- joshuamorton 7y ago
  What would you prefer that paragraph say?
chupa-chups 7y ago
The really funny thing about this thread is that: * google appears to make all of our data available to most of its developers * we complain that brave wants to boost its reputation wtf, seriously, wtf? I mean, granted, brave sucks and wants to have an easy buy-in to some folks, but still: what's hiding behind this is huge. If I were google I'd buy brave for this kind of burying.
- dantheman 7y ago
  Because seriously this a relative non-issue.
  - chupa-chups 7y ago
    Yeah, sure. I know I'll be downvoted for this into oblivion, but hell, the collective stupidity of mankind really surpasses the probability of the universe being infinite. Einstein was right :) Just one small thing to consider: if even one person of google was a federal agent (of an offending country). Fill the missing parts of the sentence. And yes, as much as I despise the EU in its current form, that's the intention of GDPR: to prevent spilling personal data into a pool of people with potentially malignant actors, and, if this happens, to be responsible to full disclosure. @dantheman: I guess you still won't be considered to be hired by google for this post.
- joshuamorton 7y ago
  Is there any evidence of your first claim? I don't even think brave goes so far as to claim that the data is available to most developers. They claim that the scope of systems that have access is too broad, but that's a very different, and much weaker claim, then that any dev has access to data.
wharfjumper 7y ago
As discussed in "The Age of Surveillance Capitalism"[0] it's inconsistent with their business model for Google to comply with GDPR and other similar privacy laws/regulations. The benefits of the surveillance capitalism business model are seeing business values being recalculated as business owners recognise the value of exploiting vast amounts of data collected in the pursuit of a purpose other than for which it was collected. Microsoft for example has been heading in this direction over the last few years through their acquisition of Lynda/LinkedIn, Github and Glint. I expect other SaaS businesses to increasingly exploit this opportunity. Personally I support the efforts of Brave in this case and there are other potential targets that I think are vulnerable to a similar complaint. It will be interesting to follow the Irish Data Protection Commission's progress on this. 0. https://en.wikipedia.org/wiki/Surveillance_capitalism https://en.wikipedia.org/wiki/Surveillance_capitalism

313 points by hadrien01 7y ago

andrewljohnson 7y ago

Typo in article: “for hundreds ill-defined processing purposes.”

gentaro 7y ago
Good to know.

tqi 7y ago

This reads like bad content marketing. Why am I being asked to tweet every quick fact? Why do I need to download a PDF to read what is ‘Inside the Black Box’? Is this a privacy/data use complaint or an antitrust complaint?

kleiba 7y ago
Interesting. To me, it didn't feel like I was asked to tweet these quick facts, it felt more like I was given the option for my convenience. I chose to ignore it, however, I understand that they want to encourage people to get exposure.
- pdpi 7y ago
  It's somewhat disingenuous to say that repeatedly "giving me the option for my convenience" is anything other than pushing me to take action.
  - kleiba 7y ago
    That might then lie in the eye of the beholder - I certainly didn't feel like being pushed or pressured at all but naturally your mileage might vary.
    - venatiodecorus 7y ago
      i'd bet you're in the minority there. anyone could just copy and paste the text to tweet it if they wanted to. multiple "calls-to-action" are definitely trying to drive user behavior
    - _jal 7y ago
      It might. (Buy now!) But I think (Buy now!) one can certainly (Buy now!) feel (Buy now!) differently. (Buy now!)
  - rmrfstar 7y ago
    Transparently soliciting a specific desired behavior doesn't fall within the traditional definition of disingenuous. Does it bother you that a commercial entity with "a dog in the fight" is asking you to take action on its behalf?
    - rmrfstar 7y ago
      I am new to HN. If you down-vote me, please let me know why. I'd like to understand what drives decisions around these parts.
      - bryanrasmussen 7y ago
        I just upvoted you as I didn't see a problem with what you said, but asking people to tell you why they downvoted around here seems a losing battle. I've asked often enough without response.
        cyphar 7y ago
        The reason you won't get a response to such questions (and follow-up comments about downvotes get flagged and downvoted) is because discussion of voting is against the HN Guidelines[1]: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. [1]: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
    - lmkg 7y ago
      The Greek Data Protection Authority provided some guidance on online tracking last month. In particular, the following was called out explicitly as a non-compliant practice: > In the event of rejecting trackers, the user is constantly invited to make a new choice through a pop-up window, while the same does not apply if the user accepts trackers, in which case their choice is maintained for a longer period. https://iapp.org/resources/article/cookie-guidance-from-greece/ https://iapp.org/resources/article/cookie-guidance-from-gree... That's not necessarily same context, but the main point still stands: By law, if you're invoking "consent" as the legal basis for collecting and processing data, consent must be freely given and as easy to withdraw as to provide. Provoking people to change their mind from "no" to "yes" but not the opposite is not considered to be freely-given.
kasey_junk 7y ago
It _is_ content marketing. Brave is in direct competition with Google for both browser eyeballs and ad revenue. That doesn’t make it wrong but you are definitely seeing a marketing push.
jariel 7y ago
"Why do I need to download a PDF to read what is ‘Inside the Black Box’? This is a little disingenuous to the point of almost gaslighting. You need to 'click on a PDF' because it's 60 full pages of dense data in a spreadsheet. It's 100% reasonable to provide a link to that data, it's exactly the right thing to do. It's also fully reasonable to provide links to tweeting about specific issues, that's how information is shared in 2020. Though on a level it's 'marketing' - the claims are that Google is in existential violation the law, this is not Walmart proclaiming they have 'lower prices and better service than Target'.
- wizzwizz4 7y ago
  I know more people who use Mastodon than Twitter, and “only” a few hundred thousand people are really active on Mastodon.
  - jariel 7y ago
    So that's great, but there are a Billion people on Twitter, it's used universally worldwide, which is why they use it. It 'won't work' for me because I hate twitter and don't use it, it 'won't work for you' because you use Mastodon, but that's fine, 'Twitter' is the ideal, broadly convenient choice.
- tqi 7y ago
  "Gaslighting"? I opened the PDF. If by "dense data in a spreadsheet" you mean rows like the very first one: Category: Accounting Purported processing purpose: “purposes such as accounting...” Other discoverable processing purposes: “…such as…” is vague language that may conflate or omit many distinct processing purposes. Data collected: BLANK Data shared externally: BLANK Explanation and examples: For example, when you purchase apps from the Play Store or products from the Google Store. Purported legal basis: Unknown Give me a break, the legal reason in the first column. To me obvious reason this is a 60 page PDF is because they hope people don't open it and discover that they are full of shit.
  - lmkg 7y ago
amelius 7y ago
When you're fighting against a marketing giant, don't you think that a little bit of marketing is justified?
drusepth 7y ago
I clicked the link and closed the tab the second I saw it was from Brave. They put out an anti-Google piece pretty much every other week, and they rarely have any substance. This one might (someone who isn't jaded by their track record can probably tell you in the comments here), but I'd be surprised. They just want you to use their browser instead of Chrome's, and constant attacks on Google/Chrome is their primary marketing strategy (35 mentions of Brave on-page, Brave branding everywhere, giant "Download Brave" button at the end of the page, etc).
- ehsankia 7y ago
  The irony is that their entire business would not exist if it wasn't for Google developing and open sourcing Chromium, yet they seem hell-bent on destroying the very hand that feeds them.
  - jjeaff 7y ago
    Isn't Firefox also open source? Google isn't the hand that feeds them because of chromium. It's the hand that feeds them because of Google's privacy track record. If they weren't so invasive, then there would be no reason for brave to exist.
    - ehsankia 7y ago
      Well then why didn't they use Firefox as their base?

deleted 7y ago

[deleted]

SpicyLemonZest 7y ago

It should be noted that Brave is not an advocacy group; they're a medium size for-profit company, with a business model that stands to gain if Google is cut down to size. So even if their complaint seems valid, calling on regulators to shut down your business rivals is shady, and you should take any representations they make with a pile of salt. I also maintain my general skepticism that Google's business model is illegal under the GDPR. If the regulators had intended to make Google illegal, I'd think they would have said that.

rob74 7y ago
First, they're not calling on regulators to shut down Google, but to make sure they respect the GDPR (and thus their users' privacy). Second, the regulators didn't intend to make Google illegal, they intended to establish respect and moderation in the processing of users' data. Of course, it's obvious for everyone that the companies doing the massive data gathering are mostly American (Google, Facebook etc.) and that European competitors to these giants could potentially profit from this, but that's just a (very welcome) side-effect...
- SpicyLemonZest 7y ago
  It seems very clear to me from the content and tone of their article that their goal is to get regulators to hurt Google. There's a lot of discussion about how dastardly Google's being, and of how different their business will have to be after the enforcement action, but very little about which specific wrong things Google is doing.
  - gnud 7y ago
    Let's assume they're just trying to get Google to follow the GDPR. How would the report look different, compared to 'wanting to hurt google'?
    - SpicyLemonZest 7y ago
      They would say something along the lines of "I gave Google my data for purpose X, but they're using it for Y and/or claiming the right to use it for Z, what's up with that?". They would not have a "Purported Legal Basis: Unknown" column with a scary red background in their spreadsheet.

ptasci67 7y ago

Not saying that Google is or isn't breaking the intention of GDPR here but thinking as a critical reader: - this complaint is lodged by an upstart privacy-based browser which directly competes with a Google product (Chrome) so they are not objective players here - reading through the PDF linked in the blog post, it seems there is no "canary in the coal mine". It is a spreadsheet with a lot of empty cells and red backgrounds. The post and the facade of the spreadsheet scream "look at this, something's wrong" but the content doesn't match that at all. The impression is that they have found Google to be doing something wrong but the reality is that they want regulators to check and see if Google is doing something wrong. Is there presumed innocence in this circumstance (really asking here because I don't know)? As with most things, the truth often lies in the middle. It seems to me at least that this is both a click-baity blog post and complaint meant to drum up media and press for Brave as much as it is a spotlight on Google's data practices. Both are bad.

JadeNB 7y ago
> As with most things, the truth often lies in the middle. It seems to me at least that this is both a click-baity blog post and complaint meant to drum up media and press for Brave as much as it is a spotlight on Google's data practices. Both are bad. I agree on this, but if there's a company trying to make a name for itself by attacking privacy violators, and if the benefits of that accrue even to people who aren't customers of the company, then I don't overly begrudge the company a little (or, let's be honest, a lot of) breathless self-generated PR in the process.
- shadowgovt 7y ago
  The penalties will also accrue even to people who aren't customers of the company. It may be harder to see when that occurs. Google's speech model, for example, was bootstrapped on the audio collected from GOOG-411. Is the GDPR intended to prevent things like that? Then it's "intended" to hinder development of practical speech models the likes of which hadn't been seen from decades of research that lacked access to hundreds of hours of input from users asking real questions in real environments.

londons_explore 7y ago

It's a bold move to attack the main contributor of the opensource project upon which your business is based...

JadeNB 7y ago
> It's a bold move to attack the main contributor of the opensource project upon which your business is based... Is it? Part of the point of open source is that you're not beholden to any individual contributor. They can't be cut out from existing code; I don't know if they try to roll in future code developments, but, if they do, then Google can't keep them out of those, either, without a license change.
- yjftsjthsd-h 7y ago
  > Part of the point of open source is that you're not beholden to any individual contributor. I am skeptical of this being the case with Google's idea of "open source"; does anyone other than Google actually have any material say in any of its projects? Or is it like Apple's open source: code dumps with no path to upstream?
  - jiveturkey 7y ago
    Sure, it isn't open source in that way. But another important part is that the code is there, relatively freely (depending on license), for others to use as they will. In the sense that the parent meant his comment, this is the critical component of open source that matters. To put it in classic terms: don't bite the hand that feeds you.
  - londons_explore 7y ago
    Chromium has a pretty open leadership process. Each subsystem has a small number of people who make technical decisions about the roadmap, and for some subsystems of the browser, none of those people are Google employees. Qualcomm, Microsoft, and Nvidia all have direct leadership control over some Chromium subsystems.
- 7y ago

nostrademons 7y ago

My understanding (based only on investor filings, I left Google long before GDPR was drafted) is that Google's plan is basically just to set aside several billion dollars every quarter for GDPR fines and pay them as a cost of doing business. Many of Google's critical product features wouldn't work without the "internal data free-for-all". If EU regulators really make a stink about it (rather than just setting fines that can be covered by profit) they'd likely just pull out of the EU.

saagarjha 7y ago
Can Google afford your pull out of the EU? How about California, which seems to be following suit?
- shadowgovt 7y ago
  Personal prediction: California will continue to follow the GDPR up until the point it threatens Google's core business, at which point someone will pull the legislature and the governor aside and have a frank conversation about the state GDP tradeoffs of constraining the R&D of their major technical companies.
- nostrademons 7y ago
  EU, sure. They make about ~$50B of a total $161B in annual revenue from Europe. It'd hurt their stock price - at least temporarily - but there's nothing fundamental about the service they're offering worldwide that'd disappear if they no longer did business in Europe. They'd treat it as a simple economic decision: when the cost of operating in Europe exceeds the revenue generated from it, it's time to pull out of Europe. I also suspect that Project Dragonfly (Google's re-entry into China) might've been partially to blunt the effect of a European exit - Europe hasn't really liked Google since about 2010, and the regulatory climate keeps getting worse for them, so at some point it'll become not worth it for them to continue. They already pulled Google News out of several European countries when regulations made it too much trouble to continue offering the service, and then reinstated it when the regulations were rescinded because local publishers realized how much traffic they'd lose if Google News no longer featured their articles. California is trickier because many key employees work at their Mountain View, San Francisco, and Santa Monica offices. I suspect that that's changing - they've been expanding rapidly in offices in other locations, perhaps as insurance against this (and the rising cost of living in California), and there's probably less of a concept of a "key employee" now that the main services are written, not really innovating, and mostly in maintenance mode.

brunoTbear 7y ago

It seems that the people who made Firefox back in the day are still mad that Google launched a more performant and secure browser that ate their marketshare.

random3 7y ago

GDPR weaponizing privacy-oriented companies and the ability of the EU to walk the GDPR talk (as opposed to simply producing legislation) is going to be an interesting development to watch.

Hokusai 7y ago

> hundreds of ill-defined processing purposes, and unknown legal bases I have worked in regulated markets for quite a long time. I can understand that many companies do not understand what it means to be compliant. For many years the tech industry has avoided many requirements that affect other engineering companies. Software is at the core of our society and cannot have a free pass any more. Now it's more important to be reliable than to move as fast as possible. I hope this is the end of the era of move fast and break things, software is now too critical for that.

whatshisface 7y ago
What are you hoping to get as a result of increased regulation? Not as in "more careful software," I mean, what software are you hoping will be made more carefully?
- DSingularity 7y ago
  For me, everything actuated by opaque models trained with user data and evaluated based on profit-oriented metrics (clicks, attention, ...). One can dream.
- Hokusai 7y ago
  GDPR is a good example on how treating information carefully is important. Facebook, YouTube, etc spreading of missinformation is something that needs to be fixed for democracy to survive. Apps like Uber that do not recognize its own employees and follow the strategy of running faster than laws are also a good example of something that is damaging our society. Addictive loot boxes that prey on teenagers is another ugly one. I will need more time to think to make a better list, but these are some of the ones I think need stronger regulation.
  - dagenix 7y ago
    > Apps like Uber that ... follow the strategy of running faster than laws are also a good example of something that is damaging our society. Re just the part about running faster than the laws: As best as I can tell, app based taxis exist solely because Uber ignored the laws - and good (in some cases) that they did as the laws were designed to protect the entrenched businesses that had no incentive to change regardless of how well they were working. Anecdotally, I've seen a huge increase in people taking Uber or Lyft to or from a happy hour when 10 years ago those same people would likely have decided to drive because calling a traditional Taxi was so much of a pain. Ignoring the laws is a weak criticism when sometimes that is the only way to achieve progress. No comment on how they treat their employees - that is its own complicated issue that I won't comment on here.

shadowgovt 7y ago

This complaint is going to be an interesting test, because if it ends up with legs it could go two ways: 1) it fails, and the GDPR has some precedent to constrain its application in the future 2) it succeeds, and Google actually pulls out of the European markets completely. Internal responsible data-sharing and data-aggregation is extremely core to Google's entire business model (it is the "special sauce" that drives the entire application suite, from search to speech), and if the GDPR is incompatible with that business model, Google is incompatible with Europe.

mongol 7y ago
Google will not pull out of Europe. As long as it can make a profit in Europe it will stay. There is a demand for many of the services it offers and it is well positioned to sell them, regardless of GDPR.
- shadowgovt 7y ago
  Possibly. Depends on what the cost-benefit tradeoff is. Google tends to be a long-term-thinking-oriented company, and requiring them to silo internal data (under the rules of a third-party oversight, not their own rules) strikes at their ability to do R&D. They know that in the long-term, the survival of a technical company is hinged on what they deliver in the future, not what they're delivering now.
  - disgruntledphd2 7y ago
    Ok, so there are two parts of the work rich enough to support advertising companies. They are the US and Europe. It's super implausible that Google will pull out of Europe (the EU at least), because they are forced to implement the laws. It's as likely as them pulling out of the US because they are forced to refuse to deal with countries under US sanctions.
    - shadowgovt 7y ago
      > They are the US and Europe ... and China. And the refusal of the ability to deal with countries under US sanctions doesn't strike at the core of Google's R&D techniques and resources.

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

robertpelloni 7y ago

I want Google to use my data in a "free for all." They have done incredible and useful things with it and in my opinion have been extremely responsible about it. If Google had a waiver I could sign allowing my data to be used for future developments I would sign it. I hope they continue doing more cool stuff and measures like these don't end up limiting any future developments. If anything I just wish I could more easily see what internal data all the advertising companies have on me. I'm sure they know more about me than I know about myself.

pmoriarty 7y ago
"They have done incredible and useful things with it and in my opinion have been extremely responsible about it" It's impossible to know everything that they've actually done with your data, so I don't see how you can maintain that they've been responsible with it.
- creato 7y ago
  It's pretty easy to see data "leakage" from other services when it happens. Maybe google is just better at hiding this, but I doubt it.
fangorn 7y ago
That's great, you should have that option. "Option" implies choice, however. I should have an option to meaningfully not agree to it. And "don't use Google services" doesn't actually cause Google to stop collecting data about an individual. Nothing short of "don't use internet" does, and even then only to an extent. I've started reading "privacy agreement" for Google's "do not track me" browser extension the other day and it just seemed grotesque.
2OEH8eoCRo0 7y ago
Same. I give my data to Google and I know this. I wish there were more transparency about the people I don't actually give permission to or there is no workaround. Credit card companies, web trackers, ISPs, etc.
jariel 7y ago

izacus 7y ago

It's worth noting that this is a COMPLAINT, not a RULING (e.g. as opposed to the fine that Google just got in Sweden, which is a ruling). The allegiations that Googles browser competitor Brave is making will have to be actually proven first. Until then, it's just one competitor accusing another competitor of wrongdoing on their own web page.

alkonaut 7y ago

I use google and don’t even want them to use my last search query when answering my next one. I have no idea if they do or where I’d change it, but I’d like that to be the default. If they use e.g content of a gmail email or something I did on another site as a clue for what and to show in my search result then I don’t just want a better option and default, I’d like to see them fined.

drusepth 7y ago
Why wouldn't you want your search engine to use what contextual information it knows about you when attempting to provide you quality, relevant answers to the questions you're asking it?
- alkonaut 7y ago
  I’m ok with seeing a shoe ad if I google shoes. It’s fine to do a geo lookup of my up to show a local offer too. That’s context from the request. That should be enough. I’m not ok with seeing anything that requires them storing information I don’t want them to store (eg search history, behavior on other sites such as past purchases). I’d rather have worse results. Google works great in a private browser using a vpn, I don’t need whatever extra they can bring with my info.

open-source-ux 7y ago

I am glad to see someone, even if it is a competitor to Google, raising important questions about the data Google captures. The amount of data Google collects about users is quite simply of unimaginable scale. Who sees this information at Google? Are they able to identify an individual and browse or analyse their online activity (which for millions of people will include some of their most personal and private details)? Who has access to this data should be stated clearly in Google's Privacy Policy [1]. Instead we have this vague and generic paragraph: "We restrict access to personal information to Google employees, contractors, and agents who need that information in order to process it. Anyone with this access is subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations." I'll repeat that this is a company that holds the private and personal online behaviour of millions of people, and yet the only detail they reveal about who sees that data internally and which user details are exposed is the purposefully vague and unspecific paragraph above. The fact that the "tech community" has never chosen to challenge Google on their internal usage of people data shows how little developers care about privacy (as this thread amply demonstrates). [1] https://policies.google.com/privacy?hl=en-US https://policies.google.com/privacy?hl=en-US

joshuamorton 7y ago
What would you prefer that paragraph say?

chupa-chups 7y ago

The really funny thing about this thread is that: * google appears to make all of our data available to most of its developers * we complain that brave wants to boost its reputation wtf, seriously, wtf? I mean, granted, brave sucks and wants to have an easy buy-in to some folks, but still: what's hiding behind this is huge. If I were google I'd buy brave for this kind of burying.

dantheman 7y ago
Because seriously this a relative non-issue.
- chupa-chups 7y ago
  Yeah, sure. I know I'll be downvoted for this into oblivion, but hell, the collective stupidity of mankind really surpasses the probability of the universe being infinite. Einstein was right :) Just one small thing to consider: if even one person of google was a federal agent (of an offending country). Fill the missing parts of the sentence. And yes, as much as I despise the EU in its current form, that's the intention of GDPR: to prevent spilling personal data into a pool of people with potentially malignant actors, and, if this happens, to be responsible to full disclosure. @dantheman: I guess you still won't be considered to be hired by google for this post.
joshuamorton 7y ago
Is there any evidence of your first claim? I don't even think brave goes so far as to claim that the data is available to most developers. They claim that the scope of systems that have access is too broad, but that's a very different, and much weaker claim, then that any dev has access to data.

wharfjumper 7y ago

As discussed in "The Age of Surveillance Capitalism"[0] it's inconsistent with their business model for Google to comply with GDPR and other similar privacy laws/regulations. The benefits of the surveillance capitalism business model are seeing business values being recalculated as business owners recognise the value of exploiting vast amounts of data collected in the pursuit of a purpose other than for which it was collected. Microsoft for example has been heading in this direction over the last few years through their acquisition of Lynda/LinkedIn, Github and Glint. I expect other SaaS businesses to increasingly exploit this opportunity. Personally I support the efforts of Brave in this case and there are other potential targets that I think are vulnerable to a similar complaint. It will be interesting to follow the Irish Data Protection Commission's progress on this. 0. https://en.wikipedia.org/wiki/Surveillance_capitalism https://en.wikipedia.org/wiki/Surveillance_capitalism