3 ms·

It would be easy. They'd have to just not collect, collate, fingerprint, and otherwise acquire enough PII to de-anonymize anyone that touches a script that fee

It would be easy. They'd have to just not collect, collate, fingerprint, and otherwise acquire enough PII to de-anonymize anyone that touches a script that feeds back to their servers. > "Google tracks and collects consumer browsing history and other web activity data no matter what safeguards consumers undertake to protect their data privacy," reads the complaint. The search giant surreptitiously collects data through Google Analytics, Google Ad Manager, website plug-ins and other applications, including mobile apps, according to the complaint. The web worked fine in the days before Google started building a profile of everyone who interacts with the internet so that they can sell us garbage we don't need. So how about stopping with the voracious data collection feeding into a permanent profile? You know, like the web used to work? Just because it is now doesn't mean it hasn't been deliberately built into the thing that presently exists. edit: and if that makes certain ad-centric businesses obsolete, good.

VikingCoder 6y ago
Would you consider IP address enough to de-anonymize most people? Why not?
- cmroanirgo 6y ago
  Definitely not. Case 1. Fixed home broadband often allocates a single IP that the household might have for weeks, months or years. There might be only one person in the house, and even if not it's easy to build a profile across websites visited on how many live there, what time they're active, etc. Case 2. Mobile broadband often allocates IP seemingly based on the tower you're connected to (in my country, I can notice this effect). So, looking at the surface of the you'd think it arguable that mobile IP is anonymised... Unfortunately, people are creatures of habit and ping the same towers repeatedly. So it's still possible to track. In short, if there's value to be had in storing any value (like an IP) for ad related purposes, then there's more than a good chance personal information is leaking.
  - SpicyLemonZest 6y ago
    Right, that's the point. Chrome will send "enough PII to de-anonymize" no matter how careful they try to be, because your IP address is very often enough.
- staticautomatic 6y ago
  I wouldn’t and I’ve professionally sourced and brokered PII. It may be the case that you could match up IP’s with other fingerprinting and/or PII but I’m not sure how. I’ve never seen a broker with a PII data product that would even accept an IP as an input, and IP geolocation is famously inaccurate. This strikes me as theoretically possible but totally infeasible unless you have access to some very special data. I’ve always assumed it was possible and that someone was likely doing it but I was never able to determine how with data that could be acquired through the usual channels.
  - VikingCoder 6y ago
    1) Log in to your gmail 2) Switch to incognito mode, and go to some website that has Google ads on it It would now be possible for Google to figure out that the ad was served to someone from the same IP address that recently was logged in with your gmail account. Any health care website (for instance) that has PII on it probably stores IP addresses at some level, to try to detect DoS attacks, etc. If someone wanted to join that data, IP to PII, they could.
    - staticautomatic 6y ago
      I can't disagree that's it's possible for Google to match up all the stuff it has on people and can get from others. In fact, I made that same assertion in another thread some time ago and got super down-voted over it. However, there are lots of totally legal scenarios in which two parties match up and combine data on a user containing PII. I also would like to know if you believe there's something ethically wrong with combining data, provided it's legal and doesn't violate a privacy policy. You haven't said so explicitly but that seems like the implication.
      - VikingCoder 6y ago
        Espressosaurus made the assertion that it would be easy for Google to not collect enough PII to de-anonymize anyone (in Incognito Mode). I'm pointing out that if you: 1) log in to your gmail 2) Switch to incognito mode and go to a website that has Google ads on it And if Google has recorded your IP address in both those interactions (of course they have - everyone does), then Google has enough information on most people to de-anonymize them. Therefore, what Espressosaurus said is absurdly wrong and should not be taken seriously by anyone. Let's focus our efforts on saying how Google can analyze and use the data, rather than on whether they're allowed to gather it in the first place. Because it's ridiculous to pretend you can stop Google, or any website for that matter, from collecting IP addresses of logged-in users.
folkrav 6y ago
> So how about stopping with the voracious data collection feeding into a permanent profile? You know, like the web used to work? You're asking Google to stop making most of their money. Their whole business is built around selling advertisers a targeted advertising platform. - Advertising revenue of Google for 2019 (in billion U.S. dollars): 134.81 [1] - Annual revenue of Google for 2019 (in billion U.S. dollars): 160.74 [2] Sure, they should stop, people should not get fingerprinted across sites, these companies should not track us, but good luck getting them to comply with just asking. [1] https://www.statista.com/statistics/266249/advertising-revenue-of-google/ [2] https://www.statista.com/statistics/266206/googles-annual-global-revenue/
jameslk 6y ago
> It would be easy Why do these idealistic comments get voted to the top? As if Google could just simply change their entire business model if only they were enlightened how "easy" it would be. > The web worked fine in the days before The web is the way it is today because there wasn't anything to stop it from becoming this way. There still isn't anything stopping it. If you want to see change to some historical point in time, start working on solutions to get there. I see these type of comments so often on HN but I really don't believe it reflects the majority opinion. I don't honestly think most people care about how the web used to be. It is the way it is because people don't know or care about the consequences of trading their privacy with a big company for free stuff.
- paulryanrogers 6y ago
  > If you want to see change to some historical point in time, start working on solutions to get there. The only solution I see is enforced regulation to respect DNT, or something like it. Do you have something else in mind?
  - jameslk 6y ago
    If you mean respect for privacy in general by companies, I think this comes down to people needing to first want it more. Like a lot more. We only started seeing things such as GDPR and CCPA after Cambridge Analytica caused people to understand a bit more why privacy matters. But it wasn't enough to see drastic change since there isn't a clear problem and that's the crux of the issue: nobody really understands why it's a such a big deal. There isn't an easy to grasp response to "what is so bad if others know what I'm doing online." Start with justifications and education of why privacy matters, and if it's compelling, change will be demanded.
  - Espressosaurus 6y ago
    Regulation is the only thing that can work. The goodness of their heart is not something that can be relied on. Asking Google (and other advertisers) to just back off their biggest money-maker is a non-starter. The only solution is regulation. Insufficient regulation is what brought us to this point. The harm here is too distributed, too abstract, and not obvious to the people it's harming. The people it's harming are the product, the people buying the data are the customers. There is no way Google voluntarily makes those changes. It will have to be forced to via regulation, enforcement, imposition of fines or potentially even jailtime in order to get it to comply. Its business model demands nothing less.

VikingCoder 6y ago

Would you consider IP address enough to de-anonymize most people? Why not?

cmroanirgo 6y ago
Definitely not. Case 1. Fixed home broadband often allocates a single IP that the household might have for weeks, months or years. There might be only one person in the house, and even if not it's easy to build a profile across websites visited on how many live there, what time they're active, etc. Case 2. Mobile broadband often allocates IP seemingly based on the tower you're connected to (in my country, I can notice this effect). So, looking at the surface of the you'd think it arguable that mobile IP is anonymised... Unfortunately, people are creatures of habit and ping the same towers repeatedly. So it's still possible to track. In short, if there's value to be had in storing any value (like an IP) for ad related purposes, then there's more than a good chance personal information is leaking.
- SpicyLemonZest 6y ago
  Right, that's the point. Chrome will send "enough PII to de-anonymize" no matter how careful they try to be, because your IP address is very often enough.
staticautomatic 6y ago
I wouldn’t and I’ve professionally sourced and brokered PII. It may be the case that you could match up IP’s with other fingerprinting and/or PII but I’m not sure how. I’ve never seen a broker with a PII data product that would even accept an IP as an input, and IP geolocation is famously inaccurate. This strikes me as theoretically possible but totally infeasible unless you have access to some very special data. I’ve always assumed it was possible and that someone was likely doing it but I was never able to determine how with data that could be acquired through the usual channels.
- VikingCoder 6y ago
  1) Log in to your gmail 2) Switch to incognito mode, and go to some website that has Google ads on it It would now be possible for Google to figure out that the ad was served to someone from the same IP address that recently was logged in with your gmail account. Any health care website (for instance) that has PII on it probably stores IP addresses at some level, to try to detect DoS attacks, etc. If someone wanted to join that data, IP to PII, they could.
  - staticautomatic 6y ago
    I can't disagree that's it's possible for Google to match up all the stuff it has on people and can get from others. In fact, I made that same assertion in another thread some time ago and got super down-voted over it. However, there are lots of totally legal scenarios in which two parties match up and combine data on a user containing PII. I also would like to know if you believe there's something ethically wrong with combining data, provided it's legal and doesn't violate a privacy policy. You haven't said so explicitly but that seems like the implication.
    - VikingCoder 6y ago
      Espressosaurus made the assertion that it would be easy for Google to not collect enough PII to de-anonymize anyone (in Incognito Mode). I'm pointing out that if you: 1) log in to your gmail 2) Switch to incognito mode and go to a website that has Google ads on it And if Google has recorded your IP address in both those interactions (of course they have - everyone does), then Google has enough information on most people to de-anonymize them. Therefore, what Espressosaurus said is absurdly wrong and should not be taken seriously by anyone. Let's focus our efforts on saying how Google can analyze and use the data, rather than on whether they're allowed to gather it in the first place. Because it's ridiculous to pretend you can stop Google, or any website for that matter, from collecting IP addresses of logged-in users.

folkrav 6y ago

> So how about stopping with the voracious data collection feeding into a permanent profile? You know, like the web used to work? You're asking Google to stop making most of their money. Their whole business is built around selling advertisers a targeted advertising platform. - Advertising revenue of Google for 2019 (in billion U.S. dollars): 134.81 [1] - Annual revenue of Google for 2019 (in billion U.S. dollars): 160.74 [2] Sure, they should stop, people should not get fingerprinted across sites, these companies should not track us, but good luck getting them to comply with just asking. [1] https://www.statista.com/statistics/266249/advertising-revenue-of-google/ [2] https://www.statista.com/statistics/266206/googles-annual-global-revenue/

jameslk 6y ago

> It would be easy Why do these idealistic comments get voted to the top? As if Google could just simply change their entire business model if only they were enlightened how "easy" it would be. > The web worked fine in the days before The web is the way it is today because there wasn't anything to stop it from becoming this way. There still isn't anything stopping it. If you want to see change to some historical point in time, start working on solutions to get there. I see these type of comments so often on HN but I really don't believe it reflects the majority opinion. I don't honestly think most people care about how the web used to be. It is the way it is because people don't know or care about the consequences of trading their privacy with a big company for free stuff.

paulryanrogers 6y ago
> If you want to see change to some historical point in time, start working on solutions to get there. The only solution I see is enforced regulation to respect DNT, or something like it. Do you have something else in mind?
- jameslk 6y ago
  If you mean respect for privacy in general by companies, I think this comes down to people needing to first want it more. Like a lot more. We only started seeing things such as GDPR and CCPA after Cambridge Analytica caused people to understand a bit more why privacy matters. But it wasn't enough to see drastic change since there isn't a clear problem and that's the crux of the issue: nobody really understands why it's a such a big deal. There isn't an easy to grasp response to "what is so bad if others know what I'm doing online." Start with justifications and education of why privacy matters, and if it's compelling, change will be demanded.
- Espressosaurus 6y ago
  Regulation is the only thing that can work. The goodness of their heart is not something that can be relied on. Asking Google (and other advertisers) to just back off their biggest money-maker is a non-starter. The only solution is regulation. Insufficient regulation is what brought us to this point. The harm here is too distributed, too abstract, and not obvious to the people it's harming. The people it's harming are the product, the people buying the data are the customers. There is no way Google voluntarily makes those changes. It will have to be forced to via regulation, enforcement, imposition of fines or potentially even jailtime in order to get it to comply. Its business model demands nothing less.