3 ms·

I'll be interested to see how this plays out. The ACCC media release might make it sound worse than it was. In the included screenshots, there is clearly text

by gundmc 6y ago

I'll be interested to see how this plays out. The ACCC media release might make it sound worse than it was. In the included screenshots, there is clearly text that explains in pretty plain English. They left these parts out of the media release itself. > ... With this change, this setting may also include browsing data from Chrome and activity from websites and apps that partner with Google, including those that show ads from Google. > ...In My Account, the Ads Personalization setting currently allows Google to use data in your account to tailor ads that appear on Google products. With this change, this setting will also allow Google to use data in your account to tailor ads on websites and apps that partner with Google. It's a lot to process in a pop-up that forces a user to make an instant decision, and the lack of an opt out without clicking through to "More Options" is shady, but it does feel like a pretty good layman's explanation of what they were going to do.

shakna 6y ago
> It's a lot to process in a pop-up that forces a user to make an instant decision Part of informed consent in Australia is "can freely make decisions without unfair pressure or influence from others." This kind of instant decision, and the following opt-in, don't fit within that requirement. > but it does feel like a pretty good layman's explanation of what they were going to do. It doesn't include the detail required by Australian law. > may also include browsing data from Chrome and activity from websites and apps that partner with Google, including those that show ads from Google. This is not enough. You cannot simply specify any arbitrary third party. You cannot simply say "browsing data", but have to specify what it is that you're grabbing. You have to say that you're grabbing IP ranges, headers, screen sizes, etc.
- nl 6y ago
  > It doesn't include the detail required by Australian law... > You cannot simply say "browsing data", but have to specify what it is that you're grabbing. You have to say that you're grabbing IP ranges, headers, screen sizes, etc. What specifically? I'm Australian and I'm not aware of any law that specifies anything like that at all. > This is not enough. You cannot simply specify any arbitrary third party. That's clearly not true. Amongst others, credit companies in Australia do this frequently and haven't had issues with the ACCC over it.
  - shakna 6y ago
    > That's clearly not true. Amongst others, credit companies in Australia do this frequently and haven't had issues with the ACCC over it. They don't list _arbitrary_ third parties. For example, Mastercard tells everyone "MasterCard requires members to register all Third Party Processors (TPPs) and Data Storage Entities (DSEs) with the MasterCard Registration Program system.", and then all of those are available for the public, usually via a link, within their policy. > What specifically? I'm Australian and I'm not aware of any law that specifies anything like that at all. Enough information that informed consent can be considered. It isn't specified, because it were, then companies would work around it. Australia makes use of a Common Law system, that which is "reasonable", rather than that which can be litigated.
    - nl 6y ago
      > They don't list _arbitrary_ third parties. For example, Mastercard tells everyone... Not sure if you mean Google or Mastercard doesn't list third parties? You seem to be conflating Mastercards's PCI compliance requirements[1] with their data sales to companies like Equifax[2] and others, which is an extremely opaque trade and not disclosed. > Enough information that informed consent can be considered. It isn't specified, because it were, then companies would work around it. Australia makes use of a Common Law system, that which is "reasonable", rather than that which can be litigated. Exactly, and I don't believe that any court would find that they need to specify "that you're grabbing IP ranges, headers, screen sizes, etc". I'd note that the ACCC isn't making that claim either. > that which is "reasonable", rather than that which can be litigated Well "reasonable" is decided the courts, so it is litigated. [1] https://www.mastercard.com.au/en-au/merchants/safety-security/security-recommendations/service-providers-need-to-know.html https://www.mastercard.com.au/en-au/merchants/safety-securit... [2] https://www.equifax.com.au/about-us https://www.equifax.com.au/about-us

by gundmc 6y ago

shakna 6y ago

> It's a lot to process in a pop-up that forces a user to make an instant decision Part of informed consent in Australia is "can freely make decisions without unfair pressure or influence from others." This kind of instant decision, and the following opt-in, don't fit within that requirement. > but it does feel like a pretty good layman's explanation of what they were going to do. It doesn't include the detail required by Australian law. > may also include browsing data from Chrome and activity from websites and apps that partner with Google, including those that show ads from Google. This is not enough. You cannot simply specify any arbitrary third party. You cannot simply say "browsing data", but have to specify what it is that you're grabbing. You have to say that you're grabbing IP ranges, headers, screen sizes, etc.

nl 6y ago
> It doesn't include the detail required by Australian law... > You cannot simply say "browsing data", but have to specify what it is that you're grabbing. You have to say that you're grabbing IP ranges, headers, screen sizes, etc. What specifically? I'm Australian and I'm not aware of any law that specifies anything like that at all. > This is not enough. You cannot simply specify any arbitrary third party. That's clearly not true. Amongst others, credit companies in Australia do this frequently and haven't had issues with the ACCC over it.
- shakna 6y ago
  > That's clearly not true. Amongst others, credit companies in Australia do this frequently and haven't had issues with the ACCC over it. They don't list _arbitrary_ third parties. For example, Mastercard tells everyone "MasterCard requires members to register all Third Party Processors (TPPs) and Data Storage Entities (DSEs) with the MasterCard Registration Program system.", and then all of those are available for the public, usually via a link, within their policy. > What specifically? I'm Australian and I'm not aware of any law that specifies anything like that at all. Enough information that informed consent can be considered. It isn't specified, because it were, then companies would work around it. Australia makes use of a Common Law system, that which is "reasonable", rather than that which can be litigated.
  - nl 6y ago
    > They don't list _arbitrary_ third parties. For example, Mastercard tells everyone... Not sure if you mean Google or Mastercard doesn't list third parties? You seem to be conflating Mastercards's PCI compliance requirements[1] with their data sales to companies like Equifax[2] and others, which is an extremely opaque trade and not disclosed. > Enough information that informed consent can be considered. It isn't specified, because it were, then companies would work around it. Australia makes use of a Common Law system, that which is "reasonable", rather than that which can be litigated. Exactly, and I don't believe that any court would find that they need to specify "that you're grabbing IP ranges, headers, screen sizes, etc". I'd note that the ACCC isn't making that claim either. > that which is "reasonable", rather than that which can be litigated Well "reasonable" is decided the courts, so it is litigated. [1] https://www.mastercard.com.au/en-au/merchants/safety-security/security-recommendations/service-providers-need-to-know.html https://www.mastercard.com.au/en-au/merchants/safety-securit... [2] https://www.equifax.com.au/about-us https://www.equifax.com.au/about-us