6 ms·
> it doesn't contain any PII. Even if that was the case, this is a bullshit argument. They don't need any PII, it's just more fingerprinting. They already have
by ttt0 6y ago
> it doesn't contain any PII.
Even if that was the case, this is a bullshit argument. They don't need any PII, it's just more fingerprinting. They already have all the personal information they'll ever need by using all the other means.
- ElvisTrout 6y agoSurely fingerprinting is PII? It allows for mosaic identification.
- ttt0 6y agoI don't know, are fonts installed on your system PII? Because it can be used for fingerprinting. But I don't know the precise definition, so maybe you're right.
- ska 6y agoPerhaps a reasonable line to draw would be that if the content of the information is enough to fingerprint, the it is PII (regardless if broken into many messages) and the individual data doesn't matter.
- ttt0 6y agoIf we talk purely about "reasonable", I don't think it's even possible to draw any line, besides something obvious like unique user identifiers. It's hard to predict what data can be used for fingerprinting until someone actually does it, just like it's hard to predict what bugs are actually possible to exploit. I could never predict some of those things being used for that and yet here we are. So it can be a cat-and-mouse type of situation. And some of that information is probably legit useful for purposes other than tracking.
- tremon 6y agoIntent matters. If you use the fonts list to identify persons, it's PII.
- lmkg 6y agoFingerprinting doesn't reveal an individual's name or passport number, so it's not PII. That's why PII is not a very useful concept in general, and why claims about privacy safeguards that over-focus on PII should be met with some skepticism. The laws are catching up this in regard. GDPR uses "personal data" and CCPA uses "personal information," both of which more generally refer to data that identifies an individual.
- ttt0 6y agoAt the same time let's not forget it's Google we're talking about. They are even parsing your emails to extract all the data from your transactions. They already have all your personal information, they just need to keep track of you when you're using other websites.
- baybal2 6y agoYep, they have GREASE TLS bytes, TLS resume ticket, RLZ value, X-Geo header, UA header, JS APIs with persistent random values (which they do indeed use on adsense! This is why you get surprise WebGL code seemingly doing nonsense once a while in adsense ads) This cannot be a coincidence. They packed Chrome with fingerprints to work around GDPR by combining fingerprints on their side.
- paulryanrogers 6y agoDoesn't that risk massive fines if proven? Like a percentage of all revenue?
- baybal2 6y agoI believe they already did lawyerising, as written above. They grabbed onto the wording of PII as "personally identifiable information" that information is identifiable, but not personally identifiable, so it is ok to use for ads.
- ngold 6y agoSo we knows it's you, but you are a integer.
- teddyh 6y ago“I am not a number! I am a free man!” — The Prisoner
- WesolyKubeczek 6y agoReminds me of this: "So here I was now, two years just to the day of being kicked and clanged into Staja 84F, dressed in the height of prison fashion, which was a one-piece suit of a very filthy like cal colour, and the number sewn on the groody part just above the old tick-tocker and on the back as well, so that going and coming I was 6655321 and not your little droog Alex not no longer."
- ricardo81 6y ago