19 ms·

EU privacy agency urges more safeguards to curb U.S. tech giants

223 points by stiray 6y ago

an_ko 6y ago
In what I imagine is a brilliant twist of irony (I can't read the article), all I see when I open this page is a consent form to be tracked, with a link buried in text to opt out, which brings me to a page that requires me to fill in all of my personal details in order to opt out. Apparently in order not to track me reading their web page, Reuters requires (among others) my full name, residency, date of birth, street address, and telephone number.
- Jestar342 6y ago
  I see the usual OneTrust modal, with a giant, very easy to locate "Reject All" button at the bottom of the modal. https://imgur.com/uZmlGlc https://imgur.com/uZmlGlc
  - an_ko 6y ago
    I see the same. Maybe I'm getting confused by the wording and layout. I interpreted the "Reject All"/"Confirm My Choices" buttons at the bottom to belong only to the "Manage Consent Preferences" section. The "Information Our Partners Collect" part above it is a separate section, with a separate "Accept All" button, and an opt-out link in the text, so I figured the final "Reject All" might only reject the second section. Because why else would they have separate sections with separate buttons? Either way, none of this inspires confidence that they have my interests in mind.
    - estaseuropano 6y ago
      > Either way, none of this inspires confidence that they have my interests in mind. Bingo. This is the underlying issue. And indeed this dual opt out is probably intentionally confusing - and I'm never sure either whether 'refuse all' refuses also the partners.
  - throwaway2245 6y ago
    I would wager that "Reject All" does not, in fact, opt you out of "Legitimate Interests" - sites are using the language "Object to Legitimate Interests" for this.
- Semaphor 6y ago
  For me (EU) the consent popup has "reject all" at the very bottom (though I only see it with blocking disabled). Pretty lame, but still better than most.
  - weinzierl 6y ago
    "For me (EU) [..]" You are probably not the right person to ask then, but I always wondered: How prevalent are these consent popups outside of the EU?
    - bgdam 6y ago
      Way less frequent. I'm usually jumping between Germany and India and whenever I'm in Germany it feels like I'm always getting a popup on every site I visit for the first time. A lot of the same sites don't bother to throw the popup when I'm browsing from India.
    - curryst 6y ago
      In the US, I see them fairly often. Doubly annoying because I know they don't even have to obey my answers in the US.
      - Semaphor 6y ago
        If their consent manager doesn't distinguish between EU and non-eu, I doubt they'll handle your data differently
- high_byte 6y ago
  is there some extension to mark links like this? popups, paywalls, consent forms. all of these, I don't mind if the link is red or if their domain is entirely blocked. I'm immediately not interested in such websites and it would save me so much time
yulaow 6y ago
At this point honestly I just wish for a general ban on tracking ads of any kind. Just give me good old contextual ads and remove some MBs of js, with the only purpose of tracking me, from most websites of the internet.
- petre 6y ago
  How would the EU enforce such a ban? They actually need to prove company X was tracking its users if it goes to court.
  - jorge-d 6y ago
    By setting very high fines for those who don't comply?
    - petre 6y ago
      Already done. It's up to 10% of turnover, not profits. Which the companies would happily go to court over. But how to actually prove in court that company X is tracking users if a leak doesn't occur? Subopenas? They need a court order for that. They need reasonable suspicion to get a court order.
      - speedgoose 6y ago
        Right now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.
        EGreg 6y ago
        Disqus loads a million external resources That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?
        6y ago
4cao 6y ago
Call me cynical but more regulation like this only serves to further entrench the existing (quasi-)monopolies by increasing the barriers for new entrants. Especially the focus on "illegal" content and political advertising only (as opposed to, say, advertising as such) makes it appear not as an attempt to improve the situation in general, but rather to carve a bigger slice of the extant lucrative pie for certain interest groups. > EDPS said gatekeepers should provide an easy and accessible way for users to consent or decline the use of their personal data by the companies for their other services, and that there should be tests to ensure personal data is effectively anonymous. Users will consent to anything, especially if they have no choice, and any tests can and will be gamed. Ultimately if the problem is to be solved it would require a more novel approach than this. > The proposed European Commission rules will need to be discussed with EU countries and EU lawmakers before they become law, a process which will take 16-24 months. The implementation deadline seems excessively long to me. A lot can change within this timeframe, rendering the laws obsolete before they even come into force.
- qertoip 6y ago
  100%.
- betterunix2 6y ago
  Yup, that is exactly how it worked with GDPR: big companies can easily afford the cost of compliance while smaller competitors struggle.
  - Avamander 6y ago
    Can you provide any citations for that claim?
- M2Ys4U 6y ago
  > Call me cynical but more regulation like this only serves to further entrench the existing (quasi-)monopolies by increasing the barriers for new entrants. Have you actually read the proposals? I don't mean that in a snarky way, but you're never going to be able to figure that out from a couple of lines in a wire report. For instance: it's not mentioned in this article, but the proposals add extra conditions on Very Large Online Platforms (VLOPs) which wouldn't apply to smaller entities. The definition of a VLOP would be one that reaches > 10% of the entire EU population (~45 million). >The implementation deadline seems excessively long to me. A lot can change within this timeframe, rendering the laws obsolete before they even come into force. It's not like this is now law and the EU will be sitting around for 2 years. The DSM and DMA are just legislative proposals which need to be considered (and almost certainly amended) by the European Parliament and the Council of the EU before they can become law. Large, impactful legislation shouldn't just be plonked on the statute book by the executive.
marcodiego 6y ago
It is good to see regulation that diminishes the chance of monopolies or abuses. I don't know if current safeguards help such guarantees. What could be interesting are economic incentives. For example, social networks profits could be taxed and part of the money acquired could be applied on independent de-centralized services. Imagine the impact if just a small amount of facebook profits were donated to wikipedia.
- betterunix2 6y ago
  How is this going to diminish monopolies? Big tech is (a) going to have a voice in these regulations and (b) will easily afford the cost of compliance. Small competitors will have no voice and will struggle to comply. This is almost certainly going to entrench the big players and widen their moats.
- qertoip 6y ago
  > It is good to see regulation It is never good to see regulation. Never ask state to fix the problem or you will end up with two problems. Especially, the Big State.
detournement 6y ago
really excited for more popup policies to approve
- dazc 6y ago
  Maybe it's a cunning ploy to condition people into agreeing to anything if only it means they can see the damn content? I already instantly accept cookies without hesitation.
  - undefined1 6y ago
    no doubt that's what 99% of people do. just like terms of service, it's an automatic click through and a waste of everyone's time.
- pornel 6y ago
  Adtech companies have worked hard to make you associate privacy with annoying popups. They've lobbied hard to water down tracking bans to be "user choice", and then used dark patterns/malicious compliance to make not agreeing a horrible experience to wear people down, so that people just give up on privacy.
- hedora 6y ago
  They should ban the pop ups, and make the cookies opt in. Done. Easy.
- teeray 6y ago
  It’s so irritating that this can’t be an HTTP header. Then again, we probably have the failure of DNT to thank for that.
  - colejohnson66 6y ago
    The problem was the DNT was optional, so there was no legal method to force a website to obey it.
apples_oranges 6y ago
People. Just. Delete. Your. Cookies. Regularly. I am baffled about the crazy amount of debate and technical solutions to a problem that was solved the moment Cookies were invented. In the 1990s I suppose.
- speedgoose 6y ago
  People use Google chrome.
- kzrdude 6y ago
  (Seriously) I don't want to be logged out.
  - apples_oranges 6y ago
    why not, your browser or operating system remembers all your logins for you
    - paddez 6y ago
      2FA slows down the entire log-in process a non-trivial amount - even more so if it's implemented over SMS.
      - apples_oranges 6y ago
        hm, then just use a dedicated browser for those logins? use a Firefox for logged in stuff for example, Safari for the other stuff.
    - inetknght 6y ago
      Automatic logins are easily automatable to steal data from my device, me, and the people around me. I want to be asked every time a service wants to know who's using it from my device. I want to have the option to immediately decline authorization before any information about me or my device is sent. I want to have the option to say "no, I don't want this service to know it's me". I also want the option to say "I am <soandso>" even if really I am not <soandso>. Not giving me that option is a disrespect of me as a user.
weinzierl 6y ago
On related news: Just two days ago the EU ePrivacy regulation took the first hurdle in Brussels. This will most likely bring some changes to the whole consent drama. I'm not good at reading legalese and there seem to be no commentary for the current version[1] yet. What I understand is that they "encourage" browsers to implement "whitelists" (their choice of word, not mine) as a solution to "end-users [..] overloaded with requests to provide consent". I'm not sure what is in there regarding first-party analytics cookies which some hoped will be exempted. [1] https://data.consilium.europa.eu/doc/document/ST-6087-2021-INIT/en/pdf https://data.consilium.europa.eu/doc/document/ST-6087-2021-I... Partly recycled comment from https://news.ycombinator.com/item?id=26103635 https://news.ycombinator.com/item?id=26103635
- lmkg 6y ago
  I would hone in on pages 27 & 28 in that document. In particular, this quote: > Cookies can also be a legitimate and useful tool, for example, in assessing the effectiveness of a delivered information society service, for example of website design and advertising or by helping to measure the numbers of end-users visiting a website, certain pages of a website or the number of end-users of an application. This is not the case, however, regarding cookies and similar identifiers used to determine the nature of who is using the site, which always require the consent of the end-user. It is, of course, legalese. But they seem to be drawing a distinction between analytics and tracking. Counting distinct users seems to be acceptable without consent; profiling users does not.
hedora 6y ago
They should just ban the gathering of personal information without consent, and ban any UI that makes it easier (or as easy) to opt in. On the day the legislation takes effect all users should be assumed to have opted out, regardless of any terms of service or non-negotiated contract. The only exceptions should be things strictly necessary to do business (e.g., contact info for a bank account holder.)
KDJohnBrown 6y ago
What the EU should really do is fine / tax monopolists like Google and Facebook into submission then invest that money into the EU-based startup ecosystem.
- kreeben 6y ago
  Targeting taxes directly towards specific companies seems overly aggressive. I hope they will find and implement more generic rules to achieve what it is they want to achieve which, if I'm not completely mistaken, is to protect me from invasive tracking.
  - Nasrudith 6y ago
    Are you sure that is really their goal in the first place? If they wanted that they would downsize their intelligence agencies.
  - KDJohnBrown 6y ago
    Is this really any different than the USA banning Huawei to prevent 5G carrier equipment competition under the guise of “national security”? (Edited to clarify 5G carrier equipment competition)
- dominotw 6y ago
  can't google just threaten to pull out like they did in australia?
  - jonathanstrange 6y ago
    That could indeed potentially create a little bit of friction for a few weeks before everyone had replaced their services with different solutions.
    - emteycz 6y ago
      Like what solutions? Have you tried these "solutions"? I live in one of the countries which is special by having its own competitive search engine - and it's truly bad compared to Google. If we're going back to that, I am going out of EU.
lanevorockz 6y ago
I pray to the day were privacy is reclaimed. Big Tech has abused us for long enough. You cannot enforce slavery through terms of service, You also should not be able to own all private information of someone through terms of service.
beaconstudios 6y ago
God no. Governments absolutely suck at changing the incentives to deter bad behaviour. Do we really want more cookie banners and GDPR consent forms? Maybe I'm missing something, but why can't we block all forms of stateful identifiers to third-party content? First-party cookies, localStorage, etc only. Is there some big legitimate use case I'm not seeing? Having said that, I'm sure if they were blocked, tech companies would just provide an SDK that passes through first-party state so companies could continue the status quo.
- Nextgrid 6y ago
  Some stateful identifiers are required for technical purposes. IP addresses for example. Other identifiers are required for the functionality of the service, such as your contact details or information you enter in a social network. Given you can't work around providing the information, the only solution is to use legislation to prevent that information for being used in malicious ways. Also, the current situation with the consent prompts in Europe is not because of the GDPR but because of its lack of enforcement. The GDPR learned from the former "cookie law" (which I agree was a shit-show) and explicitly prohibits annoying/misleading consent prompts.
  - beaconstudios 6y ago
    > Some stateful identifiers are required for technical purposes. IP addresses for example. Yeah that one's pretty unavoidable, but is at least for many people temporary and pseudonymous only. Once their dynamic IP rotates (granted this isn't the case for everybody), the connection is lost. Much better than every website with a "Like" button on the page allowing facebook to track you as you traipse across the internet. > Other identifiers are required for the functionality of the service, such as your contact details or information you enter in a social network. That's first-party information. You're not posting on facebook via an iframe on another site. If you choose to provide your information to facebook, they're gonna use it - legislation or not. Legal encodings of intent are always full of loopholes, even if they escape regulatory capture via lobbying. The best way to stop Facebook from getting information about you, is to not give them information. > Also, the current situation with the consent prompts in Europe is not because of the GDPR but because of its lack of enforcement. The GDPR learned from the former "cookie law" (which I agree was a shit-show) and explicitly prohibits annoying/misleading consent prompts. I'm sure it won't be long before that argument goes to court and teams of lawyers spend the next decade arguing over the meaning of the word "annoying". Hence my argument that if we want Facebook to not know everything about us, perhaps we should stop them knowing everything about us?
jefftk 6y ago
> profiling of users for content moderation purposes should be banned I'm not sure exactly what this is suggesting, but noticing that a user has previously posted abusive comments and using that to lower the threshold for flagging future comments for review seems completely fine.
h_anna_h 6y ago
They could start by making it easier to report and act on GDPR violations (fb, discord, google, etc all have known violations but nobody seems to care). Then they say that they need more safeguards, no, you need to actually start doing something.
CodeGlitch 6y ago
The web is broken. No amount of regulation by the EU will fix things. I can only hope for something new which is designed from the ground up to protect the users. I'm not smart enough to know what that looks like, perhaps IPFS or similar? In the mean time I'll block all ads and third party cookies and hope for the best.
ElectricMind 6y ago
I applaud EU for taking at least this initiative. US tech giants is result of lax rules by USA and entire world is suffering. I will even go further and say: EU should not allow any US company to work on EU soil unless there is separate sub-EU division which is tailor made for compatible with EU laws. US should solve their own problems inside US. We have our own problem- no free tutoring and moral lessons !

223 points by stiray 6y ago

In what I imagine is a brilliant twist of irony (I can't read the article), all I see when I open this page is a consent form to be tracked, with a link buried in text to opt out, which brings me to a page that requires me to fill in all of my personal details in order to opt out. Apparently in order not to track me reading their web page, Reuters requires (among others) my full name, residency, date of birth, street address, and telephone number.

Jestar342 6y ago
I see the usual OneTrust modal, with a giant, very easy to locate "Reject All" button at the bottom of the modal. https://imgur.com/uZmlGlc https://imgur.com/uZmlGlc
- an_ko 6y ago
  I see the same. Maybe I'm getting confused by the wording and layout. I interpreted the "Reject All"/"Confirm My Choices" buttons at the bottom to belong only to the "Manage Consent Preferences" section. The "Information Our Partners Collect" part above it is a separate section, with a separate "Accept All" button, and an opt-out link in the text, so I figured the final "Reject All" might only reject the second section. Because why else would they have separate sections with separate buttons? Either way, none of this inspires confidence that they have my interests in mind.
  - estaseuropano 6y ago
    > Either way, none of this inspires confidence that they have my interests in mind. Bingo. This is the underlying issue. And indeed this dual opt out is probably intentionally confusing - and I'm never sure either whether 'refuse all' refuses also the partners.
- throwaway2245 6y ago
  I would wager that "Reject All" does not, in fact, opt you out of "Legitimate Interests" - sites are using the language "Object to Legitimate Interests" for this.
Semaphor 6y ago
For me (EU) the consent popup has "reject all" at the very bottom (though I only see it with blocking disabled). Pretty lame, but still better than most.
- weinzierl 6y ago
  "For me (EU) [..]" You are probably not the right person to ask then, but I always wondered: How prevalent are these consent popups outside of the EU?
  - bgdam 6y ago
    Way less frequent. I'm usually jumping between Germany and India and whenever I'm in Germany it feels like I'm always getting a popup on every site I visit for the first time. A lot of the same sites don't bother to throw the popup when I'm browsing from India.
  - curryst 6y ago
    In the US, I see them fairly often. Doubly annoying because I know they don't even have to obey my answers in the US.
    - Semaphor 6y ago
      If their consent manager doesn't distinguish between EU and non-eu, I doubt they'll handle your data differently
high_byte 6y ago
is there some extension to mark links like this? popups, paywalls, consent forms. all of these, I don't mind if the link is red or if their domain is entirely blocked. I'm immediately not interested in such websites and it would save me so much time

yulaow 6y ago

At this point honestly I just wish for a general ban on tracking ads of any kind. Just give me good old contextual ads and remove some MBs of js, with the only purpose of tracking me, from most websites of the internet.

petre 6y ago
How would the EU enforce such a ban? They actually need to prove company X was tracking its users if it goes to court.
- jorge-d 6y ago
  By setting very high fines for those who don't comply?
  - petre 6y ago
    Already done. It's up to 10% of turnover, not profits. Which the companies would happily go to court over. But how to actually prove in court that company X is tracking users if a leak doesn't occur? Subopenas? They need a court order for that. They need reasonable suspicion to get a court order.
    - speedgoose 6y ago
      Right now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.
      - EGreg 6y ago
        Disqus loads a million external resources That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?
        6y ago

4cao 6y ago

Call me cynical but more regulation like this only serves to further entrench the existing (quasi-)monopolies by increasing the barriers for new entrants. Especially the focus on "illegal" content and political advertising only (as opposed to, say, advertising as such) makes it appear not as an attempt to improve the situation in general, but rather to carve a bigger slice of the extant lucrative pie for certain interest groups. > EDPS said gatekeepers should provide an easy and accessible way for users to consent or decline the use of their personal data by the companies for their other services, and that there should be tests to ensure personal data is effectively anonymous. Users will consent to anything, especially if they have no choice, and any tests can and will be gamed. Ultimately if the problem is to be solved it would require a more novel approach than this. > The proposed European Commission rules will need to be discussed with EU countries and EU lawmakers before they become law, a process which will take 16-24 months. The implementation deadline seems excessively long to me. A lot can change within this timeframe, rendering the laws obsolete before they even come into force.

qertoip 6y ago
100%.
betterunix2 6y ago
Yup, that is exactly how it worked with GDPR: big companies can easily afford the cost of compliance while smaller competitors struggle.
- Avamander 6y ago
  Can you provide any citations for that claim?
M2Ys4U 6y ago
> Call me cynical but more regulation like this only serves to further entrench the existing (quasi-)monopolies by increasing the barriers for new entrants. Have you actually read the proposals? I don't mean that in a snarky way, but you're never going to be able to figure that out from a couple of lines in a wire report. For instance: it's not mentioned in this article, but the proposals add extra conditions on Very Large Online Platforms (VLOPs) which wouldn't apply to smaller entities. The definition of a VLOP would be one that reaches > 10% of the entire EU population (~45 million). >The implementation deadline seems excessively long to me. A lot can change within this timeframe, rendering the laws obsolete before they even come into force. It's not like this is now law and the EU will be sitting around for 2 years. The DSM and DMA are just legislative proposals which need to be considered (and almost certainly amended) by the European Parliament and the Council of the EU before they can become law. Large, impactful legislation shouldn't just be plonked on the statute book by the executive.

marcodiego 6y ago

It is good to see regulation that diminishes the chance of monopolies or abuses. I don't know if current safeguards help such guarantees. What could be interesting are economic incentives. For example, social networks profits could be taxed and part of the money acquired could be applied on independent de-centralized services. Imagine the impact if just a small amount of facebook profits were donated to wikipedia.

betterunix2 6y ago
How is this going to diminish monopolies? Big tech is (a) going to have a voice in these regulations and (b) will easily afford the cost of compliance. Small competitors will have no voice and will struggle to comply. This is almost certainly going to entrench the big players and widen their moats.
qertoip 6y ago
> It is good to see regulation It is never good to see regulation. Never ask state to fix the problem or you will end up with two problems. Especially, the Big State.

detournement 6y ago

really excited for more popup policies to approve

dazc 6y ago
Maybe it's a cunning ploy to condition people into agreeing to anything if only it means they can see the damn content? I already instantly accept cookies without hesitation.
- undefined1 6y ago
  no doubt that's what 99% of people do. just like terms of service, it's an automatic click through and a waste of everyone's time.
pornel 6y ago
Adtech companies have worked hard to make you associate privacy with annoying popups. They've lobbied hard to water down tracking bans to be "user choice", and then used dark patterns/malicious compliance to make not agreeing a horrible experience to wear people down, so that people just give up on privacy.
hedora 6y ago
They should ban the pop ups, and make the cookies opt in. Done. Easy.
teeray 6y ago
It’s so irritating that this can’t be an HTTP header. Then again, we probably have the failure of DNT to thank for that.
- colejohnson66 6y ago
  The problem was the DNT was optional, so there was no legal method to force a website to obey it.

apples_oranges 6y ago

People. Just. Delete. Your. Cookies. Regularly. I am baffled about the crazy amount of debate and technical solutions to a problem that was solved the moment Cookies were invented. In the 1990s I suppose.

speedgoose 6y ago
People use Google chrome.
kzrdude 6y ago
(Seriously) I don't want to be logged out.
- apples_oranges 6y ago
  why not, your browser or operating system remembers all your logins for you
  - paddez 6y ago
    2FA slows down the entire log-in process a non-trivial amount - even more so if it's implemented over SMS.
    - apples_oranges 6y ago
      hm, then just use a dedicated browser for those logins? use a Firefox for logged in stuff for example, Safari for the other stuff.
  - inetknght 6y ago
    Automatic logins are easily automatable to steal data from my device, me, and the people around me. I want to be asked every time a service wants to know who's using it from my device. I want to have the option to immediately decline authorization before any information about me or my device is sent. I want to have the option to say "no, I don't want this service to know it's me". I also want the option to say "I am <soandso>" even if really I am not <soandso>. Not giving me that option is a disrespect of me as a user.

weinzierl 6y ago

On related news: Just two days ago the EU ePrivacy regulation took the first hurdle in Brussels. This will most likely bring some changes to the whole consent drama. I'm not good at reading legalese and there seem to be no commentary for the current version[1] yet. What I understand is that they "encourage" browsers to implement "whitelists" (their choice of word, not mine) as a solution to "end-users [..] overloaded with requests to provide consent". I'm not sure what is in there regarding first-party analytics cookies which some hoped will be exempted. [1] https://data.consilium.europa.eu/doc/document/ST-6087-2021-INIT/en/pdf https://data.consilium.europa.eu/doc/document/ST-6087-2021-I... Partly recycled comment from https://news.ycombinator.com/item?id=26103635 https://news.ycombinator.com/item?id=26103635

lmkg 6y ago
I would hone in on pages 27 & 28 in that document. In particular, this quote: > Cookies can also be a legitimate and useful tool, for example, in assessing the effectiveness of a delivered information society service, for example of website design and advertising or by helping to measure the numbers of end-users visiting a website, certain pages of a website or the number of end-users of an application. This is not the case, however, regarding cookies and similar identifiers used to determine the nature of who is using the site, which always require the consent of the end-user. It is, of course, legalese. But they seem to be drawing a distinction between analytics and tracking. Counting distinct users seems to be acceptable without consent; profiling users does not.

hedora 6y ago

They should just ban the gathering of personal information without consent, and ban any UI that makes it easier (or as easy) to opt in. On the day the legislation takes effect all users should be assumed to have opted out, regardless of any terms of service or non-negotiated contract. The only exceptions should be things strictly necessary to do business (e.g., contact info for a bank account holder.)

KDJohnBrown 6y ago

What the EU should really do is fine / tax monopolists like Google and Facebook into submission then invest that money into the EU-based startup ecosystem.

kreeben 6y ago
Targeting taxes directly towards specific companies seems overly aggressive. I hope they will find and implement more generic rules to achieve what it is they want to achieve which, if I'm not completely mistaken, is to protect me from invasive tracking.
- Nasrudith 6y ago
  Are you sure that is really their goal in the first place? If they wanted that they would downsize their intelligence agencies.
- KDJohnBrown 6y ago
  Is this really any different than the USA banning Huawei to prevent 5G carrier equipment competition under the guise of “national security”? (Edited to clarify 5G carrier equipment competition)
dominotw 6y ago
can't google just threaten to pull out like they did in australia?
- jonathanstrange 6y ago
  That could indeed potentially create a little bit of friction for a few weeks before everyone had replaced their services with different solutions.
  - emteycz 6y ago
    Like what solutions? Have you tried these "solutions"? I live in one of the countries which is special by having its own competitive search engine - and it's truly bad compared to Google. If we're going back to that, I am going out of EU.

lanevorockz 6y ago

I pray to the day were privacy is reclaimed. Big Tech has abused us for long enough. You cannot enforce slavery through terms of service, You also should not be able to own all private information of someone through terms of service.

beaconstudios 6y ago

God no. Governments absolutely suck at changing the incentives to deter bad behaviour. Do we really want more cookie banners and GDPR consent forms? Maybe I'm missing something, but why can't we block all forms of stateful identifiers to third-party content? First-party cookies, localStorage, etc only. Is there some big legitimate use case I'm not seeing? Having said that, I'm sure if they were blocked, tech companies would just provide an SDK that passes through first-party state so companies could continue the status quo.

Nextgrid 6y ago
Some stateful identifiers are required for technical purposes. IP addresses for example. Other identifiers are required for the functionality of the service, such as your contact details or information you enter in a social network. Given you can't work around providing the information, the only solution is to use legislation to prevent that information for being used in malicious ways. Also, the current situation with the consent prompts in Europe is not because of the GDPR but because of its lack of enforcement. The GDPR learned from the former "cookie law" (which I agree was a shit-show) and explicitly prohibits annoying/misleading consent prompts.
- beaconstudios 6y ago
  > Some stateful identifiers are required for technical purposes. IP addresses for example. Yeah that one's pretty unavoidable, but is at least for many people temporary and pseudonymous only. Once their dynamic IP rotates (granted this isn't the case for everybody), the connection is lost. Much better than every website with a "Like" button on the page allowing facebook to track you as you traipse across the internet. > Other identifiers are required for the functionality of the service, such as your contact details or information you enter in a social network. That's first-party information. You're not posting on facebook via an iframe on another site. If you choose to provide your information to facebook, they're gonna use it - legislation or not. Legal encodings of intent are always full of loopholes, even if they escape regulatory capture via lobbying. The best way to stop Facebook from getting information about you, is to not give them information. > Also, the current situation with the consent prompts in Europe is not because of the GDPR but because of its lack of enforcement. The GDPR learned from the former "cookie law" (which I agree was a shit-show) and explicitly prohibits annoying/misleading consent prompts. I'm sure it won't be long before that argument goes to court and teams of lawyers spend the next decade arguing over the meaning of the word "annoying". Hence my argument that if we want Facebook to not know everything about us, perhaps we should stop them knowing everything about us?

jefftk 6y ago

> profiling of users for content moderation purposes should be banned I'm not sure exactly what this is suggesting, but noticing that a user has previously posted abusive comments and using that to lower the threshold for flagging future comments for review seems completely fine.

h_anna_h 6y ago

They could start by making it easier to report and act on GDPR violations (fb, discord, google, etc all have known violations but nobody seems to care). Then they say that they need more safeguards, no, you need to actually start doing something.

CodeGlitch 6y ago

The web is broken. No amount of regulation by the EU will fix things. I can only hope for something new which is designed from the ground up to protect the users. I'm not smart enough to know what that looks like, perhaps IPFS or similar? In the mean time I'll block all ads and third party cookies and hope for the best.

ElectricMind 6y ago

I applaud EU for taking at least this initiative. US tech giants is result of lax rules by USA and entire world is suffering. I will even go further and say: EU should not allow any US company to work on EU soil unless there is separate sub-EU division which is tailor made for compatible with EU laws. US should solve their own problems inside US. We have our own problem- no free tutoring and moral lessons !