4 ms·
How would the EU enforce such a ban? They actually need to prove company X was tracking its users if it goes to court.
by petre 6y ago
How would the EU enforce such a ban? They actually need to prove company X was tracking its users if it goes to court.
- jorge-d 6y agoBy setting very high fines for those who don't comply?
- petre 6y agoAlready done. It's up to 10% of turnover, not profits. Which the companies would happily go to court over. But how to actually prove in court that company X is tracking users if a leak doesn't occur? Subopenas? They need a court order for that. They need reasonable suspicion to get a court order.
- speedgoose 6y agoRight now it's very easy to see, the companies are not hiding it at all. They send the data to third-party trackers straight from their website or application.
- EGreg 6y agoDisqus loads a million external resources That’s so stupid, why not just take your OWN cookie and use it in the backend to send to all these resources, proxying through your own server or having a CNAME for theirs under your domain?
- speedgoose 6y agoI guess it's often much simpler and cheaper to not try to hide it. The CNAME practice is becoming more and more common. See https://blog.apnic.net/2020/08/04/characterizing-cname-cloaking-based-tracking/ https://blog.apnic.net/2020/08/04/characterizing-cname-cloak... or https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a https://medium.com/nextdns/cname-cloaking-the-dangerous-disg... or https://www.laquadrature.net/2020/10/05/le-deguisement-des-trackers-par-cname/ https://www.laquadrature.net/2020/10/05/le-deguisement-des-t... I think proxying or doing it server side only will be implemented later when these people will be forced to hide to save their shitty business model.
- Sayrus 6y agoCNAME cloacking has gone even further, ad company now ask you to put a A/AAAA record pointing to one of their IPs as CNAME uncloaking was working pretty well.
- _-david-_ 6y agoI think the move will be for ANAME records. ANAME is not a real record (yet), but some providers are supporting them. It is similar to a CNAME record but instead of storing the domain name you want to map to it pulls the A record and puts that IP as your A record.
- travisjungroth 6y agoThose issues aren’t unique to this problem. Courts already try to solve them. It’s the same as how you would find banks denying loan based on race. You find banks by complaints or wide search. You do an initial investigation from the outside with no warrant or subpoena. Like send in a white client and black client (or someone with a search history of fishing versus sewing) and see what happens. Then that’s enough to ask for all the secrets. Of course they could delete them, but that should be a big crime. I’m not saying this is a perfect system. It’s not. But it’s an attempt the problem you describe.
- Nasrudith 6y agoThat is like saying if we make the punishment for any crime tortorous enough we won't need law enforcement. That only answers "what the punishment will theoretically be" not "How can it be found out when it is being broken? By whom? Will we able to take action against it?".
- maedla 6y agoOh heaven help us if a trillion dollar enterprise gets a fine !!!!
- caddywompus 6y agoI think what they mean is, how can you track which companies are not complicit, how do you organize the proof so that you can levy the fine successfully
- mrtksn 6y agoTurkey successfully made US tech giants comply to Turkish law by banning purchase of ads from non compliant ones and threatening with accumulating fines and progressive bandwidth throttling.
- matheusmoreira 6y agoHow about we make them prove they are not tracking users instead?
- sefrost 6y agoHow could I prove my blog doesn't track you?
- matheusmoreira 6y agoAllow experts to audit your blog, including the code running on the servers. Hosts should submit to similar audits.
- filoleg 6y agoNever thought I would see the day when people on HN would enthusiastically support making it much more difficult for anyone to publish their stuff on the web. All while, in the same breath, clamoring for the "good old days" of the web when publishing something was as easy as just uploading a folder with your HTML/CSS to your host. No, thank you, I don't want to go through audits and deal with bureaucracy when I just want to publish my side-project blog on the web. If you want to discourage people from building and publishing their personal projects and making them easily accessible to the public, that's how you do it. However, I am absolutely ok with EU doing this, given they seem to be hellbent on running their local tech industry into the ground. Truly great founders from EU will either manage to make their companies succeed despite EU or eventually end up creating their companies in the US, and both of those scenarios sound like a win-win to me (from the perspective of the US; from the perspective of the EU, I guess they are doing all of this knowingly, so they get what they wanted, which would count as a win in a way too).
- matheusmoreira 6y agoWell, in the good old days people didn't abuse users with unwanted tracking and fingerprinting. Pages used to be just that: files someone uploaded to the internet. People came up with tracking techniques here and there but they weren't so pervasive. Now most pages aren't pages, they're hostile applications purposefully built to extract as much value out of you as they can by any means available whether you want it to or not. If all you did was publish an HTML+CSS page, your innocence is self-evident. Anyone can look at your page's source and confirm it. If you link to Google's javascripts though, that should put you into a completely different category of suspicion.