9 ms·

Dear Email Industry, We've Got a GDPR Problem

62 points by iamacyborg 6y ago

Nextgrid 6y ago
Previous discussion: https://news.ycombinator.com/item?id=21024926 https://news.ycombinator.com/item?id=21024926
- chrismorgan 6y ago
  And indeed, (2019). Also a related discussion from today, Spy pixels in emails 'have become endemic': https://news.ycombinator.com/item?id=26162513 https://news.ycombinator.com/item?id=26162513
kungito 6y ago
God bless GDPR. I only wish it was enforced more. Small businesses seem to not be aware or are faking it that they have legitimate interest for the most basic information. Gyms and similar facilities have been very adamant about me signing the consent form. They tell me "and now just the GDPR form" and I tell them "oh, it's ok, I don't want to sign it" and they keep insisting "I have to". It's ridiculous
- o_m 6y ago
  The regulators here in Norway has gained momentum and have this year already fined as many as they did in all of 2020.
- sofixa 6y ago
  You might like https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ , it's pretty cool to see all the enforcements so far.
  - Nextgrid 6y ago
    You mean the lack of enforcement? I don't see neither Facebook nor Google being fined for their non-compliant consent prompts nor analytics. Google got fined (peanuts for a company of their size) for other stuff, and Facebook only got fined the equivalent of a few cents once on a technicality.
    - dkersten 6y ago
      From that list, Google got fined 50 million euro in France for "Insufficient legal basis for data processing". That's not "other stuff", but is peanuts for a company its size. https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi...
- jeroenhd 6y ago
  You should report these facilities to your local DPA so something can be done against them.
neallindsay 6y ago
Tracking pixels in email should be worthless, because loading external images should be disabled by default in email clients. Instead, all email clients I’ve ever seen default the other way. Maybe Apple would some day be willing to make its client more secure in the name of privacy by flipping the default. I’m sure they’d face a backlash, though.
- Moru 6y ago
  I'm pretty sure Thunderbird defaults to not load external images but I only install it every 5 years so don't quote me on it :-)
  - yetihehe 6y ago
    I'm very sure thunderbird defaults to blocking external images (but there is button to download if you want), because I'm using it daily exactly for this reason. I also have my mail server from small local provider and it has several web mail clients available, each one of them is setup to not download external images.
- Semaphor 6y ago
  > Instead, all email clients I’ve ever seen default the other way. What E-Mail clients are those? Both I use (Outlook for work, Fastmail privately) do exactly that, and neither of those are small. The only one I know that’s different is GMail, but well, Google and Privacy.
  - csunbird 6y ago
    As far as I know, GMail actually downloads the image as soon as the mail arrives on their servers, accomplishing the “making tracking useless” task in another way.
    - iamacyborg 6y ago
      This is not correct. Gmail's cache certainly obfuscates some data, such as the IP, but email pixels will still tell you when an email was opened and by who.
the_af 6y ago
For those who, like me, needed to click on the article to understand what the "email industry" is: the author refers to the email marketing industry. This isn't a problem with email, but with email marketing.
- kawsper 6y ago
  Transactional e-mails also use tracking.
  - Nextgrid 6y ago
    They don't need to, so if the GDPR actually becomes enforced it's trivial to disable tracking on those.
    - buro9 6y ago
      Indeed. I use Sendgrid for transactional emails and have disabled all tracking. Email is hardly a guaranteed delivery system by nature, I do not need to have proof of delivery or proof of opening by tracking systems or even the logs (beyond needing to debug if a customer asks why they didn't get an email). In fact, all I really need is the ability to resend a transactional email on demand, or the equivalent action I can communicate (in my case I run forums, and a transactional email would say "someone replied to your comment" and I can point at a page on the website that has the feed of recent actions).
upofadown 6y ago
>...tracking pixels and tracking links... I consider the fact that email clients can ever be in a mode where such things can work quietly in the background the actual problem here. A program should never leak information in a way that is out of the control of that user. Perhaps we could try applying the GDPR to the creators of such clients.
stiray 6y ago
Ok, I am glad the author has figured it out (2 years too late) but I have another question: Why are they even using tracking pixels, I cant remember when I had some email client that was showing the 3rd party images in emails? I thought this is a dead "technology" for at least a decade?
- iamacyborg 6y ago
  What do you think is dead? Email marketing or email tracking? In either case, both are very much alive and doing better than ever, though in the latter case this is not a good thing.
  - stiray 6y ago
    No, I meant specifically tracking using url to images on 3rd party servers. I have just checked outlook and evolution and both are blocking it by default, same with thunderbird and nine mail O.o
    - iamacyborg 6y ago
      Sadly, nope, still very much a thing that is happening.
    - ACS_Solver 6y ago
      I sometimes cannot tell if HN users are being sarcastic, or are genuinely out of touch with how people use technology. You're not a typical user if you have Thunderbird, let alone Evolution. Gmail is the de-facto standard provider for personal email. People use web clients on their computers, and either the Gmail app or Apple's apps on mobile. Those load images by default, and render HTML. If you're using Thunderbird on your PC or K-9 on your Android, you're in a minority, and your habits don't reflect the vast masses targeted by marketers.
      - Macha 6y ago
        Gmail for web and android does not load remote assets by default. images have to be either attached or in data URLs to load from most senders (only your contacts and whitelisted senders get a pass).
KingOfCoders 6y ago
The problem is more basic. EU companies illegally transferring billions of email adresses to Mailchimp. [Edit] The ECJ voided Privacy Shield because it did not protect the data of EU citizens. The way forward would be Standard Contractual Clauses (SCC)as a tool the ECJ said. The EU comission formulated (an instance of) Standard Contractual Clauses. These have not been accepted by EU data protection agencies (yet). Until they are accepted they do not protect against being fined. Those are for every third country. In the special case of the US currently you can't create SCCs that work because the EU citizen has no lever against three letter US agencies. Until the US changes it's position here, you're not safe with SCCs. Private contracts can or can't safe you. e.g. if I have a contract with someone to steal something togther, the contract doesn't make it legal. Although it is legal to have a contract.
- iamacyborg 6y ago
  Illegal in what sense?
  - jeroenhd 6y ago
    Not the parent, but here's my take: Email addresses are PII and Mailchimp is a US company. With the death of privacy shield, handing over your customers' PII to an American company is a gross violation of the GDPR and its implementations. An EU company sending email to customers using American services would be a legal minefield if the GDPR would actually get enforced. As far as I know, no data protection agency has looked into the practice as of yet. Of course, that could all change very quickly. Personally, I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Sharing a list of email addresses is nothing compared to placing your entire customer database into the hands of Amazon.
    - LunaSea 6y ago
      It really isn't a mine field. You can simply sign a Data Processing Agreement (DPA with MailChimp containing Standard Contractual Clauses (SCC) and you're good to go.
FriedrichN 6y ago
Dear Email Industry, I hope you become obsolete real fast. Does anyone really read those e-mails websites send them? I can't be the only one looking for the unsub link immediately because you accidentally left the check 'subscribe to our newsletter' on when ordering something. You know, those checks that are turned back on when you post the form but are redirected to the form because of validation errors.
- smt88 6y ago
  > Does anyone really read those e-mails websites send them? I can't be the only one looking for the unsub link immediately because you accidentally left the check 'subscribe to our newsletter' on when ordering something. Yes, a few people read and engage with them. They're so inexpensive to send that many companies can justify the cost with a conversion rate of < 1%.
- hoseja 6y ago
  I actually don't mind them. Most of the emails I get are from retailers where I am likely to buy something in the future, and seem mostly to be in the form of a deals-leaflet. A nice quaint bit of somewhat useful, traditional advertising.
- dkersten 6y ago
  I can't think of a single "newsletter" that I've received in the past two years that I actually read. Usually my response is "huh, did I forget to uncheck a box? Unsubscribe".
- iamacyborg 6y ago
  > Does anyone really read those e-mails websites send them? Hundreds of millions of people. Every day.
albertgoeswoof 6y ago
I’ve created https://ohmysmtp.com https://ohmysmtp.com - a transactional email provider. One of the things we’ve specifically done is not include an option to track opens. I think we’re the only provider out there that doesn’t do this, and most if not all default to tracking opens. Of course it would be useful to know if a user has opened a transactional email in some cases, but it’s really not necessary. My personal gripe with tracking pixels is the UX, users have no idea that they are being tracked inside their email client. If there was a big button that said “tell the sender you’ve read this” would any user actually click it? Almost certainly not
bryanrasmussen 6y ago
I sort of feel this is looking at some shadows on the window curtains of the house and thinking there is a hell of a party going on inside. Which given the way things generally work is probably correct but not necessarily so. Example - if you send a tracking pixel with every email you send out and you track those pixels to see how many of your emails sent out were read without connecting each tracking pixel with the user account I don't think you're in violation of the GDPR. If you send out a tracking pixel that is 1. designed to track user reading of emails per user 2. and the user has opted out of the tracking, 3. and the backend implementation is look up tracking pixel id and lookup user assigned to that id and look up if user consented 4. if not consent do not track user read email. I'm not sure that scenario is against the GDPR either, although it may be that the company is told at some point - do not send out the pixel if the user has said they don't want to be tracked, in other words you will not be allowed to stop tracking at the backend, you must not send the image with any non-trackable email that would you allow you to potentially track that email even if you never follow up on that potential (which would really seem to be a good policy to have)
- tpxl 6y ago
  > 2. and the user has opted out of the tracking, > do not send out the pixel if the user has said they don't want to be tracked Per the GDPR, they need to opt in, not opt out.
  - bryanrasmussen 6y ago
    yes, but sometimes when one is writing fast one makes slight errors that don't make much difference overall, thus: If you send out a tracking pixel that is 1. designed to track user reading of emails per user 2. and the user has not opted in to the tracking 3. and the backend implementation is look up tracking pixel id and lookup user assigned to that id and look up if user consented 4. if not consent do not track user read email. I'm not sure that scenario is against the GDPR either, although it may be that the company is told at some point - do not send out the pixel if the user has not said they agree to be tracked... so, I don't think that it made much of a difference in my argument.
  - 6y ago

62 points by iamacyborg 6y ago

Nextgrid 6y ago

Previous discussion: https://news.ycombinator.com/item?id=21024926 https://news.ycombinator.com/item?id=21024926

chrismorgan 6y ago
And indeed, (2019). Also a related discussion from today, Spy pixels in emails 'have become endemic': https://news.ycombinator.com/item?id=26162513 https://news.ycombinator.com/item?id=26162513

kungito 6y ago

God bless GDPR. I only wish it was enforced more. Small businesses seem to not be aware or are faking it that they have legitimate interest for the most basic information. Gyms and similar facilities have been very adamant about me signing the consent form. They tell me "and now just the GDPR form" and I tell them "oh, it's ok, I don't want to sign it" and they keep insisting "I have to". It's ridiculous

o_m 6y ago
The regulators here in Norway has gained momentum and have this year already fined as many as they did in all of 2020.
sofixa 6y ago
You might like https://www.enforcementtracker.com/ https://www.enforcementtracker.com/ , it's pretty cool to see all the enforcements so far.
- Nextgrid 6y ago
  You mean the lack of enforcement? I don't see neither Facebook nor Google being fined for their non-compliant consent prompts nor analytics. Google got fined (peanuts for a company of their size) for other stuff, and Facebook only got fined the equivalent of a few cents once on a technicality.
  - dkersten 6y ago
    From that list, Google got fined 50 million euro in France for "Insufficient legal basis for data processing". That's not "other stuff", but is peanuts for a company its size. https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc https://www.cnil.fr/en/cnils-restricted-committee-imposes-fi...
jeroenhd 6y ago
You should report these facilities to your local DPA so something can be done against them.

neallindsay 6y ago

Tracking pixels in email should be worthless, because loading external images should be disabled by default in email clients. Instead, all email clients I’ve ever seen default the other way. Maybe Apple would some day be willing to make its client more secure in the name of privacy by flipping the default. I’m sure they’d face a backlash, though.

Moru 6y ago
I'm pretty sure Thunderbird defaults to not load external images but I only install it every 5 years so don't quote me on it :-)
- yetihehe 6y ago
  I'm very sure thunderbird defaults to blocking external images (but there is button to download if you want), because I'm using it daily exactly for this reason. I also have my mail server from small local provider and it has several web mail clients available, each one of them is setup to not download external images.
Semaphor 6y ago
> Instead, all email clients I’ve ever seen default the other way. What E-Mail clients are those? Both I use (Outlook for work, Fastmail privately) do exactly that, and neither of those are small. The only one I know that’s different is GMail, but well, Google and Privacy.
- csunbird 6y ago
  As far as I know, GMail actually downloads the image as soon as the mail arrives on their servers, accomplishing the “making tracking useless” task in another way.
  - iamacyborg 6y ago
    This is not correct. Gmail's cache certainly obfuscates some data, such as the IP, but email pixels will still tell you when an email was opened and by who.

the_af 6y ago

For those who, like me, needed to click on the article to understand what the "email industry" is: the author refers to the email marketing industry. This isn't a problem with email, but with email marketing.

kawsper 6y ago
Transactional e-mails also use tracking.
- Nextgrid 6y ago
  They don't need to, so if the GDPR actually becomes enforced it's trivial to disable tracking on those.
  - buro9 6y ago
    Indeed. I use Sendgrid for transactional emails and have disabled all tracking. Email is hardly a guaranteed delivery system by nature, I do not need to have proof of delivery or proof of opening by tracking systems or even the logs (beyond needing to debug if a customer asks why they didn't get an email). In fact, all I really need is the ability to resend a transactional email on demand, or the equivalent action I can communicate (in my case I run forums, and a transactional email would say "someone replied to your comment" and I can point at a page on the website that has the feed of recent actions).

upofadown 6y ago

>...tracking pixels and tracking links... I consider the fact that email clients can ever be in a mode where such things can work quietly in the background the actual problem here. A program should never leak information in a way that is out of the control of that user. Perhaps we could try applying the GDPR to the creators of such clients.

stiray 6y ago

Ok, I am glad the author has figured it out (2 years too late) but I have another question: Why are they even using tracking pixels, I cant remember when I had some email client that was showing the 3rd party images in emails? I thought this is a dead "technology" for at least a decade?

iamacyborg 6y ago
What do you think is dead? Email marketing or email tracking? In either case, both are very much alive and doing better than ever, though in the latter case this is not a good thing.
- stiray 6y ago
  No, I meant specifically tracking using url to images on 3rd party servers. I have just checked outlook and evolution and both are blocking it by default, same with thunderbird and nine mail O.o
  - iamacyborg 6y ago
    Sadly, nope, still very much a thing that is happening.
  - ACS_Solver 6y ago
    I sometimes cannot tell if HN users are being sarcastic, or are genuinely out of touch with how people use technology. You're not a typical user if you have Thunderbird, let alone Evolution. Gmail is the de-facto standard provider for personal email. People use web clients on their computers, and either the Gmail app or Apple's apps on mobile. Those load images by default, and render HTML. If you're using Thunderbird on your PC or K-9 on your Android, you're in a minority, and your habits don't reflect the vast masses targeted by marketers.
    - Macha 6y ago
      Gmail for web and android does not load remote assets by default. images have to be either attached or in data URLs to load from most senders (only your contacts and whitelisted senders get a pass).

KingOfCoders 6y ago

The problem is more basic. EU companies illegally transferring billions of email adresses to Mailchimp. [Edit] The ECJ voided Privacy Shield because it did not protect the data of EU citizens. The way forward would be Standard Contractual Clauses (SCC)as a tool the ECJ said. The EU comission formulated (an instance of) Standard Contractual Clauses. These have not been accepted by EU data protection agencies (yet). Until they are accepted they do not protect against being fined. Those are for every third country. In the special case of the US currently you can't create SCCs that work because the EU citizen has no lever against three letter US agencies. Until the US changes it's position here, you're not safe with SCCs. Private contracts can or can't safe you. e.g. if I have a contract with someone to steal something togther, the contract doesn't make it legal. Although it is legal to have a contract.

iamacyborg 6y ago
Illegal in what sense?
- jeroenhd 6y ago
  Not the parent, but here's my take: Email addresses are PII and Mailchimp is a US company. With the death of privacy shield, handing over your customers' PII to an American company is a gross violation of the GDPR and its implementations. An EU company sending email to customers using American services would be a legal minefield if the GDPR would actually get enforced. As far as I know, no data protection agency has looked into the practice as of yet. Of course, that could all change very quickly. Personally, I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Sharing a list of email addresses is nothing compared to placing your entire customer database into the hands of Amazon.
  - LunaSea 6y ago
    It really isn't a mine field. You can simply sign a Data Processing Agreement (DPA with MailChimp containing Standard Contractual Clauses (SCC) and you're good to go.

FriedrichN 6y ago

Dear Email Industry, I hope you become obsolete real fast. Does anyone really read those e-mails websites send them? I can't be the only one looking for the unsub link immediately because you accidentally left the check 'subscribe to our newsletter' on when ordering something. You know, those checks that are turned back on when you post the form but are redirected to the form because of validation errors.

smt88 6y ago
> Does anyone really read those e-mails websites send them? I can't be the only one looking for the unsub link immediately because you accidentally left the check 'subscribe to our newsletter' on when ordering something. Yes, a few people read and engage with them. They're so inexpensive to send that many companies can justify the cost with a conversion rate of < 1%.
hoseja 6y ago
I actually don't mind them. Most of the emails I get are from retailers where I am likely to buy something in the future, and seem mostly to be in the form of a deals-leaflet. A nice quaint bit of somewhat useful, traditional advertising.
dkersten 6y ago
I can't think of a single "newsletter" that I've received in the past two years that I actually read. Usually my response is "huh, did I forget to uncheck a box? Unsubscribe".
iamacyborg 6y ago
> Does anyone really read those e-mails websites send them? Hundreds of millions of people. Every day.

albertgoeswoof 6y ago

I’ve created https://ohmysmtp.com https://ohmysmtp.com - a transactional email provider. One of the things we’ve specifically done is not include an option to track opens. I think we’re the only provider out there that doesn’t do this, and most if not all default to tracking opens. Of course it would be useful to know if a user has opened a transactional email in some cases, but it’s really not necessary. My personal gripe with tracking pixels is the UX, users have no idea that they are being tracked inside their email client. If there was a big button that said “tell the sender you’ve read this” would any user actually click it? Almost certainly not

bryanrasmussen 6y ago

I sort of feel this is looking at some shadows on the window curtains of the house and thinking there is a hell of a party going on inside. Which given the way things generally work is probably correct but not necessarily so. Example - if you send a tracking pixel with every email you send out and you track those pixels to see how many of your emails sent out were read without connecting each tracking pixel with the user account I don't think you're in violation of the GDPR. If you send out a tracking pixel that is 1. designed to track user reading of emails per user 2. and the user has opted out of the tracking, 3. and the backend implementation is look up tracking pixel id and lookup user assigned to that id and look up if user consented 4. if not consent do not track user read email. I'm not sure that scenario is against the GDPR either, although it may be that the company is told at some point - do not send out the pixel if the user has said they don't want to be tracked, in other words you will not be allowed to stop tracking at the backend, you must not send the image with any non-trackable email that would you allow you to potentially track that email even if you never follow up on that potential (which would really seem to be a good policy to have)

tpxl 6y ago
> 2. and the user has opted out of the tracking, > do not send out the pixel if the user has said they don't want to be tracked Per the GDPR, they need to opt in, not opt out.
- bryanrasmussen 6y ago
  yes, but sometimes when one is writing fast one makes slight errors that don't make much difference overall, thus: If you send out a tracking pixel that is 1. designed to track user reading of emails per user 2. and the user has not opted in to the tracking 3. and the backend implementation is look up tracking pixel id and lookup user assigned to that id and look up if user consented 4. if not consent do not track user read email. I'm not sure that scenario is against the GDPR either, although it may be that the company is told at some point - do not send out the pixel if the user has not said they agree to be tracked... so, I don't think that it made much of a difference in my argument.
- 6y ago