3 ms·

> Facebook now argues that it has a "duty to provide personalized advertisement" to the users, therefore, it does not need the user's consent to process his or

> Facebook now argues that it has a "duty to provide personalized advertisement" to the users, therefore, it does not need the user's consent to process his or her personal data. That’s a bold move. Very user hostile. If users want personalized ads, then let them opt in.

rzzzt 6y ago
Object to legitimate interest! ...I find cookie dialogs that have an on/off switch _and_ such a button very confusing, but it sounds like it was created for these kind of situations. IANAL.
- mnw21cam 6y ago
  No, they were created either out of a complete misunderstanding of the law, or as a way to try and weasel-word into being able to retain the information even when you do not consent. It's illegal. Either you have a legitimate interest in the data (by which I mean you have to use the data in order to do what the user explicitly asked you to do), at which point you can process the data without asking for consent, or you don't, at which point you must ask for consent, and you must not alter/degrade the user experience if you do not get it.
  - oytis 6y ago
    Legitimate interest is not necessarily what the user wants you to do. Storing data e.g. for preventing fraud is also a kind of legitimate interest. As a non-legal person I in all honesty can't understand why e.g. storing person's credit score is legitimate while storing their advertising profile isn't.
    - jdlshore 6y ago
      The “legitimate interest” lawful basis is required to be “balanced against the interest of the data subject to privacy.” (Paraphrased from memory) So it’s not so much that storing their advertising profile isn’t a legitimate interest, it’s that users’ desire for privacy supersedes it. (Not a lawyer, have read the GDPR.)
      - oytis 6y ago
        Well, I would argue a lot of people would desire to reset their credit score to default level, and it has much more profound impact on a person's life than some targeted ads. The whole thing seems to be designed for arbitrary enforcement to me. The only positive thing is that people people start discussing the topic seriously, and companies start being explicit about what they are going to use with people's data.
- amelius 6y ago
  Why can't we have a fixed preference in the browser? (The do-not-track header field failed, but it still seems like the best solution)
alkonaut 6y ago
I don't mind targeted ads, I mind targeting based on information I haven't explicitly given. I understand that since I joined a group for local mountainbikers, which is tagged that it is about "cycling", I can see ads for mountainbiking. They infer my interests from information I have given (age, groups, ...). That's fair game. I do NOT want to see a mountainbike ad, ever, because I browsed a random retailer for mountainbikes, or wrote a message about a mountainbike to a friend on messenger, or because a friend of a friend bought a bike on fb marketplace etc etc.
- colejohnson66 6y ago
  Yes. I agree. I like targeted ads. Ads on electronic engineering or computer science are nice because I actually enjoy those things. But just because I looked at something as a possible present for someone doesn’t mean I want ads for weeks. Facebook goes really far on this. It seems even pausing your scrolling for a few seconds more than usual is enough for them to think I’m interesting. I’m not. I’m just trying to figure out if I want to read this post or not.
that_guy_iain 6y ago
> If users want personalized ads, then let them opt in. Let's be honest, if you're using Facebook you've basically agreed to personalised ads on some level. We all know their business model. Try convincing random joe that Facebook don't read their messages for ad purposes and you'll probably find most won't believe you. With that being said, Facebook also knows if their users are given a choice most will choose not to get personalised ads. That's why they fight so hard againist any privacy move.
- cratermoon 6y ago
  > if you're using Facebook you've basically agreed to personalised ads on some level Yes, but no. Someone who joined Facebook in 2007 would have had very different expectations than someone joining in 2017. And there's a difference between "sure, send me personalized ads" and "sell everything you know about to me malicious actors"
- MaxBarraclough 6y ago
  > if you're using Facebook you've basically agreed to personalised ads on some level The GDPR quite explicitly rejects the idea that this constitutes consent.
  - that_guy_iain 6y ago
    Actually, I believe it explictly includes this idea of consent. For example, they state that when you use a cart system you consent to the cookie because you knew it would be needed. But my point was more about the basic idea that people know Facebook is data mining them and use it anyways therefore the idea that you haven't opt'd into it is a bit silly. I wasn't talking about the legal point of view.
    - MaxBarraclough 6y ago
      Consent requires a positive opt-in [0] but there are conditions that permit use of cookies without consent [1]. It seems clear to me that it was written with the intent of excluding advertising cookies while allowing shopping baskets to work even without consent, as you say. Facebook is contesting that its use of cookies falls under the processing is necessary for a contract you have with the individual category, and so doesn't require consent. Of course, if that's the case, the GDPR is truly toothless regarding tracking cookies. > my point was more about the basic idea that people know Facebook is data mining them and use it anyways therefore the idea that you haven't opt'd into it is a bit silly Another relevant point here is that we seem to keep focusing on cookies, but that's just a small part of the equation. [0] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-data-protectio...

rzzzt 6y ago

Object to legitimate interest! ...I find cookie dialogs that have an on/off switch _and_ such a button very confusing, but it sounds like it was created for these kind of situations. IANAL.

mnw21cam 6y ago
No, they were created either out of a complete misunderstanding of the law, or as a way to try and weasel-word into being able to retain the information even when you do not consent. It's illegal. Either you have a legitimate interest in the data (by which I mean you have to use the data in order to do what the user explicitly asked you to do), at which point you can process the data without asking for consent, or you don't, at which point you must ask for consent, and you must not alter/degrade the user experience if you do not get it.
- oytis 6y ago
  Legitimate interest is not necessarily what the user wants you to do. Storing data e.g. for preventing fraud is also a kind of legitimate interest. As a non-legal person I in all honesty can't understand why e.g. storing person's credit score is legitimate while storing their advertising profile isn't.
  - jdlshore 6y ago
    The “legitimate interest” lawful basis is required to be “balanced against the interest of the data subject to privacy.” (Paraphrased from memory) So it’s not so much that storing their advertising profile isn’t a legitimate interest, it’s that users’ desire for privacy supersedes it. (Not a lawyer, have read the GDPR.)
    - oytis 6y ago
      Well, I would argue a lot of people would desire to reset their credit score to default level, and it has much more profound impact on a person's life than some targeted ads. The whole thing seems to be designed for arbitrary enforcement to me. The only positive thing is that people people start discussing the topic seriously, and companies start being explicit about what they are going to use with people's data.
amelius 6y ago
Why can't we have a fixed preference in the browser? (The do-not-track header field failed, but it still seems like the best solution)

alkonaut 6y ago

I don't mind targeted ads, I mind targeting based on information I haven't explicitly given. I understand that since I joined a group for local mountainbikers, which is tagged that it is about "cycling", I can see ads for mountainbiking. They infer my interests from information I have given (age, groups, ...). That's fair game. I do NOT want to see a mountainbike ad, ever, because I browsed a random retailer for mountainbikes, or wrote a message about a mountainbike to a friend on messenger, or because a friend of a friend bought a bike on fb marketplace etc etc.

colejohnson66 6y ago
Yes. I agree. I like targeted ads. Ads on electronic engineering or computer science are nice because I actually enjoy those things. But just because I looked at something as a possible present for someone doesn’t mean I want ads for weeks. Facebook goes really far on this. It seems even pausing your scrolling for a few seconds more than usual is enough for them to think I’m interesting. I’m not. I’m just trying to figure out if I want to read this post or not.

that_guy_iain 6y ago

> If users want personalized ads, then let them opt in. Let's be honest, if you're using Facebook you've basically agreed to personalised ads on some level. We all know their business model. Try convincing random joe that Facebook don't read their messages for ad purposes and you'll probably find most won't believe you. With that being said, Facebook also knows if their users are given a choice most will choose not to get personalised ads. That's why they fight so hard againist any privacy move.

cratermoon 6y ago
> if you're using Facebook you've basically agreed to personalised ads on some level Yes, but no. Someone who joined Facebook in 2007 would have had very different expectations than someone joining in 2017. And there's a difference between "sure, send me personalized ads" and "sell everything you know about to me malicious actors"
MaxBarraclough 6y ago
> if you're using Facebook you've basically agreed to personalised ads on some level The GDPR quite explicitly rejects the idea that this constitutes consent.
- that_guy_iain 6y ago
  Actually, I believe it explictly includes this idea of consent. For example, they state that when you use a cart system you consent to the cookie because you knew it would be needed. But my point was more about the basic idea that people know Facebook is data mining them and use it anyways therefore the idea that you haven't opt'd into it is a bit silly. I wasn't talking about the legal point of view.
  - MaxBarraclough 6y ago
    Consent requires a positive opt-in [0] but there are conditions that permit use of cookies without consent [1]. It seems clear to me that it was written with the intent of excluding advertising cookies while allowing shopping baskets to work even without consent, as you say. Facebook is contesting that its use of cookies falls under the processing is necessary for a contract you have with the individual category, and so doesn't require consent. Of course, if that's the case, the GDPR is truly toothless regarding tracking cookies. > my point was more about the basic idea that people know Facebook is data mining them and use it anyways therefore the idea that you haven't opt'd into it is a bit silly Another relevant point here is that we seem to keep focusing on cookies, but that's just a small part of the equation. [0] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ https://ico.org.uk/for-organisations/guide-to-data-protectio... [1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/ https://ico.org.uk/for-organisations/guide-to-data-protectio...