4 ms·

I was definitely not asked for consent on being tracked online for advertisement purposes. Consent needs to be explicit, specific, unambiguous and freely given.

I was definitely not asked for consent on being tracked online for advertisement purposes. Consent needs to be explicit, specific, unambiguous and freely given. Hiding this behind sugar coated language is illegal in the EU. I very much appreciate the work on NOYB to remind companies that privacy is not optional. P.S. While "building something useless" is not illegal, I find the usage of this information shitty. "You bought X, we'll display ads for X for the next two weeks." How likely is one to buy another bike? Or another pram? Why is the AdTech industry insisting on collecting information that it can't use and is invasive?

kllrnohj 6y ago
The complaint isn't that you're actually being tracked nor that the ID is being used without your consent. The complaint is that the (resettable) ID exists at all. These IDs (Android and iOS) were introduced to push apps off of using globally unique device identifiers that couldn't be reset like the IME number. They were a massive improvement over what previously existed, and on their own don't do any tracking nor contain any user data. This complaint feels like it's a stretch, and if the complaint succeeds the inevitable alternative is much worse for users.
- throwaway3699 6y ago
  It's like the cookie dilemma. Get rid of them and fingerprinting will become the norm (and user's lose the ability to reset them). I don't know how much fingerprinting you can be done within a JVM, but I imagine it's a lot.
  - anticristi 6y ago
    Just as no amount of technical implementation will save the environment, I now believe that no amount of technical implementation (by itself) will enable privacy. GDPR is clear: Any data that allows an individual to be directly or indirectly identified is personal data. Fines are now targeting "lower hanging fruits", i.e., more obvious violations. However, as the landscape shifts, I'm looking forward to the first fine related to non-consented fingerprinting.
    - kllrnohj 6y ago
      But right now they aren't targeting improper usage of identifying data, but instead that identifying data exists at all. This doesn't seem like a GDPR violation at all?
      - anticristi 6y ago
        Collection of identifying data also needs consent. It would be perfectly legal to have an AAID and never disclose it to anyone, but that wouldn't be very useful. :)
        kllrnohj 6y ago
        Right, but they aren't complaining about collection of identifying data. Google/Android (or iOS) isn't collecting the AAID themselves in an unauthorized way. The complaint is purely that the AAID is generated, fully independent of whether or not it's ever used.
        anticristi 6y ago
        Generating UUID and persisting them on a device is perfectly fine. However, once you send this UUID to a server (i.e., the owner of the server collects it) without consent, that becomes illegal.
TeMPOraL 6y ago
> Why is the AdTech industry insisting on collecting information that it can't use and is invasive? - The "dumb" approach to targeted advertising is good enough, they're stuck in a local minimum. When they try to be more clever, ROI drops. - That might change in the future, so it's better to have the data than to not have it. - A lot of that data is also useful for the problem of ad attribution - i.e. determining who should be paid and how much if a person buys something somewhere (possibly off-line).

kllrnohj 6y ago

The complaint isn't that you're actually being tracked nor that the ID is being used without your consent. The complaint is that the (resettable) ID exists at all. These IDs (Android and iOS) were introduced to push apps off of using globally unique device identifiers that couldn't be reset like the IME number. They were a massive improvement over what previously existed, and on their own don't do any tracking nor contain any user data. This complaint feels like it's a stretch, and if the complaint succeeds the inevitable alternative is much worse for users.

throwaway3699 6y ago
It's like the cookie dilemma. Get rid of them and fingerprinting will become the norm (and user's lose the ability to reset them). I don't know how much fingerprinting you can be done within a JVM, but I imagine it's a lot.
- anticristi 6y ago
  Just as no amount of technical implementation will save the environment, I now believe that no amount of technical implementation (by itself) will enable privacy. GDPR is clear: Any data that allows an individual to be directly or indirectly identified is personal data. Fines are now targeting "lower hanging fruits", i.e., more obvious violations. However, as the landscape shifts, I'm looking forward to the first fine related to non-consented fingerprinting.
  - kllrnohj 6y ago
    But right now they aren't targeting improper usage of identifying data, but instead that identifying data exists at all. This doesn't seem like a GDPR violation at all?
    - anticristi 6y ago
      Collection of identifying data also needs consent. It would be perfectly legal to have an AAID and never disclose it to anyone, but that wouldn't be very useful. :)
      - kllrnohj 6y ago
        Right, but they aren't complaining about collection of identifying data. Google/Android (or iOS) isn't collecting the AAID themselves in an unauthorized way. The complaint is purely that the AAID is generated, fully independent of whether or not it's ever used.
        anticristi 6y ago
        Generating UUID and persisting them on a device is perfectly fine. However, once you send this UUID to a server (i.e., the owner of the server collects it) without consent, that becomes illegal.

TeMPOraL 6y ago

> Why is the AdTech industry insisting on collecting information that it can't use and is invasive? - The "dumb" approach to targeted advertising is good enough, they're stuck in a local minimum. When they try to be more clever, ROI drops. - That might change in the future, so it's better to have the data than to not have it. - A lot of that data is also useful for the problem of ad attribution - i.e. determining who should be paid and how much if a person buys something somewhere (possibly off-line).