20 ms·

Open letter: Ban surveillance-based advertising

487 points by velmu 5y ago

ColinHayhurst 5y ago
Cohort based targetting such as FLoC, PARAKEET and ATT will further embed the power of Big Tech. But I'm sure the HN community realizes this. The question is: in the face of GAFAM moats and large lobbying efforts, how else might these coalitions and smaller/emerging companies get regulators' attention? Disclosure: we are part of this coalition of 14 businesses offering browsers, search, mail, analytics, and other web services and add our view here as a search engine https://blog.mojeek.com/2021/07/time-to-ban-surveillance-based-advertising.html https://blog.mojeek.com/2021/07/time-to-ban-surveillance-bas...
eivarv 5y ago
More context: https://www.forbrukerradet.no/side/new-report-details-threats-to-consumers-from-surveillance-based-advertising/ https://www.forbrukerradet.no/side/new-report-details-threat...
- ColinHayhurst 5y ago
  And HN discussion on that: https://news.ycombinator.com/item?id=27619030 https://news.ycombinator.com/item?id=27619030
JumpCrisscross 5y ago
Do we have a good proposed legal definition of surveillance-based advertising?
- matheusmoreira 5y ago
  If it collects any data at all, it's surveillance. Anything else is a loophole.
  - JumpCrisscross 5y ago
    > If it collects any data at all, it's surveillance Great, we just banned TCP.
    - swiley 5y ago
      That's why we have TOR. Which allows you to use TCP without revealing the two TCP endpoints to anyone else.
    - 411111111111111 5y ago
      Exposing is not the same as collecting though... I'd definitely consider a system which collects all information that are exposed in a TCP stream a surveillance tool
  - tomjen3 5y ago
    That is nearly impossible to avoid. Go to your local store enough times and they might remember you, even when no data is retained at all.
    - scotu 5y ago
      do you mean the people at the store remember you? kinda different than collecting data and deploying it across the whole internet wouldn't you say?
      - jefftk 5y ago
        The person running the store remembering you and treating you differently based on your history is within what they're covering here, yes. In the report that Vivaldi is recommending (https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202...) they consider both first-party and third-party tracking to be part of "surveillance-based advertising". For example, a site showing ads for users based on what topics they tend to view weighted by how much they interact with each one. There's nothing about having to "deploy it across the whole internet" before it counts; activity on a single site is still (described as) surveillance.
- charcircuit 5y ago
  The report defines it as >In this context, we use the term ‘surveillance-based advertising’ as a blanket >term for digital advertising that is targeted at individuals or consumer >segments, usually through tracking and profiling based on personal data. This is ridiculous. If I am trying to advertise an Elixer IDE, then I don't want my advertisements shown to any random person on the internet. The majority of users on the internet are not even developers. I want to be able to advertise to a consumer segment which consists of people who are interested in Elixir. "Surveillance" is essential to internet advertising.
  - indigochill 5y ago
    > If I am trying to advertise an Elixer IDE, then I don't want my advertisements shown to any random person on the internet. The definition in the report is poor. Yes, you always need to advertise to a segment. No, you don't have to spy on users to do it. How? Make a website about something and select advertisements that are relevant to the sort of people who are probably interested in the topic of the website. ReadTheDocs has already spun off an ad business that advertises tech stuff to readers of ReadTheDocs because it's reasonable to assume that is the audience that is perusing ReadTheDocs pages.
    - charcircuit 5y ago
      >No, you don't have to spy on users to do it. Assuming you are running an ad network you kind of have to in order to prevent ad fraud. Also by reducing that data you know about someone's interests is the knowledge that they have visited a site at least you will not be able to pick as good of an ad compared to if you had more data.
      - danbruc 5y ago
        That is the problem of the ad network. If they have to deal with fraud then find a way to solve this but not at the cost of everyone.
        5y ago
- ColinHayhurst 5y ago
  Good question. IANAL but how about this? Any ad which uses data about an individual, without full transparency about the data being used, to target them as an individual OR where such data is collected and stored and associated with an explicit or implicit identity.
  - JumpCrisscross 5y ago
    “Data about an individual” is too vague, as is “to target them.” Would this ban search-based advertising? What about using an IP address to guess at a language? I think this can be done. I just don’t have the domain expertise to do it, and haven’t seen a proposed definition that made sense. The only intuition I have is around ephemeral versus permanent profiling.
    - ColinHayhurst 5y ago
      Agreed and agreed. For search based advertising we use the search query and location (taken from the country the user chooses in settings - and that can be "None" in which case we just use the search query). The language of the search query could be used rather than IP. Key for us is to never store IP and never pass on any part of it.
      - JumpCrisscross 5y ago
        > Key for us is to never store IP and never pass on any part of it I think this might hold the key. The law likely doesn’t need to try to regulate advertising per se, but instead the types of data advertisers are allowed to retain (or access). Maybe a first step is creating a definition of an advertiser, requiring registration (not licensing) and the annual filing of the inputs their algorithm uses? All inputs, even the most banal? This assumes defining advertiser and algorithm and inputs is easier than what we’re trying to ban.
    - deallocator 5y ago
      don't browsers send a header telling the server what language they expect? I live in Belgium where there's 3 national languages, and my preference isn't even one of them. Please us whatever language my browser tells you to (English)
- Yizahi 5y ago
  I will employ a spy/cop to follow you everywhere and log everything you do in detail, would you consider it a surveillance? Of course, he will refrain from listening to you talking and won't enter your home. But everywhere else he will follow you at a distance. This is essentially what is going on in the internet. Metadata collection = Surveillance.
  - chopin 5y ago
    The analogy breaks at the point "won't enter your home". Current surveillance tech does exactly the analogous of that. It's rather like having a cop sitting at home pinky-promising not to listen or storing any conversation. Maybe it's even worse. There are third-party analytics tools which send out any key-stroke you do, even if you don't submit any form. It has become the new normal. Take todays article in Ars Technica on Audacity (https://arstechnica.com/gadgets/2021/07/no-open-source-audacity-audio-editor-is-not-spyware/ https://arstechnica.com/gadgets/2021/07/no-open-source-audac...). The author has no complaint about the fact that a tool for local editing of audio files reaches out to the internet to send data about the user and seemingly defends this on grounds that it is opt-in. That's fine but that code is needlessly there. There's no reason whatsoever for it. And I am tired of being told that surveillance is for my benefit. No, it's not. It's solely for the benefit of the surveillor.
  - markzzerella 5y ago
    If metadata is good enough to kill people it's dangerous enough to stop collecting en masse.
  - djbebs 5y ago
    Oh no, hes going to be reading every email you send and receive, every message and everything you do. D9nt worry though, he wont do anything unless he finds anything illegal.
- ColinHayhurst 5y ago
  A very experienced expert lawyer who should know, and knows adtech well says "Section 3 of the DPA? Advertising using data that would reveal an identifiable living individual ? It’s a bit more complex than that as processes to protect such data being used should also be included." DPA is I assume Data Protection Act (UK): https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted https://www.legislation.gov.uk/ukpga/2018/12/contents/enacte...
- criddell 5y ago
  I think it's advertising targeted to a group (where a group size of one is an individual). Some of the unintended side effects (which aren't necessarily bad) include ending virtually all store loyalty programs.
- jefftk 5y ago
  I think this is quite tricky to pin down. For example, consider an e-commerce site like Amazon. They know your purchase history, reviews you've given or liked, and products you've viewed or put in your shopping cart but not purchased. Which information about your history would they be allowed to use to show you products you might be interested in buying? They also have lots of information about users in aggregate ("people who bought this also bought x") which they got by collecting data about their users. Can they use this?
  - blooalien 5y ago
    Personally, I'm not bothered by Amazon doing this on their site when I'm there, and I even disable my adblocker on Amazon but limited to Amazon because I'm there to buy a product or service. Advertising at me if it doesn't get in the way of that quest is appropriate there. Covering my entire webpage I'm trying to research something else at with a full-page Amazon ad for a product I already bought just because I expressed interest in that product by buying it is not okay. Thus, I block all ads elsewhere to avoid that sorta thing. Works pretty well for me, but it's sad I should have to jump through as many hoops as I have to to avoid such crapware being forced upon me. Ads I'm not wanting literally steal a portion of my allotted bandwidth and give me less than zero value in return. Perhaps advertisers should start paying us for our valuable time, attention, and bandwidth?
    - jefftk 5y ago
      > Personally, I'm not bothered by Amazon doing this on their site when I'm there You may not be, but this is within what they cover in the report Vivaldi is recommending: https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202... (it's a good read, and there are a lot of things they object to even with only first-party tracking) > Perhaps advertisers should start paying us for our valuable time, attention, and bandwidth? They don't pay you directly, but they pay the site you're visiting, and in most cases that's why the site is able to afford to create the content you're reading and show it to you for free.
- adolph 5y ago
  I have the same question and a followup: What is the difference between "surveillance-based advertising" and observation-based advertising?
- freediver 5y ago
  It could be as simple as 'using data that the user did not explicitly opt-into sharing'. Agreeing to terms&conditions doesn't count as it is not explicit.
deregulateMed 5y ago
There's something beautiful about Google lead FOSS software being the source of privacy software. But hey that's why we support FOSS. A bad dictator means it's time to fork. If Chrome was proprietary, we'd be locked in a Walled Prison.
- Santosh83 5y ago
  This is no longer the era of one company monopoly like the old days. We are now in Big Tech dominance, not monopoly. No one needs a monopoly any longer. Regulatory and technological moats leading to consolidation is good enough.
- type0 5y ago
  > If Chrome was proprietary Chrome is proprietary, it's Chromium that isn't
uniqueuid 5y ago
Instead of arguing what current business models that would break, I think we should take a step back and ask: What legal and moral basis warrants "surveillance-based advertising"? The premise of GDPR in the EU has been that "surveillance-based advertising" needs to be balanced with user rights. If we come to the conclusion that this balance cannot be achieved (e.g. because users are not savvy enough to safeguard their rights, because data sticks around forever, because data can be sold etc.), then it's a straightforward step to prohibit tracking entirely.
- Ensorceled 5y ago
  Also, what old business models might return (like newspaper and other content based advertising) and what new business models might emerge.
- kerkeslager 5y ago
  There's a fundamental disconnect which causes people to ask what business models fixing a social ill would break. We should not be tolerating social ills to prop up the businesses that cause them. If we really believe that the free market will result in positive outcomes, then creating rules against negative outcomes like surveillance shouldn't cause any problems, since they shouldn't be a problem for a free market that will arrive there anyway. Wasn't it Reagan who said, "Trust, but verify?"
pasabagi 5y ago
I think there's a simpler way to achieve this. Force companies who leak personal data to pay reasonable damages to all the individuals involved, on the scale of 10-100 dollars, depending on how much personal info has been leaked. That would make businesses very quickly reassess how much data they need to keep, and how careful they need to be with it, without requiring any really radical legislation.
- pjerem 5y ago
  Yeah but what is a leak ? Do you consider it a leak when a data transfer to another company is intentional ? Companies like Google are probably secured like fortress and will probably not leak data anytime soon (lets hope) so your idea wont have any effect against giants that takes security seriously. However, I really like your point and you'll probably have a good side effect on middle size companies. But giants are a giant part of the problem.
  - pasabagi 5y ago
    Well, my suggestion is kind of aiming to be as pragmatic and unambitious as possible, so the fact it doesn't have an effect against giants who spend a lot of money on security is part of the pragmatism - it means you split the opposition a bill like this would face. The big companies would see it as a way to expand their moat, and so, they'd probably lobby for it, or at least, you could convince them not to lobby against it. If you can build a big coalition of people for whom privacy is something important, then you can start making ambitious policy proposals because you'll have the voters to back it up. Before that point, I think you have to try for easy wins.
  - inetknght 5y ago
    > Yeah but what is a leak? Any time someone who's not me or a direct party to a transaction or conversation learns something about me then that is a "leak". > Do you consider it a leak when a data transfer to another company is intentional? If I do business with my bank then the bank should have no right to sell my information to a third party for any reason whatsoever. If I do business with my hair stylist then the credit card processor should not have any right whatsoever to do anything with the facts: - where was the hair stylist? That's private. - who was the hair stylist? That's private. - when was I at the hair stylist? That's private. - what did the hair stylist sell? That's private. - why did I go to the hair stylist? That's private. Nobody except my hair stylist and myself should have this information.
apatheticonion 5y ago
Physical storefronts have over time learned how to optimise their presentation to achieve higher conversion. Initially it was experimentation with layouts, with time they added cameras which helped understand customer behaviours. This expertise is commonly outsourced to physical marketing companies who dispatch "merchandisers" to your store to help optimise your layout to fall in line with the layouts they have designed based on the experience they have doing this for many different stores. Some companies would actively seek out target customers, give them cash to conduct surveys for market research. The barrier to retail taking this to an extreme is physical obstruction and money. It takes time to experiment with layouts, you have to pay people for their insight. It isn't practical to have a Moogle which has cameras analyzing most physical storefronts around the world. It's a really complex issue as online retailers do make money from online advertising companies and it often matters to them, but the proliferation of the chosen advertising providers few means that everywhere you go they have a presence listening for your user actions. With that said, these companies don't really want to know you, they just want to ensure they are able to serve relevant ads to someone like you. Collecting personal data is a consequence of there being no other way to group data into uniquely identifying profiles and get those insights on the interests of those profiles. More often, these companies explicitly don't want to know you. Personal information is a massive liability. Attempts to anonymise the data are difficult as you will need some kind of unique primary identifier, but you can infer a lot about an identity from seemingly unimportant things like browser resolution.
- ashtonkem 5y ago
  They don’t want to know us, but they appear to have very few limits on what they’re willing to do to sell ads. So far we’re basically counting on our interests and theirs being coincidentally similar, I would not bet on that in the long run. Better to handcuff them before they decide that doing something incredibly unseemly is necessary for ad sales.
- natmaka 5y ago
  > Physical storefronts ((...)) with time they added cameras which helped understand customer behaviours. R. Doisneau, a French photograph, may have in a way be a precursor https://www.christies.com/lot/lot-4572128/?intobjectid=4572128 https://www.christies.com/lot/lot-4572128/?intobjectid=45721... > you can infer a lot about an identity from seemingly unimportant things like browser resolution Oblink: EFF's "Cover tour tracks" https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/
mdp2021 5y ago
The problem is with the match of partial virtual profiles with individual-specific identities. That A uses a profile to visit www sites about code optimization, leisure mathematics, statistic software and StackOverflow, and commercial information about some IDE is shown, that may be welcome. That A uses another profile to visit www sites about baking cakes, nutriment science and ethnic restaurants, and information about some IDE is shown, that is unwelcome as an understatement. That A is Adrian Oberweller of Tamaxa, MT and his individual-specific identity is associated with his private concerns, that is "you must be joking" swinging at the edge between dystopia and ridiculous.
- falsaberN1 5y ago
  This makes me think. What happens when partial profiles are matched to the wrong person? Like, it's very likely these systems are going to match different people in the same household/network because... how can they even separate different people with different interests and a single person using many profiles? I suspect all our "valuable user data" is tainted by default and its monetary value is an illusion. We do know that the systems are overzealous, and the algorithms driving those systems are far from perfect (and in case of ML models, high chances of it being non-deterministic, to boot). A friend recently got some of those ISP copyright strikes because the fiancee of his sister got relocated to his house for a few days and decided to leech from the network to download some AAA videogames. Of course the strikes were to my friend's name, because they have no way to know some stranger did it instead. I can easily see my data profile saying I'm into horoscopes and that voodoo because my mother browses that stuff all day from the network assigned to my name. I'm sure there are attempts to defeat incognito/private tabs by bundling all "indecisive" data to the main profile in a given IP, so a large household can be a completely schizophrenic data profile with data mixed from a lot of users in that household. Imagine someone in your house has been using some extremist or taboo site. If that data is mixed up with yours, and a person with bad intent wants to take advantage of leaked data they obtained on you...they have a pretty strong weapon to assassinate your image. "You can't deny it, it's in the data. Your cousin did it? Oh what an ignoble attempt to save your butt, how lowly!". Since you have no way to plausibly deny it, it can be a strong blackmail weapon. Maybe stronger than medical data leaks in this weirdly political climate we got now.
codecutter 5y ago
I read the open letter. I learned about businesses that support user privacy and I will be supporting them with my wallet. (already use Mailfence and Duckduckgo )
kerkeslager 5y ago
Frankly, I don't think this goes far enough: "Ban advertising" would be better. Almost every problem with the internet right now is caused by advertising if you dig through the chain of causality. From social media patterns that addict you to conflict and conspiracy, to popups, adware and spam, to constant attacks on our attention even when we're driving and could literally kill someone with inattention, to spreading dissatisfaction, fear, and poor financial advice, advertising is the root of much evil. And at its core, advertising is just never a good thing, in any context. Proponents of advertising will say, "How do people find out about products and services?" but advertising is an extremely poor answer to that question: there's an inherent conflict of interest when the people selling a product are the primary source of information about the product. In the worst case, this leads to advertisers just lying to consumers and manipulating people's emotion. In the very best case, advertisers present information only about their own product, which doesn't allow consumers to make educated decisions--it's arguably not lying but the effect is the same. You might say, "Why would advertisers be obligated to provide information about competitors?" and you're right, they aren't, but we aren't trying to establish blame or responsibility here, we're trying to find a solution that's good for consumers, and advertising just isn't that. A better solution is independent review sites. Consumer Reports[1] is a paid service, so you aren't the product. More specialized sites exist for all sorts of product areas: I'm a rock climber, and when I want a new piece of rock climbing gear, the first places I look at are Outdoor Gear Lab[2] and Weigh My Rack [3]. There's Labdoor[4] for supplements, Psychology Today[5] for therapists, WireCutter[6] for electronics, etc. But even here advertising has poisoned the water: many of these sites receive compensation from sellers, not from buyers, which has resulted in some dark patterns. It's not a perfect solution, but it would work a lot better if advertising were banned, and these conflicts of interest were removed. Another solution is simpler and older, and it's exactly what I was doing in my previous post: word-of-mouth. That's arguably one of the best solutions, because while it's low-bandwidth, it's high fidelity: people don't go out of their way to promote a product unless it was actually quite good for them. The other thing proponents of advertising will say is that advertising is necessary to fund existing sites, particularly content sites. On Hacker News, this often comes from someone who makes their money from advertising, directly or indirectly. The thing is, the idea that people only produce content or software when it's profitable to do so reflects a very narrow view of the world. It's just not true. I'm old enough to remember the internet of the 90s, and in that time the internet was full of resources which were simply given away for free without advertising, which I'll refer to roughly as "old internet". Many old internet resources have yet to be reproduced in the new internet: Sheldon Brown's page[7] is still the best resource on bikes (the advertising was added after his death). Erowid[8] remains the most comprehensive resource on drugs. Sites like Wikipedia have somewhat drunk the advertising poison--and were better before. And that leads me to my third reason advertising should be banned: it's infectious. Advertising is Scott Alexander's Moloch[9]--if one entity does it, then all their competitors have to do it in order to compete. The entire purpose of the free market is supposedly that it results in the best outcomes, but this is clearly a hack that prevents that from happening: we want companies to compete by producing the best goods and services at the lowest cost, but when you allow advertising, companies can (and do) compete by manipulating consumers into buying inferior goods at higher costs. Advertising is an anticompetitive business practice that undermines the entire purpose of a free market. Banning advertising is only a bad thing for bad companies: good companies would only stand to benefit. Banning advertising would free good companies to spend their resources on producing the best products and services at the lowest cost: every cent companies spend on advertising now is wasted money. Sure, some companies would go under without advertising. Good riddance: if your company can't sell products and services without ramming them down consumer's throats, your products/services aren't of value. Contrary to the advertiser's paternalistic views, the efficient market hypothesis means that people understand their own problems and can find solutions to them without your help. The world would be better off without advertising. [1] https://www.consumerreports.org/cro/index.htm https://www.consumerreports.org/cro/index.htm [2] https://www.outdoorgearlab.com/ https://www.outdoorgearlab.com/ [3] https://weighmyrack.com/ https://weighmyrack.com/ [4] https://labdoor.com/ https://labdoor.com/ [5] https://www.psychologytoday.com/us/therapists https://www.psychologytoday.com/us/therapists [6] https://www.nytimes.com/wirecutter/ https://www.nytimes.com/wirecutter/ [7] https://www.sheldonbrown.com/ https://www.sheldonbrown.com/ [8] https://www.erowid.org/ https://www.erowid.org/ [9] https://slatestarcodex.com/2014/07/30/meditations-on-moloch/ https://slatestarcodex.com/2014/07/30/meditations-on-moloch/
jefftk 5y ago
This looks like Vivaldi supporting a recommendation made by a consumer advocacy group in Norway (Norwegian Consumer Council / Forbrukerradet), and boosting their report. You can read the original report at: https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202...
- Jonsvt 5y ago
  This is very much a recommended read for everyone.
pmoriarty 5y ago
Surveillance-based advertising is just the tip of the iceberg. All unsolicited advertising should be banned.
dalbasal 5y ago
Not a ton of depth in the letter itself, but I like the angle they take. It's not all about privacy or data security. "In addition to the clear privacy issues caused by surveillance-based advertising, it is also detrimental to the business landscape." "In the surveillance-based advertising model, a few actors can obtain competitive advantages by collecting data from across websites and services and dominant platform actors can abuse their positions by giving preference to their own services." In many senses, Google & FB have achieved what net neutrality wanted to prevent ISPs from doing. In the developing world, FB has actually achieved it. If AOL had succeeded, we would have ended up approximately here.
- jefftk 5y ago
  > a few actors can obtain competitive advantages by collecting data from across websites... This is going away: all the major browsers have said they are going to block cross-site tracking. (Disclosure: I work on ads at Google, speaking only for myself)
  - BiteCode_dev 5y ago
    Google analytics won't track cross site ?
    - jefftk 5y ago
      Does Google Analytics even track cross-site today? Looking at it in developer tools I only see it using first-party cookies. But anyway, Google Analytics won't be able to do it because nobody will be able to do it. For example, here is Chrome's project to remove cross-site tracking: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... (Still speaking only for myself)
      - binarymax 5y ago
        I'm not sure if you're being intentionally obtuse or not. GA phones home with vast information about user, and builds a profile of them. That profile is correlated across sites to personalize search results and sell ads.
hungryforcodes 5y ago
Ban surveillance everything.
- hungryforcodes 5y ago
  I wish that was a moto.
kerkeslager 5y ago
Would any of the people who downvoted my post[1] without comment care to explain why? [1] https://news.ycombinator.com/item?id=27761401 https://news.ycombinator.com/item?id=27761401 EDIT: Didn't think so.
- tqi 5y ago
  It's an unworkable idea. What is an ad, exactly? You cite Consumer Reports as a model - they have affiliate links on their reviews. Is that an ad? Is a sponsored social media post? A celebrity endorsement? Free products given to athletes in the hopes that they will be seen using it? Logos on clothing? Is the standard just "I know it when I see it"? Also (in the US) it almost certain runs afoul of the First Amendment.
  - kerkeslager 5y ago
    > What is an ad, exactly? You cite Consumer Reports as a model - they have affiliate links on their reviews. Is that an ad? I agree that Consumer Reports does include some advertising, but it's not necessary for their business model to work--consumer reports predated the internet by over 50 years, so it certainly predated affiliate links. At least at some points their primary source of income was subscriptions, and judging by how hard it is to get at most of their reviews without a subscription, that continues to be a significant revenue stream for them. > Is a sponsored social media post? A celebrity endorsement? Free products given to athletes in the hopes that they will be seen using it? Logos on clothing? Is the standard just "I know it when I see it"? While I agree that we need a clear definition of an ad to encode this to law, I don't buy this feigned confusion as a valid argument that we can't or shouldn't legislate against ads. Obviously we need to work out a clearer definition than "I know it when I see it" to legislate effectively, but it's absurd to claim that I need to present a fully-written legal code in order to present a valid opinion on Hacker News. We may disagree about free products given to athletes in the hopes that they'll be seen wearing them, for example. But if you claim not to know that a 30 second video clip in the middle of your TV show telling you that you should drink Budweiser to pick up chicks is both an ad and a harmful lie, you're not arguing in good faith. This argument is just throwing FUD about implementation details: you're not responding in any way to my statement of the problem, or presenting any fundamental criticism of my proposed solution. The first implementation of this law wouldn't be perfect. We'd need to iterate on it. But even a ban against a very narrow definition of ads would be extremely beneficial. Since you haven't even disagreed with my statement of the problem, perhaps you agree that advertising is bad, and would like to draft some sample legislation that solves that problem to your satisfaction? > Also (in the US) it almost certain runs afoul of the First Amendment. While current judicial precedent defines corporations as people, that's clearly a terrible mistake. Corporations aren't people and as such the first amendment does not apply to them. Yes, I know, there's some grey area where restricting the rights of corporations might restrict the rights of individuals: remember what I said about implementation details? Overturning judicial precedent is a legal hurdle to get over to get rid of advertising, but it isn't a logical problem with the solution. Just because something is difficult to do doesn't mean it's not worth doing.
only_as_i_fall 5y ago
Opposition to online surveillance always makes me wonder why nobody has attempted to create adversarial browsers or plug-ins. I'm not aware of how difficult it would be technically, but wouldn't a good solution to be simply throw troves of noise at Google Amazon and Facebook to drown out the actual signal? For example, how valuable would online advertising even be if 20% of all users were continously clicking through the ads and opening the landing pages in a virtual browser that the user never even sees? What about opening every search result at random and simply closing the page again after a few seconds? Is there some reason this kind of idea is infeasible or illegal?
- pavel_lishin 5y ago
  > if 20% of all users were continously clicking through the ads and opening the landing pages in a virtual browser that the user never even sees? Those adoption figures are wildly, unreasonably optimistic. I doubt you could get 20% of HN readers in this thread to install such an extension; you'd be lucky if you got 2%.
  - only_as_i_fall 5y ago
    Probably, but IIRC that's about how many users are estimated to run ad blockers which was the basis. Obviously less people care about privacy than care about intrusive ads, but if such features were combined you might get momentum.
- hpoe 5y ago
  People actually have created adversarial browser extension checkout AdNaseum (https://adnauseam.io/ https://adnauseam.io/) which will click every single ad on a page, as well as acting as an adblocker that is based on ublock. In addition the TrackMeNot (https://trackmenot.io/ https://trackmenot.io/) extension will randomly create search requests in the background constantly generating useless noise. If you combine them you get a wonderful situation where random searches are performed and then all the ads on the search result are clicked. I've currently clicked on 2210 ads today while just having it open in another tab on my browser. Join the fight my friends.
1vuio0pswjnm7 5y ago
"In a population survey conducted by YouGov on behalf of the Norwegian Consumer Council, just one out of ten respondents were positive to commercial actors collecting personal information about them online, while only one out of five thought that serving ads based on personal information is acceptable. This resembles similar surveys from both sides of the Atlantic, and indicates that consumers do not regard commercial surveillance as an acceptable trade-off for the possibility of seeing tailored ads." https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202... In light of the evidence, should surveillance-based ads be opt-in (default, no need to figure out and change settings) or opt-out. Currently, tech companies make these ads opt-out. By default the ads are enabled. To disable them, the user must find, understand and change settings. Of course, most users do not ever change default settings. Many users may not even be aware that there are such things as settings.
- Jonsvt 5y ago
  I think you will find that there is a certain part of the population that has bought into the story that surveillance-based ads are somewhat needed for the Internet to work. It is just a story. We have seen from GDPR that you cannot leave any holes. Lets not do it this time.
alexashka 5y ago
Why not go to the logical conclusion and ban advertising? Why not have a yellow pages of cool stuff with proper discovery mechanisms instead. Anyone who's interested in new stuff can go and see what's new, what's happening, like reading the news. Remember when you'd check the app store on your phone for cool stuff? Just have that, for everything. Advertising is mind pollution, it's exhaust fumes for your mind and it's a giant industry that wastes everyone's time playing zero sum games too, ugh.
crazypython 5y ago
1. Web content creators are funded by advertisers. 2. Tracking-based advertising generates more clicks than non-tracking based advertising. 3. Generating more clicks gives web content creators a bigger budget to create, resulting in more web content. Therefore: It's not surveillance-based advertising if all data is stored and processed locally in a way the website cannot read– ideally with a free and open source machine learning system. Like FLoC, but implemented better in a way the site cannot read.
no_time 5y ago
Ban targeted advertising. Break up big tech into <10 000 employee companies. Make GDPR fines a percentage of global revenue. Hold companies liable for data breaches. Stop handing out software patents like toilet paper. End planned obsolescence of tech products like phones. Technology went from a tool to empower and enrich people's lives to a tool to oppress and silence in a few short decades. Either people realize the monster it has turned into or the conjoining of government and tech companies will create a dystopia that will make the dictatorships of the previous millennia look like heaven on earth.

487 points by velmu 5y ago

Cohort based targetting such as FLoC, PARAKEET and ATT will further embed the power of Big Tech. But I'm sure the HN community realizes this. The question is: in the face of GAFAM moats and large lobbying efforts, how else might these coalitions and smaller/emerging companies get regulators' attention? Disclosure: we are part of this coalition of 14 businesses offering browsers, search, mail, analytics, and other web services and add our view here as a search engine https://blog.mojeek.com/2021/07/time-to-ban-surveillance-based-advertising.html https://blog.mojeek.com/2021/07/time-to-ban-surveillance-bas...

eivarv 5y ago

More context: https://www.forbrukerradet.no/side/new-report-details-threats-to-consumers-from-surveillance-based-advertising/ https://www.forbrukerradet.no/side/new-report-details-threat...

ColinHayhurst 5y ago
And HN discussion on that: https://news.ycombinator.com/item?id=27619030 https://news.ycombinator.com/item?id=27619030

JumpCrisscross 5y ago

Do we have a good proposed legal definition of surveillance-based advertising?

matheusmoreira 5y ago
If it collects any data at all, it's surveillance. Anything else is a loophole.
- JumpCrisscross 5y ago
  > If it collects any data at all, it's surveillance Great, we just banned TCP.
  - swiley 5y ago
    That's why we have TOR. Which allows you to use TCP without revealing the two TCP endpoints to anyone else.
  - 411111111111111 5y ago
    Exposing is not the same as collecting though... I'd definitely consider a system which collects all information that are exposed in a TCP stream a surveillance tool
- tomjen3 5y ago
  That is nearly impossible to avoid. Go to your local store enough times and they might remember you, even when no data is retained at all.
  - scotu 5y ago
    do you mean the people at the store remember you? kinda different than collecting data and deploying it across the whole internet wouldn't you say?
    - jefftk 5y ago
      The person running the store remembering you and treating you differently based on your history is within what they're covering here, yes. In the report that Vivaldi is recommending (https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202...) they consider both first-party and third-party tracking to be part of "surveillance-based advertising". For example, a site showing ads for users based on what topics they tend to view weighted by how much they interact with each one. There's nothing about having to "deploy it across the whole internet" before it counts; activity on a single site is still (described as) surveillance.
charcircuit 5y ago
The report defines it as >In this context, we use the term ‘surveillance-based advertising’ as a blanket >term for digital advertising that is targeted at individuals or consumer >segments, usually through tracking and profiling based on personal data. This is ridiculous. If I am trying to advertise an Elixer IDE, then I don't want my advertisements shown to any random person on the internet. The majority of users on the internet are not even developers. I want to be able to advertise to a consumer segment which consists of people who are interested in Elixir. "Surveillance" is essential to internet advertising.
- indigochill 5y ago
  > If I am trying to advertise an Elixer IDE, then I don't want my advertisements shown to any random person on the internet. The definition in the report is poor. Yes, you always need to advertise to a segment. No, you don't have to spy on users to do it. How? Make a website about something and select advertisements that are relevant to the sort of people who are probably interested in the topic of the website. ReadTheDocs has already spun off an ad business that advertises tech stuff to readers of ReadTheDocs because it's reasonable to assume that is the audience that is perusing ReadTheDocs pages.
  - charcircuit 5y ago
    >No, you don't have to spy on users to do it. Assuming you are running an ad network you kind of have to in order to prevent ad fraud. Also by reducing that data you know about someone's interests is the knowledge that they have visited a site at least you will not be able to pick as good of an ad compared to if you had more data.
    - danbruc 5y ago
      That is the problem of the ad network. If they have to deal with fraud then find a way to solve this but not at the cost of everyone.
      - 5y ago
ColinHayhurst 5y ago
Good question. IANAL but how about this? Any ad which uses data about an individual, without full transparency about the data being used, to target them as an individual OR where such data is collected and stored and associated with an explicit or implicit identity.
- JumpCrisscross 5y ago
  “Data about an individual” is too vague, as is “to target them.” Would this ban search-based advertising? What about using an IP address to guess at a language? I think this can be done. I just don’t have the domain expertise to do it, and haven’t seen a proposed definition that made sense. The only intuition I have is around ephemeral versus permanent profiling.
  - ColinHayhurst 5y ago
    Agreed and agreed. For search based advertising we use the search query and location (taken from the country the user chooses in settings - and that can be "None" in which case we just use the search query). The language of the search query could be used rather than IP. Key for us is to never store IP and never pass on any part of it.
    - JumpCrisscross 5y ago
      > Key for us is to never store IP and never pass on any part of it I think this might hold the key. The law likely doesn’t need to try to regulate advertising per se, but instead the types of data advertisers are allowed to retain (or access). Maybe a first step is creating a definition of an advertiser, requiring registration (not licensing) and the annual filing of the inputs their algorithm uses? All inputs, even the most banal? This assumes defining advertiser and algorithm and inputs is easier than what we’re trying to ban.
  - deallocator 5y ago
    don't browsers send a header telling the server what language they expect? I live in Belgium where there's 3 national languages, and my preference isn't even one of them. Please us whatever language my browser tells you to (English)
Yizahi 5y ago
I will employ a spy/cop to follow you everywhere and log everything you do in detail, would you consider it a surveillance? Of course, he will refrain from listening to you talking and won't enter your home. But everywhere else he will follow you at a distance. This is essentially what is going on in the internet. Metadata collection = Surveillance.
- chopin 5y ago
  The analogy breaks at the point "won't enter your home". Current surveillance tech does exactly the analogous of that. It's rather like having a cop sitting at home pinky-promising not to listen or storing any conversation. Maybe it's even worse. There are third-party analytics tools which send out any key-stroke you do, even if you don't submit any form. It has become the new normal. Take todays article in Ars Technica on Audacity (https://arstechnica.com/gadgets/2021/07/no-open-source-audacity-audio-editor-is-not-spyware/ https://arstechnica.com/gadgets/2021/07/no-open-source-audac...). The author has no complaint about the fact that a tool for local editing of audio files reaches out to the internet to send data about the user and seemingly defends this on grounds that it is opt-in. That's fine but that code is needlessly there. There's no reason whatsoever for it. And I am tired of being told that surveillance is for my benefit. No, it's not. It's solely for the benefit of the surveillor.
- markzzerella 5y ago
  If metadata is good enough to kill people it's dangerous enough to stop collecting en masse.
- djbebs 5y ago
  Oh no, hes going to be reading every email you send and receive, every message and everything you do. D9nt worry though, he wont do anything unless he finds anything illegal.
ColinHayhurst 5y ago
A very experienced expert lawyer who should know, and knows adtech well says "Section 3 of the DPA? Advertising using data that would reveal an identifiable living individual ? It’s a bit more complex than that as processes to protect such data being used should also be included." DPA is I assume Data Protection Act (UK): https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted https://www.legislation.gov.uk/ukpga/2018/12/contents/enacte...
criddell 5y ago
I think it's advertising targeted to a group (where a group size of one is an individual). Some of the unintended side effects (which aren't necessarily bad) include ending virtually all store loyalty programs.
jefftk 5y ago
I think this is quite tricky to pin down. For example, consider an e-commerce site like Amazon. They know your purchase history, reviews you've given or liked, and products you've viewed or put in your shopping cart but not purchased. Which information about your history would they be allowed to use to show you products you might be interested in buying? They also have lots of information about users in aggregate ("people who bought this also bought x") which they got by collecting data about their users. Can they use this?
- blooalien 5y ago
  Personally, I'm not bothered by Amazon doing this on their site when I'm there, and I even disable my adblocker on Amazon but limited to Amazon because I'm there to buy a product or service. Advertising at me if it doesn't get in the way of that quest is appropriate there. Covering my entire webpage I'm trying to research something else at with a full-page Amazon ad for a product I already bought just because I expressed interest in that product by buying it is not okay. Thus, I block all ads elsewhere to avoid that sorta thing. Works pretty well for me, but it's sad I should have to jump through as many hoops as I have to to avoid such crapware being forced upon me. Ads I'm not wanting literally steal a portion of my allotted bandwidth and give me less than zero value in return. Perhaps advertisers should start paying us for our valuable time, attention, and bandwidth?
  - jefftk 5y ago
    > Personally, I'm not bothered by Amazon doing this on their site when I'm there You may not be, but this is within what they cover in the report Vivaldi is recommending: https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202... (it's a good read, and there are a lot of things they object to even with only first-party tracking) > Perhaps advertisers should start paying us for our valuable time, attention, and bandwidth? They don't pay you directly, but they pay the site you're visiting, and in most cases that's why the site is able to afford to create the content you're reading and show it to you for free.
adolph 5y ago
I have the same question and a followup: What is the difference between "surveillance-based advertising" and observation-based advertising?
freediver 5y ago
It could be as simple as 'using data that the user did not explicitly opt-into sharing'. Agreeing to terms&conditions doesn't count as it is not explicit.

deregulateMed 5y ago

There's something beautiful about Google lead FOSS software being the source of privacy software. But hey that's why we support FOSS. A bad dictator means it's time to fork. If Chrome was proprietary, we'd be locked in a Walled Prison.

Santosh83 5y ago
This is no longer the era of one company monopoly like the old days. We are now in Big Tech dominance, not monopoly. No one needs a monopoly any longer. Regulatory and technological moats leading to consolidation is good enough.
type0 5y ago
> If Chrome was proprietary Chrome is proprietary, it's Chromium that isn't

uniqueuid 5y ago

Instead of arguing what current business models that would break, I think we should take a step back and ask: What legal and moral basis warrants "surveillance-based advertising"? The premise of GDPR in the EU has been that "surveillance-based advertising" needs to be balanced with user rights. If we come to the conclusion that this balance cannot be achieved (e.g. because users are not savvy enough to safeguard their rights, because data sticks around forever, because data can be sold etc.), then it's a straightforward step to prohibit tracking entirely.

Ensorceled 5y ago
Also, what old business models might return (like newspaper and other content based advertising) and what new business models might emerge.
kerkeslager 5y ago
There's a fundamental disconnect which causes people to ask what business models fixing a social ill would break. We should not be tolerating social ills to prop up the businesses that cause them. If we really believe that the free market will result in positive outcomes, then creating rules against negative outcomes like surveillance shouldn't cause any problems, since they shouldn't be a problem for a free market that will arrive there anyway. Wasn't it Reagan who said, "Trust, but verify?"

pasabagi 5y ago

I think there's a simpler way to achieve this. Force companies who leak personal data to pay reasonable damages to all the individuals involved, on the scale of 10-100 dollars, depending on how much personal info has been leaked. That would make businesses very quickly reassess how much data they need to keep, and how careful they need to be with it, without requiring any really radical legislation.

pjerem 5y ago
Yeah but what is a leak ? Do you consider it a leak when a data transfer to another company is intentional ? Companies like Google are probably secured like fortress and will probably not leak data anytime soon (lets hope) so your idea wont have any effect against giants that takes security seriously. However, I really like your point and you'll probably have a good side effect on middle size companies. But giants are a giant part of the problem.
- pasabagi 5y ago
  Well, my suggestion is kind of aiming to be as pragmatic and unambitious as possible, so the fact it doesn't have an effect against giants who spend a lot of money on security is part of the pragmatism - it means you split the opposition a bill like this would face. The big companies would see it as a way to expand their moat, and so, they'd probably lobby for it, or at least, you could convince them not to lobby against it. If you can build a big coalition of people for whom privacy is something important, then you can start making ambitious policy proposals because you'll have the voters to back it up. Before that point, I think you have to try for easy wins.
- inetknght 5y ago
  > Yeah but what is a leak? Any time someone who's not me or a direct party to a transaction or conversation learns something about me then that is a "leak". > Do you consider it a leak when a data transfer to another company is intentional? If I do business with my bank then the bank should have no right to sell my information to a third party for any reason whatsoever. If I do business with my hair stylist then the credit card processor should not have any right whatsoever to do anything with the facts: - where was the hair stylist? That's private. - who was the hair stylist? That's private. - when was I at the hair stylist? That's private. - what did the hair stylist sell? That's private. - why did I go to the hair stylist? That's private. Nobody except my hair stylist and myself should have this information.

apatheticonion 5y ago

Physical storefronts have over time learned how to optimise their presentation to achieve higher conversion. Initially it was experimentation with layouts, with time they added cameras which helped understand customer behaviours. This expertise is commonly outsourced to physical marketing companies who dispatch "merchandisers" to your store to help optimise your layout to fall in line with the layouts they have designed based on the experience they have doing this for many different stores. Some companies would actively seek out target customers, give them cash to conduct surveys for market research. The barrier to retail taking this to an extreme is physical obstruction and money. It takes time to experiment with layouts, you have to pay people for their insight. It isn't practical to have a Moogle which has cameras analyzing most physical storefronts around the world. It's a really complex issue as online retailers do make money from online advertising companies and it often matters to them, but the proliferation of the chosen advertising providers few means that everywhere you go they have a presence listening for your user actions. With that said, these companies don't really want to know you, they just want to ensure they are able to serve relevant ads to someone like you. Collecting personal data is a consequence of there being no other way to group data into uniquely identifying profiles and get those insights on the interests of those profiles. More often, these companies explicitly don't want to know you. Personal information is a massive liability. Attempts to anonymise the data are difficult as you will need some kind of unique primary identifier, but you can infer a lot about an identity from seemingly unimportant things like browser resolution.

ashtonkem 5y ago
They don’t want to know us, but they appear to have very few limits on what they’re willing to do to sell ads. So far we’re basically counting on our interests and theirs being coincidentally similar, I would not bet on that in the long run. Better to handcuff them before they decide that doing something incredibly unseemly is necessary for ad sales.
natmaka 5y ago
> Physical storefronts ((...)) with time they added cameras which helped understand customer behaviours. R. Doisneau, a French photograph, may have in a way be a precursor https://www.christies.com/lot/lot-4572128/?intobjectid=4572128 https://www.christies.com/lot/lot-4572128/?intobjectid=45721... > you can infer a lot about an identity from seemingly unimportant things like browser resolution Oblink: EFF's "Cover tour tracks" https://coveryourtracks.eff.org/ https://coveryourtracks.eff.org/

mdp2021 5y ago

The problem is with the match of partial virtual profiles with individual-specific identities. That A uses a profile to visit www sites about code optimization, leisure mathematics, statistic software and StackOverflow, and commercial information about some IDE is shown, that may be welcome. That A uses another profile to visit www sites about baking cakes, nutriment science and ethnic restaurants, and information about some IDE is shown, that is unwelcome as an understatement. That A is Adrian Oberweller of Tamaxa, MT and his individual-specific identity is associated with his private concerns, that is "you must be joking" swinging at the edge between dystopia and ridiculous.

falsaberN1 5y ago
This makes me think. What happens when partial profiles are matched to the wrong person? Like, it's very likely these systems are going to match different people in the same household/network because... how can they even separate different people with different interests and a single person using many profiles? I suspect all our "valuable user data" is tainted by default and its monetary value is an illusion. We do know that the systems are overzealous, and the algorithms driving those systems are far from perfect (and in case of ML models, high chances of it being non-deterministic, to boot). A friend recently got some of those ISP copyright strikes because the fiancee of his sister got relocated to his house for a few days and decided to leech from the network to download some AAA videogames. Of course the strikes were to my friend's name, because they have no way to know some stranger did it instead. I can easily see my data profile saying I'm into horoscopes and that voodoo because my mother browses that stuff all day from the network assigned to my name. I'm sure there are attempts to defeat incognito/private tabs by bundling all "indecisive" data to the main profile in a given IP, so a large household can be a completely schizophrenic data profile with data mixed from a lot of users in that household. Imagine someone in your house has been using some extremist or taboo site. If that data is mixed up with yours, and a person with bad intent wants to take advantage of leaked data they obtained on you...they have a pretty strong weapon to assassinate your image. "You can't deny it, it's in the data. Your cousin did it? Oh what an ignoble attempt to save your butt, how lowly!". Since you have no way to plausibly deny it, it can be a strong blackmail weapon. Maybe stronger than medical data leaks in this weirdly political climate we got now.

codecutter 5y ago

I read the open letter. I learned about businesses that support user privacy and I will be supporting them with my wallet. (already use Mailfence and Duckduckgo )

kerkeslager 5y ago

Frankly, I don't think this goes far enough: "Ban advertising" would be better. Almost every problem with the internet right now is caused by advertising if you dig through the chain of causality. From social media patterns that addict you to conflict and conspiracy, to popups, adware and spam, to constant attacks on our attention even when we're driving and could literally kill someone with inattention, to spreading dissatisfaction, fear, and poor financial advice, advertising is the root of much evil. And at its core, advertising is just never a good thing, in any context. Proponents of advertising will say, "How do people find out about products and services?" but advertising is an extremely poor answer to that question: there's an inherent conflict of interest when the people selling a product are the primary source of information about the product. In the worst case, this leads to advertisers just lying to consumers and manipulating people's emotion. In the very best case, advertisers present information only about their own product, which doesn't allow consumers to make educated decisions--it's arguably not lying but the effect is the same. You might say, "Why would advertisers be obligated to provide information about competitors?" and you're right, they aren't, but we aren't trying to establish blame or responsibility here, we're trying to find a solution that's good for consumers, and advertising just isn't that. A better solution is independent review sites. Consumer Reports[1] is a paid service, so you aren't the product. More specialized sites exist for all sorts of product areas: I'm a rock climber, and when I want a new piece of rock climbing gear, the first places I look at are Outdoor Gear Lab[2] and Weigh My Rack [3]. There's Labdoor[4] for supplements, Psychology Today[5] for therapists, WireCutter[6] for electronics, etc. But even here advertising has poisoned the water: many of these sites receive compensation from sellers, not from buyers, which has resulted in some dark patterns. It's not a perfect solution, but it would work a lot better if advertising were banned, and these conflicts of interest were removed. Another solution is simpler and older, and it's exactly what I was doing in my previous post: word-of-mouth. That's arguably one of the best solutions, because while it's low-bandwidth, it's high fidelity: people don't go out of their way to promote a product unless it was actually quite good for them. The other thing proponents of advertising will say is that advertising is necessary to fund existing sites, particularly content sites. On Hacker News, this often comes from someone who makes their money from advertising, directly or indirectly. The thing is, the idea that people only produce content or software when it's profitable to do so reflects a very narrow view of the world. It's just not true. I'm old enough to remember the internet of the 90s, and in that time the internet was full of resources which were simply given away for free without advertising, which I'll refer to roughly as "old internet". Many old internet resources have yet to be reproduced in the new internet: Sheldon Brown's page[7] is still the best resource on bikes (the advertising was added after his death). Erowid[8] remains the most comprehensive resource on drugs. Sites like Wikipedia have somewhat drunk the advertising poison--and were better before. And that leads me to my third reason advertising should be banned: it's infectious. Advertising is Scott Alexander's Moloch[9]--if one entity does it, then all their competitors have to do it in order to compete. The entire purpose of the free market is supposedly that it results in the best outcomes, but this is clearly a hack that prevents that from happening: we want companies to compete by producing the best goods and services at the lowest cost, but when you allow advertising, companies can (and do) compete by manipulating consumers into buying inferior goods at higher costs. Advertising is an anticompetitive business practice that undermines the entire purpose of a free market. Banning advertising is only a bad thing for bad companies: good companies would only stand to benefit. Banning advertising would free good companies to spend their resources on producing the best products and services at the lowest cost: every cent companies spend on advertising now is wasted money. Sure, some companies would go under without advertising. Good riddance: if your company can't sell products and services without ramming them down consumer's throats, your products/services aren't of value. Contrary to the advertiser's paternalistic views, the efficient market hypothesis means that people understand their own problems and can find solutions to them without your help. The world would be better off without advertising. [1] https://www.consumerreports.org/cro/index.htm https://www.consumerreports.org/cro/index.htm [2] https://www.outdoorgearlab.com/ https://www.outdoorgearlab.com/ [3] https://weighmyrack.com/ https://weighmyrack.com/ [4] https://labdoor.com/ https://labdoor.com/ [5] https://www.psychologytoday.com/us/therapists https://www.psychologytoday.com/us/therapists [6] https://www.nytimes.com/wirecutter/ https://www.nytimes.com/wirecutter/ [7] https://www.sheldonbrown.com/ https://www.sheldonbrown.com/ [8] https://www.erowid.org/ https://www.erowid.org/ [9] https://slatestarcodex.com/2014/07/30/meditations-on-moloch/ https://slatestarcodex.com/2014/07/30/meditations-on-moloch/

jefftk 5y ago

This looks like Vivaldi supporting a recommendation made by a consumer advocacy group in Norway (Norwegian Consumer Council / Forbrukerradet), and boosting their report. You can read the original report at: https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202...

Jonsvt 5y ago
This is very much a recommended read for everyone.

pmoriarty 5y ago

Surveillance-based advertising is just the tip of the iceberg. All unsolicited advertising should be banned.

dalbasal 5y ago

Not a ton of depth in the letter itself, but I like the angle they take. It's not all about privacy or data security. "In addition to the clear privacy issues caused by surveillance-based advertising, it is also detrimental to the business landscape." "In the surveillance-based advertising model, a few actors can obtain competitive advantages by collecting data from across websites and services and dominant platform actors can abuse their positions by giving preference to their own services." In many senses, Google & FB have achieved what net neutrality wanted to prevent ISPs from doing. In the developing world, FB has actually achieved it. If AOL had succeeded, we would have ended up approximately here.

jefftk 5y ago
> a few actors can obtain competitive advantages by collecting data from across websites... This is going away: all the major browsers have said they are going to block cross-site tracking. (Disclosure: I work on ads at Google, speaking only for myself)
- BiteCode_dev 5y ago
  Google analytics won't track cross site ?
  - jefftk 5y ago
    Does Google Analytics even track cross-site today? Looking at it in developer tools I only see it using first-party cookies. But anyway, Google Analytics won't be able to do it because nobody will be able to do it. For example, here is Chrome's project to remove cross-site tracking: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... (Still speaking only for myself)
    - binarymax 5y ago
      I'm not sure if you're being intentionally obtuse or not. GA phones home with vast information about user, and builds a profile of them. That profile is correlated across sites to personalize search results and sell ads.

hungryforcodes 5y ago

Ban surveillance everything.

hungryforcodes 5y ago
I wish that was a moto.

kerkeslager 5y ago

Would any of the people who downvoted my post[1] without comment care to explain why? [1] https://news.ycombinator.com/item?id=27761401 https://news.ycombinator.com/item?id=27761401 EDIT: Didn't think so.

tqi 5y ago
It's an unworkable idea. What is an ad, exactly? You cite Consumer Reports as a model - they have affiliate links on their reviews. Is that an ad? Is a sponsored social media post? A celebrity endorsement? Free products given to athletes in the hopes that they will be seen using it? Logos on clothing? Is the standard just "I know it when I see it"? Also (in the US) it almost certain runs afoul of the First Amendment.
- kerkeslager 5y ago
  > What is an ad, exactly? You cite Consumer Reports as a model - they have affiliate links on their reviews. Is that an ad? I agree that Consumer Reports does include some advertising, but it's not necessary for their business model to work--consumer reports predated the internet by over 50 years, so it certainly predated affiliate links. At least at some points their primary source of income was subscriptions, and judging by how hard it is to get at most of their reviews without a subscription, that continues to be a significant revenue stream for them. > Is a sponsored social media post? A celebrity endorsement? Free products given to athletes in the hopes that they will be seen using it? Logos on clothing? Is the standard just "I know it when I see it"? While I agree that we need a clear definition of an ad to encode this to law, I don't buy this feigned confusion as a valid argument that we can't or shouldn't legislate against ads. Obviously we need to work out a clearer definition than "I know it when I see it" to legislate effectively, but it's absurd to claim that I need to present a fully-written legal code in order to present a valid opinion on Hacker News. We may disagree about free products given to athletes in the hopes that they'll be seen wearing them, for example. But if you claim not to know that a 30 second video clip in the middle of your TV show telling you that you should drink Budweiser to pick up chicks is both an ad and a harmful lie, you're not arguing in good faith. This argument is just throwing FUD about implementation details: you're not responding in any way to my statement of the problem, or presenting any fundamental criticism of my proposed solution. The first implementation of this law wouldn't be perfect. We'd need to iterate on it. But even a ban against a very narrow definition of ads would be extremely beneficial. Since you haven't even disagreed with my statement of the problem, perhaps you agree that advertising is bad, and would like to draft some sample legislation that solves that problem to your satisfaction? > Also (in the US) it almost certain runs afoul of the First Amendment. While current judicial precedent defines corporations as people, that's clearly a terrible mistake. Corporations aren't people and as such the first amendment does not apply to them. Yes, I know, there's some grey area where restricting the rights of corporations might restrict the rights of individuals: remember what I said about implementation details? Overturning judicial precedent is a legal hurdle to get over to get rid of advertising, but it isn't a logical problem with the solution. Just because something is difficult to do doesn't mean it's not worth doing.

only_as_i_fall 5y ago

Opposition to online surveillance always makes me wonder why nobody has attempted to create adversarial browsers or plug-ins. I'm not aware of how difficult it would be technically, but wouldn't a good solution to be simply throw troves of noise at Google Amazon and Facebook to drown out the actual signal? For example, how valuable would online advertising even be if 20% of all users were continously clicking through the ads and opening the landing pages in a virtual browser that the user never even sees? What about opening every search result at random and simply closing the page again after a few seconds? Is there some reason this kind of idea is infeasible or illegal?

pavel_lishin 5y ago
> if 20% of all users were continously clicking through the ads and opening the landing pages in a virtual browser that the user never even sees? Those adoption figures are wildly, unreasonably optimistic. I doubt you could get 20% of HN readers in this thread to install such an extension; you'd be lucky if you got 2%.
- only_as_i_fall 5y ago
  Probably, but IIRC that's about how many users are estimated to run ad blockers which was the basis. Obviously less people care about privacy than care about intrusive ads, but if such features were combined you might get momentum.
hpoe 5y ago
People actually have created adversarial browser extension checkout AdNaseum (https://adnauseam.io/ https://adnauseam.io/) which will click every single ad on a page, as well as acting as an adblocker that is based on ublock. In addition the TrackMeNot (https://trackmenot.io/ https://trackmenot.io/) extension will randomly create search requests in the background constantly generating useless noise. If you combine them you get a wonderful situation where random searches are performed and then all the ads on the search result are clicked. I've currently clicked on 2210 ads today while just having it open in another tab on my browser. Join the fight my friends.

1vuio0pswjnm7 5y ago

"In a population survey conducted by YouGov on behalf of the Norwegian Consumer Council, just one out of ten respondents were positive to commercial actors collecting personal information about them online, while only one out of five thought that serving ads based on personal information is acceptable. This resembles similar surveys from both sides of the Atlantic, and indicates that consumers do not regard commercial surveillance as an acceptable trade-off for the possibility of seeing tailored ads." https://www.forbrukerradet.no/wp-content/uploads/2021/06/20210622-final-report-time-to-ban-surveillance-based-advertising.pdf https://www.forbrukerradet.no/wp-content/uploads/2021/06/202... In light of the evidence, should surveillance-based ads be opt-in (default, no need to figure out and change settings) or opt-out. Currently, tech companies make these ads opt-out. By default the ads are enabled. To disable them, the user must find, understand and change settings. Of course, most users do not ever change default settings. Many users may not even be aware that there are such things as settings.

Jonsvt 5y ago
I think you will find that there is a certain part of the population that has bought into the story that surveillance-based ads are somewhat needed for the Internet to work. It is just a story. We have seen from GDPR that you cannot leave any holes. Lets not do it this time.

alexashka 5y ago

Why not go to the logical conclusion and ban advertising? Why not have a yellow pages of cool stuff with proper discovery mechanisms instead. Anyone who's interested in new stuff can go and see what's new, what's happening, like reading the news. Remember when you'd check the app store on your phone for cool stuff? Just have that, for everything. Advertising is mind pollution, it's exhaust fumes for your mind and it's a giant industry that wastes everyone's time playing zero sum games too, ugh.

crazypython 5y ago

1. Web content creators are funded by advertisers. 2. Tracking-based advertising generates more clicks than non-tracking based advertising. 3. Generating more clicks gives web content creators a bigger budget to create, resulting in more web content. Therefore: It's not surveillance-based advertising if all data is stored and processed locally in a way the website cannot read– ideally with a free and open source machine learning system. Like FLoC, but implemented better in a way the site cannot read.

no_time 5y ago

Ban targeted advertising. Break up big tech into <10 000 employee companies. Make GDPR fines a percentage of global revenue. Hold companies liable for data breaches. Stop handing out software patents like toilet paper. End planned obsolescence of tech products like phones. Technology went from a tool to empower and enrich people's lives to a tool to oppress and silence in a few short decades. Either people realize the monster it has turned into or the conjoining of government and tech companies will create a dystopia that will make the dictatorships of the previous millennia look like heaven on earth.