18 ms·

Not a ton of depth in the letter itself, but I like the angle they take. It's not all about privacy or data security. "In addition to the clear privacy issues

Not a ton of depth in the letter itself, but I like the angle they take. It's not all about privacy or data security. "In addition to the clear privacy issues caused by surveillance-based advertising, it is also detrimental to the business landscape." "In the surveillance-based advertising model, a few actors can obtain competitive advantages by collecting data from across websites and services and dominant platform actors can abuse their positions by giving preference to their own services." In many senses, Google & FB have achieved what net neutrality wanted to prevent ISPs from doing. In the developing world, FB has actually achieved it. If AOL had succeeded, we would have ended up approximately here.

jefftk 5y ago
> a few actors can obtain competitive advantages by collecting data from across websites... This is going away: all the major browsers have said they are going to block cross-site tracking. (Disclosure: I work on ads at Google, speaking only for myself)
- BiteCode_dev 5y ago
  Google analytics won't track cross site ?
  - jefftk 5y ago
    Does Google Analytics even track cross-site today? Looking at it in developer tools I only see it using first-party cookies. But anyway, Google Analytics won't be able to do it because nobody will be able to do it. For example, here is Chrome's project to remove cross-site tracking: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... (Still speaking only for myself)
    - binarymax 5y ago
      I'm not sure if you're being intentionally obtuse or not. GA phones home with vast information about user, and builds a profile of them. That profile is correlated across sites to personalize search results and sell ads.
      - jefftk 5y ago
        I'm not being intentionally obtuse, but I also don't know all of Google's advertising business. I didn't think Google Analytics did that? What makes you think it does? (GA sends a message to Google, but I had thought that it was not linked to your behavior on other sites via GA?)
        LegitShady 5y ago
        google analytics tells you the interest of your audience. how do you think it does this without correlating you to a profile they've built?
        lmkg 5y ago
        Googe Analytics consultant here (not Google employee). 1. Google Analytics' primary identity signal is a first-party cookie. this is not shared between domains. There is no technical way to link identity between domains with different cookie values. 1a. Google Analytics has built-in library functions to allow site owners to share first-party cookie values between a whitelisted set of domains. This effectively lets one company with multiple sites share a first-party identifier, but still not let anyone (Google or otherwise) link that identity to identities set on other sites. 1b. BUT. But. BUT. Google is rolling out "Google Signals" for Google Analytics, which will use your Google Account as the identity signal instead for users who are logged in to Chrome. This, obviously, lets your identity be correlated across sites. (Personally, I suspect that the availability of this feature played a part in Google's decision to let Chrome follow the industry towards blocking third-party cookies. But this is a baseless opinion, one step removed from a conspiracy theory.) 2. Google Analytics can link their identifier (the first-party cookie or Google Signals) to your DoubleClick profile via DoubleClick's third-party cookie. The checkbox that does this is unchecked by default. There are many other features of GA that encourage or require you to check this checkbox. 2a. Google's documentation (including legal contracts!) places limits in the data exchanged between the two profiles. Data exchanged does include demographic and interest information from DoubleClick's profile into GA. This is one of the big reasons why people click the checkbox. To my knowledge, GA data is not used to inform the DoubleClick profile. GA data can be used to build an "audience" in various Google ad platforms, and direct ads to those people specifically, or to use as the basis for a "look-alike audience." 3. Google is a Processor under GDPR for Google Analytics, and a Controller under GDPR for Google Ads. To a first approximation, this means they make the specific legal claim that they do not use GA data for their own purposes. Linking Analytics and Ads data is... complicated and frankly I still haven't gotten an explanation of its legal status that I fully understand. In my personal opinion, I don't think Google actually uses Google Analytics data. Most Analytics implementations are tire fires, and they can get all the data from other more reliable sources, like Publisher data or Chrome. Given that they have based on their entire GDPR compliance strategy for Analytics on being a Processor, I don't think the risk/reward is there. (apologies for lack of copy-editing, the thunder's about to take my internet away)
    - alisonkisk 5y ago
      Is Google going to give back the $100B is made from cross site tracking in the past? Is Google going to consider YouTube, Gmail, Maps, and Android Location history different sites, or is "having an effective monopoly an exemption to crosss-site tracking prohibition? Does anything in the proposal prevent server-side cross-site tracking? (No.) Is Google going to stop buying third party tracking data like credit card transactions?
- neolog 5y ago
  No it isn't, Google will still track me across the web.
  - blooalien 5y ago
    So will Facebook (and several others) if you take no steps of your own to block them. It's an escalating war of cat and mouse. You'll block them, they'll find a new way around it, you'll block them some more, they'll find another way. Eventually the only answer will be to shut down the Internet because it's become just too broken to use anymore.
    - squiggleblaz 5y ago
      The simpler answer is to just ban it. The law doesn't need to be technically detailed or envision every single technological adaptation: it just needs to be sufficient for a judge to be able to recognise it when a prosecutor describes it and a defence lawyer attempts to pull the wool over their eyes. It needs to be focused on outcomes. Once banned, Google and Facebook will submit. They will attempt to lobby against the reforms, eventually saying "it will prevent legitimate business: it represents a small fraction of our revenue, but we are selflessly lobbying on their behalf to ask you to implement this technically specific law to reign us in". Ignore them. You don't listen to the hitman when they comment on homicide laws. And ensure that the penalties amount to a ban. The US congress and courts can and do terminate human lives. Whatever penalty they propose on abstract legal entities is not too harsh; even if they completely dismantled Google and destroyed all of their economic value, it is nothing compared to the things we do to natural living breathing humans in response to criminal behavior. Profitable companies will submit to a law that aims to control their behavior.
      - JumpCrisscross 5y ago
        > law doesn't need to be technically detailed or envision every single technological adaptation: it just needs to be sufficient for a judge to be able to recognise it when a prosecutor describes it and a defence lawyer attempts to pull the wool over their eyes This is a terrible philosophy for legislating. It undermines the rule of law, i.e. that you should ex ante be able to determine if what you're doing is legal or not. What you're describing is rule making. Congress regularly does this, in passing a law that requires such and such agency propose (or even implement) rules that achieve this or that within so many days.
- blooalien 5y ago
  > "This is going away: all the major browsers have said they are going to block cross-site tracking." That's mighty pleasing news to hear. A step in the right direction for sure. Here's hoping it's the beginning of a trend.
- acituan 5y ago
  The thing with information is that once it is shared, it can't be unshared. Sure, blocking cross-site tracking would ostensibly make monopolistic accumulation of new data more difficult, but except for the most decay prone information, there is already a comprehensive profile established for a good chunk of the users, which can be milked for a good while. This is not even taking into account of backchannel acquisition of the missing data (i.e. through brokers) with the sweet sweet profits already made, potency of which is enhanced when joined with existing data (and therefore still creating monopolistic dynamics).
  - NicoJuicy 5y ago
    It can be made useless if you don't have a identifier.
- binarymax 5y ago
  The browsers intent may be to remove cross-site tracking, but we all know that Google Ads will still follow people around the web through latent signals (even if wrapped in something like FLOC), and other parties like KISSmetrics will continue the fingerprinting cat and mouse game.
  - jefftk 5y ago
    > Google Ads will still follow people around the web through latent signals I'm not sure what you mean by this? Google Ads has committed "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products." -- https://blog.google/products/ads-commerce/a-more-privacy-first-web/ https://blog.google/products/ads-commerce/a-more-privacy-fir... > even if wrapped in something like FLOC FLoC doesn't allow "a few actors [to] obtain competitive advantages by collecting data from across websites" since everyone sees the same number of identifying cohort bits. > other parties like KISSmetrics will continue the fingerprinting cat and mouse game Historically, the TOR browser was pretty much the only one that took fingerprinting prevention seriously, but it's now a substantial focus for Safari/Firefox/Chrome. I do think fingerprinting groups will continue to have things that work when third-party cookies go away, but I don't expect it to persist that long after? I also would not be surprised to see a regulation here, since I (not a lawyer) don't think fingerprinting is compatible with the GDPR or the other regulations it's inspiring around the world. (Still speaking only for myself)
    - Jonsvt 5y ago
      The point is the FLOC is surveillance as well. You are still profiling users. This has got to stop. https://vivaldi.com/blog/no-google-vivaldi-users-will-not-get-floced/ https://vivaldi.com/blog/no-google-vivaldi-users-will-not-ge...
      - jefftk 5y ago
        I agree FLoC is tracking (though not at the individual level). The question we've been discussing, however, is the effect on competition in particular: https://news.ycombinator.com/item?id=27763345 https://news.ycombinator.com/item?id=27763345
- _jal 5y ago
  Be careful not to confuse one cross-site tracking techniques with cross-site tracking. Ask about company behaviors that may be of interest, not specific mechanisms. You can always ask about the mechanisms later. "Will you use information about users from third-party sites when making decisions about how to interact with them?" "Will you use data about offline purchases made by users when deciding how to interact with those users?" Etc.
- dreyfan 5y ago
  Nobody needs cookies to track users cross-site. Cookies are just convenient.
  - jefftk 5y ago
    All the browsers have said that they consider general-purpose cross-site tracking to be deprecated, not just cookies. They are working on removing other forms of linking users across sites, including the browser cache, link decoration, and fingerprinting.
    - Jonsvt 5y ago
      And some of them, such as Google, are working on FLOC... This has got to stop now.
      - jefftk 5y ago
        Creating more private alternatives to cross-site ad tracking is a project that most of the major browsers are working on. In addition to Chrome, Edge has https://github.com/WICG/privacy-preserving-ads/blob/main/Parakeet.md https://github.com/WICG/privacy-preserving-ads/blob/main/Par... and Safari has https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/ https://webkit.org/blog/8943/privacy-preserving-ad-click-att...
        Jonsvt 5y ago
        These are not more private alternatives. This is just tracking using other methods. FLOC is tracking and it is in no way more private.
        jefftk 5y ago
        Setting aside whether FLoC is private enough, how can you say it is not more private? Today, with third party cookies, many companies have almost your entire browsing history through a combination of direct tracking and cookie matching. With FLoC this information stays on your device, and only a summary is made available to sites.
- deleted 5y ago
  [deleted]
alisonkisk 5y ago
The argument is bad for privacy, since the business solution to that problem is the same for other IP antitrust: mandating non-discriminatory licensing to anyone who wants access to the data.
- dalbasal 5y ago
  I can see where you're coming from, but I think common carrier type action is pretty unlikely here. Besides controversy, it's too technically hairy to legislate. There's also no reason. "Surveillance advertising" isn't a necessary service. The reason I like the angle of this letter is that it isn't stand-alone. It's providing another perspective to the pile. Data centric advertising is monopoly & centralisation prone. They're extracting a lot of value out of the digital economy and this chokes out a lot of potential economic activity. It doesn't negate or replace privacy, data security, general creepiness or other rationales. What they're literally calling for is a ban. How this affects politicians, if it does, is providing them an additional persona of affected groups. Businesses .
deleted 5y ago
[deleted]

jefftk 5y ago

> a few actors can obtain competitive advantages by collecting data from across websites... This is going away: all the major browsers have said they are going to block cross-site tracking. (Disclosure: I work on ads at Google, speaking only for myself)

BiteCode_dev 5y ago
Google analytics won't track cross site ?
- jefftk 5y ago
  Does Google Analytics even track cross-site today? Looking at it in developer tools I only see it using first-party cookies. But anyway, Google Analytics won't be able to do it because nobody will be able to do it. For example, here is Chrome's project to remove cross-site tracking: https://www.chromium.org/Home/chromium-privacy/privacy-sandbox https://www.chromium.org/Home/chromium-privacy/privacy-sandb... (Still speaking only for myself)
  - binarymax 5y ago
    I'm not sure if you're being intentionally obtuse or not. GA phones home with vast information about user, and builds a profile of them. That profile is correlated across sites to personalize search results and sell ads.
    - jefftk 5y ago
      I'm not being intentionally obtuse, but I also don't know all of Google's advertising business. I didn't think Google Analytics did that? What makes you think it does? (GA sends a message to Google, but I had thought that it was not linked to your behavior on other sites via GA?)
      - LegitShady 5y ago
        google analytics tells you the interest of your audience. how do you think it does this without correlating you to a profile they've built?
        lmkg 5y ago
        Googe Analytics consultant here (not Google employee). 1. Google Analytics' primary identity signal is a first-party cookie. this is not shared between domains. There is no technical way to link identity between domains with different cookie values. 1a. Google Analytics has built-in library functions to allow site owners to share first-party cookie values between a whitelisted set of domains. This effectively lets one company with multiple sites share a first-party identifier, but still not let anyone (Google or otherwise) link that identity to identities set on other sites. 1b. BUT. But. BUT. Google is rolling out "Google Signals" for Google Analytics, which will use your Google Account as the identity signal instead for users who are logged in to Chrome. This, obviously, lets your identity be correlated across sites. (Personally, I suspect that the availability of this feature played a part in Google's decision to let Chrome follow the industry towards blocking third-party cookies. But this is a baseless opinion, one step removed from a conspiracy theory.) 2. Google Analytics can link their identifier (the first-party cookie or Google Signals) to your DoubleClick profile via DoubleClick's third-party cookie. The checkbox that does this is unchecked by default. There are many other features of GA that encourage or require you to check this checkbox. 2a. Google's documentation (including legal contracts!) places limits in the data exchanged between the two profiles. Data exchanged does include demographic and interest information from DoubleClick's profile into GA. This is one of the big reasons why people click the checkbox. To my knowledge, GA data is not used to inform the DoubleClick profile. GA data can be used to build an "audience" in various Google ad platforms, and direct ads to those people specifically, or to use as the basis for a "look-alike audience." 3. Google is a Processor under GDPR for Google Analytics, and a Controller under GDPR for Google Ads. To a first approximation, this means they make the specific legal claim that they do not use GA data for their own purposes. Linking Analytics and Ads data is... complicated and frankly I still haven't gotten an explanation of its legal status that I fully understand. In my personal opinion, I don't think Google actually uses Google Analytics data. Most Analytics implementations are tire fires, and they can get all the data from other more reliable sources, like Publisher data or Chrome. Given that they have based on their entire GDPR compliance strategy for Analytics on being a Processor, I don't think the risk/reward is there. (apologies for lack of copy-editing, the thunder's about to take my internet away)
  - alisonkisk 5y ago
    Is Google going to give back the $100B is made from cross site tracking in the past? Is Google going to consider YouTube, Gmail, Maps, and Android Location history different sites, or is "having an effective monopoly an exemption to crosss-site tracking prohibition? Does anything in the proposal prevent server-side cross-site tracking? (No.) Is Google going to stop buying third party tracking data like credit card transactions?
neolog 5y ago
No it isn't, Google will still track me across the web.
- blooalien 5y ago
  So will Facebook (and several others) if you take no steps of your own to block them. It's an escalating war of cat and mouse. You'll block them, they'll find a new way around it, you'll block them some more, they'll find another way. Eventually the only answer will be to shut down the Internet because it's become just too broken to use anymore.
  - squiggleblaz 5y ago
    The simpler answer is to just ban it. The law doesn't need to be technically detailed or envision every single technological adaptation: it just needs to be sufficient for a judge to be able to recognise it when a prosecutor describes it and a defence lawyer attempts to pull the wool over their eyes. It needs to be focused on outcomes. Once banned, Google and Facebook will submit. They will attempt to lobby against the reforms, eventually saying "it will prevent legitimate business: it represents a small fraction of our revenue, but we are selflessly lobbying on their behalf to ask you to implement this technically specific law to reign us in". Ignore them. You don't listen to the hitman when they comment on homicide laws. And ensure that the penalties amount to a ban. The US congress and courts can and do terminate human lives. Whatever penalty they propose on abstract legal entities is not too harsh; even if they completely dismantled Google and destroyed all of their economic value, it is nothing compared to the things we do to natural living breathing humans in response to criminal behavior. Profitable companies will submit to a law that aims to control their behavior.
    - JumpCrisscross 5y ago
      > law doesn't need to be technically detailed or envision every single technological adaptation: it just needs to be sufficient for a judge to be able to recognise it when a prosecutor describes it and a defence lawyer attempts to pull the wool over their eyes This is a terrible philosophy for legislating. It undermines the rule of law, i.e. that you should ex ante be able to determine if what you're doing is legal or not. What you're describing is rule making. Congress regularly does this, in passing a law that requires such and such agency propose (or even implement) rules that achieve this or that within so many days.
blooalien 5y ago
> "This is going away: all the major browsers have said they are going to block cross-site tracking." That's mighty pleasing news to hear. A step in the right direction for sure. Here's hoping it's the beginning of a trend.
acituan 5y ago
The thing with information is that once it is shared, it can't be unshared. Sure, blocking cross-site tracking would ostensibly make monopolistic accumulation of new data more difficult, but except for the most decay prone information, there is already a comprehensive profile established for a good chunk of the users, which can be milked for a good while. This is not even taking into account of backchannel acquisition of the missing data (i.e. through brokers) with the sweet sweet profits already made, potency of which is enhanced when joined with existing data (and therefore still creating monopolistic dynamics).
- NicoJuicy 5y ago
  It can be made useless if you don't have a identifier.
binarymax 5y ago
The browsers intent may be to remove cross-site tracking, but we all know that Google Ads will still follow people around the web through latent signals (even if wrapped in something like FLOC), and other parties like KISSmetrics will continue the fingerprinting cat and mouse game.
- jefftk 5y ago
  > Google Ads will still follow people around the web through latent signals I'm not sure what you mean by this? Google Ads has committed "once third-party cookies are phased out, we will not build alternate identifiers to track individuals as they browse across the web, nor will we use them in our products." -- https://blog.google/products/ads-commerce/a-more-privacy-first-web/ https://blog.google/products/ads-commerce/a-more-privacy-fir... > even if wrapped in something like FLOC FLoC doesn't allow "a few actors [to] obtain competitive advantages by collecting data from across websites" since everyone sees the same number of identifying cohort bits. > other parties like KISSmetrics will continue the fingerprinting cat and mouse game Historically, the TOR browser was pretty much the only one that took fingerprinting prevention seriously, but it's now a substantial focus for Safari/Firefox/Chrome. I do think fingerprinting groups will continue to have things that work when third-party cookies go away, but I don't expect it to persist that long after? I also would not be surprised to see a regulation here, since I (not a lawyer) don't think fingerprinting is compatible with the GDPR or the other regulations it's inspiring around the world. (Still speaking only for myself)
  - Jonsvt 5y ago
    The point is the FLOC is surveillance as well. You are still profiling users. This has got to stop. https://vivaldi.com/blog/no-google-vivaldi-users-will-not-get-floced/ https://vivaldi.com/blog/no-google-vivaldi-users-will-not-ge...
    - jefftk 5y ago
      I agree FLoC is tracking (though not at the individual level). The question we've been discussing, however, is the effect on competition in particular: https://news.ycombinator.com/item?id=27763345 https://news.ycombinator.com/item?id=27763345
_jal 5y ago
Be careful not to confuse one cross-site tracking techniques with cross-site tracking. Ask about company behaviors that may be of interest, not specific mechanisms. You can always ask about the mechanisms later. "Will you use information about users from third-party sites when making decisions about how to interact with them?" "Will you use data about offline purchases made by users when deciding how to interact with those users?" Etc.
dreyfan 5y ago
Nobody needs cookies to track users cross-site. Cookies are just convenient.
- jefftk 5y ago
  All the browsers have said that they consider general-purpose cross-site tracking to be deprecated, not just cookies. They are working on removing other forms of linking users across sites, including the browser cache, link decoration, and fingerprinting.
  - Jonsvt 5y ago
    And some of them, such as Google, are working on FLOC... This has got to stop now.
    - jefftk 5y ago
      Creating more private alternatives to cross-site ad tracking is a project that most of the major browsers are working on. In addition to Chrome, Edge has https://github.com/WICG/privacy-preserving-ads/blob/main/Parakeet.md https://github.com/WICG/privacy-preserving-ads/blob/main/Par... and Safari has https://webkit.org/blog/8943/privacy-preserving-ad-click-attribution-for-the-web/ https://webkit.org/blog/8943/privacy-preserving-ad-click-att...
      - Jonsvt 5y ago
        These are not more private alternatives. This is just tracking using other methods. FLOC is tracking and it is in no way more private.
        jefftk 5y ago
        Setting aside whether FLoC is private enough, how can you say it is not more private? Today, with third party cookies, many companies have almost your entire browsing history through a combination of direct tracking and cookie matching. With FLoC this information stays on your device, and only a summary is made available to sites.
deleted 5y ago
[deleted]

alisonkisk 5y ago

The argument is bad for privacy, since the business solution to that problem is the same for other IP antitrust: mandating non-discriminatory licensing to anyone who wants access to the data.

dalbasal 5y ago
I can see where you're coming from, but I think common carrier type action is pretty unlikely here. Besides controversy, it's too technically hairy to legislate. There's also no reason. "Surveillance advertising" isn't a necessary service. The reason I like the angle of this letter is that it isn't stand-alone. It's providing another perspective to the pile. Data centric advertising is monopoly & centralisation prone. They're extracting a lot of value out of the digital economy and this chokes out a lot of potential economic activity. It doesn't negate or replace privacy, data security, general creepiness or other rationales. What they're literally calling for is a ban. How this affects politicians, if it does, is providing them an additional persona of affected groups. Businesses .

deleted 5y ago

[deleted]