4 ms·

Out of curiosity, I decided to check your website with adblocker turned off. After rejecting (!) GDPR consent, the website decided to send my personal informati

Out of curiosity, I decided to check your website with adblocker turned off. After rejecting (!) GDPR consent, the website decided to send my personal information to the following companies: Google, Facebook, Amazon, Ad Lightning, Setupad, UniConsent, Adagio, ID5, Criteo, Magnite, RTB House, Casale Media, EMX Digital, Adform, Pubmatic, Between Digital, Lijit Networks, AppNexus, 33Across, Adx Premium, Sharethrough, Smart Adserver, OpenX, BRealTime, bumlam.com (couldn't find information about owner of this domain), BidSwitch, Getintent, Yahoo, and more - at some point I gave up trying to figure out who owns given domain names. The privacy policy which is quite hidden on the website (https://www.photopea.com/privacy.html https://www.photopea.com/privacy.html) says nothing about that. All it says is the following: > We use third party tracking tools to improve the performance and features of the Service (e.g. Google Analytics). Such tools are created and managed by parties outside our control. As such, we are not responsible for what information is actually captured by such third parties or how such third parties use and protect that information. This won't fly under GDPR, just saying. Not only you are responsible for third party behavior, but you didn't even mention all tracking scripts that are directly used (I see Facebook Pixel Code right in the source code for photopea.com). You are in Czech Republic, right? I think it is in European Union.

DitheringIdiot 5y ago
I just checked the same thing. I didn’t get a consent banner at all, not sure why. I’d just like to add that a decent chunk of the traffic to this site is from people typing “free photo editor” or things along those lines. The creator of this site is specifically targeting people who want a free photo editor… And then complaining about people wanting to use it for free.
- GlitchMr 5y ago
  Are you in European Union? I imagine the consent banner may skipped when not in European Union.
  - DitheringIdiot 5y ago
    I’m in the UK. So not anymore. But we still apply GDPR rules as far as I’m aware
    - g_p 5y ago
      GDPR still applies in the UK via their "equivalent" UK GDPR, as does the PECR (which is their implementation of the ePrivacy Directive, which covers cookies). UK cookie law is pretty strict, and also pretty clear to read - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... The issue is nobody bothers to follow it, and enforcement isn't likely enough, or crippling enough, to drive compliance.
IvanK_net 5y ago
And what exactly is "your personal information", that has been sent to so many websites?
- detaro 5y ago
  That is what you should document on your privacy page, exactly.
  - IvanK_net 5y ago
    If you know how the web works, you must know, that websites do not have access to your device. You do not tell Photopea your name or your address. The only thing a website can know, is, that "someone with a screen resolution of 1920x1080 pixels visited www.Photopea.com at 18:37". It can be useful to know the number of visitors, or the usual screen resolutions.
    - detaro 5y ago
      > Google, Facebook, Amazon, Ad Lightning, Setupad, UniConsent, Adagio, ID5, Criteo, Magnite, RTB House, Casale Media, EMX Digital, Adform, Pubmatic, Between Digital, Lijit Networks, AppNexus, 33Across, Adx Premium, Sharethrough, Smart Adserver, OpenX, BRealTime, bumlam.com (couldn't find information about owner of this domain), BidSwitch, Getintent, Which one of those do you need to know usual screen resolutions of users? Or maybe there are some other reasons those all get contacted? (You also missed some "minor" details like IP addresses and fingerprinting profiles overall, and I'm honestly not sure if you are as ignorant as you act or just pretend to do so, and which one would be more offensive)
      - IvanK_net 5y ago
        I do not know a lot about the ad mechanism, which my partners use. But it usually works by contacting several servers and asking them "hey, there is someone visiting www.Photopea.com, probably from Canada, with a screen resolution of 1920x1080 pixels, how much would you pay for showing them your ad?" ... there is an auction, and the ad from the highest bidder is shown to you. The more servers take part in the auction, the more money I can make. Like really, if you open a website for the first time in your life, what kind of secret information could it know about you?

DitheringIdiot 5y ago

I just checked the same thing. I didn’t get a consent banner at all, not sure why. I’d just like to add that a decent chunk of the traffic to this site is from people typing “free photo editor” or things along those lines. The creator of this site is specifically targeting people who want a free photo editor… And then complaining about people wanting to use it for free.

GlitchMr 5y ago
Are you in European Union? I imagine the consent banner may skipped when not in European Union.
- DitheringIdiot 5y ago
  I’m in the UK. So not anymore. But we still apply GDPR rules as far as I’m aware
  - g_p 5y ago
    GDPR still applies in the UK via their "equivalent" UK GDPR, as does the PECR (which is their implementation of the ePrivacy Directive, which covers cookies). UK cookie law is pretty strict, and also pretty clear to read - https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/what-are-the-rules-on-cookies-and-similar-technologies/ https://ico.org.uk/for-organisations/guide-to-pecr/guidance-... The issue is nobody bothers to follow it, and enforcement isn't likely enough, or crippling enough, to drive compliance.

IvanK_net 5y ago

And what exactly is "your personal information", that has been sent to so many websites?

detaro 5y ago
That is what you should document on your privacy page, exactly.
- IvanK_net 5y ago
  If you know how the web works, you must know, that websites do not have access to your device. You do not tell Photopea your name or your address. The only thing a website can know, is, that "someone with a screen resolution of 1920x1080 pixels visited www.Photopea.com at 18:37". It can be useful to know the number of visitors, or the usual screen resolutions.
  - detaro 5y ago
    > Google, Facebook, Amazon, Ad Lightning, Setupad, UniConsent, Adagio, ID5, Criteo, Magnite, RTB House, Casale Media, EMX Digital, Adform, Pubmatic, Between Digital, Lijit Networks, AppNexus, 33Across, Adx Premium, Sharethrough, Smart Adserver, OpenX, BRealTime, bumlam.com (couldn't find information about owner of this domain), BidSwitch, Getintent, Which one of those do you need to know usual screen resolutions of users? Or maybe there are some other reasons those all get contacted? (You also missed some "minor" details like IP addresses and fingerprinting profiles overall, and I'm honestly not sure if you are as ignorant as you act or just pretend to do so, and which one would be more offensive)
    - IvanK_net 5y ago
      I do not know a lot about the ad mechanism, which my partners use. But it usually works by contacting several servers and asking them "hey, there is someone visiting www.Photopea.com, probably from Canada, with a screen resolution of 1920x1080 pixels, how much would you pay for showing them your ad?" ... there is an auction, and the ad from the highest bidder is shown to you. The more servers take part in the auction, the more money I can make. Like really, if you open a website for the first time in your life, what kind of secret information could it know about you?