9 ms·

Google, Amazon, and the entire tracking industry relies on IAB Europe’s consent system, which has now been found to be illegal following complaints coordinated

by bajtos 5y ago

Google, Amazon, and the entire tracking industry relies on IAB Europe’s consent system, which has now been found to be illegal following complaints coordinated by ICCL. EU data protection authorities find that the consent popups that plagued Europeans for years are illegal. All data collected through them must be deleted. This decision impacts Google’s, Amazon’s and Microsoft’s online advertising businesses.

gilrain 5y ago
I wish my government looked out for me like this.
- optimalsolver 5y ago
  Then vote for it! Just kidding.
  - jb1991 5y ago
    Why kidding?
    - wayoutthere 5y ago
      Because voting doesn’t matter when your choices are corporate stooge A and corporate stooge B.
      - gidorah 5y ago
        I always think of South Park. It's always a choice between a giant douche or a turd sandwich.
        wayoutthere 5y ago
        More like if it was a choice between two, shitty giant douches and one was painted orange and the other was painted with a rainbow. They’re both the same thing with a different color paint.
    - tux3 5y ago
      Say you live in a two-party first past the post system. If what you want to express is "I like privacy regulations", the single bit of information that your vote conveys does a very limited job of communicating what issues you actually care about. The signal in traditional voting is very diluted. You vote on a person that you think supports some of the things you care about. You are not allowed to weight in on individual issues in a way that matters. The person works for several years, and the only feedback you have on that process, the only tether that holds that person accountable, is whether you vote for them the second time.
      - rjmunro 5y ago
        How many EU countries run a "two-party first past the post system" nowadays? If you are in a first past the post system, and in a safe seat, vote for one of the no-chance-of-winning candidates who best represents your views. Although they won't win, the fact that they are getting votes will be noticed and the main 2 parties will respond by adopting some of their policies. E.g. in the UK as more people vote for the Green party, other parties will become more Green to get those votes back, even though the Green party has only ever got a single MP.
        Macha 5y ago
        Even in a decent PR multi-party system. Our green party for example is environment first, left wing economics second, public transit, pro-agriculture, anti-nuclear, somewhere down the list is internet privacy. Or maybe I could vote for the labour party, which are centre left economics, pro-EU, pro-housing expansion, pro-healthcare investment, pro-environment, somewhere down the list is internet privacy The idea that there's a party that (a) both has the same views on all issues as you do, (b) has sufficient votes to get seats and (c) orders issues in the same importance you do, for everyone, is clearly not valid. More parties = more choices, and this is often better, but ultimately we'd end up with de facto direct democracy to have a party with the exact views for every person. Similarly, even for myself, I consider internet privacy important. Maybe I should vote the for the pirate party then? Except I consider the environment more important and our pirate party is so small that it hasn't even considered a position on non-privacy related issues, never mind have an adequate plan for how we're going to make a transition from a heavily fossil fuel based power supply. Even on that environmental issue, I think the green party's anti-nuclear stance has historically been a mistake, but if the others are just going to build more gas plants, I'll deal with it.
    - denton-scratch 5y ago
      Because calling for a riot is likely sedition? (Depending on jurisdiction)
  - gilrain 5y ago
    I do, as near as I can anyway. My government has been captured by the capital class and will be difficult to recover.
  - marcus_holmes 5y ago
    Then riot for it! Maybe kidding? Seems the only way to get a single-issue topic on the agenda these days.
- Scarblac 5y ago
  The scary thing is that it's the EU doing this. Our national elected governments are not interested in actually fixing things like this because it doesn't immediately win votes, and there is only a limited number of national civil servants so nobody is working on this kind of thing on a national scale. But put those civil servants in a committee in Brussels with not as much short term pressure, and they can work out regulations that achieve the right thing.
  - ArnoVW 5y ago
    There's a bit of that. But I think a big part of the reason is that national governments can not address international issues. The EU represents 300M people, and has the economic and political weight to make a dent. The same goes for other international issues, such as climate change, corporate tax evasion, cyber crime, etc.
    - oblio 5y ago
      445 million people.
  - arlort 5y ago
    This is not really accurate. The enforcement of GDPR is still up to national civil services/judiciaries, in this case it was a cooperation of multiple national protection authorities. Even the legislation itself necessarily involved national governments and national civil servants in national ministries GDPR being an EU level legislation has more to do with the absolute nightmare it would be for the internal market to have 27 different standards and the drastically lower leverage available for enforcement than disinterest in the subject
    - pseingatl 5y ago
      There's this: • Austria: Datenschutz-Grundverordnung (DSGVO) • Belgium: algemene verordening gegevensbescherming / règlement général sur la protection des données (RGPD) • Bulgaria: Общ регламент относно защитата на данните • Croatia: Opća uredba o zaštiti podataka • Cyprus: Γενικός Κανονισμός για την Προστασία Δεδομένων • Czech Republic: obecné nařízení o ochraně osobních údajů • Denmark: generel forordning om databeskyttelse • Estonia: isikuandmete kaitse üldmäärus • Finland: yleinen tietosuoja-asetus • France: règlement général sur la protection des données (RGPD) • Germany: Datenschutz-Grundverordnung (DSGVO) • Greece: Γενικός Κανονισμός για την Προστασία Δεδομένων • Hungary: általános adatvédelmi rendelet • Ireland: An Rialachán Ginearálta maidir le Cosaint Sonraí / General Data Protection Regulation (GDPR) • Italy: regolamento generale sulla protezione dei dati (RGPD) • Latvia: Vispārīgā datu aizsardzības regula • Lithuania: Bendrasis duomenų apsaugos reglamentas (BDAR) • Luxembourg: règlement général sur la protection des données (RGPD) / Datenschutz-Grundverordnung (DSGVO) • Malta: Regolament Ġenerali dwar il-Protezzjoni tad-Data • The Netherlands: algemene verordening gegevensbescherming • Poland: ogólne rozporządzenie o ochronie danych • Portugal: Regulamento Geral sobre a Proteção de Dados (RGPD) • Romania: Regulamentul general privind protecția datelor • Slovakia: všeobecné nariadenie o ochrane údajov • Slovenia: Splošna uredba o varstvu podatkov • Spain: Reglamento general de protección de datos (RGPD) • Sweden: Dataskyddsförordning • The United Kingdom: General Data Protection Regulation (GDPR)
- deleted 5y ago
  [deleted]
riddleronroof 5y ago
Ok but I don’t get how this consent system ran for years? How can one get pre approved? The issue here isn’t that they collected data (it’s own problems), but they they didn’t use the right language! Does this mean it will be a long term of conditions like apple does every time we use a website? ICCL might have made internet worse with this. Not better.
- foepys 5y ago
  To this day Twitter is not even trying to comply with GDPR. They have a banner "we track you, deal with it" and that's it. So far nothing happened. I hope that they get fined billions for keeping it illegal for so long but I doubt it.
- Macha 5y ago
  The DPAs are not in the business of pre-approving, much like your local court won't pre-approve your pre-nup and so you might have to fight over it in court in an acrimonious divorce. You can of course retain outside help to advise you but there's no guarantee that they are right and many of the consultancies and providers were incentivized to compete on maximum opt ins. Maybe the CMPs and the adtech companies can fight it out in court over whether the CMPs misled the adtech companies or they just gave the adtech companies options which the adtech companies misused. The ruling is not just "fix your language", though that's what the industry will be incentivized to try, again. They all bandwagoned on hiding secondary opt out checkboxes under "legitimate interest" and this wrist slap tells them it's not ok: > Fails to properly request consent, and relies on a lawful basis (legitimate interest) that is not permissible because of the severe risk posed by the online advertising tracking (Article 5(1)a, and Article 6 GDPR) > Fails to respect the requirement for “data protection by design” (Article 25 GDPR) The route to complying is clear. Don't track without opt in. Know where the user data is going, not just "whichever vendor happens to be in the winning ad". Don't use dark patterns to encourage the opt in. It's the industry's attempts to bury its head in the sand because it hurts their bottom line and their search for increasingly convoluted workarounds that is making this complicated.
- wongarsu 5y ago
  > Does this mean it will be a long term of conditions like apple does every time we use a website We call that a privacy agreement. But having a proper privacy agreement that lists what data is collected and what happens with it is far from the only part of the ruling

by bajtos 5y ago

gilrain 5y ago

I wish my government looked out for me like this.

optimalsolver 5y ago
Then vote for it! Just kidding.
- jb1991 5y ago
  Why kidding?
  - wayoutthere 5y ago
    Because voting doesn’t matter when your choices are corporate stooge A and corporate stooge B.
    - gidorah 5y ago
      I always think of South Park. It's always a choice between a giant douche or a turd sandwich.
      - wayoutthere 5y ago
        More like if it was a choice between two, shitty giant douches and one was painted orange and the other was painted with a rainbow. They’re both the same thing with a different color paint.
  - tux3 5y ago
    Say you live in a two-party first past the post system. If what you want to express is "I like privacy regulations", the single bit of information that your vote conveys does a very limited job of communicating what issues you actually care about. The signal in traditional voting is very diluted. You vote on a person that you think supports some of the things you care about. You are not allowed to weight in on individual issues in a way that matters. The person works for several years, and the only feedback you have on that process, the only tether that holds that person accountable, is whether you vote for them the second time.
    - rjmunro 5y ago
      How many EU countries run a "two-party first past the post system" nowadays? If you are in a first past the post system, and in a safe seat, vote for one of the no-chance-of-winning candidates who best represents your views. Although they won't win, the fact that they are getting votes will be noticed and the main 2 parties will respond by adopting some of their policies. E.g. in the UK as more people vote for the Green party, other parties will become more Green to get those votes back, even though the Green party has only ever got a single MP.
      - Macha 5y ago
        Even in a decent PR multi-party system. Our green party for example is environment first, left wing economics second, public transit, pro-agriculture, anti-nuclear, somewhere down the list is internet privacy. Or maybe I could vote for the labour party, which are centre left economics, pro-EU, pro-housing expansion, pro-healthcare investment, pro-environment, somewhere down the list is internet privacy The idea that there's a party that (a) both has the same views on all issues as you do, (b) has sufficient votes to get seats and (c) orders issues in the same importance you do, for everyone, is clearly not valid. More parties = more choices, and this is often better, but ultimately we'd end up with de facto direct democracy to have a party with the exact views for every person. Similarly, even for myself, I consider internet privacy important. Maybe I should vote the for the pirate party then? Except I consider the environment more important and our pirate party is so small that it hasn't even considered a position on non-privacy related issues, never mind have an adequate plan for how we're going to make a transition from a heavily fossil fuel based power supply. Even on that environmental issue, I think the green party's anti-nuclear stance has historically been a mistake, but if the others are just going to build more gas plants, I'll deal with it.
  - denton-scratch 5y ago
    Because calling for a riot is likely sedition? (Depending on jurisdiction)
- gilrain 5y ago
  I do, as near as I can anyway. My government has been captured by the capital class and will be difficult to recover.
- marcus_holmes 5y ago
  Then riot for it! Maybe kidding? Seems the only way to get a single-issue topic on the agenda these days.
Scarblac 5y ago
The scary thing is that it's the EU doing this. Our national elected governments are not interested in actually fixing things like this because it doesn't immediately win votes, and there is only a limited number of national civil servants so nobody is working on this kind of thing on a national scale. But put those civil servants in a committee in Brussels with not as much short term pressure, and they can work out regulations that achieve the right thing.
- ArnoVW 5y ago
  There's a bit of that. But I think a big part of the reason is that national governments can not address international issues. The EU represents 300M people, and has the economic and political weight to make a dent. The same goes for other international issues, such as climate change, corporate tax evasion, cyber crime, etc.
  - oblio 5y ago
    445 million people.
- arlort 5y ago
  This is not really accurate. The enforcement of GDPR is still up to national civil services/judiciaries, in this case it was a cooperation of multiple national protection authorities. Even the legislation itself necessarily involved national governments and national civil servants in national ministries GDPR being an EU level legislation has more to do with the absolute nightmare it would be for the internal market to have 27 different standards and the drastically lower leverage available for enforcement than disinterest in the subject
  - pseingatl 5y ago
    There's this: • Austria: Datenschutz-Grundverordnung (DSGVO) • Belgium: algemene verordening gegevensbescherming / règlement général sur la protection des données (RGPD) • Bulgaria: Общ регламент относно защитата на данните • Croatia: Opća uredba o zaštiti podataka • Cyprus: Γενικός Κανονισμός για την Προστασία Δεδομένων • Czech Republic: obecné nařízení o ochraně osobních údajů • Denmark: generel forordning om databeskyttelse • Estonia: isikuandmete kaitse üldmäärus • Finland: yleinen tietosuoja-asetus • France: règlement général sur la protection des données (RGPD) • Germany: Datenschutz-Grundverordnung (DSGVO) • Greece: Γενικός Κανονισμός για την Προστασία Δεδομένων • Hungary: általános adatvédelmi rendelet • Ireland: An Rialachán Ginearálta maidir le Cosaint Sonraí / General Data Protection Regulation (GDPR) • Italy: regolamento generale sulla protezione dei dati (RGPD) • Latvia: Vispārīgā datu aizsardzības regula • Lithuania: Bendrasis duomenų apsaugos reglamentas (BDAR) • Luxembourg: règlement général sur la protection des données (RGPD) / Datenschutz-Grundverordnung (DSGVO) • Malta: Regolament Ġenerali dwar il-Protezzjoni tad-Data • The Netherlands: algemene verordening gegevensbescherming • Poland: ogólne rozporządzenie o ochronie danych • Portugal: Regulamento Geral sobre a Proteção de Dados (RGPD) • Romania: Regulamentul general privind protecția datelor • Slovakia: všeobecné nariadenie o ochrane údajov • Slovenia: Splošna uredba o varstvu podatkov • Spain: Reglamento general de protección de datos (RGPD) • Sweden: Dataskyddsförordning • The United Kingdom: General Data Protection Regulation (GDPR)
deleted 5y ago
[deleted]

riddleronroof 5y ago

Ok but I don’t get how this consent system ran for years? How can one get pre approved? The issue here isn’t that they collected data (it’s own problems), but they they didn’t use the right language! Does this mean it will be a long term of conditions like apple does every time we use a website? ICCL might have made internet worse with this. Not better.

foepys 5y ago
To this day Twitter is not even trying to comply with GDPR. They have a banner "we track you, deal with it" and that's it. So far nothing happened. I hope that they get fined billions for keeping it illegal for so long but I doubt it.
Macha 5y ago
The DPAs are not in the business of pre-approving, much like your local court won't pre-approve your pre-nup and so you might have to fight over it in court in an acrimonious divorce. You can of course retain outside help to advise you but there's no guarantee that they are right and many of the consultancies and providers were incentivized to compete on maximum opt ins. Maybe the CMPs and the adtech companies can fight it out in court over whether the CMPs misled the adtech companies or they just gave the adtech companies options which the adtech companies misused. The ruling is not just "fix your language", though that's what the industry will be incentivized to try, again. They all bandwagoned on hiding secondary opt out checkboxes under "legitimate interest" and this wrist slap tells them it's not ok: > Fails to properly request consent, and relies on a lawful basis (legitimate interest) that is not permissible because of the severe risk posed by the online advertising tracking (Article 5(1)a, and Article 6 GDPR) > Fails to respect the requirement for “data protection by design” (Article 25 GDPR) The route to complying is clear. Don't track without opt in. Know where the user data is going, not just "whichever vendor happens to be in the winning ad". Don't use dark patterns to encourage the opt in. It's the industry's attempts to bury its head in the sand because it hurts their bottom line and their search for increasingly convoluted workarounds that is making this complicated.
wongarsu 5y ago
> Does this mean it will be a long term of conditions like apple does every time we use a website We call that a privacy agreement. But having a proper privacy agreement that lists what data is collected and what happens with it is far from the only part of the ruling