4 ms·

> EU data protection authorities find that the consent popups that plagued Europeans for years are illegal. All data collected through them must be deleted. Thi

> EU data protection authorities find that the consent popups that plagued Europeans for years are illegal. All data collected through them must be deleted. This decision impacts Google’s, Amazon’s and Microsoft’s online advertising businesses. How much data is being collected through these pop-ups?

samsari 5y ago
All the data they were collecting before that GDPR said they had to stop collecting (without freely given consent).
- endisneigh 5y ago
  How much data is that? How do we know? It's not clear to me how the ICCL will know that "all data collected" is deleted. Even if the IAB is sanctioned or you storm their datacenters, the ICCL said that the tracking industry collected data through the IAB. How is the ICCL going to ensure that the tracking industry deletes the collected data?
  - inetknght 5y ago
    It doesn't really matter "how much" data. What matters is the type of data and whether or not it's strictly necessary to deliver the content.
  - Jensson 5y ago
    They will ask the companies to delete the data and take action if there is evidence they didn't, just like how all of GDPR is enforced.
    - endisneigh 5y ago
      How would they know if they did or didn't, though?
      - Jensson 5y ago
        They don't know. But if evidence comes up showing a company didn't then they will take legal action against that company, in which case intent to break the law from the would be crystal clear so they would get maximum fines which are huge for GDPR. It isn't like laws prevents all crimes, the goal is to reduce illegit data usage, there is nobody who thinks it can ever get completely stamped out.
        endisneigh 5y ago
        I'm asking what kind of evidence can exist that proves a negative? Without knowing what was collected how can they prove it was deleted? Doesn't make any sense.
        deleted 5y ago
        [deleted]
        Jensson 5y ago
        > Without knowing what was collected how can they prove it was deleted? They don't need to know what data was collected. GDPR requires you to track all data and mark where you got it from, so the companies are legally required to track this for you, they should already have a switch where they can delete this data at the notice of the user, so they should have no problems honouring such a request from the government. The government don't know if the data was deleted, but a user will know if a company has data the user didn't agree to give to the company, in which case that company is violating GDPR regardless how they got that data. That wont always come up, but if it does the government will go after those companies.
        endisneigh 5y ago
        What you're saying is literally illogical in the case of IAB acting as an intermediary... Not sure you know what you're talking about in this case. The entire point of the original article is that the user's data is being fed through via IAB to tracking companies. This isn't a normal GDPR situation where the user's data directly is being stored in a way that's accessible to the user as well. Obviously in that scenario the user themselves could just request their data be deleted as that's what GDPR allows. IAB in this case has been acting as an intermediary, allowing tracking companies to collect metadata on users through them. Even if IAB deletes their data, the question is how will the Council know if the end-tracking companies deleted their data?
marketingtech 5y ago
The data being collected is a random identifier and a consent opt-in for tracking/cookies. These businesses use this framework as their source-of-truth declaring whether an internet user consented to cookies or tracking, and their ad systems behave according to the user's preferences. So now they're being asked to delete their records of who opted in or out, because that data was illegitimately acquired. [edit] This could also have implications regarding data collected through other systems based on the assumption that an opt-in was valid.

samsari 5y ago

All the data they were collecting before that GDPR said they had to stop collecting (without freely given consent).

endisneigh 5y ago
How much data is that? How do we know? It's not clear to me how the ICCL will know that "all data collected" is deleted. Even if the IAB is sanctioned or you storm their datacenters, the ICCL said that the tracking industry collected data through the IAB. How is the ICCL going to ensure that the tracking industry deletes the collected data?
- inetknght 5y ago
  It doesn't really matter "how much" data. What matters is the type of data and whether or not it's strictly necessary to deliver the content.
- Jensson 5y ago
  They will ask the companies to delete the data and take action if there is evidence they didn't, just like how all of GDPR is enforced.
  - endisneigh 5y ago
    How would they know if they did or didn't, though?
    - Jensson 5y ago
      They don't know. But if evidence comes up showing a company didn't then they will take legal action against that company, in which case intent to break the law from the would be crystal clear so they would get maximum fines which are huge for GDPR. It isn't like laws prevents all crimes, the goal is to reduce illegit data usage, there is nobody who thinks it can ever get completely stamped out.
      - endisneigh 5y ago
        I'm asking what kind of evidence can exist that proves a negative? Without knowing what was collected how can they prove it was deleted? Doesn't make any sense.
        deleted 5y ago
        [deleted]
        Jensson 5y ago
        > Without knowing what was collected how can they prove it was deleted? They don't need to know what data was collected. GDPR requires you to track all data and mark where you got it from, so the companies are legally required to track this for you, they should already have a switch where they can delete this data at the notice of the user, so they should have no problems honouring such a request from the government. The government don't know if the data was deleted, but a user will know if a company has data the user didn't agree to give to the company, in which case that company is violating GDPR regardless how they got that data. That wont always come up, but if it does the government will go after those companies.
        endisneigh 5y ago
        What you're saying is literally illogical in the case of IAB acting as an intermediary... Not sure you know what you're talking about in this case. The entire point of the original article is that the user's data is being fed through via IAB to tracking companies. This isn't a normal GDPR situation where the user's data directly is being stored in a way that's accessible to the user as well. Obviously in that scenario the user themselves could just request their data be deleted as that's what GDPR allows. IAB in this case has been acting as an intermediary, allowing tracking companies to collect metadata on users through them. Even if IAB deletes their data, the question is how will the Council know if the end-tracking companies deleted their data?

marketingtech 5y ago

The data being collected is a random identifier and a consent opt-in for tracking/cookies. These businesses use this framework as their source-of-truth declaring whether an internet user consented to cookies or tracking, and their ad systems behave according to the user's preferences. So now they're being asked to delete their records of who opted in or out, because that data was illegitimately acquired. [edit] This could also have implications regarding data collected through other systems based on the assumption that an opt-in was valid.