6 ms·

Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third p

Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). It's disingenuous to have problems with websites collecting entirely anonymous browsing data -- that goes beyond any arguments for privacy and just steers into "yelling at clouds" territory.

simion314 5y ago
>Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). How, you don't enter your name when you pay with cash. Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party unless they make you sign a paper first. Edit:typos
- germanier 5y ago
  On the other hand, it's perfectly legal (and usual practice) to contract out the operation of people counting devices that just tally up how many persons go through a door. (By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)
  - simion314 5y ago
    >By the way, a gym can and usually does share contract data with numerous third-parties such as external bookkeepers. This is perfectly legal under the GDPR) Why is it legal, does the gym need those 100 contractors to know my data for it to work? What are those for 100 different accountants? How did gyms or other businesses worked before the internet, did a guy walked to 100 different locations with papers in hand so those "partners" take a quick look?
    - germanier 5y ago
      Yes, before there was electronic bookkeeping businesses hauled stacks of paper to their accountant. This is standard business practice since literally centuries. If they want to send you a letter, they have to give your data to the postal service. Again, no consent needed. This is legal because our whole economy is based on devision of labor. Privacy laws account for that.
      - simion314 5y ago
        Maybe you are referring to required data. I can buy some bread and the store does not need my ID for accounting purposes, so not sure what exceptional stores or gym need to send a copy of my ID and my activities to their accountant. My problem is with the 100+ partners that are OBVIOUSLy not partners and not required to have my data.
        germanier 5y ago
        Ok, now what's the difference between sharing "1 bread sold" (with no identifying information about the customer) with a third-party and "1 page visited" (with no identifying information about the visitor) with a third-party?
        hutzlibu 5y ago
        The fundamental issue here is probably sharing with a different nation. If google would be german, they would have no problems with it.
        tremon 5y ago
        "1 page visited" (with no identifying information about the visitor) with a third-party? False equivalence, no online stalking company actually works like that (that would require a server-side hook). They all make the visitor go to the third party's desk and increase the tally themselves (via http request), giving the tracker company access to all the contact details of the visitor.
    - 5y ago
- umvi 5y ago
  > How, you don't enter your name when you pay with cache. You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint". "Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash"
  - simion314 5y ago
    >"Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash" And the store person will then what? Open excel wnd write "a dude with glasses was ehre at 12:51"? and then send the file to 100+ partners? >You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint". So the physical stores have some shady dudes attempting to lift fingerprints from money then some statistics guy try to put probabilities on which fingerprint matches which anonymous guy? here in my country you still pay with cash and the store people put it in a machine combine it with money from other people, it will be a lot of work and risk for some shitty nano reward. Edit typo
    - hutzlibu 5y ago
      Sorry to nitpick, but since you wrote it 2 times wrong: it is cash, not cache.
      - simion314 5y ago
        No problem, thanks
  - elevader 5y ago
    And the GDPR forbids them from writing that information (e.g. "the privacy nut bought apple juice") down or passing it to a third party without your explicit consent.
hdjjhhvvhga 5y ago
> shopping habits I think you are wrong. What they receive is a set of purchases in a given period of time that allow them to make many important decisions (when people buy most, what purchases are more likely on a given date etc.) but there is no way of finding out my shopping habits.
- abakker 5y ago
  no - the analysis is done on receipts, not just total products sold. They don't care what you bought, they care to know that people who buy diapers also buy wipes, and people who buy soy milk don't buy butter, etc. The analysis of anonymous receipts still yields very interesting and actionable results in aggregate. Your privacy has nothing to do with how a company analyzes its sales data as long as they don't include your identity and drill down into analyzing your receipt alone.
  - hdjjhhvvhga 5y ago
    Yes, I understand that they see patterns and trends and a lot of valuable data: my point is that they have no way of tracking shopping habits of any individual purchaser unless they trick them into some loyalty program, coupons etc.
    - abakker 5y ago
      I think we agree. If the average search advertiser gave me the same benefits that some loyalty programs do, I'd feel a lot better about them. I.e. if I got points for the data I provided in my browsing habits that translated into actual dollars, I'd be game to let them have it. If I wanted to "not swipe my loyalty card for this purchase" to leave it out of my history, I'd appreciate the granular control. The issue with all the tracking is that most consumers have no choice, no functional UI to interact with the tracking systems, and no clear idea of who they are ultimately transacting with.
    - afiori 5y ago
      As a nitpick: "unless they trick enough customers in a loyalty program or something". With enough good data (so probably not in all sectors) you can also identify people out of the system. There are not that many bits of entropy in (contextualized) human behavior.
elevader 5y ago
GDPR also applies to the real world. That store is definitely not allowed to share data about your shopping habits with some third party without your explicit consent. For example government departments in Germany have to aks for your explicit permission beforehand if they need to request/share data with a different department.
- germanier 5y ago
  This is in general not true and German government departments share data with different departments all the time without explicit consent of the affected citizen. This is also not a good example as there are additional legal restrictions for government departments which businesses don't need to obey.
  - ben_w 5y ago
    GDPR is a standardisation of pre-existing national rules within the EU member states, at the time including the UK’s Data Protection Act. When I was at university, one of the examples of the scope of the Data Protection Act was a barbershop which kept hand-written (no computer involved) records of customers, and one customer used the DPA to demand to see their records and then to have those records destroyed.
  - usr1106 5y ago
    If the sharing is not required by any law they have to ask. Sometimes they do. I'm sure there are cases where they share without either of the precondition met.
    - germanier 5y ago
      There are cases in which sharing without asking is legal without it being required by law.
- CWuestefeld 5y ago
  Is your claim that they can't share a customer's address with a shipping customer, and thus must actually perform all shipping themselves?
iicc 5y ago
>your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). GDPR requires data sharing to be done for a defined purpose. The purpose of sharing data with an external company bookkeeper for bookkeeping is not remotely connected to any purpose an analytics service fulfills. So while the shared data is capable of the same insights, it's explicitly illegal for it to be processed that way without a defined purpose (which is it's own can of worms). >entirely anonymous browsing data It's never entirely anonymous, because how useful data is, is inversely related to how anonymous it is. ergo it would only be truly anonymous if it was truly useless.
- germanier 5y ago
  It's still legal to ask your bookkeeper to go through the books and give you a list of your 10 best selling products broken down by season (given you have all the right paperwork in place with them etc. but no consent of the customers needed).
  - kyboren 5y ago
    Well, it's not necessary to process any personal data in order to calculate that. Can you ask your bookkeeper to tell you the top 3 best selling products for your top 5 customers without declaring that the purpose of the data transfer to the external bookkeeper is also to run sales analytics?
    - germanier 5y ago
      It is necessary to process personal information for that purpose. That's what the sales records are. > top 5 customers You probably have to declare that the data is processed for that purpose in general terms but I don't see why consent would be necessary. Anyway, this analytics service claims it doesn't do this kind of analysis.
      - kyboren 5y ago
        Obviously it depends on the system involved, but there should be no need to touch any column containing personally identifying information in order to calculate aggregate sales statistics for each of your products.
tshaddox 5y ago
That’s bad too. There are also things happening in the world that are much worse, like people getting murdered. All these things can be bad at the same time.
- FredPret 5y ago
  External bookkeepers are bad now!? Information is valuable, but it is not holy.
- toqy 5y ago
  > That’s bad too In what way? I agree that personally tracking an individual and using psychology tricks and whatnot to trick them into buying stuff is bad, but if it's just a company knowing what works well for them, I don't see the argument.
  - tshaddox 5y ago
    I was referring to this: > when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party Retail stores also use your shopping data to target you with ads. Credit cards also obviously sell your purchase data to anyone willing to pay for it. I wouldn't be surprised if retail stores even sell your cash purchase data to any third party willing to pay for it.
usr1106 5y ago
If you pay by cash the shop has no personal data about you.
- pphysch 5y ago
  Not necessarily, they might have timestamps and register # that could be correlated to build a "unsupervised" profile of a customer. Extreme case: you are the only person that ever buys product X around time Y, so that fact can be used as an anchor to build a profile. You need to be way more paranoid if you want to be a true privacy warrior.
  - toqy 5y ago
    Also be careful not to leave any fingerprints or strands of hair around!
    - hutzlibu 5y ago
      So better not leave your basement at all.
croes 5y ago
Nope, the external company bookkeeper doesn't know which of the hundreds or thousands transactions are done by me. He doesn't even know how often I bought something. And even if, that knowledge is nothing compared to the millions of data points of services like google analytics.
- rdiddly 5y ago
  If it were true as AdriaanvRossum said above that Simple Analytics data has "no identifiers" (taking that at face value for now) then that seems exactly analogous to those cash transactions someotherperson describes.
  - shkkmo 5y ago
    Simple Analytics absolutely does receive identifies (namely IP address). They claim they do not store these address, but that depends entirely on trusting them and their closed source software. This is very unlike the accounting firm, which never receives any identifying for cash transactions and thus couldn't store it even if they wanted to.
  - croes 5y ago
    Not quite analogous. If they ask for my zip code every time I buy something cash that's more similar. It's still a difference between not having data and not storing it. The later needs trust, the former doesn't.
BrS96bVxXBLzf5B 5y ago
The other replies are missing what analytics is really comparable to. With a standard purchase, we have an exchange of the minimum necessary information at the point of engaging in a mutual financial transaction. The bookkeeper can examine that transaction after. They can look for patterns in what receipts have. That's fine. Analytics isn't that. Analytics is tracking a customer walking into the store and looking for which store they came from. Analytics is noting down how long a customer spent holding a blue item, if they looked at a big red item, and noting it down because it might matter. Analytics is seeing how the customer went back and forth between one aisle and another. Whether looking at one item made them less inclined to look at the next. Analytics is hoarding all of that information and keeping it even if the customer doesn't make a purchase. Of course stores have been looking at how and why and when customers shop for years, but through consensual studies. They learnt to put the fruit at the entrance and the sweets at the exit. They learnt to put their high value items at eye level. And they didn't do it through spying and analysing the behaviours of everyone walking through their doors. They didn't keep years of CCTV with the sole excuse that they might want to see how long you lingered between deciding on diaper brands. The web has no excuse.

simion314 5y ago

>Yes, and when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). How, you don't enter your name when you pay with cash. Also in EU is illegal to share any personal info in physical world too, say you go and make a subscription to a gym they can't share your data with a third party unless they make you sign a paper first. Edit:typos

germanier 5y ago
On the other hand, it's perfectly legal (and usual practice) to contract out the operation of people counting devices that just tally up how many persons go through a door. (By the way, a gym can and usually does share contract data including personal information with numerous third-parties such as external bookkeepers. This is legal under the GDPR without explicit consent.)
- simion314 5y ago
  >By the way, a gym can and usually does share contract data with numerous third-parties such as external bookkeepers. This is perfectly legal under the GDPR) Why is it legal, does the gym need those 100 contractors to know my data for it to work? What are those for 100 different accountants? How did gyms or other businesses worked before the internet, did a guy walked to 100 different locations with papers in hand so those "partners" take a quick look?
  - germanier 5y ago
    Yes, before there was electronic bookkeeping businesses hauled stacks of paper to their accountant. This is standard business practice since literally centuries. If they want to send you a letter, they have to give your data to the postal service. Again, no consent needed. This is legal because our whole economy is based on devision of labor. Privacy laws account for that.
    - simion314 5y ago
      Maybe you are referring to required data. I can buy some bread and the store does not need my ID for accounting purposes, so not sure what exceptional stores or gym need to send a copy of my ID and my activities to their accountant. My problem is with the 100+ partners that are OBVIOUSLy not partners and not required to have my data.
      - germanier 5y ago
        Ok, now what's the difference between sharing "1 bread sold" (with no identifying information about the customer) with a third-party and "1 page visited" (with no identifying information about the visitor) with a third-party?
        hutzlibu 5y ago
        The fundamental issue here is probably sharing with a different nation. If google would be german, they would have no problems with it.
        tremon 5y ago
        "1 page visited" (with no identifying information about the visitor) with a third-party? False equivalence, no online stalking company actually works like that (that would require a server-side hook). They all make the visitor go to the third party's desk and increase the tally themselves (via http request), giving the tracker company access to all the contact details of the visitor.
  - 5y ago
umvi 5y ago
> How, you don't enter your name when you pay with cache. You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint". "Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash"
- simion314 5y ago
  >"Oh, it's that one privacy nut again who always wears sunglasses and a hoodie and only pays in cash" And the store person will then what? Open excel wnd write "a dude with glasses was ehre at 12:51"? and then send the file to 100+ partners? >You don't need to be identified by name, just by a "fingerprint". If you go there regularly you will be identified by your "fingerprint". So the physical stores have some shady dudes attempting to lift fingerprints from money then some statistics guy try to put probabilities on which fingerprint matches which anonymous guy? here in my country you still pay with cash and the store people put it in a machine combine it with money from other people, it will be a lot of work and risk for some shitty nano reward. Edit typo
  - hutzlibu 5y ago
    Sorry to nitpick, but since you wrote it 2 times wrong: it is cash, not cache.
    - simion314 5y ago
      No problem, thanks
- elevader 5y ago
  And the GDPR forbids them from writing that information (e.g. "the privacy nut bought apple juice") down or passing it to a third party without your explicit consent.

hdjjhhvvhga 5y ago

> shopping habits I think you are wrong. What they receive is a set of purchases in a given period of time that allow them to make many important decisions (when people buy most, what purchases are more likely on a given date etc.) but there is no way of finding out my shopping habits.

abakker 5y ago
no - the analysis is done on receipts, not just total products sold. They don't care what you bought, they care to know that people who buy diapers also buy wipes, and people who buy soy milk don't buy butter, etc. The analysis of anonymous receipts still yields very interesting and actionable results in aggregate. Your privacy has nothing to do with how a company analyzes its sales data as long as they don't include your identity and drill down into analyzing your receipt alone.
- hdjjhhvvhga 5y ago
  Yes, I understand that they see patterns and trends and a lot of valuable data: my point is that they have no way of tracking shopping habits of any individual purchaser unless they trick them into some loyalty program, coupons etc.
  - abakker 5y ago
    I think we agree. If the average search advertiser gave me the same benefits that some loyalty programs do, I'd feel a lot better about them. I.e. if I got points for the data I provided in my browsing habits that translated into actual dollars, I'd be game to let them have it. If I wanted to "not swipe my loyalty card for this purchase" to leave it out of my history, I'd appreciate the granular control. The issue with all the tracking is that most consumers have no choice, no functional UI to interact with the tracking systems, and no clear idea of who they are ultimately transacting with.
  - afiori 5y ago
    As a nitpick: "unless they trick enough customers in a loyalty program or something". With enough good data (so probably not in all sectors) you can also identify people out of the system. There are not that many bits of entropy in (contextualized) human behavior.

elevader 5y ago

GDPR also applies to the real world. That store is definitely not allowed to share data about your shopping habits with some third party without your explicit consent. For example government departments in Germany have to aks for your explicit permission beforehand if they need to request/share data with a different department.

germanier 5y ago
This is in general not true and German government departments share data with different departments all the time without explicit consent of the affected citizen. This is also not a good example as there are additional legal restrictions for government departments which businesses don't need to obey.
- ben_w 5y ago
  GDPR is a standardisation of pre-existing national rules within the EU member states, at the time including the UK’s Data Protection Act. When I was at university, one of the examples of the scope of the Data Protection Act was a barbershop which kept hand-written (no computer involved) records of customers, and one customer used the DPA to demand to see their records and then to have those records destroyed.
- usr1106 5y ago
  If the sharing is not required by any law they have to ask. Sometimes they do. I'm sure there are cases where they share without either of the precondition met.
  - germanier 5y ago
    There are cases in which sharing without asking is legal without it being required by law.
CWuestefeld 5y ago
Is your claim that they can't share a customer's address with a shipping customer, and thus must actually perform all shipping themselves?

iicc 5y ago

>your shopping habits are being shared against your wishes with a random third party (the external company bookkeeper). GDPR requires data sharing to be done for a defined purpose. The purpose of sharing data with an external company bookkeeper for bookkeeping is not remotely connected to any purpose an analytics service fulfills. So while the shared data is capable of the same insights, it's explicitly illegal for it to be processed that way without a defined purpose (which is it's own can of worms). >entirely anonymous browsing data It's never entirely anonymous, because how useful data is, is inversely related to how anonymous it is. ergo it would only be truly anonymous if it was truly useless.

germanier 5y ago
It's still legal to ask your bookkeeper to go through the books and give you a list of your 10 best selling products broken down by season (given you have all the right paperwork in place with them etc. but no consent of the customers needed).
- kyboren 5y ago
  Well, it's not necessary to process any personal data in order to calculate that. Can you ask your bookkeeper to tell you the top 3 best selling products for your top 5 customers without declaring that the purpose of the data transfer to the external bookkeeper is also to run sales analytics?
  - germanier 5y ago
    It is necessary to process personal information for that purpose. That's what the sales records are. > top 5 customers You probably have to declare that the data is processed for that purpose in general terms but I don't see why consent would be necessary. Anyway, this analytics service claims it doesn't do this kind of analysis.
    - kyboren 5y ago
      Obviously it depends on the system involved, but there should be no need to touch any column containing personally identifying information in order to calculate aggregate sales statistics for each of your products.

tshaddox 5y ago

That’s bad too. There are also things happening in the world that are much worse, like people getting murdered. All these things can be bad at the same time.

FredPret 5y ago
External bookkeepers are bad now!? Information is valuable, but it is not holy.
toqy 5y ago
> That’s bad too In what way? I agree that personally tracking an individual and using psychology tricks and whatnot to trick them into buying stuff is bad, but if it's just a company knowing what works well for them, I don't see the argument.
- tshaddox 5y ago
  I was referring to this: > when you go shopping and pay with cash in a store with no surveillance, your shopping habits are being shared against your wishes with a random third party Retail stores also use your shopping data to target you with ads. Credit cards also obviously sell your purchase data to anyone willing to pay for it. I wouldn't be surprised if retail stores even sell your cash purchase data to any third party willing to pay for it.

usr1106 5y ago

If you pay by cash the shop has no personal data about you.

pphysch 5y ago
Not necessarily, they might have timestamps and register # that could be correlated to build a "unsupervised" profile of a customer. Extreme case: you are the only person that ever buys product X around time Y, so that fact can be used as an anchor to build a profile. You need to be way more paranoid if you want to be a true privacy warrior.
- toqy 5y ago
  Also be careful not to leave any fingerprints or strands of hair around!
  - hutzlibu 5y ago
    So better not leave your basement at all.

croes 5y ago

Nope, the external company bookkeeper doesn't know which of the hundreds or thousands transactions are done by me. He doesn't even know how often I bought something. And even if, that knowledge is nothing compared to the millions of data points of services like google analytics.

rdiddly 5y ago
If it were true as AdriaanvRossum said above that Simple Analytics data has "no identifiers" (taking that at face value for now) then that seems exactly analogous to those cash transactions someotherperson describes.
- shkkmo 5y ago
  Simple Analytics absolutely does receive identifies (namely IP address). They claim they do not store these address, but that depends entirely on trusting them and their closed source software. This is very unlike the accounting firm, which never receives any identifying for cash transactions and thus couldn't store it even if they wanted to.
- croes 5y ago
  Not quite analogous. If they ask for my zip code every time I buy something cash that's more similar. It's still a difference between not having data and not storing it. The later needs trust, the former doesn't.

BrS96bVxXBLzf5B 5y ago

The other replies are missing what analytics is really comparable to. With a standard purchase, we have an exchange of the minimum necessary information at the point of engaging in a mutual financial transaction. The bookkeeper can examine that transaction after. They can look for patterns in what receipts have. That's fine. Analytics isn't that. Analytics is tracking a customer walking into the store and looking for which store they came from. Analytics is noting down how long a customer spent holding a blue item, if they looked at a big red item, and noting it down because it might matter. Analytics is seeing how the customer went back and forth between one aisle and another. Whether looking at one item made them less inclined to look at the next. Analytics is hoarding all of that information and keeping it even if the customer doesn't make a purchase. Of course stores have been looking at how and why and when customers shop for years, but through consensual studies. They learnt to put the fruit at the entrance and the sweets at the exit. They learnt to put their high value items at eye level. And they didn't do it through spying and analysing the behaviours of everyone walking through their doors. They didn't keep years of CCTV with the sole excuse that they might want to see how long you lingered between deciding on diaper brands. The web has no excuse.