3 ms·

What an amazing win for Europe, and the GDPR. This isn't about just the button. Until a few years, "you're not the customer; you're the product" was the norm f

What an amazing win for Europe, and the GDPR. This isn't about just the button. Until a few years, "you're not the customer; you're the product" was the norm for a typical user's interaction with the internet, and they were powerless to change that. Then the GDPR came along, declaring that users have fundamental right to their data, and as such, they no longer can be forced to be "the product" without their consent. One of its most empowering rules, however, is in Article 7 (4): "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." So consent must be (1) freely given, and (2) it's not free if you're blocking access to service A by requiring consent for service B, when B is unnecessary for performing A. Hence, a search engine cannot force you to consent to tracking for advertising purposes, because technically, the search engine doesn't need it. So how can the search engine make money? One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking).

jsnell 4y ago
> One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking). Where has that been ruled legal, and do you have a link to the ruling? I've only seen German newspapers do this, so my assumption has been that it's just the German authorities turning a blind eye to it. If it's really a legit option, it seems like a miracle that nobody else is using this.
- ckastner 4y ago
  > Where has that been ruled legal, and do you have a link to the ruling? This was communicated to me by a law firm specializing this area. This was with regards to the newspaper "derstandard.at". Here's a source in German which includes the ruling as a PDF [1]. I see that in the meantime, this "pay or okay" model has been questioned again, but in any case, a ruling exists. And, as I was told, the national DPAs don't just rule as they see fit, but rather coordinate with other DPAs, in order to harmonize the enforcement across the EU. [1] https://www.dataprotect.at/2018/12/07/payortrack-die-entscheidung-der-dsb-nicht-rechtskr%C3%A4ftig/ https://www.dataprotect.at/2018/12/07/payortrack-die-entsche... > If it's really a legit option, it seems like a miracle that nobody else is using this. None of the big sites are using it because it's frequently far more profitable to track people. Just look at various revenue-per-user stats. And the users most willing to spend money for no-tracking tend to be the users who also spend money on other things, so their the users you'd want to advertise to the most.
  - mrmr1993 4y ago
    The UK's ICO took a different stance[0] when the Washington Post tried to do this a few years back. For companies that want to do business in the UK, it probably makes sense to follow that more conservative decision. The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): > (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Interestingly, the decision that you linked prefers to rely on the case law of the data protection authority when interpreting the question of consent, in particular referring to rulings that predate the GDPR, despite its refinement of the concept of consent. It also focuses upon 'wesentlicher Nachteil' (significant detriment) where the original text of the GDPR prohibits just 'Nachteil' detriment. I find these choices rather suspicious, and wouldn't be comfortable with relying on them holding if challenged in other EU states. [0]: https://www.theregister.com/2018/11/19/ico_washington_post/ https://www.theregister.com/2018/11/19/ico_washington_post/
    - ckastner 4y ago
      Indeed, I overlooked that the ICO took a different stance. I have to admit that I did not research this myself, I just took the word of the (top-tier) law firm back then. > The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): >> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.* I don't see why they should be at odds with the decision? Quoting: "Gibt eine betroffene Person keine Einwilligung ab, so besteht die erste Konsequenz darin, dass diese ein O*-Abo abschließen kann. Dieses O*-Abo ist – wie festgestellt – frei von Werbung, frei von Daten-Tracking und frei von der Setzung von Fremdcookies. Das O*-Abo ist mit einem Preis von 6 Euro monatlich ab dem zweiten Monat auch keine unverhältnismäßig teure Alternative." It's obviously without question that one can charge something for a service rendered -- the newspaper does not have to offer this for free. And in the above text, the authority then opined that charging 6 Euro for a monthly subscription to read a newspaper is not unreasonable, hence the decision to opt into tracking is a free one, because the alternative is simply to pay 6 Euro for a month's access.
qeternity 4y ago
> and they were powerless to change that. Don't use the service. > they no longer can be forced to be "the product" without their consent. Don't use the service. > when B is unnecessary for performing A. Technically unnecessary, the same way that the existence of goods in a shop is not dependent on whether or not I pay for them. But it sure has hell is necessary for the shop to keep functioning. The overwhelming majority of people are happy to sell their data for free services. How many Facebook movies need to be made before people are convinced that 1) the average person knows they are being tracked and 2) they would still rather be tracked than pay. I mean ffs, Netflix is about to roll out an ad supported plan. The average person does not value their privacy nearly as much as the outraged HN'er would believe. Bring on the downvotes.
- Nextgrid 4y ago
  > Don't use the service. This is fine if: 1) The true extent of the tracking was disclosed. Before the GDPR that wasn't the case. 2) In practice, this only works for small services with lots of competition. For services which have a monopoly and/or oligopoly (and all of them are equally bad), this isn't a solution. Maybe the GDPR can be relaxed in a few years/decades after other regulations against monopolies take effect or the monopoly/oligopoly problem self-resolves, but in the meantime I think the current state of the GDPR is valuable.
- alkonaut 4y ago
  The whole idea of the law (at least as I see it) is to state that companies shouldn’t be allowed to trade in people’s information unless both parties of the transaction know exactly what the transaction is. And that means even people who don’t care. That basically means the business model “give people a service in exchange for personal info they think they don’t mind sharing” isn’t ok. It also, by extension, means that you are telling consenting people that some agreements aren’t ok for them to enter into. Which is also fine. > The average person does not value their privacy nearly as much as the outraged HN'er would believe. I think you have it backwards. Regulation is needed because people don’t care. Not the other way around. Seat belt laws are there because people don’t care about personal safety enough.
dmitriid 4y ago
> So how can the search engine make money? One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking). Google search was likely profitable with keyword ads long before any tracking was involved.

jsnell 4y ago

> One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking). Where has that been ruled legal, and do you have a link to the ruling? I've only seen German newspapers do this, so my assumption has been that it's just the German authorities turning a blind eye to it. If it's really a legit option, it seems like a miracle that nobody else is using this.

ckastner 4y ago
> Where has that been ruled legal, and do you have a link to the ruling? This was communicated to me by a law firm specializing this area. This was with regards to the newspaper "derstandard.at". Here's a source in German which includes the ruling as a PDF [1]. I see that in the meantime, this "pay or okay" model has been questioned again, but in any case, a ruling exists. And, as I was told, the national DPAs don't just rule as they see fit, but rather coordinate with other DPAs, in order to harmonize the enforcement across the EU. [1] https://www.dataprotect.at/2018/12/07/payortrack-die-entscheidung-der-dsb-nicht-rechtskr%C3%A4ftig/ https://www.dataprotect.at/2018/12/07/payortrack-die-entsche... > If it's really a legit option, it seems like a miracle that nobody else is using this. None of the big sites are using it because it's frequently far more profitable to track people. Just look at various revenue-per-user stats. And the users most willing to spend money for no-tracking tend to be the users who also spend money on other things, so their the users you'd want to advertise to the most.
- mrmr1993 4y ago
  The UK's ICO took a different stance[0] when the Washington Post tried to do this a few years back. For companies that want to do business in the UK, it probably makes sense to follow that more conservative decision. The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): > (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Interestingly, the decision that you linked prefers to rely on the case law of the data protection authority when interpreting the question of consent, in particular referring to rulings that predate the GDPR, despite its refinement of the concept of consent. It also focuses upon 'wesentlicher Nachteil' (significant detriment) where the original text of the GDPR prohibits just 'Nachteil' detriment. I find these choices rather suspicious, and wouldn't be comfortable with relying on them holding if challenged in other EU states. [0]: https://www.theregister.com/2018/11/19/ico_washington_post/ https://www.theregister.com/2018/11/19/ico_washington_post/
  - ckastner 4y ago
    Indeed, I overlooked that the ICO took a different stance. I have to admit that I did not research this myself, I just took the word of the (top-tier) law firm back then. > The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): >> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.* I don't see why they should be at odds with the decision? Quoting: "Gibt eine betroffene Person keine Einwilligung ab, so besteht die erste Konsequenz darin, dass diese ein O*-Abo abschließen kann. Dieses O*-Abo ist – wie festgestellt – frei von Werbung, frei von Daten-Tracking und frei von der Setzung von Fremdcookies. Das O*-Abo ist mit einem Preis von 6 Euro monatlich ab dem zweiten Monat auch keine unverhältnismäßig teure Alternative." It's obviously without question that one can charge something for a service rendered -- the newspaper does not have to offer this for free. And in the above text, the authority then opined that charging 6 Euro for a monthly subscription to read a newspaper is not unreasonable, hence the decision to opt into tracking is a free one, because the alternative is simply to pay 6 Euro for a month's access.

qeternity 4y ago

> and they were powerless to change that. Don't use the service. > they no longer can be forced to be "the product" without their consent. Don't use the service. > when B is unnecessary for performing A. Technically unnecessary, the same way that the existence of goods in a shop is not dependent on whether or not I pay for them. But it sure has hell is necessary for the shop to keep functioning. The overwhelming majority of people are happy to sell their data for free services. How many Facebook movies need to be made before people are convinced that 1) the average person knows they are being tracked and 2) they would still rather be tracked than pay. I mean ffs, Netflix is about to roll out an ad supported plan. The average person does not value their privacy nearly as much as the outraged HN'er would believe. Bring on the downvotes.

Nextgrid 4y ago
> Don't use the service. This is fine if: 1) The true extent of the tracking was disclosed. Before the GDPR that wasn't the case. 2) In practice, this only works for small services with lots of competition. For services which have a monopoly and/or oligopoly (and all of them are equally bad), this isn't a solution. Maybe the GDPR can be relaxed in a few years/decades after other regulations against monopolies take effect or the monopoly/oligopoly problem self-resolves, but in the meantime I think the current state of the GDPR is valuable.
alkonaut 4y ago
The whole idea of the law (at least as I see it) is to state that companies shouldn’t be allowed to trade in people’s information unless both parties of the transaction know exactly what the transaction is. And that means even people who don’t care. That basically means the business model “give people a service in exchange for personal info they think they don’t mind sharing” isn’t ok. It also, by extension, means that you are telling consenting people that some agreements aren’t ok for them to enter into. Which is also fine. > The average person does not value their privacy nearly as much as the outraged HN'er would believe. I think you have it backwards. Regulation is needed because people don’t care. Not the other way around. Seat belt laws are there because people don’t care about personal safety enough.

dmitriid 4y ago

> So how can the search engine make money? One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking). Google search was likely profitable with keyword ads long before any tracking was involved.