14 ms·

This is a crazy way of making laws, IMO. To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with

This is a crazy way of making laws, IMO. To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means. Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law. Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and all of those billions of dollars have gone to waste. So absurdly inefficient. No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better? No; we prefer to thrive by ignoring problems for a long time then smashing them with a hammer.

zapt02 4y ago
People who make laws can't see the future, it's a constant race to curb corporate behavior that is deemed unacceptable and the laws evolve as new loopholes are found and exploited. Corporations know this and take it into account when making a cost/benefit calculation. A while ago Facebook was threatening to pull out of the EU. When nobody cared they ponied up the tech required to stay. They will this time as well.
- peoplefromibiza 4y ago
  > People who make laws can't see the future People who make laws can see the future (yeah, sometimes they don't), it's the people that do not understand them and protest, because they do not see the immediate benefit for themselves, so the laws have to be changed to accomodate the snowflakes of the World. Making laws is about govern, not about futurism. A compromise has to be found every time a new law is proposed to be approved. See for example the ban on ICE engines, one side wanted it NOW the other side wanted it NEVER, truth is a good compromise was to accelerate as much as possible for some heavy user (Amazon alone, for example, is responsible for more than 20% of the global deliveries) and make some exception (5 years tops) for supercar luxury brands like Ferrari or Lamborghini, that sell a few thousands cars/ year. But things being as they are, people complained about Ferrari asking for an extension (for themselves and other luxury brands) but at the same time against the ban in general because everyone owns a car. The real problem is that people put in charge of making laws other people like them, not people better than them. It's a vicious circle. EDIT: the HN paradox: everyone knows what's bad, everyone has a very important job, but apparently things never improve because "politics". Maybe things are harder than what they look at first sight, from outside, and it's not about "people not seeing the future", but about the fact that the more a society is rich and established, the more changes are hard and people oppose to them. See for example how hard it is to convince American people that socialism is not a crime and USA could survive free health care paid by everyone's taxes. Does it mean that Americans are stupid and can't open Wikipedia and do a simple research, that they can't see the truth in front of their eyes, or that they are simply afraid of change, because the system works for a large part of the population, the same part of the population that basically runs the country and decides who gets elected?
Barrin92 4y ago
>No; we prefer to thrive by ignoring problems for a long time then smashing them with a hammer. and here I was thinking that breaking things and disruption is what Facebook in particular was super into. Sucks if it happens to you I guess. Laws and regulations aren't made by meeting Facebook representatives and then asking them what's convenient. Okay Facebook has invested billions of dollars, luckily they've also made billions of dollars. How much do you think traditional journalism, including all the positive externalities it entails has suffered from Facebook? They didn't seem to care, it's a legacy industry if I remember correctly. Car manufacturers all over the world have invested probably a hundred times as much in the combustion engine and the traditional car, it's going away as well. Like are we going to reimburse and invite everyone who has made anything we've decided we don't want any more?
tomrod 4y ago
This is called regulatory uncertainty and there is a long history to it. Its also part of why you want a stable polity that listens to the people it rules, why you want lobbying to be legal (but not bribery), and why you should be careful about building businesses in areas that have regulatory uncertainty. In terms of society, regulatory uncertainty better than no regulation, hands down, and is a spectrum whether the risk is too high to engage in the market profitably.
IanCal 4y ago
There's a very strong assumption that Facebook are operating in good faith. The article suggests you need actice consent, which is what a basic reading of gdpr rules would mean. I don't know why hiding it in the terms and conditions would possible be conpatible.
pulse7 4y ago
Facebook has many legal experts. They have surely consulted with them, before investing their billions... For them it is more profitable to "not comply and be caught" than to exit the business... Now they got caught and they will fight until the end - because they have many more billions to spend... Any business in any country is making a risk, that laws will change...
halestock 4y ago
> No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better? This would never work because Facebook is uninterested in making "the whole system better". Their entire goal is to make money off of user data, and they have zero incentive to work with governments that threaten that goal.
- RubyRidgeRandy 4y ago
  on the contrary, I think facebook and google have a huge incentive to work with different governing bodies to define what data is ok to collect and build identifiers around, and what is not. There is no way facebook would just throw up it's hands and say "we have no incentive to find a way to advertise to a population of 750 million people."
  - CountSessine 4y ago
    Yes - especially if they can do this in a way that still makes them money but is expensive and burdensome to comply with. That would keep them in the game but seal the market off to potential competitors.
  - hailwren 4y ago
    > There is no way facebook would just throw up it's hands and say "we have no incentive to find a way to advertise to a population of 750 million people." And yet, this is exactly what they do repeatedly [1] [2] [3]. 1 - https://www.vice.com/en/article/889pk3/facebook-threatens-to-pull-out-of-europe-if-it-doesnt-get-its-way https://www.vice.com/en/article/889pk3/facebook-threatens-to... 2 - https://www.exchangewire.com/blog/2022/02/08/facebook-threatens-to-leave-europe-if-data-sharing-with-us-ends/ https://www.exchangewire.com/blog/2022/02/08/facebook-threat... 3 - https://www.niemanlab.org/2019/01/google-is-threatening-to-kill-google-news-in-europe-if-the-eu-goes-ahead-with-its-snippet-tax/ https://www.niemanlab.org/2019/01/google-is-threatening-to-k...
    - 4y ago
RubyRidgeRandy 4y ago
It is crazy. If the EU just wants to fully outright ban advertising - then do it - but set a standard and stick to it.
- wnoise 4y ago
  Tracked advertising is not all advertising.
  - RubyRidgeRandy 4y ago
    I didn't say it was. However, defining what is tracking and what is not is also an issue. Let's say facebook runs an ad on its platform to my website with a url of site.com/fbad. Then I can see how many people clicked on the ad on facebook and how many people converted on that webpage. There are people on this site who will tell you, and FULLY believe that that is TOO much tracking and is morally wrong.
    - kergonath 4y ago
      Incrementing a counter is not tracking. I don’t know where you’d find someone saying otherwise. However, keeping records associating the fact that something was clicked with personal identifying information, such as an IP address or a unique identifier, is tracking, and you need to ask for consent. What is and is not acceptable use of data related to a person is defined in the regulation.
- ndsipa_pomu 4y ago
  There's no problem with advertising, the issue is with companies misusing people's data. If a company wants to use targetted advertising then they just have to openly ask for consent to do so, but tying it up with the terms and conditions to use the site is hardly asking for consent.
- kergonath 4y ago
  > If the EU just wants to fully outright ban advertising Come on, don’t be obtuse. The problem is not advertising, the problem is tracking and using user data without consent. The fact that they do that for advertising is irrelevant. They would have the same issue if they were doing it for any other reason. > set a standard and stick to it That’s what they did. It’s called the GDPR. One can argue that enforcement was insufficient, but the standard has not changed.
ad404b8a372f2b9 4y ago
I'm impressed both by your outrage at requiring free, informed consent for tracking and personalized ads as well as this change resulting in "all of those billions [going to waste]". To me it means one of two possibilities: 1. Facebook is incompetent, not only did it spend billions developing lackluster practices that don't fit the spirit of the GDPR but that money also instantly disappears because they are apparently incapable of adding a prompt for tracking consent and evolving with the regulatory landscape like every other company on earth. or 2. Facebook relies on its relationship with its users being non-consensual.
- A4ET8a8uTh0 4y ago
  <<2. Facebook relies on its relationship with its users being non-consensual. Well, I am not certain FB tells users exactly the extent to which their online persona is being profiled. We have relatively vague lawyer talk for 'more targeted ads', but it does not tell you that FB identifies as a prime target for ads that would feature, say, a suffering animal. For the record, I am making it up, but inferences taken from massive amounts of posts people make daily make it highly unlikely that a detailed and thorough psychological profile that would normally require years of visiting an actual psychiatrist are now very much a possibility. And the only official indication of this we have comes from various FB court cases, but those being 1000s of pages of useful information is not an average person will go through, let alone understand. I forgot which company tried to shed some light on it with ads that used that info indicating to ad viewing person that "you are an X who likes Y". They got shot down fast. I guess my point is.. it may be consensual in the sense that user agreed, but did the user truly understood what he/she agreed to, is something I would argue against.
- matheusmoreira 4y ago
  > Facebook relies on its relationship with its users being non-consensual. Its very existence depends on it. Facebook is a company that builds shadow profiles of people who never joined the social network, never agreed to the terms of service and not even once consented to anything.
hnlmorg 4y ago
> Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law. So often in the last 20 years I’ve seen companies (and particularly US tech companies, but it’s not exclusive to them) deliberately read more charitable interpretation of the law, knowing they'll make millions over and above any fines they might receive. It’s so common place that there is even a saying for it: “ask for forgiveness not permission” So I have a hard time believing that Facebook, with their army of lawyers and millions earned from data collection, are the victims here.
- gameman144 4y ago
  It's definitely hard to say that big corporations are victims, but I know that I personally find lots of bog standard legalese hard to interpret. Granted, lawyers have a lot more experience there, and more employed gives lots more perspective. At the end of the day, they are still human, and laws and regulations are still written by humans, meaning that it can often be hard to suss out intent from the letter of the law.
  - denton-scratch 4y ago
    > standard legalese hard to interpret Indeed. We should know what the law is, without first hiring a team of lawyers. There's a trend to make laws that are harder and harder for ordinary people to understand. Partly that's a result of having to cut out exceptions and loopholes for lobbyists and donors; but I suspect it's largely because lawmakers are increasingly trained, practising lawyers. If the language you speak is legalese, I guess that's the language you use to write laws.
    - ClumsyPilot 4y ago
      oh and the facebook EULA is easy to ubderstand and grants you make rights and protections?
    - zelphirkalt 4y ago
      Parts I read of GDPR were more approachable than any of the EULAs I have seen. More approachable than software licenses as well.
cramjabsyn 4y ago
On the contrary, it’s actually quite refreshing to see law that patches a loophole which was being exploited by a data mining company to enrich itself.
- cormacrelf 4y ago
  As a matter of process, this isn’t a new law. It’s the same law that was in place in 2018 when the first complaint was filed. The courts have only just decided what it means for this specific scenario. They decided you can’t rely on contractual necessity to excuse not presenting the user with a choice about whether to be tracked, just because Facebook’s business is tracking. Up until now Facebook had operated assuming they could. The main fault of the process is that it took 4.5 years. That’s 4.5 years of illegal revenue. Speed is justice. We all know this. It would have been preferable for the law to have been so clear that it didn’t take that long to argue. I forget the exact wording but I think it was pretty clear, and they just managed to draw it out long enough to turn more profit in the meantime. Possibly not so much a problem with lawmaking as with the litigation.
snotrockets 4y ago
Facebook interest is being ambiguously regulated. So no, you can't have fruitful discussion with them. History shows us the regulator always comes after the original culprits exploited what they could, never before.
kryptozinc 4y ago
Oh no, will someone think of the poor companies!
csomar 4y ago
You are not getting it. This is a fight for the money Facebook is generating. The court, the law, the administrations, the bureaucrats, the media, the lawyers, the judges are all complicit. Using the law to say, take over someone house without reason will be outrageous (though it does happen in "lesser" countries than the EU). But in the EU, you can still get people to look the other side if you explain it by Facebook is evil, Facebook is tracking you, Facebook is addicting you, Facebook is generating lots of money, etc... Of course, you have to realize, this is the same government that will sell your blood if they think they can make profit out of it. Welcome to the Jungle.
ndsipa_pomu 4y ago
GDPR requires consent for a specified usage of people's data. If you want to send people emails, then you need emailing consent. If you want to use people's data to target advertising, then you need to ask them for that consent. https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ I'm doubtful that Facebook have been using a fair interpretation of the laws as that doesn't seem to be the way they operate. I'm also doubtful that users can easily revoke consent which is another requirement under GDPR.
newaccount74 4y ago
> Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law This is utter bullshit. They have tried to twist and bend the rules and tried to use an exception that doesn't apply to them at all. Everybody knew that Facebook went against the spirit of the law. Somehow they got the Irish authority to go along with their idiotic interpretation of the law, but that doesn't mean they were working "according to a fair reading of the law", it just means that the Irish authority failed to do their job. If Facebook had gone with a conservative reading of the law, like many other companies have, they would have added consent prompts 5 years ago, and they wouldn't have a problem today. I would suggest you spend some time reading the GDPR. It's surprisingly approachable. The parts about consent really aren't that hard to understand at all, and it's clear what the intention of the exceptions were (eg. a pizza delivery service obviously does not need to ask for consent to share the customer address with a delivery driver for the purpose of delivering the pizza, but they do need to ask for consent if they want to add the address to a direct mailing directory). It's unfortunate that it took the EU 5 years to do something about this obvious violation, but the problem is not the law itself.
stingraycharles 4y ago
> Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law. I think the crux is that they instead implemented a system according to their most favourable reading of that law. They took a calculated risk, it backfired a little bit (albeit after 5 years of using it to their advantage), and now they need to approach things differently. Business as usual.
matkoniecz 4y ago
> according to their fair reading of that law. I do not care at all what FB claims. They repeatedly lied, cheated (see 2 factor phone numbers) and deliberately misinterpreted law in insane ways. One of their attempts was putting serving interesting ads as service given to users and claiming that it means that they are obligated to track them.
bigbillheck 4y ago
> all of those billions of dollars have gone to waste 'Gone to waste' is the best possible outcome of money spent on advertising infrastructure.
jrm4 4y ago
What? No. This legal response is perfectly reasonable in light of the facts. "Having a real conversation" is clearly not how Facebook intends to operate. It has never been particularly open or forthcoming about how it handles data.
Macha 4y ago
> To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means. The "vague and general language": Article 7, paragraph 4: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ Recital 42: > Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. 2In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. 3In accordance with Council Directive 93/13/EEC¹ a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. 4For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. 5Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. https://gdpr-info.eu/recitals/no-42/ https://gdpr-info.eu/recitals/no-42/ Facebook didn't like the business impact of complying so has spent years grasping at loopholes that don't exist in a law which is remarkably clear for legalese (especially EU legalese). The fault for that lies with Facebook, not the law making process.
- Zak 4y ago
  I am not a lawyer, a GDPR implementation specialist, or even a GDPR enthusiast and I knew this. Specifically, my understanding has always been that a company cannot demand consent to data storage and processing in exchange for providing a service except where the data is actually necessary to provide the service. It certainly isn't necessary to track what users do on other websites in order to provide Facebook's core product. It isn't even necessary to do that to provide ads targeted to a Facebook user's interests because people who use Facebook normally provide significant information about their interests through normal use of Facebook. There is no way that Facebook wasn't aware courts were likely to understand the law that way.
bryanrasmussen 4y ago
>Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and all of those billions of dollars have gone to waste. so when you say a crazy way of making laws, you mean the way that laws basically get made? >No regulator has had the idea of just going to Facebook, pretty sure there was all sorts of conversations with Facebook and others over at least 5 years where it was quite clear people wanted to fix privacy issues and it was also clear that it was in Facebook's financial interest that it not get fixed. >tried to draft a forward-looking law that will make the whole system better? Facebook doesn't want the system better, Facebook wants the system to benefit them. At some point these things are incompatible. No body has gone to a bank robber and tried to discuss with them how to best draft the laws on how to stop the robbing of banks, because of an intuitive understanding that it is not the bank robber's intention to help stop the robbing of banks. So when the law gets made to stop the robbing of banks, the bank robber than goes ahead and breaks it. Or in the case of Facebook they say we are obeying the law! But still try to do what the law wants them not to do. But I think this is the core of our disagreement here >according to their fair reading of that law I would say according to their desire to get around that law.
- Kalium 4y ago
  > so when you say a crazy way of making laws, you mean the way that laws basically get made? I think what's being characterized as crazy is that the laws as written are at best vague. It takes years to find out what they actually mean in implementable detail. This makes it very difficult to comply. Have you read through GDPR? I have. It talks a lot about "reasonable measures" and includes vast swaths of other laws while being very light on details. Compare to, for example, electrical codes. Those tend to be quite specific and clear with sharply limited room for interpretation. With this in mind, I can see why someone might regard this as an insane way to create laws.
  - Macha 4y ago
    Reasonable is a common term in laws, see for example the "reasonable person test" which is widespread in US civil law. Laws are not written like electrical codes in the most part because such specific laws either explicitly enumerate what is permissible (which is more ok for something like "acceptable methods of wiring a house" than "acceptable uses of data") or are rendered obsolete by the first thing the law writers didn't foresee ("Oh, the law bans tracking with cookies? Well we just have a server side database for UA+IP address combinations, so we don't need to comply" - in fact the first EU attempt at privacy law arguably failed for this reason)
ildon 4y ago
No court has decided over this. It's the decision of a regulator, so Meta will most likely appeal to a court, and then we will know what the law allows or not.
ErikVandeWater 4y ago
> To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means. The article makes it seem pretty straightforward: > Meta explained that its updated terms rely on the GDPR concept of "contractual necessity". The GDPR mostly prohibits companies from forcing users to turn over personal information to use their services. The only exception is when that information is necessary to execute a contract: For instance, a car sharing app needs to know your location so that it can show cars near you. For a car sharing app, it is necessary for them to get your location for the service to work. In Facebook's case, personalized ads are not necessary for Facebook to work. Since it isn't necessary, Facebook needs to get express permission to use personal information for ads. Facebook took an overly optimistic view of the law expecting regulatory capture to allow them to skirt the rules. It didn't work, so their investment was a poor one. Regulators didn't force Facebook to make a poor investment. Also, Facebook can decide to pay the users it tracks in Europe. Maybe the investment has poor returns, but the money hasn't entirely gone to waste yet.
detaro 4y ago
> No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better? Many would argue that that's what happened, Facebook choose to bet a few billions on trying to get around it by trying to argue loopholes into the interpretation and is now getting told to knock that off a bit more forcefully.
62951413 4y ago
Move fast and break things (C)
Zachsa999 4y ago
Are you a Facebook employee?
- johndhi 4y ago
  No. Never have been. Nor do I work in ad tech. I'm an attorney who interprets laws, including gdpr, for a tech company that does not engage in targeted advertising.
  - Zachsa999 4y ago
    Sorry, I just had to ask. I'll control myself better in the future
Krasnol 4y ago
> Then, some random guy says he doesn't think Facebook's interpretation is right This is not "some random guy". It's noyb and they're doing an important job. They not just "saying this and that" but do try to get the actual laws enforced which is what they did here. You can learn more about them here: https://noyb.eu/en/our-detailed-concept https://noyb.eu/en/our-detailed-concept The "random guy" you've probably actually meant is Max Schrems and his history is also quite noteworthy: https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
verisimi 4y ago
And to think, neither of these interpretations has anything to do with respecting my privacy, in a way that I think is fit! I should be able to choose complete privacy. Anything less, regardless of what corporations or government agencies say or agree, is illegitimate. And it shows that the governance agencies are illegitimate too. It shouldn't be that it is assumed I am a criminal and that as crimes occur online, my data should be collected. Not should it be assumed that my data should be monetisable by intermediaries.
Bombthecat 4y ago
Can't believe this is the top comment...
- Krasnol 4y ago
  I unfortunately expected just that. Protection of personal data is not something many in this bubble like to see since it threatens their products business model.
  - Macha 4y ago
    Indeed, the law is only confusing if what you're trying to understand from it is "How do I track my users for my own revenue model, who would not agree to be tracked if it was as easy to decline and they understood the options?" and don't want to accept the answer is "You don't"
    - MandieD 4y ago
      “It is difficult to get a man to understand something, when his salary depends on his not understanding it.” - Upton Sinclair
  - Bombthecat 4y ago
    It's not even that.. he also wants that laws can't be contested or reinterpreted...
senko 4y ago
> a law was put in place 5 years ago that said [...] with some very vague and general language [...]. > Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and [the law changes]. You've just described how US legal system works (case law - https://legaldictionary.net/case-law/ https://legaldictionary.net/case-law/) > just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better You've just described how US lobbying works.
matheusmoreira 4y ago
On the contrary, these laws are proving to be very efficient at stopping Facebook's abusive surveillance. The Facebook problem should be smashed. Hopefully Gooogle and the other Big Techs are next in line. All they have to do is stop collecting people's personal information, all their problems would go away. People don't want their surveillance capitalism abuse anymore. No one is interested in watching Facebook "discuss" the matter with regulators in order to massage it into a "compliant" form. We want Facebook's unconditional surrender on the matter, cease and desist all surveillance activities. We don't care how much money it will cost them, what they are doing is simply not acceptable and it has to stop.
epolanski 4y ago
You gotta be kidding defending a toxic and frequently illegal privacy abuser like Facebook. It's really not up to Facebook nor you to decide what is the "fair interpretation of the law".
zelphirkalt 4y ago
How about not rolling with ones own interpretation of the law, which coincidentally is very convenient for oneself? I mean, if they do not actually know for sure how a specific law is to be interpreted then better err on the side of caution, instead of becoming a criminal, violating the rights of many millions of people. Better take precautions in case ones convenient interpretation turns out to be BS. I am sure they made their business viable without all those violations of the law. They can just flip a switch now, and stop doing the bad thing, that they now know for sure is illegal :) But hey, that is just what I personally would consider an ethical approach, ha! Maybe not caring about the law and just continuing to ignore people's rights, being as invasive as possible to people's privacy, for as long as it is financially viable is the more ethical choice ...
ckastner 4y ago
> To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means. What? Article 7 par 4. GDPR [1], "Conditions for consent": When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. (emphasis mine) Personalizing ads is not necessary for providing the service, hence the forced consent is not given freely. To anyone involved with the GDPR back then, this was as clear as the day. Also, Article 7 par 3. clearly states that even if consent were given freely, the "data subject shall have the right to withdraw his or her consent at any time", and "[p]rior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.", which was clearly not on the table with Facebook. [1] https://gdpr.eu/article-7-how-to-get-consent-to-collect-personal-data/ https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...
_Algernon_ 4y ago
Considering FB's past behaviour (See Cambridge Analytica), the last thing they deserve is good faith treatment.
TheCoelacanth 4y ago
Facebook didn't have a leg to stand on. Their justification was utterly ridiculous. The only insane thing is that they made it this long.
tremon 4y ago
according to their fair reading of that law. If their "fair reading" of that law is about as accurate as the characterization in your post, it's no wonder they lose court case after court case about it.
tgsovlerkhgsel 4y ago
> very vague and general language about how consent can be gathered The language Art. 7 (https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/) may not be clear enough, but check out the recitals. Unless you're actively trying to skirt the edge (in which case you shouldn't act surprised if you find yourself on the wrong side of it), it's pretty clear. However, I think this article is slightly missing the point, as is your conclusion. (https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag... explains this a bit better.) Facebook wasn't trying to get consent through the fine print (that would be very obviously illegal). https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dispute-resolution-binding-decisions-regarding-facebook-instagram_en https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dis... says that the decision "settles ... the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising". Under GDPR, you need to have a valid legal basis for any data processing. This can be a) consent (which Facebook was not getting, nor claiming to get), b) doing only what's necessary for the performance of a contract, (some other things), and f) legitimate interests. Consent is the easiest: When you get it (properly), as you said, you can basically use data in any way. But getting consent properly means actually getting consent, not tricking, annoying or forcing the user into saying yes when they don't want to. Ad platforms tend to either try to claim consent without actually getting it in a valid way (because, surprise, most people don't want this), or they reach for the other justifications. While the advertising industry is trying to push to justify legitimate interest, anyone who has read the official EU interpretations (e.g. https://edpb.europa.eu/sites/default/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf https://edpb.europa.eu/sites/default/files/consultation/edpb... - page 16 point 50, referencing Page 47 in https://web.archive.org/web/20220305192156/https://ec.europa.eu/justice/Article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf https://web.archive.org/web/20220305192156/https://ec.europa...) would plainly see that you cannot use that to justify the kind of tracking that these ad networks do. I suspect Facebook has realized this because otherwise they would have claimed Legitimate Interest. Instead, they claimed that processing the personal data is "necessary for the performance of a contract". That is obvious bullshit, and the EDPB has now explicitly confirmed this. So I would recap it differently: - A law was put in place 5 years ago to protect people from exactly the kind of behavior Facebook wanted to engage in (intrusive tracking, wholesale collection of personal data). - Facebook has made a massive profit by violating the law, claiming to be merely skirting it, relying on creative interpretations that they must have known were "creative". - They have now been told that their creative interpretations are wrong and that they need to actually follow the law. (They will likely also have to pay a fine that is a fraction of the profit they made from violating the law.) - They can still do the thing they want, they'll just need to actually get voluntary user consent. Which they probably will not get in many ways, in particular because they're known for abusing the users and illegally misusing their data (see above). I agree that it's inefficient that they were allowed to do this for 5 years before being told to stop, but I don't think that's unfair to Facebook, to Facebook's detriment, or because Facebook couldn't have known. It's because Facebook correctly concluded that they will get away with, and profit from, violating the law until caught and stopped.
thiht 4y ago
> according to their fair reading of that law I get the feeling that you can bypass laws in the US based on technicalities and loopholes. In the EU, it’s the intent of the laws that matters, not how the words are written first degree. And the intent is pretty fucking clear: don’t mess with EU citizens private data. I can’t wait for Facebook to die and will never care that they spent billions trying to bypass EU laws for nothing.
webinvest 4y ago
A pessimistic take: Europe isn’t capable of producing that many good tech companies[1]. Thus the goal of these fines is to raise money by fining foreign companies. Under that lense, the system functions perfectly as it was designed. [1]source: a list of the largest tech companies sorted by market cap.

zapt02 4y ago

People who make laws can't see the future, it's a constant race to curb corporate behavior that is deemed unacceptable and the laws evolve as new loopholes are found and exploited. Corporations know this and take it into account when making a cost/benefit calculation. A while ago Facebook was threatening to pull out of the EU. When nobody cared they ponied up the tech required to stay. They will this time as well.

peoplefromibiza 4y ago
> People who make laws can't see the future People who make laws can see the future (yeah, sometimes they don't), it's the people that do not understand them and protest, because they do not see the immediate benefit for themselves, so the laws have to be changed to accomodate the snowflakes of the World. Making laws is about govern, not about futurism. A compromise has to be found every time a new law is proposed to be approved. See for example the ban on ICE engines, one side wanted it NOW the other side wanted it NEVER, truth is a good compromise was to accelerate as much as possible for some heavy user (Amazon alone, for example, is responsible for more than 20% of the global deliveries) and make some exception (5 years tops) for supercar luxury brands like Ferrari or Lamborghini, that sell a few thousands cars/ year. But things being as they are, people complained about Ferrari asking for an extension (for themselves and other luxury brands) but at the same time against the ban in general because everyone owns a car. The real problem is that people put in charge of making laws other people like them, not people better than them. It's a vicious circle. EDIT: the HN paradox: everyone knows what's bad, everyone has a very important job, but apparently things never improve because "politics". Maybe things are harder than what they look at first sight, from outside, and it's not about "people not seeing the future", but about the fact that the more a society is rich and established, the more changes are hard and people oppose to them. See for example how hard it is to convince American people that socialism is not a crime and USA could survive free health care paid by everyone's taxes. Does it mean that Americans are stupid and can't open Wikipedia and do a simple research, that they can't see the truth in front of their eyes, or that they are simply afraid of change, because the system works for a large part of the population, the same part of the population that basically runs the country and decides who gets elected?

Barrin92 4y ago

>No; we prefer to thrive by ignoring problems for a long time then smashing them with a hammer. and here I was thinking that breaking things and disruption is what Facebook in particular was super into. Sucks if it happens to you I guess. Laws and regulations aren't made by meeting Facebook representatives and then asking them what's convenient. Okay Facebook has invested billions of dollars, luckily they've also made billions of dollars. How much do you think traditional journalism, including all the positive externalities it entails has suffered from Facebook? They didn't seem to care, it's a legacy industry if I remember correctly. Car manufacturers all over the world have invested probably a hundred times as much in the combustion engine and the traditional car, it's going away as well. Like are we going to reimburse and invite everyone who has made anything we've decided we don't want any more?

tomrod 4y ago

This is called regulatory uncertainty and there is a long history to it. Its also part of why you want a stable polity that listens to the people it rules, why you want lobbying to be legal (but not bribery), and why you should be careful about building businesses in areas that have regulatory uncertainty. In terms of society, regulatory uncertainty better than no regulation, hands down, and is a spectrum whether the risk is too high to engage in the market profitably.

IanCal 4y ago

There's a very strong assumption that Facebook are operating in good faith. The article suggests you need actice consent, which is what a basic reading of gdpr rules would mean. I don't know why hiding it in the terms and conditions would possible be conpatible.

pulse7 4y ago

Facebook has many legal experts. They have surely consulted with them, before investing their billions... For them it is more profitable to "not comply and be caught" than to exit the business... Now they got caught and they will fight until the end - because they have many more billions to spend... Any business in any country is making a risk, that laws will change...

halestock 4y ago

> No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better? This would never work because Facebook is uninterested in making "the whole system better". Their entire goal is to make money off of user data, and they have zero incentive to work with governments that threaten that goal.

RubyRidgeRandy 4y ago
on the contrary, I think facebook and google have a huge incentive to work with different governing bodies to define what data is ok to collect and build identifiers around, and what is not. There is no way facebook would just throw up it's hands and say "we have no incentive to find a way to advertise to a population of 750 million people."
- CountSessine 4y ago
  Yes - especially if they can do this in a way that still makes them money but is expensive and burdensome to comply with. That would keep them in the game but seal the market off to potential competitors.
- hailwren 4y ago
  > There is no way facebook would just throw up it's hands and say "we have no incentive to find a way to advertise to a population of 750 million people." And yet, this is exactly what they do repeatedly [1] [2] [3]. 1 - https://www.vice.com/en/article/889pk3/facebook-threatens-to-pull-out-of-europe-if-it-doesnt-get-its-way https://www.vice.com/en/article/889pk3/facebook-threatens-to... 2 - https://www.exchangewire.com/blog/2022/02/08/facebook-threatens-to-leave-europe-if-data-sharing-with-us-ends/ https://www.exchangewire.com/blog/2022/02/08/facebook-threat... 3 - https://www.niemanlab.org/2019/01/google-is-threatening-to-kill-google-news-in-europe-if-the-eu-goes-ahead-with-its-snippet-tax/ https://www.niemanlab.org/2019/01/google-is-threatening-to-k...
  - 4y ago

RubyRidgeRandy 4y ago

It is crazy. If the EU just wants to fully outright ban advertising - then do it - but set a standard and stick to it.

wnoise 4y ago
Tracked advertising is not all advertising.
- RubyRidgeRandy 4y ago
  I didn't say it was. However, defining what is tracking and what is not is also an issue. Let's say facebook runs an ad on its platform to my website with a url of site.com/fbad. Then I can see how many people clicked on the ad on facebook and how many people converted on that webpage. There are people on this site who will tell you, and FULLY believe that that is TOO much tracking and is morally wrong.
  - kergonath 4y ago
    Incrementing a counter is not tracking. I don’t know where you’d find someone saying otherwise. However, keeping records associating the fact that something was clicked with personal identifying information, such as an IP address or a unique identifier, is tracking, and you need to ask for consent. What is and is not acceptable use of data related to a person is defined in the regulation.
ndsipa_pomu 4y ago
There's no problem with advertising, the issue is with companies misusing people's data. If a company wants to use targetted advertising then they just have to openly ask for consent to do so, but tying it up with the terms and conditions to use the site is hardly asking for consent.
kergonath 4y ago
> If the EU just wants to fully outright ban advertising Come on, don’t be obtuse. The problem is not advertising, the problem is tracking and using user data without consent. The fact that they do that for advertising is irrelevant. They would have the same issue if they were doing it for any other reason. > set a standard and stick to it That’s what they did. It’s called the GDPR. One can argue that enforcement was insufficient, but the standard has not changed.

ad404b8a372f2b9 4y ago

I'm impressed both by your outrage at requiring free, informed consent for tracking and personalized ads as well as this change resulting in "all of those billions [going to waste]". To me it means one of two possibilities: 1. Facebook is incompetent, not only did it spend billions developing lackluster practices that don't fit the spirit of the GDPR but that money also instantly disappears because they are apparently incapable of adding a prompt for tracking consent and evolving with the regulatory landscape like every other company on earth. or 2. Facebook relies on its relationship with its users being non-consensual.

A4ET8a8uTh0 4y ago
<<2. Facebook relies on its relationship with its users being non-consensual. Well, I am not certain FB tells users exactly the extent to which their online persona is being profiled. We have relatively vague lawyer talk for 'more targeted ads', but it does not tell you that FB identifies as a prime target for ads that would feature, say, a suffering animal. For the record, I am making it up, but inferences taken from massive amounts of posts people make daily make it highly unlikely that a detailed and thorough psychological profile that would normally require years of visiting an actual psychiatrist are now very much a possibility. And the only official indication of this we have comes from various FB court cases, but those being 1000s of pages of useful information is not an average person will go through, let alone understand. I forgot which company tried to shed some light on it with ads that used that info indicating to ad viewing person that "you are an X who likes Y". They got shot down fast. I guess my point is.. it may be consensual in the sense that user agreed, but did the user truly understood what he/she agreed to, is something I would argue against.
matheusmoreira 4y ago
> Facebook relies on its relationship with its users being non-consensual. Its very existence depends on it. Facebook is a company that builds shadow profiles of people who never joined the social network, never agreed to the terms of service and not even once consented to anything.

hnlmorg 4y ago

> Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law. So often in the last 20 years I’ve seen companies (and particularly US tech companies, but it’s not exclusive to them) deliberately read more charitable interpretation of the law, knowing they'll make millions over and above any fines they might receive. It’s so common place that there is even a saying for it: “ask for forgiveness not permission” So I have a hard time believing that Facebook, with their army of lawyers and millions earned from data collection, are the victims here.

gameman144 4y ago
It's definitely hard to say that big corporations are victims, but I know that I personally find lots of bog standard legalese hard to interpret. Granted, lawyers have a lot more experience there, and more employed gives lots more perspective. At the end of the day, they are still human, and laws and regulations are still written by humans, meaning that it can often be hard to suss out intent from the letter of the law.
- denton-scratch 4y ago
  > standard legalese hard to interpret Indeed. We should know what the law is, without first hiring a team of lawyers. There's a trend to make laws that are harder and harder for ordinary people to understand. Partly that's a result of having to cut out exceptions and loopholes for lobbyists and donors; but I suspect it's largely because lawmakers are increasingly trained, practising lawyers. If the language you speak is legalese, I guess that's the language you use to write laws.
  - ClumsyPilot 4y ago
    oh and the facebook EULA is easy to ubderstand and grants you make rights and protections?
  - zelphirkalt 4y ago
    Parts I read of GDPR were more approachable than any of the EULAs I have seen. More approachable than software licenses as well.

cramjabsyn 4y ago

On the contrary, it’s actually quite refreshing to see law that patches a loophole which was being exploited by a data mining company to enrich itself.

cormacrelf 4y ago
As a matter of process, this isn’t a new law. It’s the same law that was in place in 2018 when the first complaint was filed. The courts have only just decided what it means for this specific scenario. They decided you can’t rely on contractual necessity to excuse not presenting the user with a choice about whether to be tracked, just because Facebook’s business is tracking. Up until now Facebook had operated assuming they could. The main fault of the process is that it took 4.5 years. That’s 4.5 years of illegal revenue. Speed is justice. We all know this. It would have been preferable for the law to have been so clear that it didn’t take that long to argue. I forget the exact wording but I think it was pretty clear, and they just managed to draw it out long enough to turn more profit in the meantime. Possibly not so much a problem with lawmaking as with the litigation.

snotrockets 4y ago

Facebook interest is being ambiguously regulated. So no, you can't have fruitful discussion with them. History shows us the regulator always comes after the original culprits exploited what they could, never before.

kryptozinc 4y ago

Oh no, will someone think of the poor companies!

csomar 4y ago

You are not getting it. This is a fight for the money Facebook is generating. The court, the law, the administrations, the bureaucrats, the media, the lawyers, the judges are all complicit. Using the law to say, take over someone house without reason will be outrageous (though it does happen in "lesser" countries than the EU). But in the EU, you can still get people to look the other side if you explain it by Facebook is evil, Facebook is tracking you, Facebook is addicting you, Facebook is generating lots of money, etc... Of course, you have to realize, this is the same government that will sell your blood if they think they can make profit out of it. Welcome to the Jungle.

ndsipa_pomu 4y ago

GDPR requires consent for a specified usage of people's data. If you want to send people emails, then you need emailing consent. If you want to use people's data to target advertising, then you need to ask them for that consent. https://gdpr.eu/gdpr-consent-requirements/ https://gdpr.eu/gdpr-consent-requirements/ I'm doubtful that Facebook have been using a fair interpretation of the laws as that doesn't seem to be the way they operate. I'm also doubtful that users can easily revoke consent which is another requirement under GDPR.

newaccount74 4y ago

> Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law This is utter bullshit. They have tried to twist and bend the rules and tried to use an exception that doesn't apply to them at all. Everybody knew that Facebook went against the spirit of the law. Somehow they got the Irish authority to go along with their idiotic interpretation of the law, but that doesn't mean they were working "according to a fair reading of the law", it just means that the Irish authority failed to do their job. If Facebook had gone with a conservative reading of the law, like many other companies have, they would have added consent prompts 5 years ago, and they wouldn't have a problem today. I would suggest you spend some time reading the GDPR. It's surprisingly approachable. The parts about consent really aren't that hard to understand at all, and it's clear what the intention of the exceptions were (eg. a pizza delivery service obviously does not need to ask for consent to share the customer address with a delivery driver for the purpose of delivering the pizza, but they do need to ask for consent if they want to add the address to a direct mailing directory). It's unfortunate that it took the EU 5 years to do something about this obvious violation, but the problem is not the law itself.

stingraycharles 4y ago

> Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law. I think the crux is that they instead implemented a system according to their most favourable reading of that law. They took a calculated risk, it backfired a little bit (albeit after 5 years of using it to their advantage), and now they need to approach things differently. Business as usual.

matkoniecz 4y ago

> according to their fair reading of that law. I do not care at all what FB claims. They repeatedly lied, cheated (see 2 factor phone numbers) and deliberately misinterpreted law in insane ways. One of their attempts was putting serving interesting ads as service given to users and claiming that it means that they are obligated to track them.

bigbillheck 4y ago

> all of those billions of dollars have gone to waste 'Gone to waste' is the best possible outcome of money spent on advertising infrastructure.

jrm4 4y ago

What? No. This legal response is perfectly reasonable in light of the facts. "Having a real conversation" is clearly not how Facebook intends to operate. It has never been particularly open or forthcoming about how it handles data.

Macha 4y ago

> To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means. The "vague and general language": Article 7, paragraph 4: > When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/ Recital 42: > Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. 2In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. 3In accordance with Council Directive 93/13/EEC¹ a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. 4For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. 5Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. https://gdpr-info.eu/recitals/no-42/ https://gdpr-info.eu/recitals/no-42/ Facebook didn't like the business impact of complying so has spent years grasping at loopholes that don't exist in a law which is remarkably clear for legalese (especially EU legalese). The fault for that lies with Facebook, not the law making process.

Zak 4y ago
I am not a lawyer, a GDPR implementation specialist, or even a GDPR enthusiast and I knew this. Specifically, my understanding has always been that a company cannot demand consent to data storage and processing in exchange for providing a service except where the data is actually necessary to provide the service. It certainly isn't necessary to track what users do on other websites in order to provide Facebook's core product. It isn't even necessary to do that to provide ads targeted to a Facebook user's interests because people who use Facebook normally provide significant information about their interests through normal use of Facebook. There is no way that Facebook wasn't aware courts were likely to understand the law that way.

bryanrasmussen 4y ago

>Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and all of those billions of dollars have gone to waste. so when you say a crazy way of making laws, you mean the way that laws basically get made? >No regulator has had the idea of just going to Facebook, pretty sure there was all sorts of conversations with Facebook and others over at least 5 years where it was quite clear people wanted to fix privacy issues and it was also clear that it was in Facebook's financial interest that it not get fixed. >tried to draft a forward-looking law that will make the whole system better? Facebook doesn't want the system better, Facebook wants the system to benefit them. At some point these things are incompatible. No body has gone to a bank robber and tried to discuss with them how to best draft the laws on how to stop the robbing of banks, because of an intuitive understanding that it is not the bank robber's intention to help stop the robbing of banks. So when the law gets made to stop the robbing of banks, the bank robber than goes ahead and breaks it. Or in the case of Facebook they say we are obeying the law! But still try to do what the law wants them not to do. But I think this is the core of our disagreement here >according to their fair reading of that law I would say according to their desire to get around that law.

Kalium 4y ago
> so when you say a crazy way of making laws, you mean the way that laws basically get made? I think what's being characterized as crazy is that the laws as written are at best vague. It takes years to find out what they actually mean in implementable detail. This makes it very difficult to comply. Have you read through GDPR? I have. It talks a lot about "reasonable measures" and includes vast swaths of other laws while being very light on details. Compare to, for example, electrical codes. Those tend to be quite specific and clear with sharply limited room for interpretation. With this in mind, I can see why someone might regard this as an insane way to create laws.
- Macha 4y ago
  Reasonable is a common term in laws, see for example the "reasonable person test" which is widespread in US civil law. Laws are not written like electrical codes in the most part because such specific laws either explicitly enumerate what is permissible (which is more ok for something like "acceptable methods of wiring a house" than "acceptable uses of data") or are rendered obsolete by the first thing the law writers didn't foresee ("Oh, the law bans tracking with cookies? Well we just have a server side database for UA+IP address combinations, so we don't need to comply" - in fact the first EU attempt at privacy law arguably failed for this reason)

ildon 4y ago

No court has decided over this. It's the decision of a regulator, so Meta will most likely appeal to a court, and then we will know what the law allows or not.

ErikVandeWater 4y ago

> To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means. The article makes it seem pretty straightforward: > Meta explained that its updated terms rely on the GDPR concept of "contractual necessity". The GDPR mostly prohibits companies from forcing users to turn over personal information to use their services. The only exception is when that information is necessary to execute a contract: For instance, a car sharing app needs to know your location so that it can show cars near you. For a car sharing app, it is necessary for them to get your location for the service to work. In Facebook's case, personalized ads are not necessary for Facebook to work. Since it isn't necessary, Facebook needs to get express permission to use personal information for ads. Facebook took an overly optimistic view of the law expecting regulatory capture to allow them to skirt the rules. It didn't work, so their investment was a poor one. Regulators didn't force Facebook to make a poor investment. Also, Facebook can decide to pay the users it tracks in Europe. Maybe the investment has poor returns, but the money hasn't entirely gone to waste yet.

detaro 4y ago

> No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better? Many would argue that that's what happened, Facebook choose to bet a few billions on trying to get around it by trying to argue loopholes into the interpretation and is now getting told to knock that off a bit more forcefully.

62951413 4y ago

Move fast and break things (C)

Zachsa999 4y ago

Are you a Facebook employee?

johndhi 4y ago
No. Never have been. Nor do I work in ad tech. I'm an attorney who interprets laws, including gdpr, for a tech company that does not engage in targeted advertising.
- Zachsa999 4y ago
  Sorry, I just had to ask. I'll control myself better in the future

Krasnol 4y ago

> Then, some random guy says he doesn't think Facebook's interpretation is right This is not "some random guy". It's noyb and they're doing an important job. They not just "saying this and that" but do try to get the actual laws enforced which is what they did here. You can learn more about them here: https://noyb.eu/en/our-detailed-concept https://noyb.eu/en/our-detailed-concept The "random guy" you've probably actually meant is Max Schrems and his history is also quite noteworthy: https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems

verisimi 4y ago

And to think, neither of these interpretations has anything to do with respecting my privacy, in a way that I think is fit! I should be able to choose complete privacy. Anything less, regardless of what corporations or government agencies say or agree, is illegitimate. And it shows that the governance agencies are illegitimate too. It shouldn't be that it is assumed I am a criminal and that as crimes occur online, my data should be collected. Not should it be assumed that my data should be monetisable by intermediaries.

Bombthecat 4y ago

Can't believe this is the top comment...

Krasnol 4y ago
I unfortunately expected just that. Protection of personal data is not something many in this bubble like to see since it threatens their products business model.
- Macha 4y ago
  Indeed, the law is only confusing if what you're trying to understand from it is "How do I track my users for my own revenue model, who would not agree to be tracked if it was as easy to decline and they understood the options?" and don't want to accept the answer is "You don't"
  - MandieD 4y ago
    “It is difficult to get a man to understand something, when his salary depends on his not understanding it.” - Upton Sinclair
- Bombthecat 4y ago
  It's not even that.. he also wants that laws can't be contested or reinterpreted...

senko 4y ago

> a law was put in place 5 years ago that said [...] with some very vague and general language [...]. > Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and [the law changes]. You've just described how US legal system works (case law - https://legaldictionary.net/case-law/ https://legaldictionary.net/case-law/) > just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better You've just described how US lobbying works.

matheusmoreira 4y ago

On the contrary, these laws are proving to be very efficient at stopping Facebook's abusive surveillance. The Facebook problem should be smashed. Hopefully Gooogle and the other Big Techs are next in line. All they have to do is stop collecting people's personal information, all their problems would go away. People don't want their surveillance capitalism abuse anymore. No one is interested in watching Facebook "discuss" the matter with regulators in order to massage it into a "compliant" form. We want Facebook's unconditional surrender on the matter, cease and desist all surveillance activities. We don't care how much money it will cost them, what they are doing is simply not acceptable and it has to stop.

epolanski 4y ago

You gotta be kidding defending a toxic and frequently illegal privacy abuser like Facebook. It's really not up to Facebook nor you to decide what is the "fair interpretation of the law".

zelphirkalt 4y ago

How about not rolling with ones own interpretation of the law, which coincidentally is very convenient for oneself? I mean, if they do not actually know for sure how a specific law is to be interpreted then better err on the side of caution, instead of becoming a criminal, violating the rights of many millions of people. Better take precautions in case ones convenient interpretation turns out to be BS. I am sure they made their business viable without all those violations of the law. They can just flip a switch now, and stop doing the bad thing, that they now know for sure is illegal :) But hey, that is just what I personally would consider an ethical approach, ha! Maybe not caring about the law and just continuing to ignore people's rights, being as invasive as possible to people's privacy, for as long as it is financially viable is the more ethical choice ...

ckastner 4y ago

_Algernon_ 4y ago

Considering FB's past behaviour (See Cambridge Analytica), the last thing they deserve is good faith treatment.

TheCoelacanth 4y ago

Facebook didn't have a leg to stand on. Their justification was utterly ridiculous. The only insane thing is that they made it this long.

tremon 4y ago

according to their fair reading of that law. If their "fair reading" of that law is about as accurate as the characterization in your post, it's no wonder they lose court case after court case about it.

tgsovlerkhgsel 4y ago

> very vague and general language about how consent can be gathered The language Art. 7 (https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/) may not be clear enough, but check out the recitals. Unless you're actively trying to skirt the edge (in which case you shouldn't act surprised if you find yourself on the wrong side of it), it's pretty clear. However, I think this article is slightly missing the point, as is your conclusion. (https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag... explains this a bit better.) Facebook wasn't trying to get consent through the fine print (that would be very obviously illegal). https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dispute-resolution-binding-decisions-regarding-facebook-instagram_en https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dis... says that the decision "settles ... the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising". Under GDPR, you need to have a valid legal basis for any data processing. This can be a) consent (which Facebook was not getting, nor claiming to get), b) doing only what's necessary for the performance of a contract, (some other things), and f) legitimate interests. Consent is the easiest: When you get it (properly), as you said, you can basically use data in any way. But getting consent properly means actually getting consent, not tricking, annoying or forcing the user into saying yes when they don't want to. Ad platforms tend to either try to claim consent without actually getting it in a valid way (because, surprise, most people don't want this), or they reach for the other justifications. While the advertising industry is trying to push to justify legitimate interest, anyone who has read the official EU interpretations (e.g. https://edpb.europa.eu/sites/default/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf https://edpb.europa.eu/sites/default/files/consultation/edpb... - page 16 point 50, referencing Page 47 in https://web.archive.org/web/20220305192156/https://ec.europa.eu/justice/Article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf https://web.archive.org/web/20220305192156/https://ec.europa...) would plainly see that you cannot use that to justify the kind of tracking that these ad networks do. I suspect Facebook has realized this because otherwise they would have claimed Legitimate Interest. Instead, they claimed that processing the personal data is "necessary for the performance of a contract". That is obvious bullshit, and the EDPB has now explicitly confirmed this. So I would recap it differently: - A law was put in place 5 years ago to protect people from exactly the kind of behavior Facebook wanted to engage in (intrusive tracking, wholesale collection of personal data). - Facebook has made a massive profit by violating the law, claiming to be merely skirting it, relying on creative interpretations that they must have known were "creative". - They have now been told that their creative interpretations are wrong and that they need to actually follow the law. (They will likely also have to pay a fine that is a fraction of the profit they made from violating the law.) - They can still do the thing they want, they'll just need to actually get voluntary user consent. Which they probably will not get in many ways, in particular because they're known for abusing the users and illegally misusing their data (see above). I agree that it's inefficient that they were allowed to do this for 5 years before being told to stop, but I don't think that's unfair to Facebook, to Facebook's detriment, or because Facebook couldn't have known. It's because Facebook correctly concluded that they will get away with, and profit from, violating the law until caught and stopped.

thiht 4y ago

> according to their fair reading of that law I get the feeling that you can bypass laws in the US based on technicalities and loopholes. In the EU, it’s the intent of the laws that matters, not how the words are written first degree. And the intent is pretty fucking clear: don’t mess with EU citizens private data. I can’t wait for Facebook to die and will never care that they spent billions trying to bypass EU laws for nothing.

webinvest 4y ago

A pessimistic take: Europe isn’t capable of producing that many good tech companies[1]. Thus the goal of these fines is to raise money by fining foreign companies. Under that lense, the system functions perfectly as it was designed. [1]source: a list of the largest tech companies sorted by market cap.