5 ms·

I'm not totally sure that's allowed under GDPR. I know you can't say "consent to data collection or you can't use the website" [1]. So I doubt "consent to data

I'm not totally sure that's allowed under GDPR. I know you can't say "consent to data collection or you can't use the website" [1]. So I doubt "consent to data collection OR PAY or you can't use the website" is acceptable. [1] unless the data is needed for the website to work

JacobSeated 4y ago
The GDPR has failed to reach a balanced approach to the issues from the start. They failed to account for missing and much needed technology (uniform, automatic and consistent consent mechanisms), and failed considering anonymization technology used to deliver targeted ads. The most profound mistake is their lack of proper risk assessment, as well as proof and transparent documentation of real actual significant harm done to users, to warrant such discriminating privacy laws. In the process they are hurting everyone, including small personal blogs, news media sites, and large social media sites. The data, if hacked, or spied on by employees, is still a privacy risk regardless if its used for targeting ads or not. The data still sits on the servers, because the applications depend on it to function properly. The number of ecommerce websites alone that do not properly handle personal data is scary; basically anyone with database access can also access all the personal data on customers. If a given CMS has a known exploit, then the data is in great risk of being leaked and abused. E.g. Never host a site on Wordpress without proper security in place. Nevertheless. We should always maintain that the user is ultimately responsible. If they do not like Facebook, they just ought NOT to create a Facebook account. Dislike being watched when walking around in physical shops? Stay away from them. However, the actual risk to the individual user, from ads, is so miniscule that we practically have no substantive examples of harm done. The worst shit is falsehoods promoted via ads, but that is purely an policy/moderation problem. Fake pages and accounts are a much bigger problem than falsehoods promoted via ads. Having a paid subscription model would be a valid opt-out of advertising (ads are often dishonest, so I would like to see that). The problem is, the data still sits on servers, and if leaked, this will, unlike targeted ads, pose an actual real risk of harm. I am not against the GDPR or the EU, but it has been profoundly flawed from the beginning, costing website owners a lot of time and money trying to comply. I absolutely hate consent platforms, because they are just another third party dependency IMO...
rootusrootus 4y ago
What a world we live in where government has decreed that business must provide services for free. No wonder people vote for that.
- dmitriid 4y ago
  > What a world we live in where government has decreed that business must provide services for free. What the hell are you talking about? You can keep providing ads. If it's a paid service, you can keep providing a paid service. No one is asking you to do stuff for free.
- tgsovlerkhgsel 4y ago
  They don't have to provide the service. They can charge money for the service (but then they probably will go bankrupt because few people are willing to pay for it, because the service isn't that great). They can show ads on the service. They can even ask people to opt in to targeted advertising. What they can't do is harvest people's personal data to monetize the service. In other words: You can give away potatoes for free. You can sell potatoes for money. You can sell potatoes for onions. You can, in many countries, even sell potatoes for sexual favors, although there will be some rules to protect against exploitation. What you cannot do, in most countries, is sell potatoes for kidneys, and you most definitely can't sell potatoes while surreptitiously removing customer's kidneys and hoping they don't notice or care enough because they have two and you're only taking one.
sunderw 4y ago
I've seen this at least twice on the french websites jeuxvideo.com and marmiton.org. I may have seen more but do not remember. It think it's a gray area right now though.
starbugs 4y ago
Seems to be quite common practice for some news outlets here in Germany. I remember that I read a court decision stating that this would for some reason be acceptable. Not sure if it really is though.
- KarlKemp 4y ago
  That’s advertising, not targeted advertising, isn’t it?
  - tgsovlerkhgsel 4y ago
    Some of them give you the choice between "targeted advertising with tracking, free" and "completely ad-free, paid". Others give you the choice between targeted advertising and paying for non-targeted advertising, or three choices (free with targeted ads, paid with non-targeted ads, paid a lot with no ads).
- tgsovlerkhgsel 4y ago
  Common practice is no indicator for it being legal. Most of the consent dialogs were illegal, it just isn't being enforced. Note how the Google and Instagram consent dialogs changed in the past year or so. I'm sure that wasn't voluntary...
tgsovlerkhgsel 4y ago
This is not 100% clear. The Austrian DPA has declared it legal, which is why many are doing it: https://www.lexology.com/library/detail.aspx?g=6cdf29db-aa57-485b-a86d-d1e63ce732d1 https://www.lexology.com/library/detail.aspx?g=6cdf29db-aa57... This is currently being contested by NOYB.

JacobSeated 4y ago

The GDPR has failed to reach a balanced approach to the issues from the start. They failed to account for missing and much needed technology (uniform, automatic and consistent consent mechanisms), and failed considering anonymization technology used to deliver targeted ads. The most profound mistake is their lack of proper risk assessment, as well as proof and transparent documentation of real actual significant harm done to users, to warrant such discriminating privacy laws. In the process they are hurting everyone, including small personal blogs, news media sites, and large social media sites. The data, if hacked, or spied on by employees, is still a privacy risk regardless if its used for targeting ads or not. The data still sits on the servers, because the applications depend on it to function properly. The number of ecommerce websites alone that do not properly handle personal data is scary; basically anyone with database access can also access all the personal data on customers. If a given CMS has a known exploit, then the data is in great risk of being leaked and abused. E.g. Never host a site on Wordpress without proper security in place. Nevertheless. We should always maintain that the user is ultimately responsible. If they do not like Facebook, they just ought NOT to create a Facebook account. Dislike being watched when walking around in physical shops? Stay away from them. However, the actual risk to the individual user, from ads, is so miniscule that we practically have no substantive examples of harm done. The worst shit is falsehoods promoted via ads, but that is purely an policy/moderation problem. Fake pages and accounts are a much bigger problem than falsehoods promoted via ads. Having a paid subscription model would be a valid opt-out of advertising (ads are often dishonest, so I would like to see that). The problem is, the data still sits on servers, and if leaked, this will, unlike targeted ads, pose an actual real risk of harm. I am not against the GDPR or the EU, but it has been profoundly flawed from the beginning, costing website owners a lot of time and money trying to comply. I absolutely hate consent platforms, because they are just another third party dependency IMO...

rootusrootus 4y ago

What a world we live in where government has decreed that business must provide services for free. No wonder people vote for that.

dmitriid 4y ago
> What a world we live in where government has decreed that business must provide services for free. What the hell are you talking about? You can keep providing ads. If it's a paid service, you can keep providing a paid service. No one is asking you to do stuff for free.
tgsovlerkhgsel 4y ago
They don't have to provide the service. They can charge money for the service (but then they probably will go bankrupt because few people are willing to pay for it, because the service isn't that great). They can show ads on the service. They can even ask people to opt in to targeted advertising. What they can't do is harvest people's personal data to monetize the service. In other words: You can give away potatoes for free. You can sell potatoes for money. You can sell potatoes for onions. You can, in many countries, even sell potatoes for sexual favors, although there will be some rules to protect against exploitation. What you cannot do, in most countries, is sell potatoes for kidneys, and you most definitely can't sell potatoes while surreptitiously removing customer's kidneys and hoping they don't notice or care enough because they have two and you're only taking one.

sunderw 4y ago

I've seen this at least twice on the french websites jeuxvideo.com and marmiton.org. I may have seen more but do not remember. It think it's a gray area right now though.

starbugs 4y ago

Seems to be quite common practice for some news outlets here in Germany. I remember that I read a court decision stating that this would for some reason be acceptable. Not sure if it really is though.

KarlKemp 4y ago
That’s advertising, not targeted advertising, isn’t it?
- tgsovlerkhgsel 4y ago
  Some of them give you the choice between "targeted advertising with tracking, free" and "completely ad-free, paid". Others give you the choice between targeted advertising and paying for non-targeted advertising, or three choices (free with targeted ads, paid with non-targeted ads, paid a lot with no ads).
tgsovlerkhgsel 4y ago
Common practice is no indicator for it being legal. Most of the consent dialogs were illegal, it just isn't being enforced. Note how the Google and Instagram consent dialogs changed in the past year or so. I'm sure that wasn't voluntary...

tgsovlerkhgsel 4y ago

This is not 100% clear. The Austrian DPA has declared it legal, which is why many are doing it: https://www.lexology.com/library/detail.aspx?g=6cdf29db-aa57-485b-a86d-d1e63ce732d1 https://www.lexology.com/library/detail.aspx?g=6cdf29db-aa57... This is currently being contested by NOYB.