10 ms·

Can ads be GDPR compliant?

65 points by mhb 4y ago

082349872349872 4y ago
Broadcast ads would certainly be compliant. (...and if the advertiser pays for the spot, not per view, "fraud detection" becomes moot as well.)
- amluto 4y ago
  The “fraud” issue is then an issue is whether the placement is on a site that actually has rights to its content. Maybe this would make link farms and other spam sites uneconomical, which would be great.
- Macha 4y ago
  Also those embedded in video ads YouTubers or podcasts do (assuming they comply with other regulations like disclosing the sponsored nature). Online advertisers would explode if any online ad gave them viewability equivalent to the "the side of a bus", or "roadside billboards", only they can't measure it (but there are efforts to try with cameras on billboards in the industry), yet despite this buses and billboards actually carry a premium compared to internet ads because it's a less competitive market.
  - verdverm 4y ago
    Behind those sponsorships is likely non-gdpr compliant tracking so advertisers know the audience type. I think of it like magazine ads of yore
- samwillis 4y ago
  In the world of smart TVs, and internet connected set-top boxes for satellite and cable TV this is not the case. Increasingly linear TV ads are discreetly swapped out for personalised ads targeting you. > The creepy world of personalised ads is coming to your TV > Channel 4 and Virgin Media are adopting Sky's AdSmart advertising system. Sky says it can put viewers into groups of 5,000 or more based on age, location, lifestyle, and "even if they have a cat" https://www.wired.co.uk/article/personalisted-tv-adverts-sky-adsmart-channel-4 https://www.wired.co.uk/article/personalisted-tv-adverts-sky...
- emodendroket 4y ago
  That's a response more to the title than the content of the article.
  - 082349872349872 4y ago
    It's a response to both. Der Spiegel could allow unadvertised access to its subscribers, and untargeted access to the general public. Es könnte sein. Sure, "circulation" is not so well known, but was it ever exactly known for broadcast* television? free papers on trains? 50% of all advertising is worthless, anyway: to what extent do we have any idea that even fraud-detected CPM ever converts to actual sales? Why does anyone do "corporate identity" placement on PBS? Finally, I'd have no problems (hint: how many targeted placements do you see on this webiste?) if a certain percentage of the internet disappeared because it was not economic to continue it without targeted advertising "revenue". If the market speaks, then let the market speak. * my dorm was once a Nielsen household for a week or two. They were warned, but accepted 80 as our household size.
    - emodendroket 4y ago
      Nielsen ratings were a decent approximation and I would submit that the cost to print gave a certain incentive to try and get people to see the publication. With digital advertising it is easy to make many times more fake traffic than the site will ever have. To your other point, the "certain percentage" is most of it and we won't have all that much to discuss here.
      - 082349872349872 4y ago
        > most of it Maybe most of yours, not of mine. I'll miss YouTube, but not badly. (of the ~dozen other stories I've commented on today, only one would likely disappear: https://news.ycombinator.com/item?id=34296560 https://news.ycombinator.com/item?id=34296560 )
        emodendroket 4y ago
        So what’s the problem? If you think ad-supported sites aren’t worth visiting then don’t.
GeekyBear 4y ago
Ads predate surveillance capitalism, so of course they can. Base the ad on the web page content, not on constantly spying on everyone.
- emodendroket 4y ago
  "In the analog world, many homes are secured with a four-digit passcode. Therefore, a four-digit passcode should be sufficient to secure any Web account." This is the form of your argument.
  - alkonaut 4y ago
    No the argument is “therefore 4 digit passcode can also secure any web account” Which is true. It’s just not as secure, just like dumb ads wouldn’t be as profitable as todays’ ads. But no one is arguing they would be nearly as profitable. Or profitable at all. Only that they are possible. Maybe you get 5c where tug used to get $1. That’s fine! Take the 5c and just shut down the site if that isn’t enough. There will be new jobs in print advertising… And this IS the argument for by-the-letter GDPR interpretation of cookie wall laws, or proponents of Adblocking: we don’t think the problem is to somehow find a solution that respects privacy and at the same time doesn’t torpedo the whole ad-based economy. I just want ads not to spy on me and my regulators to do their job, even if 75% of “ad funded” content disappears tomorrow.
    - emodendroket 4y ago
      I don’t find the vision very inspiring.
      - GeekyBear 4y ago
        I don't put your desire for money ahead of everyone else's right to privacy. Not to mention the part where optimizing content for maximum ad impressions has led to the rise of extremist content and political infighting.
dmitriid 4y ago
Again Jeff pretends that there are no ads but personalized ads that require you to collect any and all user data without consent. Again Jeff pretends that data you need to collect to combat ad fraud can be freely used for any other purpose. Again Jeff deliberately misrepresents the facts of the court cases he links. Again Jeff makes it sound like Schrems is a bad ruling. And throughout this all he presents this misinformation, intentional misrepresentation, deliberate twists of meaning and falsehoods bordering on outright lies as fact. Jeff. Stop. Edit: comments to the blog post call all this out and provide additional analysis. I highly recommend reading through them.
janosdebugs 4y ago
Sadly, ads are not the only thing that is problematic. It's almost impossibke to find something as mundane as an e-mail service that will sign a data processing agreement with its customers.
- SpicyLemonZest 4y ago
  An email service seems like one of the businesses that would be most hesitant to sign such an agreement, given that the service involves sending personal messages with metadata attached in plaintext over the public Internet.
  - janosdebugs 4y ago
    Let's put it this way: I've read a whole lot of privacy policies over the last month and, except for one law firm, none of them even mention e-mail. If I was in the questionable business of suing people for this, I'd have a lot to do. E-mail can contain a whole lot of PII and almost nobody gives two flying MIME headers about safeguarding it.
- seanhunter 4y ago
  I'm not sure it's almost impossible. Let's look at the two biggest email providers out there. 1) GSuite. Here's their data processing terms https://cloud.google.com/terms/data-processing-addendum/index-20220630 https://cloud.google.com/terms/data-processing-addendum/inde... 2) Office365. Here you go https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=1 https://www.microsoft.com/licensing/docs/view/Microsoft-Prod... So both of them will absolutely sign one. Maybe you don't like google and microsoft. Let's look at some others. What about Fastmail? https://www.fastmail.help/hc/en-us/articles/6049922252943-Fastmail-Data-Protection-Policy https://www.fastmail.help/hc/en-us/articles/6049922252943-Fa... Basically any legitimate email service will sign a gdpr-compliant data processing agreement as far as I can see. Certainly all the ones I have ever used do.
  - janosd 4y ago
    All of these are US companies, in which case the GDPR explicitly states that I need to have additional contractual clauses to transfer the data to the US, which would be nice to avoid. Furthermore, recent court decisions have stated that I, as the data controller, need to take additional technical measures to protect the data being transfered... which I'm supposed to do how exactly with e-mail?
alerighi 4y ago
Yes you can. It was the norm in the first days of the internet, before big corporation like Meta and Google made us believe that in order to show ADS you need to track the user. Before one says "but if you don't track the user you cannot know how many user did see the AD and you cannot target the AD to the user preferences so no one will buy them", because nobody buys ADs on TV, radio and newspapers where you have the same one directional communication channel? Come on, they are only excuses to collect more user data...
- floss_silicate 4y ago
  Furthermore, both Google and Meta have quietly conceded that a lot of the digital attribution data they generate is pretty bunk. It’s why Meta developed Robyn, which uses MMM techniques that have long been used to measure effectiveness of traditional channels: https://github.com/facebookexperimental/Robyn https://github.com/facebookexperimental/Robyn
- lotu 4y ago
  In the early days of the internet click fraud was rampant, and it has only gotten more and more sophisticated. While you could still do advertising the overall value would probably be much less valuable.
  - danaris 4y ago
    "Click fraud" is still just a subversion of a dataset that was not available to pre-digital (print, radio, TV, billboard) ads. You do not need that information in order to run effective online ads. You've just been conditioned to believe it's necessary by DoubleClick, Google, et al.
  - youngtaff 4y ago
    Ad fraud is still pretty rampant now too - from outright fraud like Roku screen savers that click ads though to softer things like content sites that are written just to farm ads
  - alkonaut 4y ago
    I think this is the key: advertising not only risks becoming a lot less valuable, it should be a lot less valuable. Without pinpoint targeting, more irrelevant ads will be shown. That reduces value. Without lots of invasive tech, you can’t avoid fraud or track conversions. This also reduces value. This isn’t an unfortunate side effect of GDPR and adblockers.
britneybitch 4y ago
The article makes a big assumption that ads cannot exist without privacy violations, but that's simply not true. Print ads have existed for longer than the internet, and they're chosen based on the content, not the reader. If I'm reading an article about guitars, show me an ad for a guitar or pedal or amp. Easy. That would already be better than 99% of today's "targeted" ads.
- emodendroket 4y ago
  The argument is specific to electronic ads.
  - lucideer 4y ago
    It isn't. What the ad industry refers to as "fraud detection" is just abuse of a monitoring system they didn't have access to in print (pay per view/click) - print ads were still deemed effective even without assurance of per-individual revenue. There's no reason electronic ads couldn't've been treated the same - the only difference is advertisers have been allowed to develop surveillance to gain granular revenue insights (and anything abusing that system of surveillance is labelled "fraud") Ad fraud is only legitimately "fraud" if you accept the pervasive surveillance it's "defrauding" is legitimate to begin with.
    - emodendroket 4y ago
      I don't see how you figure. If I pay to put an ad in the New York Times, the circulation is not a secret. If I pay to put an ad in some Web site (or, worse, thousands of Web sites I don't know about in advance) then I have no insight whatsoever into how many impressions I'm getting if we decide it's illegitimate to try and measure traffic.
      - lucideer 4y ago
        You can measure traffic anonymously or pseudonymously without violating GDPR. Monitoring of traffic for a website owner is inarguably legitimate interest if even just for DOS protection. The tracking discussed in this article is not about traffic measurement, it's much deeper individual tracking. Also... > the circulation is not a secret Isn't it? Like yes, there's a published figure, but is it verifiable? If we're discussing potential for "fraud" here, I don't really see how there's any difference between online and print circulation.
iso1631 4y ago
HN has an advert on the front page right now -- PhotoRoom Is Hiring a Fullstack API Developer (OpenAPI, Python, React) in Paris (lever.co) Perfectly GDPR compliant (Many people on HN are fully invested in an industry built around personal informaiton theft so hate things like GDPR as it stop them extracting money from people hence the immediate downvotes)
- snowwrestler 4y ago
  In case folks don’t know, one of the benefits of being accepted to Ycombinator is that you can place hiring notices directly on the front page of HN. Notice how there is not a voting arrow next to the Photoroom post. It is basically an ad.
- emodendroket 4y ago
  Say I'm Der Spiegel. How does this model help me?
  - PeterisP 4y ago
    Der Spiegal can sell advertisers ad spots like these, without targeting to specific audiences (but targeting them to specific sections on your site, e.g. different ads next to sports news and fashion news), and without tracking who exactly views them, rather relying on general audience statistics (e.g. Nielsen-like surveys of what percentage of German consumers read Der Spiegel online). Perfectly GDPR-compliant, simple, and worked in practice for decades. Of course it's less lucrative than ads based on invasive surveillance, but if those get prohibited, that's a reasonable alternative.
    - jefftk 4y ago
      I discuss this in the post: Nielsen like surveys work when there are a small number of things people can be watching/readings/listening to. Der Spiegel may or may not be big enough for this, depending on how many people are in your panel, but a panel big enough to get good coverage across smaller sights is not practical.
  - 4y ago
endisneigh 4y ago
Another interesting question (perhaps even more so) is whether these regulations actually are beneficial. For example, let's say the EU just banned internet advertising in general. Would this hurt or benefit the EU? As for the question posed in the article, the answer is obviously yes. You don't need to track people to do online advertising. The issues of fraud and what not are separate. Sufficiently cheap ad space would still be desirable.
- KarlKemp 4y ago
  The EU isn’t going to ban online advertising, so the question isn’t that interesting. It sounds more like a slippery slope argument. What the EU privacy push has created is an incentive for ad networks to improve. What we are already seeing are strategies that preserve both privacy as well as a revenue stream using, for examples, cohorts or that strategy (whose name I seem to have forgotten) of adding some randomness to raw data that cancels out at the learning stage. These aren’t perfect, but it is an improvement.
  - endisneigh 4y ago
    I’m not sure you understand what a slippery slope argument is. Inherently there’s a trade off between personalization and effectiveness of advertising.
    - KarlKemp 4y ago
      Inherently there’s a trade-off between speed and safety of a car. Doesn’t mean you can’t improve safety for a given speed, given the right incentives.
      - endisneigh 4y ago
        The analogy doesn’t make any sense. Privacy is not inherently “safe” to begin with.
- emodendroket 4y ago
  > As for the question posed in the article, the answer is obviously yes. You don't need to track people to do online advertising. I think you will find the article raises some problems with that view.
amluto 4y ago
> and "brand", which is trying to influence your future purchases in a much less legible manner (drink more Coke). Brand advertising is where the biggest spending is, but because the purchases aren't tied to clicks it's very dependent on keeping down fraud. I find this part a bit surprising. Brand advertising surely cares about fraud when it’s done on a cost per impression model. But I expect that brand advertising’s effectiveness is more related to placements, not impressions. For example, Nike once famously reduced the number of swooshes they used because they thought that having too many diluted the brand. Similarly, a brand placement somewhere like a movie or an article might have high impact despite only being seen once per viewer, whereas a placement on a site that gets lots of intra-site clicks (like Amazon or some mediocre review site) will get many more impressions per viewer but likely less impact per viewer despite a higher number of impressions. So, with a cost per placement model, I would expect the simple forms of fraud to be much less relevant.
- williamcotton 4y ago
  In addition, “premium” placements and take-overs can be negotiated without metrics and just a flat fee making fraudulent impressions a non-issue entirely.
  - SpicyLemonZest 4y ago
    They can be. But when you say “premium placements” and “take-overs”, I hear “banner ads” and “pop-ups”. They didn’t go away for regulatory reasons so they can absolutely return if there’s a financial incentive to make them.
    - amluto 4y ago
      Banner ads? Maybe. But take a brand like Nike as an example. I can imagine Nike paying to put (one!) swoosh on an article on a site like ESPN. But Nike, if they’re doing their job right, would not want a swoosh to interrupt the reader’s experience — that’s the opposite of good branding. Consider FM radio as another example. Ads on most music stations are obnoxious. Sponsorships on NPR are generally much more subdued, take less time, and don’t try to stand out. (Oddly, NPR is quite obnoxious about their own fundraising placements. I wonder whether they would be more effective if they backed off a bit.)
AstixAndBelix 4y ago
Maybe someone can school me on this, but why can't website owners just specify which ads are displayed on their page? Like, if I had a blog about mountaineering I would like Google to only show ads about hiking gear, regardless of the cookies of the person visiting the website. Of course my CPM would be lower, but at least I won't need to track my users and I won't have baby formula or school supplies ads between my reviews of snow boots.
- Macha 4y ago
  Website owners can: https://support.google.com/admanager/answer/2913553#ad-content-targeting https://support.google.com/admanager/answer/2913553#ad-conte... They don't because it limits revenue It doesn't disable tracking by Google or advertisers, e.g. them noting that they saw user X on a hiking website and increasing the chance to display ads to them for hiking gear elsewhere on the internet
emodendroket 4y ago
The argument is interesting but I find it hard to believe EU regulators really wish to nuke the entire industry of ad-supported content.
- Asooka 4y ago
  > nuke the entire industry of ad-supported content God, I wish. Imagine a world of content with no ads, supported by willing payment, not data extortion. It's not even that far off, a lot of the people I follow make their money from subscriptions, donations and sponsorships.
  - emodendroket 4y ago
    Well, what's the point of... say, Hacker News... if I can only read publications I already subscribe to?
    - PeterisP 4y ago
      Most of the links I click on Hacker News are to content which the authors would make and publish even if their site had 0 ad revenue. A good publication on a website is a consequence of them building the thing or wanting to express an opinion, not putting the cart ahead of the horse and building or writing some crap just to attract random visitors and show them ads.
      - emodendroket 4y ago
        I see it as something of a problem that most of the world’s newspapers are “writing some crap just to attract random visitors and show them ads” if we’re deeming that model illegitimate.
        PeterisP 4y ago
        For the specific niche of Hacker News style tech content (there are many domains where it's different - e.g. actual local news/politics/etc), when a major newspaper or news site is linked, then it generally either republishes or rewrites some primary source, and we here would prefer to see a link to the original - e.g. the actual paper from the university or the project description from its author with all the nitty-gritty details, instead of a vague pop-sci rewrite to make it more palatable to a non-tech audience. And in those cases, yes, the news site is only writing about the content to push ads, and there is no reason to legitimize various intermediaries which do not add value.
anilakar 4y ago
> Allow Der Spiegel's approach where sites can let users choose between ads with personalization or paying a reasonable price for access, under the principle that this is a real choice. This would water down the whole GDPR since its primary function is to stop using PII as merchandise.
- SpicyLemonZest 4y ago
  Many people attempt to wishcast this goal onto the GDPR, so I can understand your confusion, but the GDPR itself says no such thing. The purpose of the regulation is to ensure that your data is protected and you have control over it; companies are explicitly permitted to use it for whatever purpose they’d like so long as you give free and informed consent to it.
  - PeterisP 4y ago
    The GDPR definition of "freely given consent" is explicitly written to exclude "sale of consent" - if you say that you'll give you $1 (or some other benefit) if you consent, then according to GDPR that consent is not freely given and thus does not grant you the right to use that PII. In essence, "GDPR consent" applies when people really want you to do that thing with their data, and does not apply if they'd rather not but it comes as a requirement for something else or "bundled" with something desirable. Also, if consent is the legal basis for processing, it must be possible to withdraw consent without any adverse consequence, so if e.g. you give a discounted subscription to people who gave consent, then you can't revoke that subscription or discount if the data subject withdraws that consent a minute later. If you say that you'll provide some service only if the user "consents", then GDPR presumes that the consent is not freely given (e.g. recital 43 of GDPR).
    - SpicyLemonZest 4y ago
      Which provision of the GDPR explicitly defines “freely given” to exclude “sale of consent”? Again, I know this is conventional wisdom that gets passed around a lot, but as far as I can tell it’s not present in the actual text of the regulation. e: I see a stealth edited reference to recital 43, which I hadn’t seen before and does seem to show I’m wrong here. Thanks for the reference.
rapnie 4y ago
ReadTheDocs have a sub-division called Ethical Ads, where targeting occurs based on the content of the page you are viewing, and are claimed to be privacy-respecting. Developers are the ones targeted by these ads. https://www.ethicalads.io/blog/2022/11/a-new-approach-to-content-based-targeting-for-advertising/ https://www.ethicalads.io/blog/2022/11/a-new-approach-to-con...
- hardwaresofton 4y ago
  I'm running ethicalads on my site (vadosware.io) and it's been pretty great so far (though I suspect revenue is much lower than other alternatives) -- they also have an open source server which they run an instance of and give you access to: https://github.com/readthedocs/ethical-ad-server https://github.com/readthedocs/ethical-ad-server Stats and lots of information about the advertisements and click rates/etc is available. Been pretty smooth sailing so far, was going to write about it in the future.
diffeomorphism 4y ago
Very basic question: Suppose in addition to the usual tracking ad for $X, you also offer "basic ads" with no tracking, no fraud protection etc., just a fixed ad shown for the same amount of time for $Y. How much less is Y? A half? A third? One hundredth? Follow up: Suppose the option for $X is ruled illegal. What is Y now?
- dns_snek 4y ago
  I'm somewhat skeptical of the figure but research from 2019 seems to suggest the difference is only around 4%. https://techcrunch.com/2019/05/31/targeted-ads-offer-little-extra-value-for-online-publishers-study-suggests/ https://techcrunch.com/2019/05/31/targeted-ads-offer-little-...
  - diffeomorphism 4y ago
    Where are you getting the 4% from? The most relevant part seems to be > [...] ads were sold with targeting attached, and advertisers were willing to pay a 60% premium for those ads. So, say $3 vs $2 or showing two tracking ads vs three basic ads. So tracking seems surprisingly useless for all the work involved?
    - dns_snek 4y ago
      That only shows they're mistakenly undervaluing basic ads. If advertisers lose 4% of revenue without tracking, it stands to reason they should pay ~4% less for those ads, not 40% less.
mik1998 4y ago
> Browsers could offer sites a way to verify that your users aren't bots without any personal data being sent off the device. A sufficiently memory-hard and ASIC-resistant proof of work scheme could be used here. But obviously, that implies some non-negligible load on the client.
- yjftsjthsd-h 4y ago
  I rather suspect that said PoW will either be cheap enough to be ineffective, or expensive enough to block phones (or perhaps just murder their batteries).
  - throwawaypos 4y ago
    How about PoS then? * Lock up, say, $5, in anonymous cryptocurrency like Monero * When visiting example.org, sign a message "example.org <current timestamp>" with your private key, and include the signed message in a request header * example.org can verify the signature (and the fact it's backed by $5) * example.org can also forward the signed messages to the advertiser as a proof of legitimate pageviews * if a bot farmer wants fake pageviews, they need to lock up separate $5 per bot (and if we're counting unique pageviews, then per pageview) edit: one gothca here is that sites could collect the signed messages to track users across sites. Perhaps there's a way to sign messages so that you prove you have $5, but not which $5 – I don't know.
- runnerup 4y ago
  I believe Private Access Tokens are the proposed solution using a cryptographic chip on-device like the TPM chips. https://blog.cloudflare.com/how-to-enable-private-access-tokens-in-ios-16-and-stop-seeing-captchas/ https://blog.cloudflare.com/how-to-enable-private-access-tok...
qwerty456127 4y ago
TV ads are GDPR-compliant, they still work and they even are targeted (by time and target audience). Just do the same on the web: You (or an ad aggregator network) can ask (by e-mail or automatically via an API) a specific website to show a specific ad without leaking any details about any specific visitor. You can still target safely by the website (target audience) and specific page, time, IP geolocation, for registered (at the website you advertise at) users also by the details they voluntarily provide (without leaking personalized details to you/aggregator).
- jefftk 4y ago
  I discuss this near the end of the post: a ratings approach (mostly) works for TV because there aren't very many channels, but there are so many sites that it wouldn't work well on the web. If you tried to make it work here it would require massive consolidation, even more than we already have.
  - qwerty456127 4y ago
    Of course web ad efficiency will drop if we stick to GDPR-compliant practices only. Perhaps reaching the target audience efficiently will become less accessible to small businesses. Yet this is not enough to question if GDPR-compliant web advertising is possible. Okay, the number of TV channels is small, I get your point. But there also are physical ads, e.g. billboards, subway posters, cards/booklets, local newspapers which often are focused to a small number of physical locations but still happen to generate enough revenue to sustain a business. There also are agencies which would put your ad on posters all over the country - ad aggregator networks can still work and manage the consolidation this way, we only want to hide viewer personal details from them, not to eliminate them completely. This will decrease significantly (yet not kill completely) targeting efficiency, make display/click price bargaining more subjective but that's all.
  - qwerty456127 4y ago
    By the way there is a direct counterpart to TV commercials in the web world: YouTube/Instagram/TikTok influences promoting sponsors' products by just mentioning them in their episodes. Apparently this works despite the fragmentation.
seydor 4y ago
Google and Meta wouldn't want to go back to contextual ads, because that invites competition. Their moat is their huge userbases and tracking pixels make advertisers feel like gods driving minions to sales. Everyone can make contextual advertising, but stalking users requires dominant-player status. OTOH we have places like youtube where content makers seem to make more money with sponsorships (which are like contextual ads) than with google's adsense. So it seems like it s time to call out the advertisers: Why haven't they ever taken a stand vis-a-vis stalker advertising? It also seems weird to me that advertisers are not being fined for targetting users even though they are the original perpetrators. I would like to be able to monetize my websites, but google and EU are both my enemy
- someweirdperson 4y ago
  > OTOH we have places like youtube where content makers seem to make more money with sponsorships (which are like contextual ads) than with google's adsense. Even if not more, it would be in addition to what the google way would generate. Or for those for which google won't pay due to copyright claims, it is the only way, in which case any sponsorship is more than google.
lucideer 4y ago
As many others have also commented here, I strongly disagree with the author's argument that fraud prevention is legitimate: the word "fraud" here is tantamount to propaganda - the only thing being defrauded is a system of surveillance that shouldn't exist to begin with, and that every non-internet form of advertising has done perfectly well without. The other argument about the Der Spiegel paywall-or-ads model is also tricky. I do understand where they're coming from, but the argument only holds in a theoretical situation of perfect knowledge (a visitor to your website fully understanding the implications of accepting ads). Requiring this level of consumer understanding isn't reasonable imo. This doesn't even work in Der Spiegel's favour: the only reason to offer the free ad-supported model is that they're forced to compete with free ad-supported alternatives. Otherwise the incentive to pay would be higher for visitors. Ultimately though, the biggest argument to allow things like the above is corruption: currently we're very slowly seeing the GDPR being enforced many years later in just one or two large cases. There are millions of potential cases that'll never be prosecuted, not only because doing so would generally be unviable (it could still be an effective disincentive) but also because there's massive amounts of government lobbying to disincentivise prosecution and to defund independent data protection offices (keeping the level of enforcement even further below what it should be).
mort96 4y ago
How is this even a question? Of course ads can be GDPR compliant! There's nothing non-compliant about putting some PNG with an ad on your site. The question being asked is, can spyware be made GDPR-compliant if we just get the user to hit "accept". That's a much more difficult question. But do not conflate adverts and spyware. It doesn't have to be this way.
rvba 4y ago
The author writes: "Allow ad fraud detection under >legitimate interest<, which is the key thing keeping ads from being practical under the GDPR." Unfortunately this approach means that shady companies will still break the law, since breaking the law would give them a very big advantage. All ads would just be bought via some company fronted in some country with no regulation, or by a chain of companies that appear and disappear. It could also be like "FTX" and "Alameda research" again - this time not tokens, but information about ads would be shared. You can easily see various ad companies coming out of nowhere - if they broke the law, their ads would work better, so everyone would jump there. Then the company would implode, so everyone would jump somewhere else. Other option, an option that I dont like, but still an option is a move towards requiring users to make accounts. This of course is not great, since nobody (including me) wants to make accounts. But then, you can send ads to groups of accounts, or include / exclude some accounts from seeing the ads. And you can show "ad 1", then "ad 2", then "ad 3" to users. It's a bit more like TV. Less targeted of course. Since nobody (?) does that does it mean that it is not effective, or that it breaks GDPR? On a side note: there are many apps that require you to have a subscription and show you the same few ads again and again. Do the advertisers really think that after I install app X, that I use for say 15 minutes per day - and I see the same damn add 5 times per use.. that I will buy the product? It makes me dislike their product and not want to ever buy it. Does this approach of showing the same ad again and again really work? (I can understand that it can make me want to buy a paid version of the app, which I did at some point, but it made me hate the advertised things). Also why do they even agree to show the same ad every few minutes?
college_physics 4y ago
Targeted ads are just the wedge that opened Pandora's box. You now have a an extremely wealthy constituency that has normalized the concept of tracking, collecting data and creating human behavioral models (and that politically that is an achievable business model)
- deleted 4y ago
  [deleted]
parasense 4y ago
I'd like to point out the OP's author gave many examples of both EU & US websites, explained how both are probably not GDPR compliant, and explained how the US sites have been sued. I did not read to the end, but from what I read there were no examples of any EU sites being sued/punished for GDPR compliance. That is a problem, because it seems quite clear the EU regulations are setup for the purpose of taxing foreign tech companies. One could argue the EU websites are de facto compliant, but the OP indicates otherwise. We get it.

65 points by mhb 4y ago

Broadcast ads would certainly be compliant. (...and if the advertiser pays for the spot, not per view, "fraud detection" becomes moot as well.)

amluto 4y ago
The “fraud” issue is then an issue is whether the placement is on a site that actually has rights to its content. Maybe this would make link farms and other spam sites uneconomical, which would be great.
Macha 4y ago
Also those embedded in video ads YouTubers or podcasts do (assuming they comply with other regulations like disclosing the sponsored nature). Online advertisers would explode if any online ad gave them viewability equivalent to the "the side of a bus", or "roadside billboards", only they can't measure it (but there are efforts to try with cameras on billboards in the industry), yet despite this buses and billboards actually carry a premium compared to internet ads because it's a less competitive market.
- verdverm 4y ago
  Behind those sponsorships is likely non-gdpr compliant tracking so advertisers know the audience type. I think of it like magazine ads of yore
samwillis 4y ago
In the world of smart TVs, and internet connected set-top boxes for satellite and cable TV this is not the case. Increasingly linear TV ads are discreetly swapped out for personalised ads targeting you. > The creepy world of personalised ads is coming to your TV > Channel 4 and Virgin Media are adopting Sky's AdSmart advertising system. Sky says it can put viewers into groups of 5,000 or more based on age, location, lifestyle, and "even if they have a cat" https://www.wired.co.uk/article/personalisted-tv-adverts-sky-adsmart-channel-4 https://www.wired.co.uk/article/personalisted-tv-adverts-sky...
emodendroket 4y ago
That's a response more to the title than the content of the article.
- 082349872349872 4y ago
  It's a response to both. Der Spiegel could allow unadvertised access to its subscribers, and untargeted access to the general public. Es könnte sein. Sure, "circulation" is not so well known, but was it ever exactly known for broadcast* television? free papers on trains? 50% of all advertising is worthless, anyway: to what extent do we have any idea that even fraud-detected CPM ever converts to actual sales? Why does anyone do "corporate identity" placement on PBS? Finally, I'd have no problems (hint: how many targeted placements do you see on this webiste?) if a certain percentage of the internet disappeared because it was not economic to continue it without targeted advertising "revenue". If the market speaks, then let the market speak. * my dorm was once a Nielsen household for a week or two. They were warned, but accepted 80 as our household size.
  - emodendroket 4y ago
    Nielsen ratings were a decent approximation and I would submit that the cost to print gave a certain incentive to try and get people to see the publication. With digital advertising it is easy to make many times more fake traffic than the site will ever have. To your other point, the "certain percentage" is most of it and we won't have all that much to discuss here.
    - 082349872349872 4y ago
      > most of it Maybe most of yours, not of mine. I'll miss YouTube, but not badly. (of the ~dozen other stories I've commented on today, only one would likely disappear: https://news.ycombinator.com/item?id=34296560 https://news.ycombinator.com/item?id=34296560 )
      - emodendroket 4y ago
        So what’s the problem? If you think ad-supported sites aren’t worth visiting then don’t.

GeekyBear 4y ago

Ads predate surveillance capitalism, so of course they can. Base the ad on the web page content, not on constantly spying on everyone.

emodendroket 4y ago
"In the analog world, many homes are secured with a four-digit passcode. Therefore, a four-digit passcode should be sufficient to secure any Web account." This is the form of your argument.
- alkonaut 4y ago
  No the argument is “therefore 4 digit passcode can also secure any web account” Which is true. It’s just not as secure, just like dumb ads wouldn’t be as profitable as todays’ ads. But no one is arguing they would be nearly as profitable. Or profitable at all. Only that they are possible. Maybe you get 5c where tug used to get $1. That’s fine! Take the 5c and just shut down the site if that isn’t enough. There will be new jobs in print advertising… And this IS the argument for by-the-letter GDPR interpretation of cookie wall laws, or proponents of Adblocking: we don’t think the problem is to somehow find a solution that respects privacy and at the same time doesn’t torpedo the whole ad-based economy. I just want ads not to spy on me and my regulators to do their job, even if 75% of “ad funded” content disappears tomorrow.
  - emodendroket 4y ago
    I don’t find the vision very inspiring.
    - GeekyBear 4y ago
      I don't put your desire for money ahead of everyone else's right to privacy. Not to mention the part where optimizing content for maximum ad impressions has led to the rise of extremist content and political infighting.

dmitriid 4y ago

Again Jeff pretends that there are no ads but personalized ads that require you to collect any and all user data without consent. Again Jeff pretends that data you need to collect to combat ad fraud can be freely used for any other purpose. Again Jeff deliberately misrepresents the facts of the court cases he links. Again Jeff makes it sound like Schrems is a bad ruling. And throughout this all he presents this misinformation, intentional misrepresentation, deliberate twists of meaning and falsehoods bordering on outright lies as fact. Jeff. Stop. Edit: comments to the blog post call all this out and provide additional analysis. I highly recommend reading through them.

janosdebugs 4y ago

Sadly, ads are not the only thing that is problematic. It's almost impossibke to find something as mundane as an e-mail service that will sign a data processing agreement with its customers.

SpicyLemonZest 4y ago
An email service seems like one of the businesses that would be most hesitant to sign such an agreement, given that the service involves sending personal messages with metadata attached in plaintext over the public Internet.
- janosdebugs 4y ago
  Let's put it this way: I've read a whole lot of privacy policies over the last month and, except for one law firm, none of them even mention e-mail. If I was in the questionable business of suing people for this, I'd have a lot to do. E-mail can contain a whole lot of PII and almost nobody gives two flying MIME headers about safeguarding it.
seanhunter 4y ago
I'm not sure it's almost impossible. Let's look at the two biggest email providers out there. 1) GSuite. Here's their data processing terms https://cloud.google.com/terms/data-processing-addendum/index-20220630 https://cloud.google.com/terms/data-processing-addendum/inde... 2) Office365. Here you go https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=1 https://www.microsoft.com/licensing/docs/view/Microsoft-Prod... So both of them will absolutely sign one. Maybe you don't like google and microsoft. Let's look at some others. What about Fastmail? https://www.fastmail.help/hc/en-us/articles/6049922252943-Fastmail-Data-Protection-Policy https://www.fastmail.help/hc/en-us/articles/6049922252943-Fa... Basically any legitimate email service will sign a gdpr-compliant data processing agreement as far as I can see. Certainly all the ones I have ever used do.
- janosd 4y ago
  All of these are US companies, in which case the GDPR explicitly states that I need to have additional contractual clauses to transfer the data to the US, which would be nice to avoid. Furthermore, recent court decisions have stated that I, as the data controller, need to take additional technical measures to protect the data being transfered... which I'm supposed to do how exactly with e-mail?

alerighi 4y ago

Yes you can. It was the norm in the first days of the internet, before big corporation like Meta and Google made us believe that in order to show ADS you need to track the user. Before one says "but if you don't track the user you cannot know how many user did see the AD and you cannot target the AD to the user preferences so no one will buy them", because nobody buys ADs on TV, radio and newspapers where you have the same one directional communication channel? Come on, they are only excuses to collect more user data...

floss_silicate 4y ago
Furthermore, both Google and Meta have quietly conceded that a lot of the digital attribution data they generate is pretty bunk. It’s why Meta developed Robyn, which uses MMM techniques that have long been used to measure effectiveness of traditional channels: https://github.com/facebookexperimental/Robyn https://github.com/facebookexperimental/Robyn
lotu 4y ago
In the early days of the internet click fraud was rampant, and it has only gotten more and more sophisticated. While you could still do advertising the overall value would probably be much less valuable.
- danaris 4y ago
  "Click fraud" is still just a subversion of a dataset that was not available to pre-digital (print, radio, TV, billboard) ads. You do not need that information in order to run effective online ads. You've just been conditioned to believe it's necessary by DoubleClick, Google, et al.
- youngtaff 4y ago
  Ad fraud is still pretty rampant now too - from outright fraud like Roku screen savers that click ads though to softer things like content sites that are written just to farm ads
- alkonaut 4y ago
  I think this is the key: advertising not only risks becoming a lot less valuable, it should be a lot less valuable. Without pinpoint targeting, more irrelevant ads will be shown. That reduces value. Without lots of invasive tech, you can’t avoid fraud or track conversions. This also reduces value. This isn’t an unfortunate side effect of GDPR and adblockers.

britneybitch 4y ago

The article makes a big assumption that ads cannot exist without privacy violations, but that's simply not true. Print ads have existed for longer than the internet, and they're chosen based on the content, not the reader. If I'm reading an article about guitars, show me an ad for a guitar or pedal or amp. Easy. That would already be better than 99% of today's "targeted" ads.

emodendroket 4y ago
The argument is specific to electronic ads.
- lucideer 4y ago
  It isn't. What the ad industry refers to as "fraud detection" is just abuse of a monitoring system they didn't have access to in print (pay per view/click) - print ads were still deemed effective even without assurance of per-individual revenue. There's no reason electronic ads couldn't've been treated the same - the only difference is advertisers have been allowed to develop surveillance to gain granular revenue insights (and anything abusing that system of surveillance is labelled "fraud") Ad fraud is only legitimately "fraud" if you accept the pervasive surveillance it's "defrauding" is legitimate to begin with.
  - emodendroket 4y ago
    I don't see how you figure. If I pay to put an ad in the New York Times, the circulation is not a secret. If I pay to put an ad in some Web site (or, worse, thousands of Web sites I don't know about in advance) then I have no insight whatsoever into how many impressions I'm getting if we decide it's illegitimate to try and measure traffic.
    - lucideer 4y ago
      You can measure traffic anonymously or pseudonymously without violating GDPR. Monitoring of traffic for a website owner is inarguably legitimate interest if even just for DOS protection. The tracking discussed in this article is not about traffic measurement, it's much deeper individual tracking. Also... > the circulation is not a secret Isn't it? Like yes, there's a published figure, but is it verifiable? If we're discussing potential for "fraud" here, I don't really see how there's any difference between online and print circulation.

iso1631 4y ago

HN has an advert on the front page right now -- PhotoRoom Is Hiring a Fullstack API Developer (OpenAPI, Python, React) in Paris (lever.co) Perfectly GDPR compliant (Many people on HN are fully invested in an industry built around personal informaiton theft so hate things like GDPR as it stop them extracting money from people hence the immediate downvotes)

snowwrestler 4y ago
In case folks don’t know, one of the benefits of being accepted to Ycombinator is that you can place hiring notices directly on the front page of HN. Notice how there is not a voting arrow next to the Photoroom post. It is basically an ad.
emodendroket 4y ago
Say I'm Der Spiegel. How does this model help me?
- PeterisP 4y ago
  Der Spiegal can sell advertisers ad spots like these, without targeting to specific audiences (but targeting them to specific sections on your site, e.g. different ads next to sports news and fashion news), and without tracking who exactly views them, rather relying on general audience statistics (e.g. Nielsen-like surveys of what percentage of German consumers read Der Spiegel online). Perfectly GDPR-compliant, simple, and worked in practice for decades. Of course it's less lucrative than ads based on invasive surveillance, but if those get prohibited, that's a reasonable alternative.
  - jefftk 4y ago
    I discuss this in the post: Nielsen like surveys work when there are a small number of things people can be watching/readings/listening to. Der Spiegel may or may not be big enough for this, depending on how many people are in your panel, but a panel big enough to get good coverage across smaller sights is not practical.
- 4y ago

endisneigh 4y ago

Another interesting question (perhaps even more so) is whether these regulations actually are beneficial. For example, let's say the EU just banned internet advertising in general. Would this hurt or benefit the EU? As for the question posed in the article, the answer is obviously yes. You don't need to track people to do online advertising. The issues of fraud and what not are separate. Sufficiently cheap ad space would still be desirable.

KarlKemp 4y ago
The EU isn’t going to ban online advertising, so the question isn’t that interesting. It sounds more like a slippery slope argument. What the EU privacy push has created is an incentive for ad networks to improve. What we are already seeing are strategies that preserve both privacy as well as a revenue stream using, for examples, cohorts or that strategy (whose name I seem to have forgotten) of adding some randomness to raw data that cancels out at the learning stage. These aren’t perfect, but it is an improvement.
- endisneigh 4y ago
  I’m not sure you understand what a slippery slope argument is. Inherently there’s a trade off between personalization and effectiveness of advertising.
  - KarlKemp 4y ago
    Inherently there’s a trade-off between speed and safety of a car. Doesn’t mean you can’t improve safety for a given speed, given the right incentives.
    - endisneigh 4y ago
      The analogy doesn’t make any sense. Privacy is not inherently “safe” to begin with.
emodendroket 4y ago
> As for the question posed in the article, the answer is obviously yes. You don't need to track people to do online advertising. I think you will find the article raises some problems with that view.

amluto 4y ago

> and "brand", which is trying to influence your future purchases in a much less legible manner (drink more Coke). Brand advertising is where the biggest spending is, but because the purchases aren't tied to clicks it's very dependent on keeping down fraud. I find this part a bit surprising. Brand advertising surely cares about fraud when it’s done on a cost per impression model. But I expect that brand advertising’s effectiveness is more related to placements, not impressions. For example, Nike once famously reduced the number of swooshes they used because they thought that having too many diluted the brand. Similarly, a brand placement somewhere like a movie or an article might have high impact despite only being seen once per viewer, whereas a placement on a site that gets lots of intra-site clicks (like Amazon or some mediocre review site) will get many more impressions per viewer but likely less impact per viewer despite a higher number of impressions. So, with a cost per placement model, I would expect the simple forms of fraud to be much less relevant.

williamcotton 4y ago
In addition, “premium” placements and take-overs can be negotiated without metrics and just a flat fee making fraudulent impressions a non-issue entirely.
- SpicyLemonZest 4y ago
  They can be. But when you say “premium placements” and “take-overs”, I hear “banner ads” and “pop-ups”. They didn’t go away for regulatory reasons so they can absolutely return if there’s a financial incentive to make them.
  - amluto 4y ago
    Banner ads? Maybe. But take a brand like Nike as an example. I can imagine Nike paying to put (one!) swoosh on an article on a site like ESPN. But Nike, if they’re doing their job right, would not want a swoosh to interrupt the reader’s experience — that’s the opposite of good branding. Consider FM radio as another example. Ads on most music stations are obnoxious. Sponsorships on NPR are generally much more subdued, take less time, and don’t try to stand out. (Oddly, NPR is quite obnoxious about their own fundraising placements. I wonder whether they would be more effective if they backed off a bit.)

AstixAndBelix 4y ago

Maybe someone can school me on this, but why can't website owners just specify which ads are displayed on their page? Like, if I had a blog about mountaineering I would like Google to only show ads about hiking gear, regardless of the cookies of the person visiting the website. Of course my CPM would be lower, but at least I won't need to track my users and I won't have baby formula or school supplies ads between my reviews of snow boots.

Macha 4y ago
Website owners can: https://support.google.com/admanager/answer/2913553#ad-content-targeting https://support.google.com/admanager/answer/2913553#ad-conte... They don't because it limits revenue It doesn't disable tracking by Google or advertisers, e.g. them noting that they saw user X on a hiking website and increasing the chance to display ads to them for hiking gear elsewhere on the internet

emodendroket 4y ago

The argument is interesting but I find it hard to believe EU regulators really wish to nuke the entire industry of ad-supported content.

Asooka 4y ago
> nuke the entire industry of ad-supported content God, I wish. Imagine a world of content with no ads, supported by willing payment, not data extortion. It's not even that far off, a lot of the people I follow make their money from subscriptions, donations and sponsorships.
- emodendroket 4y ago
  Well, what's the point of... say, Hacker News... if I can only read publications I already subscribe to?
  - PeterisP 4y ago
    Most of the links I click on Hacker News are to content which the authors would make and publish even if their site had 0 ad revenue. A good publication on a website is a consequence of them building the thing or wanting to express an opinion, not putting the cart ahead of the horse and building or writing some crap just to attract random visitors and show them ads.
    - emodendroket 4y ago
      I see it as something of a problem that most of the world’s newspapers are “writing some crap just to attract random visitors and show them ads” if we’re deeming that model illegitimate.
      - PeterisP 4y ago
        For the specific niche of Hacker News style tech content (there are many domains where it's different - e.g. actual local news/politics/etc), when a major newspaper or news site is linked, then it generally either republishes or rewrites some primary source, and we here would prefer to see a link to the original - e.g. the actual paper from the university or the project description from its author with all the nitty-gritty details, instead of a vague pop-sci rewrite to make it more palatable to a non-tech audience. And in those cases, yes, the news site is only writing about the content to push ads, and there is no reason to legitimize various intermediaries which do not add value.

anilakar 4y ago

> Allow Der Spiegel's approach where sites can let users choose between ads with personalization or paying a reasonable price for access, under the principle that this is a real choice. This would water down the whole GDPR since its primary function is to stop using PII as merchandise.

SpicyLemonZest 4y ago
Many people attempt to wishcast this goal onto the GDPR, so I can understand your confusion, but the GDPR itself says no such thing. The purpose of the regulation is to ensure that your data is protected and you have control over it; companies are explicitly permitted to use it for whatever purpose they’d like so long as you give free and informed consent to it.
- PeterisP 4y ago
  The GDPR definition of "freely given consent" is explicitly written to exclude "sale of consent" - if you say that you'll give you $1 (or some other benefit) if you consent, then according to GDPR that consent is not freely given and thus does not grant you the right to use that PII. In essence, "GDPR consent" applies when people really want you to do that thing with their data, and does not apply if they'd rather not but it comes as a requirement for something else or "bundled" with something desirable. Also, if consent is the legal basis for processing, it must be possible to withdraw consent without any adverse consequence, so if e.g. you give a discounted subscription to people who gave consent, then you can't revoke that subscription or discount if the data subject withdraws that consent a minute later. If you say that you'll provide some service only if the user "consents", then GDPR presumes that the consent is not freely given (e.g. recital 43 of GDPR).
  - SpicyLemonZest 4y ago
    Which provision of the GDPR explicitly defines “freely given” to exclude “sale of consent”? Again, I know this is conventional wisdom that gets passed around a lot, but as far as I can tell it’s not present in the actual text of the regulation. e: I see a stealth edited reference to recital 43, which I hadn’t seen before and does seem to show I’m wrong here. Thanks for the reference.

rapnie 4y ago

ReadTheDocs have a sub-division called Ethical Ads, where targeting occurs based on the content of the page you are viewing, and are claimed to be privacy-respecting. Developers are the ones targeted by these ads. https://www.ethicalads.io/blog/2022/11/a-new-approach-to-content-based-targeting-for-advertising/ https://www.ethicalads.io/blog/2022/11/a-new-approach-to-con...

hardwaresofton 4y ago
I'm running ethicalads on my site (vadosware.io) and it's been pretty great so far (though I suspect revenue is much lower than other alternatives) -- they also have an open source server which they run an instance of and give you access to: https://github.com/readthedocs/ethical-ad-server https://github.com/readthedocs/ethical-ad-server Stats and lots of information about the advertisements and click rates/etc is available. Been pretty smooth sailing so far, was going to write about it in the future.

diffeomorphism 4y ago

Very basic question: Suppose in addition to the usual tracking ad for $X, you also offer "basic ads" with no tracking, no fraud protection etc., just a fixed ad shown for the same amount of time for $Y. How much less is Y? A half? A third? One hundredth? Follow up: Suppose the option for $X is ruled illegal. What is Y now?

dns_snek 4y ago
I'm somewhat skeptical of the figure but research from 2019 seems to suggest the difference is only around 4%. https://techcrunch.com/2019/05/31/targeted-ads-offer-little-extra-value-for-online-publishers-study-suggests/ https://techcrunch.com/2019/05/31/targeted-ads-offer-little-...
- diffeomorphism 4y ago
  Where are you getting the 4% from? The most relevant part seems to be > [...] ads were sold with targeting attached, and advertisers were willing to pay a 60% premium for those ads. So, say $3 vs $2 or showing two tracking ads vs three basic ads. So tracking seems surprisingly useless for all the work involved?
  - dns_snek 4y ago
    That only shows they're mistakenly undervaluing basic ads. If advertisers lose 4% of revenue without tracking, it stands to reason they should pay ~4% less for those ads, not 40% less.

mik1998 4y ago

> Browsers could offer sites a way to verify that your users aren't bots without any personal data being sent off the device. A sufficiently memory-hard and ASIC-resistant proof of work scheme could be used here. But obviously, that implies some non-negligible load on the client.

yjftsjthsd-h 4y ago
I rather suspect that said PoW will either be cheap enough to be ineffective, or expensive enough to block phones (or perhaps just murder their batteries).
- throwawaypos 4y ago
  How about PoS then? * Lock up, say, $5, in anonymous cryptocurrency like Monero * When visiting example.org, sign a message "example.org <current timestamp>" with your private key, and include the signed message in a request header * example.org can verify the signature (and the fact it's backed by $5) * example.org can also forward the signed messages to the advertiser as a proof of legitimate pageviews * if a bot farmer wants fake pageviews, they need to lock up separate $5 per bot (and if we're counting unique pageviews, then per pageview) edit: one gothca here is that sites could collect the signed messages to track users across sites. Perhaps there's a way to sign messages so that you prove you have $5, but not which $5 – I don't know.
runnerup 4y ago
I believe Private Access Tokens are the proposed solution using a cryptographic chip on-device like the TPM chips. https://blog.cloudflare.com/how-to-enable-private-access-tokens-in-ios-16-and-stop-seeing-captchas/ https://blog.cloudflare.com/how-to-enable-private-access-tok...

qwerty456127 4y ago

TV ads are GDPR-compliant, they still work and they even are targeted (by time and target audience). Just do the same on the web: You (or an ad aggregator network) can ask (by e-mail or automatically via an API) a specific website to show a specific ad without leaking any details about any specific visitor. You can still target safely by the website (target audience) and specific page, time, IP geolocation, for registered (at the website you advertise at) users also by the details they voluntarily provide (without leaking personalized details to you/aggregator).

jefftk 4y ago
I discuss this near the end of the post: a ratings approach (mostly) works for TV because there aren't very many channels, but there are so many sites that it wouldn't work well on the web. If you tried to make it work here it would require massive consolidation, even more than we already have.
- qwerty456127 4y ago
  Of course web ad efficiency will drop if we stick to GDPR-compliant practices only. Perhaps reaching the target audience efficiently will become less accessible to small businesses. Yet this is not enough to question if GDPR-compliant web advertising is possible. Okay, the number of TV channels is small, I get your point. But there also are physical ads, e.g. billboards, subway posters, cards/booklets, local newspapers which often are focused to a small number of physical locations but still happen to generate enough revenue to sustain a business. There also are agencies which would put your ad on posters all over the country - ad aggregator networks can still work and manage the consolidation this way, we only want to hide viewer personal details from them, not to eliminate them completely. This will decrease significantly (yet not kill completely) targeting efficiency, make display/click price bargaining more subjective but that's all.
- qwerty456127 4y ago
  By the way there is a direct counterpart to TV commercials in the web world: YouTube/Instagram/TikTok influences promoting sponsors' products by just mentioning them in their episodes. Apparently this works despite the fragmentation.

seydor 4y ago

Google and Meta wouldn't want to go back to contextual ads, because that invites competition. Their moat is their huge userbases and tracking pixels make advertisers feel like gods driving minions to sales. Everyone can make contextual advertising, but stalking users requires dominant-player status. OTOH we have places like youtube where content makers seem to make more money with sponsorships (which are like contextual ads) than with google's adsense. So it seems like it s time to call out the advertisers: Why haven't they ever taken a stand vis-a-vis stalker advertising? It also seems weird to me that advertisers are not being fined for targetting users even though they are the original perpetrators. I would like to be able to monetize my websites, but google and EU are both my enemy

someweirdperson 4y ago
> OTOH we have places like youtube where content makers seem to make more money with sponsorships (which are like contextual ads) than with google's adsense. Even if not more, it would be in addition to what the google way would generate. Or for those for which google won't pay due to copyright claims, it is the only way, in which case any sponsorship is more than google.

lucideer 4y ago

As many others have also commented here, I strongly disagree with the author's argument that fraud prevention is legitimate: the word "fraud" here is tantamount to propaganda - the only thing being defrauded is a system of surveillance that shouldn't exist to begin with, and that every non-internet form of advertising has done perfectly well without. The other argument about the Der Spiegel paywall-or-ads model is also tricky. I do understand where they're coming from, but the argument only holds in a theoretical situation of perfect knowledge (a visitor to your website fully understanding the implications of accepting ads). Requiring this level of consumer understanding isn't reasonable imo. This doesn't even work in Der Spiegel's favour: the only reason to offer the free ad-supported model is that they're forced to compete with free ad-supported alternatives. Otherwise the incentive to pay would be higher for visitors. Ultimately though, the biggest argument to allow things like the above is corruption: currently we're very slowly seeing the GDPR being enforced many years later in just one or two large cases. There are millions of potential cases that'll never be prosecuted, not only because doing so would generally be unviable (it could still be an effective disincentive) but also because there's massive amounts of government lobbying to disincentivise prosecution and to defund independent data protection offices (keeping the level of enforcement even further below what it should be).

mort96 4y ago

How is this even a question? Of course ads can be GDPR compliant! There's nothing non-compliant about putting some PNG with an ad on your site. The question being asked is, can spyware be made GDPR-compliant if we just get the user to hit "accept". That's a much more difficult question. But do not conflate adverts and spyware. It doesn't have to be this way.

rvba 4y ago

The author writes: "Allow ad fraud detection under >legitimate interest<, which is the key thing keeping ads from being practical under the GDPR." Unfortunately this approach means that shady companies will still break the law, since breaking the law would give them a very big advantage. All ads would just be bought via some company fronted in some country with no regulation, or by a chain of companies that appear and disappear. It could also be like "FTX" and "Alameda research" again - this time not tokens, but information about ads would be shared. You can easily see various ad companies coming out of nowhere - if they broke the law, their ads would work better, so everyone would jump there. Then the company would implode, so everyone would jump somewhere else. Other option, an option that I dont like, but still an option is a move towards requiring users to make accounts. This of course is not great, since nobody (including me) wants to make accounts. But then, you can send ads to groups of accounts, or include / exclude some accounts from seeing the ads. And you can show "ad 1", then "ad 2", then "ad 3" to users. It's a bit more like TV. Less targeted of course. Since nobody (?) does that does it mean that it is not effective, or that it breaks GDPR? On a side note: there are many apps that require you to have a subscription and show you the same few ads again and again. Do the advertisers really think that after I install app X, that I use for say 15 minutes per day - and I see the same damn add 5 times per use.. that I will buy the product? It makes me dislike their product and not want to ever buy it. Does this approach of showing the same ad again and again really work? (I can understand that it can make me want to buy a paid version of the app, which I did at some point, but it made me hate the advertised things). Also why do they even agree to show the same ad every few minutes?

college_physics 4y ago

Targeted ads are just the wedge that opened Pandora's box. You now have a an extremely wealthy constituency that has normalized the concept of tracking, collecting data and creating human behavioral models (and that politically that is an achievable business model)

deleted 4y ago
[deleted]

parasense 4y ago

I'd like to point out the OP's author gave many examples of both EU & US websites, explained how both are probably not GDPR compliant, and explained how the US sites have been sued. I did not read to the end, but from what I read there were no examples of any EU sites being sued/punished for GDPR compliance. That is a problem, because it seems quite clear the EU regulations are setup for the purpose of taxing foreign tech companies. One could argue the EU websites are de facto compliant, but the OP indicates otherwise. We get it.