5 ms·

> Allow Der Spiegel's approach where sites can let users choose between ads with personalization or paying a reasonable price for access, under the principle th

> Allow Der Spiegel's approach where sites can let users choose between ads with personalization or paying a reasonable price for access, under the principle that this is a real choice. This would water down the whole GDPR since its primary function is to stop using PII as merchandise.

SpicyLemonZest 4y ago
Many people attempt to wishcast this goal onto the GDPR, so I can understand your confusion, but the GDPR itself says no such thing. The purpose of the regulation is to ensure that your data is protected and you have control over it; companies are explicitly permitted to use it for whatever purpose they’d like so long as you give free and informed consent to it.
- PeterisP 4y ago
  The GDPR definition of "freely given consent" is explicitly written to exclude "sale of consent" - if you say that you'll give you $1 (or some other benefit) if you consent, then according to GDPR that consent is not freely given and thus does not grant you the right to use that PII. In essence, "GDPR consent" applies when people really want you to do that thing with their data, and does not apply if they'd rather not but it comes as a requirement for something else or "bundled" with something desirable. Also, if consent is the legal basis for processing, it must be possible to withdraw consent without any adverse consequence, so if e.g. you give a discounted subscription to people who gave consent, then you can't revoke that subscription or discount if the data subject withdraws that consent a minute later. If you say that you'll provide some service only if the user "consents", then GDPR presumes that the consent is not freely given (e.g. recital 43 of GDPR).
  - SpicyLemonZest 4y ago
    Which provision of the GDPR explicitly defines “freely given” to exclude “sale of consent”? Again, I know this is conventional wisdom that gets passed around a lot, but as far as I can tell it’s not present in the actual text of the regulation. e: I see a stealth edited reference to recital 43, which I hadn’t seen before and does seem to show I’m wrong here. Thanks for the reference.
    - PeterisP 4y ago
      The main part is article 7.4 "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." which is a bit tricky legal language to make the distinction between PII use that's actually needed to perform the contract (which doesn't need consent, e.g. address to deliver goods) and uses beyond that (e.g. using the same address afterwards for ad targeting). The final part of recital 42 "Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment." is probably even more clarifying than recital 43.
  - jefftk 4y ago
    I agree that's what the GDPR says, and what it will be interpreted by courts to mean. But, as I get into at the end of the post, I don't think this is what it should say.
    - PeterisP 4y ago
      At its core, GDPR is not about digital advertising, it's about all-encompassing rules for all industries to tackle privacy in an appropriate way. The clauses regarding consent have to work well (and generally do) for things like supermarkets asking 'consent' for privacy-invasive things in their loyalty/discount cards, for cell phone operators selling location data with 'consent' of the users, for employees 'consenting' to surveillance by employers, for consent in landlord-renter and real estate broker relations, etc, etc - that is the main purpose of GDPR, websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. Adjusting GDPR core principles for the purposes of website ads would be like the tail wagging the dog - if it "fixes" web ads but worsens handling of much more sensitive things like companies wanting to exploit data in physical shopping, telecommunications, healthcare and banking, then it's not worth it.
      - dmitriid 4y ago
        > websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. On top of that there's USA itself. Which said "if an American company serves anyone anywhere in the world we have the right to request any and all data on all users of that company, regardless of their residence or citizenship". That's what Schrems II was about: there's either privacy and protection of people's data or working with US-based companies. Europe keeps chosing the former, thankfully.
dns_snek 4y ago
I was under the impression that while "cookie walls" (Accept or get out) were not allowed, providing a paywall with a choice between "ads/tracking" and "payment" was already permissible* under GDPR. Is this not the case? According to https://www.iubenda.com/en/help/24487-cookie-walls-gdpr https://www.iubenda.com/en/help/24487-cookie-walls-gdpr > As regards paywalls, the Garante published a press release to inform that it’s analyzing this solution as implemented by some Italian publishers. > The Austrian and French DPAs have already indicated that the paywall system is a valid solution as long as the subscription to the site has a modest and fair cost so that it does not constrain the user’s free choice. > As it stands, the decision of whether paywalls can be compliant or not is still somewhat of a grey area. We will have to wait for a uniform approach from the DPAs to better assess the compliance of these mechanisms. I have mixed feelings about this. There is some validity to providing an alternative method of funding the website, but at the same time it will most likely maintain the status quo as the vast majority of people are conditioned to accessing online content for free.
alkonaut 4y ago
Even having a setting where you choose between 2 dumb ads and 1 targeted ad shouldn’t be acceptable.

SpicyLemonZest 4y ago

Many people attempt to wishcast this goal onto the GDPR, so I can understand your confusion, but the GDPR itself says no such thing. The purpose of the regulation is to ensure that your data is protected and you have control over it; companies are explicitly permitted to use it for whatever purpose they’d like so long as you give free and informed consent to it.

PeterisP 4y ago
The GDPR definition of "freely given consent" is explicitly written to exclude "sale of consent" - if you say that you'll give you $1 (or some other benefit) if you consent, then according to GDPR that consent is not freely given and thus does not grant you the right to use that PII. In essence, "GDPR consent" applies when people really want you to do that thing with their data, and does not apply if they'd rather not but it comes as a requirement for something else or "bundled" with something desirable. Also, if consent is the legal basis for processing, it must be possible to withdraw consent without any adverse consequence, so if e.g. you give a discounted subscription to people who gave consent, then you can't revoke that subscription or discount if the data subject withdraws that consent a minute later. If you say that you'll provide some service only if the user "consents", then GDPR presumes that the consent is not freely given (e.g. recital 43 of GDPR).
- SpicyLemonZest 4y ago
  Which provision of the GDPR explicitly defines “freely given” to exclude “sale of consent”? Again, I know this is conventional wisdom that gets passed around a lot, but as far as I can tell it’s not present in the actual text of the regulation. e: I see a stealth edited reference to recital 43, which I hadn’t seen before and does seem to show I’m wrong here. Thanks for the reference.
  - PeterisP 4y ago
    The main part is article 7.4 "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract." which is a bit tricky legal language to make the distinction between PII use that's actually needed to perform the contract (which doesn't need consent, e.g. address to deliver goods) and uses beyond that (e.g. using the same address afterwards for ad targeting). The final part of recital 42 "Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment." is probably even more clarifying than recital 43.
- jefftk 4y ago
  I agree that's what the GDPR says, and what it will be interpreted by courts to mean. But, as I get into at the end of the post, I don't think this is what it should say.
  - PeterisP 4y ago
    At its core, GDPR is not about digital advertising, it's about all-encompassing rules for all industries to tackle privacy in an appropriate way. The clauses regarding consent have to work well (and generally do) for things like supermarkets asking 'consent' for privacy-invasive things in their loyalty/discount cards, for cell phone operators selling location data with 'consent' of the users, for employees 'consenting' to surveillance by employers, for consent in landlord-renter and real estate broker relations, etc, etc - that is the main purpose of GDPR, websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. Adjusting GDPR core principles for the purposes of website ads would be like the tail wagging the dog - if it "fixes" web ads but worsens handling of much more sensitive things like companies wanting to exploit data in physical shopping, telecommunications, healthcare and banking, then it's not worth it.
    - dmitriid 4y ago
      > websites are a relatively small part of it which is only getting attention because this part is the one that works remotely and thus affects USA companies. On top of that there's USA itself. Which said "if an American company serves anyone anywhere in the world we have the right to request any and all data on all users of that company, regardless of their residence or citizenship". That's what Schrems II was about: there's either privacy and protection of people's data or working with US-based companies. Europe keeps chosing the former, thankfully.

dns_snek 4y ago

I was under the impression that while "cookie walls" (Accept or get out) were not allowed, providing a paywall with a choice between "ads/tracking" and "payment" was already permissible* under GDPR. Is this not the case? According to https://www.iubenda.com/en/help/24487-cookie-walls-gdpr https://www.iubenda.com/en/help/24487-cookie-walls-gdpr > As regards paywalls, the Garante published a press release to inform that it’s analyzing this solution as implemented by some Italian publishers. > The Austrian and French DPAs have already indicated that the paywall system is a valid solution as long as the subscription to the site has a modest and fair cost so that it does not constrain the user’s free choice. > As it stands, the decision of whether paywalls can be compliant or not is still somewhat of a grey area. We will have to wait for a uniform approach from the DPAs to better assess the compliance of these mechanisms. I have mixed feelings about this. There is some validity to providing an alternative method of funding the website, but at the same time it will most likely maintain the status quo as the vast majority of people are conditioned to accessing online content for free.

alkonaut 4y ago

Even having a setting where you choose between 2 dumb ads and 1 targeted ad shouldn’t be acceptable.