17 ms·

Meta wants EU users to apply for permission to opt out of data collection

• deleted 4y ago
  [deleted]
• siquick 4y ago
  What about the 15 years of behavioural data they already hold? Can we request that is deleted?
  • hutzlibu 4y ago
    I would say, you can request anything from them. Like I request people to just not use FB anymore, if they don't want to be tracked by them. Might have the same effect.
    • lb4r 4y ago
      Not using FB does not prevent Meta from tracking you.
      • hutzlibu 4y ago
        It does, if you also use adblocker, disable js on certain sites, etc.
        • nerdponx 4y ago
          You can and will be fingerprinted and de-anonymized.
          • hutzlibu 4y ago
            How so, if my adblocker prevents loading the add? The site itself I am visiting could do so and share it with FB and whoever, sure - but this would be a different scenario.
          • itronitron 4y ago
            Do you know if the social media icons that people put in their email signature can also be used to collect data on sender and recipient? I tried searching for information on this a while back but all I got in the search results were tutorials on how to add the social media icons in the email signature 'block'. :/
        • kergonath 4y ago
          So it’s not the “not using FB” that prevents the tracking, then.
          • hutzlibu 4y ago
            "Tracking" is a bit different, if I go to a big news site, that happens to also serve FB ads - than going to FB directly and complain that they track what I do at their place. And like I said, if I use a adblocker preventing to load FBs add in the first place, then how can they meaningfully track me in any way?
  • steveridout 4y ago
    GDPR obliges them to delete your data upon request. But I'm not sure how well Facebook/Meta complies with this. This post from 4 years ago doesn't sound encouraging: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/ Does anyone know if they've improved since then?
    • _pjx9 4y ago
      I'd deleted my Facebook account years before, but after that begrudgingly signed up to Facebook Messenger because my friends insisted on using it (which are separate accounts apparently). At some point, a couple of years ago, I decided enough was enough (probably when they forced me to accept some new anti-privacy EULA which otherwise blocked me from using Messenger Lite). There was no delete account option in the app that I can remember. I searched and searched for at least an hour. Facebook's support site was a labyrinth of circular links that edged around actually deleting my account. I had no Facebook account, so I couldn't log in to delete it on the website's account settings. I just wanted an email I could send the request to. I finally found one for a data protection officer or some sort. Sent them an email, got another one back redirecting me to the website. Obviously that wasn't helpful, so I sent them one of those GDPR deletion templates. Didn't hear back, and checking a few months later, my account was still accessible.
      • londons_explore 4y ago
        The EU has now made clear that this isn't compliant. A data removal request does not have to be via a form - it can be to any employee via any communication method, and does not have to use any special legal wording. [1] You can show up at one of their offices and tell their janitor, and they should still comply. That's why most companies now train every employee how to handle users requesting deletion (usually by forwarding the request to someone whose job it is to action them). [1]: https://medium.com/@sandeepbhalothia/a-b27d3f83ee73#:~:text=Data%20Erasure%20Request%3F-,The%20GDPR%20is%20silent,-on%20the%20%E2%80%98form https://medium.com/@sandeepbhalothia/a-b27d3f83ee73#:~:text=...
      • piva00 4y ago
        If you have documentation about your process (which the email sent to their DPO should be enough) get in contact with the Data Protection Agency of your country for them to start procedures on your behalf. I've got some help from Sweden's IMY for a similar case, asked for the removal of my data by emailing a GDPR template, got no answer and no resolution by the company in a few months and contacted IMY who solved it (and fined them).
  • qikInNdOutReply 4y ago
    No, that is already part of the software framework with which the palantir-cattlerattlers drive the large crowd along the "golden path" on the scenario tree. The cattle does not get to object, reject it or vote on it. The wellfare of the rancher is all that matters and any attempt to disucss that or just turn around, will just "never work out" because of unavoidable infighting. But dont worry, we are not in chicago yet. Who could have imagined, that stripping your brain naked would make you hackable and controllable, thus turning you into a organic component with an API for behavioural crowd simulations. deMoohCrazy has begone! And all that is a best-case-scenario.
• ranguna 4y ago
  To opt out? Shouldn't it be opt in?
  • selivanovp 4y ago
    If something is free- you're the product.
    • blitzar 4y ago
      If something is paid for- you're the product.
      • nicky0 4y ago
        Interesting. How so?
        • CatWChainsaw 4y ago
          Are there any indications that paying for Meta Verified opts you out of their data collection, since you've given them money instead?
          • nicky0 4y ago
            I see, you were referring to Meta specifically. Your statement doesn't generalise though.
            • CatWChainsaw 4y ago
              Well, I wasn't the GP but I see their point. Because today, buying a product isn't enough. Subscriptions and rent-seeking is where it's at. Once you've bought a smart TV, it shouldn't really be any of Roku's business what you watch, but you basically have to airgap any brand of "smart" TV to avoid data collection. Cars are much more computerized nowadays, so it would not be a stretch to imagine they have data harvesting software somehow (especially in light of Volkwagen's emissions test cheating); but if I've bought a car, it's mine, so why allow that? And then there's Ford's idea to have self-driving vehicles drive them back to the dealership if you miss a payment, which is a lot less time-gracious than missing utilities or anything like that. The last time I paid for a laptop with Microsoft on it I still got ads shoveled in my face, and of course there's all the telemetry to deal with. Apple had that drama a few months back with people not being able to launch certain apps because some connection to their servers wasn't being made that would allow it, and Apple products go for premium. It would seem rather prudent to assume that if you buy a product and it is electronic, there is probably some mechanism to transmit data to the manufacturer, because IoT and profit and why the fuck not.
• AstixAndBelix 4y ago
  Ah yes, the good old dark pattern of unnecessary bureaucracy. Facebook getting more and more ideas from nation states in order to subdue its netizens
  • canadianfella 4y ago
    [dead]
• rendall 4y ago
  The comments on the article are brutal.
• bilekas 4y ago
  This is still a bit insane to me. If I understand correct, you have to fill a form with a justification why you object, and then Meta will decide if you can be removed from the detailed data collection ? Privacy is a basic human right, and the strawman argument of "Well don't just use their services then" is ridiculous with their influence. Also them touting to "connected the world" When in reality is "connecting to world, but only if we can record everything you do"
  • gman83 4y ago
    In terms of Facebook where I live, "Well don't just use their services then" is simply impossible. Almost all of my kids' sports activities and parent groups are on WhatsApp, I have to use it.
    • account42 4y ago
      Even without the privacy issues it is insane that you are forced to do business with certain corporations in order to fully participate in society. But most people don't care or open alternatives would be more popular.
      • deleted 4y ago
        [deleted]
      • JustSomeNobody 4y ago
        > But most people don't care or open alternatives would be more popular. I disagree with your premise. Whatsapp wasn't always owned by FB/Meta. It had a huge user base then got bought out. Alternatives like Signal are popular, but it's hard to overcome inertia. Give them time.
        • nevinera 4y ago
          .. time to get a huge userbase and then bought out?
        • t0bia_s 4y ago
• input_sh 4y ago
  NOYB is a much better source. These two paragraphs alone do a better job than the entire Ars article: https://noyb.eu/en/meta-facebook-instagram-switching-legitimate-interest-ads https://noyb.eu/en/meta-facebook-instagram-switching-legitim... > Background. The GDPR allows to process personal data if a company complies with at least one of six legal basis in Article 6 GDPR. Most of these six options are irrelevant for advertisement. While most companies require users to consent ("opt-in") for the use of personal data for advertisement, Meta (Facebook and Instagram) have tried to bypass this requirement by arguing that the use of personal data for ads is "necessary under the contract" when the GDPR became applicable in 2018. noyb has instantly filed a series of complaints and ultimately won them before the European Data Protection Board (EDPB) in December 2022. Meta got until April to stop the practice. > One illegal practice replaced by next illegal practice. Now Meta announces to give in against the pressure by noyb, but instead of switching to an "opt-in" system, like Google or Microsoft, they now try to argue the next unlawful option, by claiming that their "legitimate interest" to process user data would override the fundamental right to privacy and data protection of users. This was tried by other companies before, but rejected by the regulators multiple times (see e.g. the Italian DPA on TikTok or the Belgian DPA on the IAB TCF at para 441).
  • top_sigrid 4y ago
    Came here to say this. NOYB are doing incredible work and if you have some spare money, I think it is a good option for a small monthly donation, as I do it. Hopefully at some point the lever of big monetary sentences will be made use of from regulatory enforcement.
  • raven105x 4y ago
    I'm honestly shocked most sensible EU countries don't simply DNS block Meta at this point.
    • scrollaway 4y ago
      Because WhatsApp is the primary mode of communication for hundreds of millions of people across the EU.
• raverbashing 4y ago
  Looks like the flow of stupid ideas coming from FB didn't stop at the metaverse Yeah sure I will fill a form to "opt-out" and I'm sure that the DP authorities will be fine with it
  • williamvds 4y ago
    I don't see it as stupid. I see it as an intentional delay tactic to maneuver around a regulator which, so far, acts far too slowly and imposes weak fines in response to flagrant privacy lawbreaking. As long as Facebook can treat the fines as a cost of doing business they're happy. That, and as long as their (bullshit) value proposition of personalising ads by collecting as much personal data as possible is unaffected.
    • raverbashing 4y ago
      Yeah it definitely makes sense from their side. But trying to spite the regulation can definitely backfire
      • Nextgrid 4y ago
        It hasn't for 5 years, and if their business is inherently incompatible with the regulation, then making some money from spiting the regulation for as long as possible is better than complying and not making money to begin with.
• palata 4y ago
  If ChatGPT is a killer tool for phishing, it may also be used to make a one-click website helping people fill the form, right?
• ZacnyLos 4y ago
  When the EU introduced the ability to opt out of being forced to save cookies on devices, malicious or lazy companies adopted hostile user unclicking forms. The same is now true of Facebook. Capitalists will always be against the convenience of users.
  • Nextgrid 4y ago
    The user-hostile forms aren't actually compliant with the regulation - any form that makes it easier to accept than to decline is against the GDPR and would not count as valid data processing consent, thus you may as well not have one and track by default. The reason those forms proliferated is because a few snake-oil vendors (TrustArc, etc) sell fake compliance solutions that merely look compliant but actually annoy most people into accepting which is preferred by their (scummy) customers instead of actually-compliant solutions (would put them out of business or force them to severely trim down the marketing/advertising teams). Since there is no significant enforcement of the regulation, these practices persist.
• leke 4y ago
  but meta is a paid service, right? So why should we hand over our privacy?
• gumballindie 4y ago
  Have they completely lost it? I kept a facebook account just to stay in touch with people, but following this madness I will simply find other means to do so and completely shut it down. This is ridiculous.
• zelphirkalt 4y ago
  Aaand another case of big tech acting stupid, misinterpreting the law, just to continue acting like they do, violating the law, a liiittle bit longer, milking that cash cow of mining illegally obtained data as long as possible. No signs of remorse to be expected there. Hopefully this blatant violation goes into the next law suit against them and makes the outcome a bit worse for them.
• rendall 4y ago
  Ars Technica is not much better. Here are the "always active" non-choices from their own GDPR pop-up ("Powered by OneTrust"). That is to say, you cannot opt-out of these: Match and combine offline data sources: Always Active Link different devices: Always Active Receive and use automatically-sent device characteristics for identification: Always Active Ensure security, prevent fraud, and debug: Always Active Technically deliver ads or content: Always Active If you don't open their "show purposes" window and "Confirm my choices" from that window, then you are also agreeing to: Store and/or access information on a device Personalised ads and content, ad and content measurement, audience insights and product development Use precise geolocation data Actively scan device characteristics for identification
  • account42 4y ago
    The EU really needs to go harder after such violations. Companies should not even want to consider playing these games.
  • oblak 4y ago
    Much better? Allowing JS on Ars is a recepi for data slurpocalypse. They've had 10+ ads and tracking third parties for at least decade. I won't even touch on doxxing Snownden's girlfriend and the amount of questionable, at best, political content they publish on a daily basis.
• th4tg41 4y ago
  NOYB are heroes!
• Havoc 4y ago
  I want meta to request permission to exist.
• kergonath 4y ago
  Lol no. That is a great way to have the European Parliament and the Commission to have a thorough look into your data harvesting practices. And lose yet another lawsuit.
  • miroljub 4y ago
    ... and be punished with yet another 11.278 € fine, as if that would change anything.
    • gattilorenz 4y ago
      “GDPR sets forth fines of up to 10 million euros, or, in the case of an undertaking, up to 2% of its entire global turnover of the preceding fiscal year, whichever is higher” Generally speaking, GDPR violations won’t be addressed with a slap on the wrist, apparently
      • retSava 4y ago
        I think it's about time they went into action with that then.
      • miroljub 4y ago
        > Generally speaking, GDPR violations won’t be addressed with a slap on the wrist, apparently So, when they plan to actually start fining? > "2% of its entire global turnover of the preceding fiscal year" I'd like to see this fine in the case of Meta and Google, but we both know it'll never happen.
        • phoronixrly 4y ago
          What do you mean when? Check 'Highest fines: individual' here https://www.enforcementtracker.com/?insights https://www.enforcementtracker.com/?insights
      • mpweiher 4y ago
        Close, but that 2% is actually half of the maximum: "The less severe infringements could result in a fine of up to €10 million, or 2% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher." "The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher." https://gdpr.eu/fines/ https://gdpr.eu/fines/
• vrglvrglvrgl 4y ago
  [dead]
• Macha 4y ago
  I don't see how this flies as even Google was recently forced into compliance by the French recently to have an actual functional top level reject all.
• jacquesm 4y ago
  Meta is way out of line. There is absolutely no way that the EU is going to allow Meta to break the law at scale without regulators throwing a fit. They might even get to be made into an example of what happens when you repeatedly try to knowingly break the law.
  • redeeman 4y ago
    [flagged]
    • jacquesm 4y ago
      > lol you really think so? lol, yes I really think so. > the EU serves at the pleasure of these megacompanies This is the sort of thing that I'd be happy if it wasn't dumped into HN.
      • pessimizer 4y ago
        Is there some sort of inside information about EU process around Facebook that you want to share here, or is this just generalized bashing of people who have negative outlooks on particular institutions as cynics?
        • jacquesm 4y ago
          Trolls will troll I guess. Let's reverse that: how about you show us how the EU is controlled by Facebook instead? Seriously, the degree and number of dumb comments on HN has been going through the roof lately and I'm getting quite fed up with it. You can have a negative outlook on the EU (assuming you're informed enough to have that outlook in the first place) but to make a blanket claim that (US!) megacompanies control the EU is beyond ridiculous and then to have to defend against even dumber comments like yours in the style of 'when did you stop beating your wife' takes the cake. The person who makes the outrageous claim gets to defend it, not the other way around.
          • redeeman 4y ago
• baynoob 4y ago
  I see a lot of comments where they prefer telegram over WhatsApp. Surprising part is whatsapp is end to end encrypted by default for all conversations but telegram is not.
  • rendall 4y ago
    Yes, agreed. I didn't understand that. For me, Signal is preferred but I will use WhatsApp if I must.
  • ggregoire 4y ago
    I'd add that WhatsApp is mandatory in some parts of the world. Where I live it's probably installed on 99.9% of the phones. All your family, friends, coworkers and customers are on WhatsApp. You want to book a haircut? They will confirm the appointment on WhatsApp. You want to get a quote for anything? They will send the file to you on WhatsApp. You want to know what was your covid vaccine number? The only way is to ask to a bot on WhatsApp. This is actually insane.
• wkat4242 4y ago
  Umm opt-out is not how GDPR works. It mandates opt-in for tracking.
• matheusmoreira 4y ago
  I wish Meta had to apply for permission to exist. And be denied.
• cm2012 4y ago
  In a world where Meta uses user cookies to run targeted advertising: Users see ads they're interested in, and experience no other downsides from that targeting. In a world where Meta doesn't use cookies to run targeted advertising: Users see lowest common denominator boring ads. None of their life is different in any other way, there's no harm they avoided. This whole issue is baseless. If the EU wants to purposefully degrade services that half of EU citizens use every day, that's their prerogative, but you're making the world slightly worse.
  • jmorenoamor 4y ago
    No I'm not. I don't want targeted ads. I'm not interested in anything they have to offer. I will search for things I think I need by myself when I think I need then.
  • yjftsjthsd-h 4y ago
    > In a world where Meta uses user cookies to run targeted advertising: Users see ads they're interested in, and experience no other downsides from that targeting. So your argument is that you don't believe privacy has any value, and you only care about second-order effects. First: Since you believe that, can I install a camera in your shower? Don't worry, you won't experience any downsides. Second: Users would do in fact experience downsides, because targeted ads exist to get them to spend more money and distort their selection (i.e. if I'm shopping for cameras, I want the best/cheapest camera, not the one that paid the most to get shoved in my face).
  • eficek 4y ago
    What terrible bait, like I'm speaking directly to a man who's sold ads for three decades. "Boring" ads? No one wants to be served ads that manipulate them with "fun" (and we know that what you really mean is "serve the most attention-stealing customer-conversion media"). I won't believe that people consume digital ads by the Meta corporation for fun. Damn, I called it terrible but it worked. Oh well
• sirsinsalot 4y ago
  I will be adding every Meta domain and property I can think of to my network blocking. A good list to start with is here: https://github.com/jmdugan/blocklists/tree/master/corporations/facebook https://github.com/jmdugan/blocklists/tree/master/corporatio...