11 ms·

CJEU declares Meta's GDPR approach illegal

109 points by draugadrotten 3y ago

the_mitsuhiko 3y ago
> Meta, however, took the view that it could just add random elements to the contract (such as personalized advertisement), to avoid a yes/no consent option for users. The most frustrating part of this entire thing is that the intent of the law is pretty clear and yet they are trying stuff like this.
- pgeorgi 3y ago
  They're used to being able to do that because the Irish DPC does fuck all, with full backing of the government (see https://noyb.eu/en/irish-gov-makes-critizising-big-tech-and-irish-dpc-crime https://noyb.eu/en/irish-gov-makes-critizising-big-tech-and-...)
  - Aachen 3y ago
    The article is about proposed secrecy regarding the Irish Data Protection Commission, "Section 26A would make most reporting about procedures or decisions by the DPC a crime." It doesn't say that DPC ruled adding data processing purposes to contracts after the fact to be legal. Data protection authorities in any country that matters are kept underfunded or on an otherwise short leash (Netherlands is no different, we might as well not have one at all for all the positive things it does ... not ... do). Not sure the German one is as bad, but then which big business decided to headquarter in DE? Ireland and the Netherlands have better tax schemes apparently. I'm not surprised they're doing as little as possible in Ireland, but I would be surprised if they actually said it's fine to make one-sided contract amendments
    - Nextgrid 3y ago
      > It doesn't say that DPC ruled adding data processing purposes to contracts after the fact to be legal. That link was just one of many examples of incompetence, corruption and favoritism by the Irish DPC - here's a more obvious one: https://noyb.eu/en/irish-data-protection-authority-gives-eu-397-billion-present-meta https://noyb.eu/en/irish-data-protection-authority-gives-eu-...
      - Aachen 3y ago
        I find that particular one even more sensational and less objective. > the DPC simply ignored the unlawful revenue made by Meta and claimed that "the Commission is unable to ascertain an estimation of the matters" and that it is therefore "unable to take these matters into account". This is despite having the power to demand such information from Meta under Article 58(1) GDPR. > Max [says] "We all know about Meta's enormous revenue. It's astonishing that this was not taken into account by the DPC. Apples and oranges. DPC says they don't know how much more money they made by doing this illegal thing. Max says "but look at how filthy rich they are! Take it all!!" 10/10 logic The latter logic is what gets these things overturned (I'm no fan of Facebook's and would be perfectly happy to see their services banned from the EU market altogether until they comply with article 8 of our human rights convention, which GDPR helps protect, but I do try to keep an objective perspective)
        Nextgrid 3y ago
        > DPC says they don't know how much more money they made by doing this illegal thing I would agree that the waters might be murky in a business spanning multiple verticals or offering multiple products. But in case of Facebook, the only business they have is targeted advertising, so it's safe to assume that any EU-sourced revenue is directly as a result of operating unlawfully and breaching the GDPR?
  - toyg 3y ago
    I used to wonder how African countries' governments could be captured so comprehensively by moneyed interests like Big Agro, mining companies, etc. Then tech got to Ireland and things got a bit clearer.
    - yieldcrv 3y ago
      from what I can tell, everyone thinks people are just wheelbarrowing bundles of cash in corrupt foreign countries while their own country has a convoluted legal process that is therefore different and okay. while in reality a lot of other countries have some form of codified legal process that makes "money to one guy for a favorable regulatory environment" possible too.
      - deleted 3y ago
        [deleted]
  - disgruntledphd2 3y ago
    Nope, that is incorrect. This was a business decision to buy as much time as possible, and it got them 5 years worth of EMEA revenue without needing consent. Like, everybody knew that this was illegal, but court cases take a long time. Fundamentally, the Irish government and DPC had no way to stop this from happening. The really interesting question is what happens to Google here, as they have traditionally taken the same approach.
    - Nextgrid 3y ago
      I don't think this is incorrect? The DPA is incompetent or corrupt because it allowed such a scheme to be profitable. > This was a business decision to buy as much time as possible A competent and non-corrupt DPA would've enforced a fine greater than the potential/estimated revenue explicitly to discourage gambles like this and seize any revenue acquired unlawfully.
      - disgruntledphd2 3y ago
        Huh? Facebook made the business decision, they got sued and the court case has finally concluded that this was (as basically everone already knew) not compliant. The maximum fine is capped at 5% of global revenue, so this was always gonna end up being profitable for Facebook, unfortunately. I personally agree that the Irish DPA should be doing a lot better, but they're definitely not corrupt.
        mandmandam 3y ago
        > they're definitely not corrupt. Mate, every regulator in Ireland is corrupt. Every single one. GSOC - corrupt. Ask Maurice McCabe. Túsla - corrupt. Ask McCabe, again. Central Bank - corrupt. Ask Jonathan Sugarman. Coillte - corrupt. Look at all the sitka spruce drenched in Round-Up that they plant. The CRU - corrupt. Have never handed down a fine over three figures, afaict. They are literally paid by the utility companies. Ask anyone you know who has ever filed a complaint against them. My lawyer wouldn't go near them when his leccy company screwed him over - no point, he said. The construction industry is a mafia; look into CRH sometime. Look at what's happening to RTE now that they were caught giving tens of millions away under the table - one or two people will be scapegoated, lose their job, and escape jailtime. FF and FG have their fingers in every pie. They have the country rotted out from the core. We're in debt over 40,000 euro per person. So why on Earth would you assume the DPC, who has been letting FB run roughshod over half the planet's data for years, are any better at all?
- jillesvangurp 3y ago
  It's a good outcome even though it takes a bit of time to get there. It just means that bigger fines are in their future unless they adapt. And not just for them of course. In the end, Meta will have to choose between doing business in Europe while complying with the law or just abandoning the loads of people using Instagram, Whatsapp, etc. over there. My guess is they'll figure out that they don't want to walk away from that many users.
  - yard2010 3y ago
    I can hardly believe they care about fines. It's like letting 3 flies inside of a murderer apartment as a punishment
    - xigoi 3y ago
      Aren't the fines for GDPR calculated as some% of the global revenue?
      - MattPalmer1086 3y ago
        For the most serious offences up to 4% of global revenue.
    - jillesvangurp 3y ago
      Well, they might end up paying fines by the billions pretty soon. And of course, Meta has share holders and those might actually start caring when that becomes a regular thing on their books. I don't know. The EU can always just keep on increasing the fines until it hurts enough.
    - supermatt 3y ago
      True, but the EU then put 6 flies, then 12, then 24, etc. That apartment will soon be full of flies.
    - pgeorgi 3y ago
      GDPR enforcement starts slow because the idea is not to amass fines but to protect privacy. Adversarial actors can exploit that, of course, but ordinarily lack of cooperation can rack up the fines pretty quickly. The main issue is that the Irish DPA is responsible for Meta (and the other US big tech companies who have their EU HQ there) and he's (nearly criminally) negligent to the chagrin of the other European DPAs. I suppose the Irish government is scared that the companies engage in forum shopping if they're strict on enforcing European rules (and some other country offers even just slightly more agreeable terms to the companies) and then bye, bye, tax moneys.
- izacus 3y ago
  > The most frustrating part of this entire thing is that the intent of the law is pretty clear and yet they are trying stuff like this. This is basically completely normal shit that american lawyers constantly pull - you're trying to put together a business contract that's been already agreed and then the legal team will just throw in insulting shit into contracts to see what kind of abuse they can get away with. It's not surprising that this "approach" leaked into Meta's normal operations. They thought that if they manage to sneak in clauses in EULA, that they somehow won something (while they actually antagonized people they shouldn't).
  - that_guy_iain 3y ago
    They probably knew this wasn't going to fly but figure the revenue between them ignoring the law and having to follow the law would be more than the fine.
    - martin8412 3y ago
      Which is why fines should be a multiple of revenue gained by ignoring the law.
    - izacus 3y ago
      With a corporation the size of Meta, it's not at all a given that: - Team putting together EU policy is in any way related to the team that needs to deal with any kind of fines. - That anyone actually made this concious decision as a tradeoff (as in, if it ever bubbled up to a VP or similar strategic lead. So many behaviours of megacorps are emergent and not deliberate.
      - that_guy_iain 3y ago
        >- Team putting together EU policy is in any way related to the team that needs to deal with any kind of fines. Wouldn't that be a compliance team/department? > - That anyone actually made this concious decision as a tradeoff (as in, if it ever bubbled up to a VP or similar strategic lead. To be fair, I can believe that.
      - 3y ago
- lloeki 3y ago
  > The most frustrating part of this entire thing is that the intent of the law is pretty clear and yet they are trying stuff like this. GDPR question box implementations reveal the true values of implementors. Here are simple heuristics: 1.a is there "accept all" but no "reject all" on the same block, equally weighted and styled identically? 1.b 2. does the question keep coming up regularly when one answers "reject all" but never again as soon as one answers "accept all"? 3.a is the question box modal i.e blocks access or interaction with content? 3.b is the question box non-modal but obscures most of the content? 3.c is the question box non-dismissible or very hard to dismiss? 4. is the question box starting with "We value your privacy"? re 1. Often there's only a "manage choices" button next to "accept all", and "reject all" is either way down the scaling area of a small modal or entirely absent. re 2. This is most infuriating, e.g "reject all" cookies having an expiration of 24h and "accept all" cookies having an expiration of 10 years, enticing people to click "accept all" out of pure STOP-PESTERING-ME rage. re 3. This is equivalent to not answering, and not answering must be treated as if "reject all" was picked, except the choice may not be stored since no explicit choice has been given. Transparent background + 2% opacity light grey crosses outside the question box (either near top right or outright stuffed on top right of the whole browser viewport) overlaid on main content's white background come to mind; that is if they are at all present. Clicking anywhere outside the box should simply dismiss the box and be treated as "I do not answer". re 4. If you feel like you have to ask me the question and present me with the above, clearly you do not value my privacy, partly because I have DNT set; I know DNT is a "failure" because it was set as default by Edge or something, but then again, I am fairly convinced that given a properly implemented 1. most people would click "reject all" prolly all the time, otherwise the implementors would simply not go to such lengths to have us click "accept all".
- bushbaba 3y ago
  Because the reward is greater than risk.
pmontra 3y ago
Could FB simply say: this service costs money to run, either you pay for it or you watch ads, if you don't want to pay or watch ads press here to delete your account. Then, to the people that stay, yes or no to targeted ads. This won't kill Instagram and Facebook but will kill WhatsApp unless it's paid for by the business accounts and the ads on the other platforms.
- Kelteseth 3y ago
  This is what most German sites like spiegel.de or heise.de do: "Continue reading with ads Visit SPIEGEL.de as you normally would with the advertising and the usual tracking. (You can revoke your consent at any time.) or Read ad-free No sharing of your data with advertisers. Use us for a fee without any ad tracking and practically free of advertising."
  - Euphorbium 3y ago
    Advertisers only want to advertise to paying customers, because free tier does not buy anything.
    - pmontra 3y ago
      Advertisers show ads to the large free tier of Facebook and Google. Furthermore everybody buy something.
      - ben_w 3y ago
        > Furthermore everybody buy something Is practically unavoidable in a system like ours; but also not important in this context as there's an implicit "because it was advertised". One of the ways I'm weird: it's like I have a homunculus of the Marie Kondo meme before I'd even heard of her, telling me I don't really want to buy $thing, or even receive one as a gift, because it won't spark joy. As a result, my total expenses included rent, food, commuting, utilities, fun… literally everything, all comes to less than €1000/month on average.
UpToTheSky 3y ago
Just to make me understand this: This is about storing data in the form of "Facebook user XYZ looked at a page about travel to Antarctica" and the reason Facebook wants to store such data is to show them travel offers when they read their Facebook feed? If so, can I download this data about me? Is there a way to download everything Facebook stores about me and then I will see all the websites and pages I visited that Facebook knows about?
- Someone 3y ago
  Possibly. https://facebook.com/help/212802592074644 https://facebook.com/help/212802592074644 allows you to download “a copy of your information on Facebook”. https://facebook.com/help/930396167085762/ https://facebook.com/help/930396167085762/ isn’t clear on whether that is included, though. I would guess that Facebook considers the “about travel to Antarctica” not part of your information on Facebook, though. They’ll tell you you visited a specific page, but not what they tagged that page with, even if it is your page (as I said, that’s a guess)
- sofixa 3y ago
  > If so, can I download this data about me? Is there a way to download everything Facebook stores about me and then I will see all the websites and pages I visited that Facebook knows about? If you live in the EU, you have the legal right to ask for all information Facebook has on you. https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens/my-rights/how-can-i-access-my-personal-data-held-company-organisation_en https://commission.europa.eu/law/law-topic/data-protection/r...
  - Nextgrid 3y ago
    > If you live in the EU, you have the legal right to ask for all information Facebook has on you. Which Facebook will promptly ignore and get away with it: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/
- belorn 3y ago
  It is about so much more. It is any personal data that facebook store that is not strictly necessary to provide the core products (such as messaging or sharing content). You bought some medicine online and the store shared that with Facebook. It can be location data from images. In theory it could also be things like "you messaged a person who leans towards a particular political side". All is data that can be data mined and used to calculate the highest revenue advertisement at any specific time you load a Facebook page. Two high profit questions that historically advertisement networks want to find out is when someone is expecting children, and when they are most likely to go to Disneyland.
rapatel0 3y ago
There is a really simple proposal Meta can make to users now. Pay €1-10 per month for no ads or consent to ads. Agree that data should be managed within the bounds of the law, but meta is not obligated to provide a service for free. I would totally pay for ad free social media to avoid all the garbage. Also, This might be one of the greatest opportunities for repricing an application in history. Meta can literally set the price arbitrarily
- anticensor 3y ago
  The problem is that cash, unlike information, can only be spent once.
- thih9 3y ago
  > There is a really simple proposal Meta can make to users now. Pay €1-10 per month for no ads or consent to ads. Wouldn't most people consent to ads, without opting in to tracking? I guess in that case Meta would be in the same situation as now.
- phyrex 3y ago
  I think meta makes much more per customer, and few people would be willing to pay, say, E100/yr to pay for Facebook without ads
- karatinversion 3y ago
  Illegal under the GDPR: consent to storing or processing personal data that is not necessary for performing a service cannot be a prerequisite to performing a service.
- lucideer 3y ago
  > Pay €1-10 per month for no ads or consent to ads. This is explicitly and very clearly called out as illegal in Article 7 (4): > 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
dfawcus 3y ago
FWIW - The English version of the press release: https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-07/cp230113en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202...
openplatypus 3y ago
I can’t wait for internal review and independent investigation of the Irish DPC. If there was no bribery involved I would be surprised.
nabla9 3y ago
Huh? Meta tried to argue that it was legally obligated to serve ads to its users and this allows them to move any consent requirement for tracking and online advertisement into terms and conditions ... Whoah. The highly paid for legal contortionists who made the argument probably knew it was doomed from the start. They are just paid to delay inevitable by dragging it trough all courts.

109 points by draugadrotten 3y ago

> Meta, however, took the view that it could just add random elements to the contract (such as personalized advertisement), to avoid a yes/no consent option for users. The most frustrating part of this entire thing is that the intent of the law is pretty clear and yet they are trying stuff like this.

pgeorgi 3y ago
They're used to being able to do that because the Irish DPC does fuck all, with full backing of the government (see https://noyb.eu/en/irish-gov-makes-critizising-big-tech-and-irish-dpc-crime https://noyb.eu/en/irish-gov-makes-critizising-big-tech-and-...)
- Aachen 3y ago
  The article is about proposed secrecy regarding the Irish Data Protection Commission, "Section 26A would make most reporting about procedures or decisions by the DPC a crime." It doesn't say that DPC ruled adding data processing purposes to contracts after the fact to be legal. Data protection authorities in any country that matters are kept underfunded or on an otherwise short leash (Netherlands is no different, we might as well not have one at all for all the positive things it does ... not ... do). Not sure the German one is as bad, but then which big business decided to headquarter in DE? Ireland and the Netherlands have better tax schemes apparently. I'm not surprised they're doing as little as possible in Ireland, but I would be surprised if they actually said it's fine to make one-sided contract amendments
  - Nextgrid 3y ago
    > It doesn't say that DPC ruled adding data processing purposes to contracts after the fact to be legal. That link was just one of many examples of incompetence, corruption and favoritism by the Irish DPC - here's a more obvious one: https://noyb.eu/en/irish-data-protection-authority-gives-eu-397-billion-present-meta https://noyb.eu/en/irish-data-protection-authority-gives-eu-...
    - Aachen 3y ago
      I find that particular one even more sensational and less objective. > the DPC simply ignored the unlawful revenue made by Meta and claimed that "the Commission is unable to ascertain an estimation of the matters" and that it is therefore "unable to take these matters into account". This is despite having the power to demand such information from Meta under Article 58(1) GDPR. > Max [says] "We all know about Meta's enormous revenue. It's astonishing that this was not taken into account by the DPC. Apples and oranges. DPC says they don't know how much more money they made by doing this illegal thing. Max says "but look at how filthy rich they are! Take it all!!" 10/10 logic The latter logic is what gets these things overturned (I'm no fan of Facebook's and would be perfectly happy to see their services banned from the EU market altogether until they comply with article 8 of our human rights convention, which GDPR helps protect, but I do try to keep an objective perspective)
      - Nextgrid 3y ago
        > DPC says they don't know how much more money they made by doing this illegal thing I would agree that the waters might be murky in a business spanning multiple verticals or offering multiple products. But in case of Facebook, the only business they have is targeted advertising, so it's safe to assume that any EU-sourced revenue is directly as a result of operating unlawfully and breaching the GDPR?
- toyg 3y ago
  I used to wonder how African countries' governments could be captured so comprehensively by moneyed interests like Big Agro, mining companies, etc. Then tech got to Ireland and things got a bit clearer.
  - yieldcrv 3y ago
    from what I can tell, everyone thinks people are just wheelbarrowing bundles of cash in corrupt foreign countries while their own country has a convoluted legal process that is therefore different and okay. while in reality a lot of other countries have some form of codified legal process that makes "money to one guy for a favorable regulatory environment" possible too.
    - deleted 3y ago
      [deleted]
- disgruntledphd2 3y ago
  Nope, that is incorrect. This was a business decision to buy as much time as possible, and it got them 5 years worth of EMEA revenue without needing consent. Like, everybody knew that this was illegal, but court cases take a long time. Fundamentally, the Irish government and DPC had no way to stop this from happening. The really interesting question is what happens to Google here, as they have traditionally taken the same approach.
  - Nextgrid 3y ago
    I don't think this is incorrect? The DPA is incompetent or corrupt because it allowed such a scheme to be profitable. > This was a business decision to buy as much time as possible A competent and non-corrupt DPA would've enforced a fine greater than the potential/estimated revenue explicitly to discourage gambles like this and seize any revenue acquired unlawfully.
    - disgruntledphd2 3y ago
      Huh? Facebook made the business decision, they got sued and the court case has finally concluded that this was (as basically everone already knew) not compliant. The maximum fine is capped at 5% of global revenue, so this was always gonna end up being profitable for Facebook, unfortunately. I personally agree that the Irish DPA should be doing a lot better, but they're definitely not corrupt.
      - mandmandam 3y ago
        > they're definitely not corrupt. Mate, every regulator in Ireland is corrupt. Every single one. GSOC - corrupt. Ask Maurice McCabe. Túsla - corrupt. Ask McCabe, again. Central Bank - corrupt. Ask Jonathan Sugarman. Coillte - corrupt. Look at all the sitka spruce drenched in Round-Up that they plant. The CRU - corrupt. Have never handed down a fine over three figures, afaict. They are literally paid by the utility companies. Ask anyone you know who has ever filed a complaint against them. My lawyer wouldn't go near them when his leccy company screwed him over - no point, he said. The construction industry is a mafia; look into CRH sometime. Look at what's happening to RTE now that they were caught giving tens of millions away under the table - one or two people will be scapegoated, lose their job, and escape jailtime. FF and FG have their fingers in every pie. They have the country rotted out from the core. We're in debt over 40,000 euro per person. So why on Earth would you assume the DPC, who has been letting FB run roughshod over half the planet's data for years, are any better at all?
jillesvangurp 3y ago
It's a good outcome even though it takes a bit of time to get there. It just means that bigger fines are in their future unless they adapt. And not just for them of course. In the end, Meta will have to choose between doing business in Europe while complying with the law or just abandoning the loads of people using Instagram, Whatsapp, etc. over there. My guess is they'll figure out that they don't want to walk away from that many users.
- yard2010 3y ago
  I can hardly believe they care about fines. It's like letting 3 flies inside of a murderer apartment as a punishment
  - xigoi 3y ago
    Aren't the fines for GDPR calculated as some% of the global revenue?
    - MattPalmer1086 3y ago
      For the most serious offences up to 4% of global revenue.
  - jillesvangurp 3y ago
    Well, they might end up paying fines by the billions pretty soon. And of course, Meta has share holders and those might actually start caring when that becomes a regular thing on their books. I don't know. The EU can always just keep on increasing the fines until it hurts enough.
  - supermatt 3y ago
    True, but the EU then put 6 flies, then 12, then 24, etc. That apartment will soon be full of flies.
  - pgeorgi 3y ago
    GDPR enforcement starts slow because the idea is not to amass fines but to protect privacy. Adversarial actors can exploit that, of course, but ordinarily lack of cooperation can rack up the fines pretty quickly. The main issue is that the Irish DPA is responsible for Meta (and the other US big tech companies who have their EU HQ there) and he's (nearly criminally) negligent to the chagrin of the other European DPAs. I suppose the Irish government is scared that the companies engage in forum shopping if they're strict on enforcing European rules (and some other country offers even just slightly more agreeable terms to the companies) and then bye, bye, tax moneys.
izacus 3y ago
> The most frustrating part of this entire thing is that the intent of the law is pretty clear and yet they are trying stuff like this. This is basically completely normal shit that american lawyers constantly pull - you're trying to put together a business contract that's been already agreed and then the legal team will just throw in insulting shit into contracts to see what kind of abuse they can get away with. It's not surprising that this "approach" leaked into Meta's normal operations. They thought that if they manage to sneak in clauses in EULA, that they somehow won something (while they actually antagonized people they shouldn't).
- that_guy_iain 3y ago
  They probably knew this wasn't going to fly but figure the revenue between them ignoring the law and having to follow the law would be more than the fine.
  - martin8412 3y ago
    Which is why fines should be a multiple of revenue gained by ignoring the law.
  - izacus 3y ago
    With a corporation the size of Meta, it's not at all a given that: - Team putting together EU policy is in any way related to the team that needs to deal with any kind of fines. - That anyone actually made this concious decision as a tradeoff (as in, if it ever bubbled up to a VP or similar strategic lead. So many behaviours of megacorps are emergent and not deliberate.
    - that_guy_iain 3y ago
      >- Team putting together EU policy is in any way related to the team that needs to deal with any kind of fines. Wouldn't that be a compliance team/department? > - That anyone actually made this concious decision as a tradeoff (as in, if it ever bubbled up to a VP or similar strategic lead. To be fair, I can believe that.
    - 3y ago
lloeki 3y ago
> The most frustrating part of this entire thing is that the intent of the law is pretty clear and yet they are trying stuff like this. GDPR question box implementations reveal the true values of implementors. Here are simple heuristics: 1.a is there "accept all" but no "reject all" on the same block, equally weighted and styled identically? 1.b 2. does the question keep coming up regularly when one answers "reject all" but never again as soon as one answers "accept all"? 3.a is the question box modal i.e blocks access or interaction with content? 3.b is the question box non-modal but obscures most of the content? 3.c is the question box non-dismissible or very hard to dismiss? 4. is the question box starting with "We value your privacy"? re 1. Often there's only a "manage choices" button next to "accept all", and "reject all" is either way down the scaling area of a small modal or entirely absent. re 2. This is most infuriating, e.g "reject all" cookies having an expiration of 24h and "accept all" cookies having an expiration of 10 years, enticing people to click "accept all" out of pure STOP-PESTERING-ME rage. re 3. This is equivalent to not answering, and not answering must be treated as if "reject all" was picked, except the choice may not be stored since no explicit choice has been given. Transparent background + 2% opacity light grey crosses outside the question box (either near top right or outright stuffed on top right of the whole browser viewport) overlaid on main content's white background come to mind; that is if they are at all present. Clicking anywhere outside the box should simply dismiss the box and be treated as "I do not answer". re 4. If you feel like you have to ask me the question and present me with the above, clearly you do not value my privacy, partly because I have DNT set; I know DNT is a "failure" because it was set as default by Edge or something, but then again, I am fairly convinced that given a properly implemented 1. most people would click "reject all" prolly all the time, otherwise the implementors would simply not go to such lengths to have us click "accept all".
bushbaba 3y ago
Because the reward is greater than risk.

pmontra 3y ago

Could FB simply say: this service costs money to run, either you pay for it or you watch ads, if you don't want to pay or watch ads press here to delete your account. Then, to the people that stay, yes or no to targeted ads. This won't kill Instagram and Facebook but will kill WhatsApp unless it's paid for by the business accounts and the ads on the other platforms.

Kelteseth 3y ago
This is what most German sites like spiegel.de or heise.de do: "Continue reading with ads Visit SPIEGEL.de as you normally would with the advertising and the usual tracking. (You can revoke your consent at any time.) or Read ad-free No sharing of your data with advertisers. Use us for a fee without any ad tracking and practically free of advertising."
- Euphorbium 3y ago
  Advertisers only want to advertise to paying customers, because free tier does not buy anything.
  - pmontra 3y ago
    Advertisers show ads to the large free tier of Facebook and Google. Furthermore everybody buy something.
    - ben_w 3y ago
      > Furthermore everybody buy something Is practically unavoidable in a system like ours; but also not important in this context as there's an implicit "because it was advertised". One of the ways I'm weird: it's like I have a homunculus of the Marie Kondo meme before I'd even heard of her, telling me I don't really want to buy $thing, or even receive one as a gift, because it won't spark joy. As a result, my total expenses included rent, food, commuting, utilities, fun… literally everything, all comes to less than €1000/month on average.

UpToTheSky 3y ago

Just to make me understand this: This is about storing data in the form of "Facebook user XYZ looked at a page about travel to Antarctica" and the reason Facebook wants to store such data is to show them travel offers when they read their Facebook feed? If so, can I download this data about me? Is there a way to download everything Facebook stores about me and then I will see all the websites and pages I visited that Facebook knows about?

Someone 3y ago
Possibly. https://facebook.com/help/212802592074644 https://facebook.com/help/212802592074644 allows you to download “a copy of your information on Facebook”. https://facebook.com/help/930396167085762/ https://facebook.com/help/930396167085762/ isn’t clear on whether that is included, though. I would guess that Facebook considers the “about travel to Antarctica” not part of your information on Facebook, though. They’ll tell you you visited a specific page, but not what they tagged that page with, even if it is your page (as I said, that’s a guess)
sofixa 3y ago
> If so, can I download this data about me? Is there a way to download everything Facebook stores about me and then I will see all the websites and pages I visited that Facebook knows about? If you live in the EU, you have the legal right to ask for all information Facebook has on you. https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens/my-rights/how-can-i-access-my-personal-data-held-company-organisation_en https://commission.europa.eu/law/law-topic/data-protection/r...
- Nextgrid 3y ago
  > If you live in the EU, you have the legal right to ask for all information Facebook has on you. Which Facebook will promptly ignore and get away with it: https://ruben.verborgh.org/facebook/ https://ruben.verborgh.org/facebook/
belorn 3y ago
It is about so much more. It is any personal data that facebook store that is not strictly necessary to provide the core products (such as messaging or sharing content). You bought some medicine online and the store shared that with Facebook. It can be location data from images. In theory it could also be things like "you messaged a person who leans towards a particular political side". All is data that can be data mined and used to calculate the highest revenue advertisement at any specific time you load a Facebook page. Two high profit questions that historically advertisement networks want to find out is when someone is expecting children, and when they are most likely to go to Disneyland.

rapatel0 3y ago

There is a really simple proposal Meta can make to users now. Pay €1-10 per month for no ads or consent to ads. Agree that data should be managed within the bounds of the law, but meta is not obligated to provide a service for free. I would totally pay for ad free social media to avoid all the garbage. Also, This might be one of the greatest opportunities for repricing an application in history. Meta can literally set the price arbitrarily

anticensor 3y ago
The problem is that cash, unlike information, can only be spent once.
thih9 3y ago
> There is a really simple proposal Meta can make to users now. Pay €1-10 per month for no ads or consent to ads. Wouldn't most people consent to ads, without opting in to tracking? I guess in that case Meta would be in the same situation as now.
phyrex 3y ago
I think meta makes much more per customer, and few people would be willing to pay, say, E100/yr to pay for Facebook without ads
karatinversion 3y ago
Illegal under the GDPR: consent to storing or processing personal data that is not necessary for performing a service cannot be a prerequisite to performing a service.
lucideer 3y ago
> Pay €1-10 per month for no ads or consent to ads. This is explicitly and very clearly called out as illegal in Article 7 (4): > 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

dfawcus 3y ago

FWIW - The English version of the press release: https://curia.europa.eu/jcms/upload/docs/application/pdf/2023-07/cp230113en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202...

openplatypus 3y ago

I can’t wait for internal review and independent investigation of the Irish DPC. If there was no bribery involved I would be surprised.

nabla9 3y ago

Huh? Meta tried to argue that it was legally obligated to serve ads to its users and this allows them to move any consent requirement for tracking and online advertisement into terms and conditions ... Whoah. The highly paid for legal contortionists who made the argument probably knew it was doomed from the start. They are just paid to delay inevitable by dragging it trough all courts.