9 ms·

Tbh if you are concerned about the privacy and ethics concerns here the biggest red flag is in the subtitle: Meta's Twitter rival launched in over 100 countrie

Tbh if you are concerned about the privacy and ethics concerns here the biggest red flag is in the subtitle: Meta's Twitter rival launched in over 100 countries today—but not in the EU Anything more is simply detail - if a major launch of this sort of service omits the EU we immediately know exactly why.

TylerE 3y ago
Not sure I buy this. Some of the EU stuff is good, I think a lot of it goes to far and it's a terrible nightmare to navigate now, never mind in a decade when we're all using software that doesn't exist yet.
- hnhg 3y ago
  Can you say specifically what goes too far? I don't find it onerous or unreasonable at all, but my business model doesn't improve by violating it either.
  - TylerE 3y ago
    Right to be forgotten has some really nasty edge csaes.
    - yoaviram 3y ago
      Such as?
      - jay_kyburz 3y ago
        such as the ability easily support redaction of personal data? Errg: sorry folks. I miss read the thread and thought the "such as" was responding to the comment next to it about the design flaw of not being able to delete personal data.
        deleted 3y ago
        [deleted]
        amanaplanacanal 3y ago
        That doesn’t sound like an edge case.
        friendlyHornet 3y ago
        And this is nasty because?
        seanhunter 3y ago
        That's not an edge case in the law, that's a limitation in your system.
      - Reubend 3y ago
        - Payments, particularly from P2P transactions. If I send you money, and then you request the deletion of your profile, there's plenty of complexity there. - Enforcement records from illegal content / violating content - Local data cache for offline mode in mobile apps I'm not saying all of these apply to "Threads". But there are tons of edge cases to consider that need code changes t o behave as expected.
        8fingerlouie 3y ago
        > Payments There's really no complexity there. The right to be forgotten doesn't superseed other laws, and it is required by law in most countries, that transaction data be stored for 5 years plus running year, so in case you request to be forgotten, that can only happen once the mandatory data retainment has expired, which can easily be handled by a "transaction date", and simply run a batch job that matches each user to their transactions (and desire to be forgotten), and once transaction are expired and the user has requested to be forgotten, you simply delete. > Local data cache for offline mode in mobile apps The right to be forgotten has a "grace period", so set your cache expiration to less than that amount of time and you're pretty much home safe, or better yet, don't cache GDPR sensitive data and you can pretty much cache for as long as you like.
        spacebanana7 3y ago
        There's a lot more to payments than raw transaction data. Payments are usually related to the exchange of goods or services. The delivery data of those could be essential for winning a chargeback dispute or a liability for a customer that asked to be forgotten.
        jen20 3y ago
        You aren’t holding raw transaction data on the basis of consent, so it doesn’t matter.
    - _cenw 3y ago
      If your app doesn't easily support redaction of personal data, you have a design flaw to fix.
      - Silhouette 3y ago
        How are you going to "fix" that "design flaw" when the personal data in question is the result of legally required customer age checks? Evidence needed to support your tax filings? Used to identify and block people who are repeatedly trying to defraud you or breach your security? Subject to a legal hold because it might provide relevant evidence in some legal action between other parties or it's been requested as evidence by some government committee? Data protection laws like the GDPR might take the position that you should minimise the collection and use of personal data. Many of us might even agree with that position in principle. It can still be complicated to work out what "minimal" actually means if you did have good reasons to collect the personal data in the first place and you might still need to keep the data or some part of it for those purposes or to comply with other laws or regulations.
        _cenw 3y ago
        I don't know where your actual problem is. The GDPR allows holding data for most of these purposes. You intermingled legal obligations with data legal departments would like to hold in the end there. Only one of those is required. Also, some of these are pure theoretical in the EU. You're not even allowed to photocopy an ID in Germany; age verification is a checkmark someone sets upon verifying the ID is valid and then (metaphorically) handing it back, not a copy of a legal document that you probably don't want deduplicated to random S3 buckets held by all the companies you do business with. They're not exactly resistant to replay attacks, after all.
        Silhouette 3y ago
        I don't know where your actual problem is. My point is that knowing which personal data you need to redact and under which circumstances is not always easy. Before you can build a system that does something you first need to identify exactly what something is required.
    - elefanten 3y ago
      Can you elaborate a full argument here? Or link somewhere that does?
      - pinkcan 3y ago
        politicians and other shady individuals know how to use this to their advantage
  - JumpCrisscross 3y ago
    > Can you say specifically what goes too far? Twenty-eight independent data regulators on a complain-investigate model. I’ve seen folks bury early-stage competitors with regulatory inundation as an effective, if unethical, strategy. Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads.
    - pgeorgi 3y ago
      For EU-based business: The DPA of your country is responsible for you. For non-EU-based business: Appoint a representative in the EU. The DPA of that representative's country is responsible for you. So where do the other 20+ DPAs come in? They might be responsible for your customers - in which case, they'll contact your DPA and sort it out among themselves. You still won't have to become an expert in the nuances of Bulgarian, Swedish and Portuguese privacy law.
      - JumpCrisscross 3y ago
        > they'll contact your DPA and sort it out among themselves No, they won’t. They’ll help you coördinate. You won’t have to become an expert in other bodies of law, but you will need to responsive to them, which is time consuming, distracting and—if you’re running a real business—expensive. I’ve seen this deployed to remarkable efficacy, with asymmetry in defence:deployment cost in excess of 10:1.
    - concordDance 3y ago
      > Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads. Note that Musk has zero need to tell anyone to do this. Some fans will do so on their own initiative and that will suffice.
  - Nifty3929 3y ago
    How do you know you aren’t violating it? Even with the best of intentions, these laws can be labyrinthian and ambiguous, and therefore expensive to (try to) observe. And there is still always the risk that you are found guilty of something. For a small or medium business, you are likely to be far enough out of the radar to avoid issues. But as a large company you may easily end up in legal crosshairs, costing millions or billions of euros, even if you ultimately prevail. And if you lose…
    - jonathankoren 3y ago
      Don’t collect information and you know you’re not violating it. ¯\_(ツ)_/¯ Seriously though, GDPR compliance isn’t that hard. You just have to get out of the habit of collecting everything.
      - mrweasel 3y ago
        > Seriously though, GDPR compliance isn’t that hard Unless compiling data on your users and selling it is your entire business plan. One of the issue I see it that many companies have been lured into this impression that they need to track everything, in great detail, but it doesn't actually provide that much value. I blame the snake oil sales people in the advertising/remarketing/up-selling/cross-selling business.
        dgb23 3y ago
        This is correct. So many websites don’t actually need to collect any user data. It’s just a distraction, slows down and bloats their site and worsens UX. I recommend to simply get rid of any tracking. If you want user feedback, ask them or do tests. It’s cheaper and more effective.
        Silhouette 3y ago
        So many websites don’t actually need to collect any user data. Any commercial organisation is going to have customers and therefore customer details and payments data. Any commercial site needs to record enough logs to investigate events like outages or security threats. Any site that isn't purely informational and read-only probably works with user-provided data in some way. People keep writing about GDPR and similar laws as if they only apply to data-harvesting analytics plugins on ad-ridden content farms but the same laws apply to everyone else as well. For many it will be reasonable and indeed necessary to process personal data in order to do whatever the site or app does.
- _cenw 3y ago
  If anything, the GDPRs wording of "legitimate interest" makes it too weak, where corporations can justify every use of data that makes them money as legitimate until a court stops them, as happened to Facebook very recently over ad microtargeting.
  - Nifty3929 3y ago
    The goal is ambiguity, so that lawyers and judges can argue about and decide each case individually based on their feelings and public sentiment of the parties involved.
  - janoc 3y ago
    I think GDPR is pretty clear there. That companies like Facebook push fancy theories of what is and isn't legitimate interest is not the fault of the law. People will always try to push the limits to see what they can get away with, esp. when there is money to be made. That doesn't mean it will fly - like Facebook has just discovered (and others before them). Law cannot enumerate every single possible existing and future use case. It outlines the intent - and if there is a grey area somewhere, it will be ultimately tested and decided in court. That's how it has always worked.
    - YurgenJurgensen 3y ago
      There are ways to make this problem less bad though. You have your permissive case and then write a number of examples into the law that show what you do not consider allowed and invite future courts to consider them. Pre-emptive case law (which is a lot cheaper than actual case law), if you will.
      - janoc 3y ago
        Which is exactly what has happened. GDPR (or any other piece of legislation, really) explicitly enumerates some of the situations. E.g. Recital 47 on Overriding legitimate interest: "The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." I.e. Facebook is entitled to use your data for their own direct marketing (e.g. sending you leaflets, sale offers or telemarketing) to you according to this. We can guess how did this provision get there (likely the lobbying has been fierce). Or Article 22 on automated processing/profiling: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." Full text of the directive is here: https://gdpr.eu/article-1-subject-matter-and-objectives-overview/ https://gdpr.eu/article-1-subject-matter-and-objectives-over... A lot of people make all sorts of comments on GDPR (and other regulation) but it is unfortunate that very few have actually *read* what they are commenting on.
- gmerc 3y ago
  Scale is the enemy of nuance. This is true for both sides but choosing between US company data brokers free for all and EU, well
- seanhunter 3y ago
  The idea that GDPR is a nightmare to navigate is entirely fud. It's pretty clear and the case law has in the main been established. Most of the time when people are saying that it is a nightmare to navigate what they actually mean is they don't like the privacy protections that it gives to EU data subjects and the implications for the data harvesting they want to do as part of their business.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
Moldoteck 3y ago
Imo it's about using instagram data for threads(following same people). Gdpr is not the case since gdpr is also in uk and threads work there
- yoaviram 3y ago
  The UK is working on a separate data protection law and the attitude towards privacy is very different from the EU (hence the rewrite)
  - _cenw 3y ago
    They're essentially the same, the ICO just doesn't enforce it.
    - orra 3y ago
      Bingo. And post Brexit they'll ignore all the CJEU case law about how blatantly companies have been building GDPR since the start.
  - remus 3y ago
    > The UK is working on a separate data protection law and the attitude towards privacy is very different from the EU (hence the rewrite) This is very speculative. My guess is that changes will be made, but they'll be incremental and some effort will be made to ensure broad alignment with eu GDPR so we don't have another SCC-syle mess (where some major EU to USA data transfers were determined to be illegal.)
  - seanhunter 3y ago
    The UK has a separate data protection law (UK GDPR[1]) which is the more or less same as the EU. The current government held a consultation on possible changes[2], but I would doubt they could actually carry through on making a significant change given their current weak and divided state and the likelihood they will lose in the next general election. [1] https://uk.practicallaw.thomsonreuters.com/w-026-8528?contextData=(sc.Default)&transitionType=Default&firstPage=true https://uk.practicallaw.thomsonreuters.com/w-026-8528?contex... [2] https://www.gov.uk/government/consultations/data-a-new-direction https://www.gov.uk/government/consultations/data-a-new-direc...
pinkcan 3y ago
why are you going so far though? it's right there: "Meta"
- mellosouls 3y ago
  Ha, yeah I had that thought after I posted.
  - senttoschool 3y ago
    I also thought you were just going to say "Meta" after the first sentence.
xinayder 3y ago
100% agree with this and the other post, the biggest red flag is "Meta". Whoever thought something good and user-first would come out of this wannabe Twitter killer is completely naive. I expect that federation won't last and there's 2 things that can happen, either Meta decides it's not worth it, or they will find a way to draw out most of federated users and then deal a killing blow to the fediverse. I was skeptical about being against Meta's Twitter being federated, but now I am totally in favor of it being banned by most instances.
- that_guy_iain 3y ago
  For me the biggest red flag is that they have apps in the EU but what they're doing with this one is so dodgy that they're not even risking entering the EU. Also, interesting to see a big international company actually back up their "we just won't do europe then"
  - WinstonSmith84 3y ago
    > interesting to see a big international company actually back up their "we just won't do europe then" that's the most interesting things to me. Whether: 1- Threads is dead in the water 2- They figure it out and makes the EU happy 3- EU is irrelevant enough to be ignored 2- still looks like the most likely 1- would be very embarrassing and 3- would be, indeed, an "interesting" development.
    - Keirmot 3y ago
      Let me give my 2 cents as an EU citizen. The way I see it is a mix of all of that, but number 3 is the biggest. Twitter is not big here. There’s people who use it, sure, but there’s a reason you don’t see that many EU issue trending on Twitter. Here’s an example out of the top of my head: France is rioting and it barely registered on Twitter. The biggest European market for Twitter is the UK and it has 19M users, the second biggest is France with 9.5M [1] The only time I see EU events surging on Twitter is during continental sporting events like Champions League, or Eurovision. Twitter is just that that big around here. Instagram on the other hand, I don’t know anyone without an IG account - so that might muddy the waters on this dynamic. This however is just my personal experience. [1] https://www.oberlo.com/statistics/number-of-twitter-users-by-country https://www.oberlo.com/statistics/number-of-twitter-users-by...
newaccount74 3y ago
A more charitable interpretation could be that they just haven't implemented a bunch of stuff that's required by the GDPR -- like being able to export data and deleting your account. I'm pretty sure they'll launch in the EU eventually.
odiroot 3y ago
"They trust me. Dumb fucks."
- stOneskull 3y ago
  any of us could've written something like that when young
  - mewmew07 3y ago
    you think zuck changed his mind on this?
    - cookie_monsta 3y ago
      On the contrary - this quote has stood the test of time. If you are trusting zuck in 2023 then you really are a DF
  - rglullis 3y ago
    1) That's not true 2) Even if it were true, we are not CEO of a multi-billion corporation.
- deleted 3y ago
  [deleted]
3cats-in-a-coat 3y ago
Don't jump to conclusions. They're likely not launching in EU because EU requires user data be stored in EU, and their current launch stack is hosted elsewhere, look at this datacenter map of Meta: https://datacenters.atmeta.com/ https://datacenters.atmeta.com/ They're mostly in the US, and most outside the EU. Given the record timeline from concept to launch for this app, it's normal they can't whip up a datacenter from nothing overnight.
- 3cats-in-a-coat 3y ago
  I find it odd that I'm downvoted. Is the information I stated incorrect? Or simply doesn't align with the narrative in this thread of bashing Meta? I'm simply trying to stay objective. Facebook is as intrusive as it can be, even more than Threads can be I'd say. And it's running fine in EU. So, let's not ignore facts.
  - deleted 3y ago
    [deleted]
- hengheng 3y ago
  Maybe it's because I grew up on IRC and ICQ, but I just cannot imagine an asynchronous text-based social network to require a full datacenter of the same scale as their video and ad-track platforms. I kinda assume that Meta could do this if they wanted. Their Instagram and Facebook comments are legal and available in the EU no problem.
  - 3cats-in-a-coat 3y ago
    Well, let's be fair to the task at hand: - Yes Instagram and Facebook are legal and available in EU (as I noted), but there's one data center in Ireland and one in Denmark as far as I see, and given the massive influx of users to Threads, they probably have no extra capacity on these two datacenters to cover all of EU with a new app, not right now at least. Compare with SEVENTEEN datacenters in the US. - "Full datacenter" doesn't mean much. When we say "a datacenter" it doesn't mean a building of specific size and capacity. They likely collocate some servers in other people's data centers (in fact many of those are like that). - IRC and ICQ still require a network of servers. IRC is a protocol that barely changes so you don't need as much centralization as with a product of rapid iteration and innovation as modern social networks. But you still must be quite familiar with IRC splits and lag, which comes with such architecture. If a social network broke as often as IRC did, people would simply not use it, modern audience have higher expectations. Resilience requires redundancy and more resource-intensive architectures. - Modern social networks have way more people on, than IRC ever did. At the peak of IRC use, around 2004-2005 all networks, all servers, total, had about 10 million users. Today they're just about 350k. Compare with Threads, which gained 30 million+ users in ONE DAY. More users mean you need more servers and beefier servers, and more serious architecture (as things don't scale linearly by magic beyond a threshold). - IRC has no content to host at all. How'd you publish a photo to the world on IRC? You can't. Or even text? I guess everyone has to be in the channel, or know where to find some logs? ICQ is also mostly peer to peer. If you lose your copy of the chat logs, that's it. At least how it was in the 90s when it was popular and I used it (I hear it's still popular in Russia or something? Dunno). So you can't compare social media with a peer-to-peer ephemeral messaging protocol. The peer-to-peer messaging protocol is a tiny part of what Twitter and Threads do. - I haven't even mentioned algorithmic timelines and the like, which make the task even more complicated, nothing like IRC. And then to pay for all these costs of hosting and algorithmic distribution, backup and so on, you need to collect said user data, profile ads, run the ad network UI and so on. That also adds to the cost and resource use of running this service. We can probably discuss "is all this needed, can't we go back to something like IRC"? And I think about this a lot. The modern social media design is not the best way to do it, it's not the final way. But Meta wanted to clone Twitter, not IRC, and this comes with the cost & system requirements of running something like Twitter.
impulser_ 3y ago
I would bet over 95% of companies don't comply with GDPR. I know some startups don't serve EU because of this. Facebook is under the microscope of the EU, they probably aren't risking getting fined until they can scale the product and implement the thing they need to lower the fine they would get and make being fined worth it. They are going to get fined most likely, but again 95% of the companies in the world could be fined as well if they were under the spotlight like Facebook is. GDPR compliance is NOT easy at all ask anyone who works in compliance they knows this.
- whstl 3y ago
  You don't even have to bet, you can just sample random websites and see how many make it more difficult to deny cookies than to accept. This is already a GDPR violation. At some point it was definitely more than 95% of websites being shady with their cookie coercion banners.
- wslh 3y ago
  I would say that no company or person is immune to arbitrary legal attacks. Complaining 100% with law is difficult if not impossible for companies or people with few resources. Laws could ge contradictory and/or inconsistent if you dig deeper. That is why it is important to have sandboxes and/or laws that are based on size, number of consumers, etc. one thing is to ask for a full GDPR compliance to a bank and much different is for small companies.
- jen20 3y ago
  It’s exceptionally easy: one just has to not do shitty things with personal information. Complying if you are doing shitty things with personal information is, by design, impossible - and that is good.
  - impulser_ 3y ago
    Ok, what if you do a database back up daily and someone requests you to delete their information. You're telling me you go through all those back ups and delete that person's information? If you don't you aren't complying with GDPR.
zelphirkalt 3y ago
I for one keep thinking: "Ah good, that that shit is not here yet." The longer it takes, the better. If they do not enter the EU at all, that would be perfect. But I probably am kidding myself, if I think, that they will never enter the EU. They will wriggle their way around the law somehow and if not, they will calculate and break the law, like they did many times before, in the name of profit.
deelowe 3y ago
> if a major launch of this sort of service omits the EU we immediately know exactly why. Yeah, because implementing compliance features takes time and they likely opted to launch early instead.
- olodus 3y ago
  Oh how nice, we Europeans get the non-beta version without those pesky privacy bugs :)
- marcod 3y ago
  Anybody who has worked on rolling out large scale software systems should understand this. Personally, I think the US should also have much stronger laws that safeguard the data of their people.
Havoc 3y ago
Yeah the EU is rapidly becoming a barometer of what’s radioactive and what’s not. Not that they’re perfect - plenty of insane rulings coming out of there too like Frances microphone one

TylerE 3y ago

Not sure I buy this. Some of the EU stuff is good, I think a lot of it goes to far and it's a terrible nightmare to navigate now, never mind in a decade when we're all using software that doesn't exist yet.

hnhg 3y ago
Can you say specifically what goes too far? I don't find it onerous or unreasonable at all, but my business model doesn't improve by violating it either.
- TylerE 3y ago
  Right to be forgotten has some really nasty edge csaes.
  - yoaviram 3y ago
    Such as?
    - jay_kyburz 3y ago
      such as the ability easily support redaction of personal data? Errg: sorry folks. I miss read the thread and thought the "such as" was responding to the comment next to it about the design flaw of not being able to delete personal data.
      - deleted 3y ago
        [deleted]
      - amanaplanacanal 3y ago
        That doesn’t sound like an edge case.
      - friendlyHornet 3y ago
        And this is nasty because?
      - seanhunter 3y ago
        That's not an edge case in the law, that's a limitation in your system.
    - Reubend 3y ago
      - Payments, particularly from P2P transactions. If I send you money, and then you request the deletion of your profile, there's plenty of complexity there. - Enforcement records from illegal content / violating content - Local data cache for offline mode in mobile apps I'm not saying all of these apply to "Threads". But there are tons of edge cases to consider that need code changes t o behave as expected.
      - 8fingerlouie 3y ago
        > Payments There's really no complexity there. The right to be forgotten doesn't superseed other laws, and it is required by law in most countries, that transaction data be stored for 5 years plus running year, so in case you request to be forgotten, that can only happen once the mandatory data retainment has expired, which can easily be handled by a "transaction date", and simply run a batch job that matches each user to their transactions (and desire to be forgotten), and once transaction are expired and the user has requested to be forgotten, you simply delete. > Local data cache for offline mode in mobile apps The right to be forgotten has a "grace period", so set your cache expiration to less than that amount of time and you're pretty much home safe, or better yet, don't cache GDPR sensitive data and you can pretty much cache for as long as you like.
        spacebanana7 3y ago
        There's a lot more to payments than raw transaction data. Payments are usually related to the exchange of goods or services. The delivery data of those could be essential for winning a chargeback dispute or a liability for a customer that asked to be forgotten.
        jen20 3y ago
        You aren’t holding raw transaction data on the basis of consent, so it doesn’t matter.
  - _cenw 3y ago
    If your app doesn't easily support redaction of personal data, you have a design flaw to fix.
    - Silhouette 3y ago
      How are you going to "fix" that "design flaw" when the personal data in question is the result of legally required customer age checks? Evidence needed to support your tax filings? Used to identify and block people who are repeatedly trying to defraud you or breach your security? Subject to a legal hold because it might provide relevant evidence in some legal action between other parties or it's been requested as evidence by some government committee? Data protection laws like the GDPR might take the position that you should minimise the collection and use of personal data. Many of us might even agree with that position in principle. It can still be complicated to work out what "minimal" actually means if you did have good reasons to collect the personal data in the first place and you might still need to keep the data or some part of it for those purposes or to comply with other laws or regulations.
      - _cenw 3y ago
        I don't know where your actual problem is. The GDPR allows holding data for most of these purposes. You intermingled legal obligations with data legal departments would like to hold in the end there. Only one of those is required. Also, some of these are pure theoretical in the EU. You're not even allowed to photocopy an ID in Germany; age verification is a checkmark someone sets upon verifying the ID is valid and then (metaphorically) handing it back, not a copy of a legal document that you probably don't want deduplicated to random S3 buckets held by all the companies you do business with. They're not exactly resistant to replay attacks, after all.
        Silhouette 3y ago
        I don't know where your actual problem is. My point is that knowing which personal data you need to redact and under which circumstances is not always easy. Before you can build a system that does something you first need to identify exactly what something is required.
  - elefanten 3y ago
    Can you elaborate a full argument here? Or link somewhere that does?
    - pinkcan 3y ago
      politicians and other shady individuals know how to use this to their advantage
- JumpCrisscross 3y ago
  > Can you say specifically what goes too far? Twenty-eight independent data regulators on a complain-investigate model. I’ve seen folks bury early-stage competitors with regulatory inundation as an effective, if unethical, strategy. Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads.
  - pgeorgi 3y ago
    For EU-based business: The DPA of your country is responsible for you. For non-EU-based business: Appoint a representative in the EU. The DPA of that representative's country is responsible for you. So where do the other 20+ DPAs come in? They might be responsible for your customers - in which case, they'll contact your DPA and sort it out among themselves. You still won't have to become an expert in the nuances of Bulgarian, Swedish and Portuguese privacy law.
    - JumpCrisscross 3y ago
      > they'll contact your DPA and sort it out among themselves No, they won’t. They’ll help you coördinate. You won’t have to become an expert in other bodies of law, but you will need to responsive to them, which is time consuming, distracting and—if you’re running a real business—expensive. I’ve seen this deployed to remarkable efficacy, with asymmetry in defence:deployment cost in excess of 10:1.
  - concordDance 3y ago
    > Zero chance Musk wouldn’t have armadas of randos complaining raining in on Threads. Note that Musk has zero need to tell anyone to do this. Some fans will do so on their own initiative and that will suffice.
- Nifty3929 3y ago
  How do you know you aren’t violating it? Even with the best of intentions, these laws can be labyrinthian and ambiguous, and therefore expensive to (try to) observe. And there is still always the risk that you are found guilty of something. For a small or medium business, you are likely to be far enough out of the radar to avoid issues. But as a large company you may easily end up in legal crosshairs, costing millions or billions of euros, even if you ultimately prevail. And if you lose…
  - jonathankoren 3y ago
    Don’t collect information and you know you’re not violating it. ¯\_(ツ)_/¯ Seriously though, GDPR compliance isn’t that hard. You just have to get out of the habit of collecting everything.
    - mrweasel 3y ago
      > Seriously though, GDPR compliance isn’t that hard Unless compiling data on your users and selling it is your entire business plan. One of the issue I see it that many companies have been lured into this impression that they need to track everything, in great detail, but it doesn't actually provide that much value. I blame the snake oil sales people in the advertising/remarketing/up-selling/cross-selling business.
      - dgb23 3y ago
        This is correct. So many websites don’t actually need to collect any user data. It’s just a distraction, slows down and bloats their site and worsens UX. I recommend to simply get rid of any tracking. If you want user feedback, ask them or do tests. It’s cheaper and more effective.
        Silhouette 3y ago
        So many websites don’t actually need to collect any user data. Any commercial organisation is going to have customers and therefore customer details and payments data. Any commercial site needs to record enough logs to investigate events like outages or security threats. Any site that isn't purely informational and read-only probably works with user-provided data in some way. People keep writing about GDPR and similar laws as if they only apply to data-harvesting analytics plugins on ad-ridden content farms but the same laws apply to everyone else as well. For many it will be reasonable and indeed necessary to process personal data in order to do whatever the site or app does.
_cenw 3y ago
If anything, the GDPRs wording of "legitimate interest" makes it too weak, where corporations can justify every use of data that makes them money as legitimate until a court stops them, as happened to Facebook very recently over ad microtargeting.
- Nifty3929 3y ago
  The goal is ambiguity, so that lawyers and judges can argue about and decide each case individually based on their feelings and public sentiment of the parties involved.
- janoc 3y ago
  I think GDPR is pretty clear there. That companies like Facebook push fancy theories of what is and isn't legitimate interest is not the fault of the law. People will always try to push the limits to see what they can get away with, esp. when there is money to be made. That doesn't mean it will fly - like Facebook has just discovered (and others before them). Law cannot enumerate every single possible existing and future use case. It outlines the intent - and if there is a grey area somewhere, it will be ultimately tested and decided in court. That's how it has always worked.
  - YurgenJurgensen 3y ago
    There are ways to make this problem less bad though. You have your permissive case and then write a number of examples into the law that show what you do not consider allowed and invite future courts to consider them. Pre-emptive case law (which is a lot cheaper than actual case law), if you will.
    - janoc 3y ago
      Which is exactly what has happened. GDPR (or any other piece of legislation, really) explicitly enumerates some of the situations. E.g. Recital 47 on Overriding legitimate interest: "The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." I.e. Facebook is entitled to use your data for their own direct marketing (e.g. sending you leaflets, sale offers or telemarketing) to you according to this. We can guess how did this provision get there (likely the lobbying has been fierce). Or Article 22 on automated processing/profiling: "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." Full text of the directive is here: https://gdpr.eu/article-1-subject-matter-and-objectives-overview/ https://gdpr.eu/article-1-subject-matter-and-objectives-over... A lot of people make all sorts of comments on GDPR (and other regulation) but it is unfortunate that very few have actually *read* what they are commenting on.
gmerc 3y ago
Scale is the enemy of nuance. This is true for both sides but choosing between US company data brokers free for all and EU, well
seanhunter 3y ago
The idea that GDPR is a nightmare to navigate is entirely fud. It's pretty clear and the case law has in the main been established. Most of the time when people are saying that it is a nightmare to navigate what they actually mean is they don't like the privacy protections that it gives to EU data subjects and the implications for the data harvesting they want to do as part of their business.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]

Moldoteck 3y ago

Imo it's about using instagram data for threads(following same people). Gdpr is not the case since gdpr is also in uk and threads work there

yoaviram 3y ago
The UK is working on a separate data protection law and the attitude towards privacy is very different from the EU (hence the rewrite)
- _cenw 3y ago
  They're essentially the same, the ICO just doesn't enforce it.
  - orra 3y ago
    Bingo. And post Brexit they'll ignore all the CJEU case law about how blatantly companies have been building GDPR since the start.
- remus 3y ago
  > The UK is working on a separate data protection law and the attitude towards privacy is very different from the EU (hence the rewrite) This is very speculative. My guess is that changes will be made, but they'll be incremental and some effort will be made to ensure broad alignment with eu GDPR so we don't have another SCC-syle mess (where some major EU to USA data transfers were determined to be illegal.)
- seanhunter 3y ago
  The UK has a separate data protection law (UK GDPR[1]) which is the more or less same as the EU. The current government held a consultation on possible changes[2], but I would doubt they could actually carry through on making a significant change given their current weak and divided state and the likelihood they will lose in the next general election. [1] https://uk.practicallaw.thomsonreuters.com/w-026-8528?contextData=(sc.Default)&transitionType=Default&firstPage=true https://uk.practicallaw.thomsonreuters.com/w-026-8528?contex... [2] https://www.gov.uk/government/consultations/data-a-new-direction https://www.gov.uk/government/consultations/data-a-new-direc...

pinkcan 3y ago

why are you going so far though? it's right there: "Meta"

mellosouls 3y ago
Ha, yeah I had that thought after I posted.
- senttoschool 3y ago
  I also thought you were just going to say "Meta" after the first sentence.

xinayder 3y ago

100% agree with this and the other post, the biggest red flag is "Meta". Whoever thought something good and user-first would come out of this wannabe Twitter killer is completely naive. I expect that federation won't last and there's 2 things that can happen, either Meta decides it's not worth it, or they will find a way to draw out most of federated users and then deal a killing blow to the fediverse. I was skeptical about being against Meta's Twitter being federated, but now I am totally in favor of it being banned by most instances.

that_guy_iain 3y ago
For me the biggest red flag is that they have apps in the EU but what they're doing with this one is so dodgy that they're not even risking entering the EU. Also, interesting to see a big international company actually back up their "we just won't do europe then"
- WinstonSmith84 3y ago
  > interesting to see a big international company actually back up their "we just won't do europe then" that's the most interesting things to me. Whether: 1- Threads is dead in the water 2- They figure it out and makes the EU happy 3- EU is irrelevant enough to be ignored 2- still looks like the most likely 1- would be very embarrassing and 3- would be, indeed, an "interesting" development.
  - Keirmot 3y ago
    Let me give my 2 cents as an EU citizen. The way I see it is a mix of all of that, but number 3 is the biggest. Twitter is not big here. There’s people who use it, sure, but there’s a reason you don’t see that many EU issue trending on Twitter. Here’s an example out of the top of my head: France is rioting and it barely registered on Twitter. The biggest European market for Twitter is the UK and it has 19M users, the second biggest is France with 9.5M [1] The only time I see EU events surging on Twitter is during continental sporting events like Champions League, or Eurovision. Twitter is just that that big around here. Instagram on the other hand, I don’t know anyone without an IG account - so that might muddy the waters on this dynamic. This however is just my personal experience. [1] https://www.oberlo.com/statistics/number-of-twitter-users-by-country https://www.oberlo.com/statistics/number-of-twitter-users-by...

newaccount74 3y ago

A more charitable interpretation could be that they just haven't implemented a bunch of stuff that's required by the GDPR -- like being able to export data and deleting your account. I'm pretty sure they'll launch in the EU eventually.

odiroot 3y ago

"They trust me. Dumb fucks."

stOneskull 3y ago
any of us could've written something like that when young
- mewmew07 3y ago
  you think zuck changed his mind on this?
  - cookie_monsta 3y ago
    On the contrary - this quote has stood the test of time. If you are trusting zuck in 2023 then you really are a DF
- rglullis 3y ago
  1) That's not true 2) Even if it were true, we are not CEO of a multi-billion corporation.
deleted 3y ago
[deleted]

3cats-in-a-coat 3y ago

Don't jump to conclusions. They're likely not launching in EU because EU requires user data be stored in EU, and their current launch stack is hosted elsewhere, look at this datacenter map of Meta: https://datacenters.atmeta.com/ https://datacenters.atmeta.com/ They're mostly in the US, and most outside the EU. Given the record timeline from concept to launch for this app, it's normal they can't whip up a datacenter from nothing overnight.

3cats-in-a-coat 3y ago
I find it odd that I'm downvoted. Is the information I stated incorrect? Or simply doesn't align with the narrative in this thread of bashing Meta? I'm simply trying to stay objective. Facebook is as intrusive as it can be, even more than Threads can be I'd say. And it's running fine in EU. So, let's not ignore facts.
- deleted 3y ago
  [deleted]
hengheng 3y ago
Maybe it's because I grew up on IRC and ICQ, but I just cannot imagine an asynchronous text-based social network to require a full datacenter of the same scale as their video and ad-track platforms. I kinda assume that Meta could do this if they wanted. Their Instagram and Facebook comments are legal and available in the EU no problem.
- 3cats-in-a-coat 3y ago
  Well, let's be fair to the task at hand: - Yes Instagram and Facebook are legal and available in EU (as I noted), but there's one data center in Ireland and one in Denmark as far as I see, and given the massive influx of users to Threads, they probably have no extra capacity on these two datacenters to cover all of EU with a new app, not right now at least. Compare with SEVENTEEN datacenters in the US. - "Full datacenter" doesn't mean much. When we say "a datacenter" it doesn't mean a building of specific size and capacity. They likely collocate some servers in other people's data centers (in fact many of those are like that). - IRC and ICQ still require a network of servers. IRC is a protocol that barely changes so you don't need as much centralization as with a product of rapid iteration and innovation as modern social networks. But you still must be quite familiar with IRC splits and lag, which comes with such architecture. If a social network broke as often as IRC did, people would simply not use it, modern audience have higher expectations. Resilience requires redundancy and more resource-intensive architectures. - Modern social networks have way more people on, than IRC ever did. At the peak of IRC use, around 2004-2005 all networks, all servers, total, had about 10 million users. Today they're just about 350k. Compare with Threads, which gained 30 million+ users in ONE DAY. More users mean you need more servers and beefier servers, and more serious architecture (as things don't scale linearly by magic beyond a threshold). - IRC has no content to host at all. How'd you publish a photo to the world on IRC? You can't. Or even text? I guess everyone has to be in the channel, or know where to find some logs? ICQ is also mostly peer to peer. If you lose your copy of the chat logs, that's it. At least how it was in the 90s when it was popular and I used it (I hear it's still popular in Russia or something? Dunno). So you can't compare social media with a peer-to-peer ephemeral messaging protocol. The peer-to-peer messaging protocol is a tiny part of what Twitter and Threads do. - I haven't even mentioned algorithmic timelines and the like, which make the task even more complicated, nothing like IRC. And then to pay for all these costs of hosting and algorithmic distribution, backup and so on, you need to collect said user data, profile ads, run the ad network UI and so on. That also adds to the cost and resource use of running this service. We can probably discuss "is all this needed, can't we go back to something like IRC"? And I think about this a lot. The modern social media design is not the best way to do it, it's not the final way. But Meta wanted to clone Twitter, not IRC, and this comes with the cost & system requirements of running something like Twitter.

impulser_ 3y ago

I would bet over 95% of companies don't comply with GDPR. I know some startups don't serve EU because of this. Facebook is under the microscope of the EU, they probably aren't risking getting fined until they can scale the product and implement the thing they need to lower the fine they would get and make being fined worth it. They are going to get fined most likely, but again 95% of the companies in the world could be fined as well if they were under the spotlight like Facebook is. GDPR compliance is NOT easy at all ask anyone who works in compliance they knows this.

whstl 3y ago
You don't even have to bet, you can just sample random websites and see how many make it more difficult to deny cookies than to accept. This is already a GDPR violation. At some point it was definitely more than 95% of websites being shady with their cookie coercion banners.
wslh 3y ago
I would say that no company or person is immune to arbitrary legal attacks. Complaining 100% with law is difficult if not impossible for companies or people with few resources. Laws could ge contradictory and/or inconsistent if you dig deeper. That is why it is important to have sandboxes and/or laws that are based on size, number of consumers, etc. one thing is to ask for a full GDPR compliance to a bank and much different is for small companies.
jen20 3y ago
It’s exceptionally easy: one just has to not do shitty things with personal information. Complying if you are doing shitty things with personal information is, by design, impossible - and that is good.
- impulser_ 3y ago
  Ok, what if you do a database back up daily and someone requests you to delete their information. You're telling me you go through all those back ups and delete that person's information? If you don't you aren't complying with GDPR.

zelphirkalt 3y ago

I for one keep thinking: "Ah good, that that shit is not here yet." The longer it takes, the better. If they do not enter the EU at all, that would be perfect. But I probably am kidding myself, if I think, that they will never enter the EU. They will wriggle their way around the law somehow and if not, they will calculate and break the law, like they did many times before, in the name of profit.

deelowe 3y ago

> if a major launch of this sort of service omits the EU we immediately know exactly why. Yeah, because implementing compliance features takes time and they likely opted to launch early instead.

olodus 3y ago
Oh how nice, we Europeans get the non-beta version without those pesky privacy bugs :)
marcod 3y ago
Anybody who has worked on rolling out large scale software systems should understand this. Personally, I think the US should also have much stronger laws that safeguard the data of their people.

Havoc 3y ago

Yeah the EU is rapidly becoming a barometer of what’s radioactive and what’s not. Not that they’re perfect - plenty of insane rulings coming out of there too like Frances microphone one