5 ms·

The article is quite clear on what the issue is. Meta needs explicit consent to do this kind of targeting. With consent, there is no issue. The tracking itself

The article is quite clear on what the issue is. Meta needs explicit consent to do this kind of targeting. With consent, there is no issue. The tracking itself is not illegal, but doing it without consent is illegal.

bettercallsalad 3y ago
I have doubts on how effective these type of consent based system are. I for one always click “accept all” and move on for most websites I am on. Average layman has very little time the effort needed to understand and customize the consents are quite high. Not to say they purposely make the UI hostile in those consent popups. For me anyway GDPR has been largely a waste of bureaucracy, a better effort would be to educate populous about what cookies are and how tracking works and the extent of the trackings etc - these stuff should be in High School curriculum already by now.
- alkonaut 3y ago
  Any site that uses a dark pattern like only having "Allow all" and "Show purposes" is in clear violation of the GDPR, and they could just as well have just ignored showing anything! The regulation is clear that opting out should be as easy as opting in. A conforming consient dialog has a "reject all" as well as an "allow" button. And when they do, I always click "reject all". I think most people would - which is why I guess some sites still try to use those dark patterns. I'm still waiting for a big regulatory fine to make an example. If a known company is fined almost out of existence due to lack of a reject button, I think there would be instant self-regulation here. > For me anyway GDPR has been largely a waste of bureaucracy, a better effort would be to educate populous about what cookies are and how tracking works and the extent of the trackings etc - these stuff should be in High School curriculum already by now. Don't confuse the GDPR with "cookie banners" though. That's the end user visible tip of the iceberg. The biggest premise (and in my opinion the genius of the regulation) is that the end user is not required to know or understand anything. Instead, the people handling their data should. And if nothing else, it really has forced everyone (often even outside the EU) to think twice about how their data is stored and retained. And that's huge positive even if cookies were never a thing in gdpr.
  - bettercallsalad 3y ago
    > how their data is stored and retained Didn’t the EU recently cut a deal where the data from EU can be transferred to US without any legal ramifications [1]? So then this just goes to show it’s just about adding another layer of bureaucracy instead of caring about protecting user data. [1] https://www.politico.eu/article/eu-signs-off-on-data-transfers-deal-with-us/ https://www.politico.eu/article/eu-signs-off-on-data-transfe...
whimsicalism 3y ago
Yes, except that Meta is being legally compelled to provide the services regardless of whether the user consents. They are basically being forced to separate the part of their business that actually makes money from the part that users like and then forced to lose money on those users. I would be fine about laws requiring facebook to be up front and clear about how they are using this data, but mandating free rider status seems a step too far.
- dtech 3y ago
  It's been a while since I read the GDPR so I could misremember, but I don't remember anything similar to this assertion. While I don't think it will work on the scale FAANG wants (see e.g. Youtube premium), what is the legal roadblock to let users chose between tracking or paying for the service?
  - whimsicalism 3y ago
    It is literally illegal in the EU, I am pretty familiar with this regulation. This is both from ECJ decisions on gdpr and will also be codified in the DMA
    - cccbbbaaa 3y ago
      It's legal in France: https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookie-walls/la-cnil-publie-des-premiers-criteres-devaluation https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/coo... https://www.cnil.fr/fr/cookies-et-autres-traceurs-le-conseil-detat-rend-sa-decision-sur-les-lignes-directrices-de-la-cnil https://www.cnil.fr/fr/cookies-et-autres-traceurs-le-conseil... https://www.dataguidance.com/opinion/france-cnil-opens-door-cookie-walls-closer-look https://www.dataguidance.com/opinion/france-cnil-opens-door-... In Germany too, if I remember correctly. But if you are so sure about this, please sue so we can get rid of these cookie walls!
      - whimsicalism 3y ago
        Fair enough, these decisions are recent and are in conflict with other decisions in other countries around the GDPR as well as past guidance from European regulators (the EDPB explicitly said that this was not allowed in 2020). I also don't think you can really say with a straight face that this is a decision that a company like Meta could comfortably rely on, the regulatory uncertainty here is still extremely high. It also requires a court to decide that your fee is a “reasonable” one and you cannot just refuse access outright - you must make your content available to the non-consenting user. Regardless, all of this will be illegal anyways once the DMA comes into effect. And I still think, national exceptions aside, that my description of the current state of EU law was accurate: "The prevalent regulatory approach in Europe is that currently advocated by the European Data Protection Board ('EDPB') in its Guidelines 05/2020 on Consent under Regulation 2016/679 whereby the EDPB provides in no uncertain terms that '[i]n order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information (paragraph 39 of the Guidelines)'." [0] [0]: https://www.dataguidance.com/opinion/france-cnil-opens-door-cookie-walls-closer-look#:~:text=Under%20the%20text%20established%20by,entail%20the%20use%20of%20cookies https://www.dataguidance.com/opinion/france-cnil-opens-door-....

bettercallsalad 3y ago

I have doubts on how effective these type of consent based system are. I for one always click “accept all” and move on for most websites I am on. Average layman has very little time the effort needed to understand and customize the consents are quite high. Not to say they purposely make the UI hostile in those consent popups. For me anyway GDPR has been largely a waste of bureaucracy, a better effort would be to educate populous about what cookies are and how tracking works and the extent of the trackings etc - these stuff should be in High School curriculum already by now.

alkonaut 3y ago
Any site that uses a dark pattern like only having "Allow all" and "Show purposes" is in clear violation of the GDPR, and they could just as well have just ignored showing anything! The regulation is clear that opting out should be as easy as opting in. A conforming consient dialog has a "reject all" as well as an "allow" button. And when they do, I always click "reject all". I think most people would - which is why I guess some sites still try to use those dark patterns. I'm still waiting for a big regulatory fine to make an example. If a known company is fined almost out of existence due to lack of a reject button, I think there would be instant self-regulation here. > For me anyway GDPR has been largely a waste of bureaucracy, a better effort would be to educate populous about what cookies are and how tracking works and the extent of the trackings etc - these stuff should be in High School curriculum already by now. Don't confuse the GDPR with "cookie banners" though. That's the end user visible tip of the iceberg. The biggest premise (and in my opinion the genius of the regulation) is that the end user is not required to know or understand anything. Instead, the people handling their data should. And if nothing else, it really has forced everyone (often even outside the EU) to think twice about how their data is stored and retained. And that's huge positive even if cookies were never a thing in gdpr.
- bettercallsalad 3y ago
  > how their data is stored and retained Didn’t the EU recently cut a deal where the data from EU can be transferred to US without any legal ramifications [1]? So then this just goes to show it’s just about adding another layer of bureaucracy instead of caring about protecting user data. [1] https://www.politico.eu/article/eu-signs-off-on-data-transfers-deal-with-us/ https://www.politico.eu/article/eu-signs-off-on-data-transfe...

whimsicalism 3y ago

Yes, except that Meta is being legally compelled to provide the services regardless of whether the user consents. They are basically being forced to separate the part of their business that actually makes money from the part that users like and then forced to lose money on those users. I would be fine about laws requiring facebook to be up front and clear about how they are using this data, but mandating free rider status seems a step too far.

dtech 3y ago
It's been a while since I read the GDPR so I could misremember, but I don't remember anything similar to this assertion. While I don't think it will work on the scale FAANG wants (see e.g. Youtube premium), what is the legal roadblock to let users chose between tracking or paying for the service?
- whimsicalism 3y ago
  It is literally illegal in the EU, I am pretty familiar with this regulation. This is both from ECJ decisions on gdpr and will also be codified in the DMA
  - cccbbbaaa 3y ago
    It's legal in France: https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookie-walls/la-cnil-publie-des-premiers-criteres-devaluation https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/coo... https://www.cnil.fr/fr/cookies-et-autres-traceurs-le-conseil-detat-rend-sa-decision-sur-les-lignes-directrices-de-la-cnil https://www.cnil.fr/fr/cookies-et-autres-traceurs-le-conseil... https://www.dataguidance.com/opinion/france-cnil-opens-door-cookie-walls-closer-look https://www.dataguidance.com/opinion/france-cnil-opens-door-... In Germany too, if I remember correctly. But if you are so sure about this, please sue so we can get rid of these cookie walls!
    - whimsicalism 3y ago
      Fair enough, these decisions are recent and are in conflict with other decisions in other countries around the GDPR as well as past guidance from European regulators (the EDPB explicitly said that this was not allowed in 2020). I also don't think you can really say with a straight face that this is a decision that a company like Meta could comfortably rely on, the regulatory uncertainty here is still extremely high. It also requires a court to decide that your fee is a “reasonable” one and you cannot just refuse access outright - you must make your content available to the non-consenting user. Regardless, all of this will be illegal anyways once the DMA comes into effect. And I still think, national exceptions aside, that my description of the current state of EU law was accurate: "The prevalent regulatory approach in Europe is that currently advocated by the European Data Protection Board ('EDPB') in its Guidelines 05/2020 on Consent under Regulation 2016/679 whereby the EDPB provides in no uncertain terms that '[i]n order for consent to be freely given, access to services and functionalities must not be made conditional on the consent of a user to the storing of information, or gaining of access to information (paragraph 39 of the Guidelines)'." [0] [0]: https://www.dataguidance.com/opinion/france-cnil-opens-door-cookie-walls-closer-look#:~:text=Under%20the%20text%20established%20by,entail%20the%20use%20of%20cookies https://www.dataguidance.com/opinion/france-cnil-opens-door-....