7 ms·

> pushed back hard on pretty much any sort of regulation and oversight I think there's a selection effect going on here: If tech and politicians agree that som

> pushed back hard on pretty much any sort of regulation and oversight I think there's a selection effect going on here: If tech and politicians agree that some policy is a good idea, then tech does it voluntarily, so no regulation is needed. The only cases where it becomes a matter of regulation are the cases where tech and politicians disagree. For example: Remember the privacy discussion around COVID-19 exposure-tracking apps? If the exposure-tracking apps had been implemented in a naive way, they would have been incredibly invasive to privacy. But tech proactively figured out good solutions to the privacy questions, so it never became an issue. If some politician _had_ proposed regulation saying that exposure-tracking apps needed to protect privacy, then tech wouldn't have pushed back, because that's what they were already doing anyway. But because tech was already doing it, politicians didn't propose the regulation. So, because an issue never becomes a matter of regulation unless tech pushes back on it, it ends up looks like "tech pushes back on all regulation". Furthermore, in the cases where tech and politicians disagree, the politicians haven't always been right. For example, GDPR cookie banners are a joke. California's AB5 law is another example, as the original article mentioned. So, I don't think "boy who cried wolf" is a fair analogy. Tech companies aren't always right, but it's not as if they're automatically opposed to all new policies; and when they do oppose politicians' proposed policies, it's sometimes for good reasons.

mschuster91 3y ago
> If tech and politicians agree that some policy is a good idea, then tech does it voluntarily, so no regulation is needed. The only cases where it becomes a matter of regulation are the cases where tech and politicians disagree. And these cases are the utter majority. > For example, GDPR cookie banners are a joke. They are, but only for those services that want to squeeze their customers like they're data lemons. What you need to do to provide the customer with the service they desire is covered automatically, the thing where you need a GDPR consent banner is if you want to include a truckload of external services to track your users across the Internet.
- DocTomoe 3y ago
  I set up a nice little webpage, that did not use any tracking at all. There was one cookie for a home-brew login functionality, and even that was only linked to an extremely limited amount of data (namely, the login name, and the password, didn't even mandate email...). By all means, this one cookie - whose use was completely voluntary - was a 'technical cookie' which I do not need consent for under the EU's cookie laws. It took about 30 minutes after the go-live before the first madmen came around and started shouting at me that I needed a cookie banner. The problem with that law is not only that it caused everyone to set up a cookie banner to operate as they used to, it also is that it created a class of people who are self-declared data protection vigilantes. I do consider publishing on Gopher (or Gemini) in the future, if only to prevent zealots - who often have no technical knowledge - from accessing my services. The people I address are capable - and willing - to use other protocols.
- timmaxw 3y ago
  > And these cases are the utter majority. I think it's the opposite -- tech and politicians agree on the vast majority of things, but they're considered banal so the topic never comes up. But, you could imagine an alternate universe where tech did things differently, and then politicians wanted to regulate them. Here are some examples: * Tech companies offer most of their services for free. You could imagine a world where Google charged for searches and Facebook charged for posting, and so "poor people being excluded from the Internet" became a political issue. * Tech companies translate their services into a variety of languages. You could imagine a world where Google and Facebook were only available in English, and so "non-English-speakers being excluded from the Internet" became a political issue. * Tech companies don't allow anyone to view DMs, private posts, etc. except law enforcement. You could imagine a world where Google and Facebook had a culture where it was normal for employees to snoop on other peoples' DMs, and it became a political issue. * Conversely, you could imagine a world where tech companies refused to allow law enforcement access to peoples' DMs even with a valid warrant, and it became a political issue. (This is starting to happen.) * Tech companies allow anyone to post by default. You could imagine a world where tech companies only allowed people to post if tech companies liked their political views (similar to how newspapers' biases affect which editorials they publish) and it became a political issue. (This is starting to happen: the left is pressuring tech companies to restrict certain right-wing content, and the right is talking about regulation to force tech not to do that.) * Tech companies sometimes kick people off the platform for arbitrary procedural reasons, but not for personal pettiness reasons (with the notable exception of Elon Musk kicking people off Twitter). You could imagine a world where it was normal for e.g. Google to delete a journalist's GMail account if the journalist published something Google didn't like, and it becoming a political issue. * Tech companies often contribute to open-source standards and software. For example, Google is heavily involved in defining web standards; and they made Chromium open-source, allowing rivals like Microsoft to build on it. You could imagine a world where the tech ecosystem was much more fragmented and closed-source than it is today, and it becoming a political issue. This is what I was saying about a selection effect: You can easily think of ways that politicians want to regulate tech more, because those topics are controversial and make the news. But there are actually a ton of ways that tech _could_ be much worse than it is, but those topics never come up, so it takes some imagination to think of them.
dgoldstein0 3y ago
A lot of cookie banners intended to satisfy GDPR don't - websites have to have a clear opt out, and anything "go to these other sites and opt out individually" is probably not compliant. Some big vendors however pushed the bounds of this and probably are getting their asses handed to them - but as with all legal things this would be happening in slow motion. GDPR has some good ideas, but implementation hasn't been perfect. CCPA https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa in my opinion is a more straightforward law. Basically: if you want to sell someone's information you have to get consent first. It still has some of the "banner on every site" problem but at least most which are clearly for CCPA are binary ok/don't sell my data questions.
- algas 3y ago
  Yeah. Cookies qua cookies are at best something obvious and measurable, but don't necessarily correlate with the company doing anything nefarious with your information. What's worse, it has always been the client's choice to keep cookies. You can, e.g., browse in a private tab on Chrome and they'll get automatically deleted. The fact that cookies are A) only loosely correlated with undesired behavior and B) already optional makes it absurd that every site I visit should waste 10 seconds of my time with a banner asking me to consent to their use of cookies. Especially because the only way for them to remember that preference is... to give you a cookie! Fortunately Brave has an option to automatically skip those banners, which works on most sites.
- bad_user 3y ago
  You and the parent are conflating GDPR with the "ePrivacy Directive" (cookie law). GDPR doesn't say much about cookies. What GDPR says is that you have to have a legal basis for processing user data. For example, a DPA just ruled that Facebook doesn't have a "legitimate interest" when using the user profile for ads targeting, so they'll be forced to ask for opt-in consent without the ability to deny service to those that refuse. A legitimate interest is for things the customer expects as part of the service, e.g. an address is needed for home delivery, or maybe data needed for security (IP logging). https://thisisunpacked.substack.com/p/the-eu-war-on-behavioral-advertising https://thisisunpacked.substack.com/p/the-eu-war-on-behavior... The cookie banners are needed when websites are fingerprinting users. The website may have a legitimate interest for doing analytics, but the user still needs to be informed that they are fingerprinted. NOTE: here, too, you don't need cookie banners if it's functionality that the user expects, like a session or a shopping cart cookie. At the risk of repeating myself: websites need cookie banners or GDPR consent dialogs mostly when doing shit that violates people's privacy. I've read a lot of complaints against GDPR on HN and elsewhere and I feel that it misses the forest from the trees: those banners and dialogs expose just how widespread the practice of violating people's privacy is. And I fear that a lot of the backlash coming from Silicon Valley has been from people connected to the ads industry.
lewhoo 3y ago
> GDPR cookie banners are a joke Many of the sites actually don't require cookie notifications because strictly necessary cookies^ are GDPR compliant but they still display the notification. In theory if cookie notifications were omitted when possible then sites who track more than needed would stick out immediately. ^ Strictly necessary cookies are essential for websites to provide basic functions or to access particular features of it. Such features include the ability to sign in, add items to your cart in an online store, or purchase stuff on the internet.
Ensorceled 3y ago
> I think there's a selection effect going on here [...] So, I don't think "boy who cried wolf" is a fair analogy. Tech companies aren't always right, but it's not as if they're automatically opposed to all new policies; and when they do oppose politicians' proposed policies, it's sometimes for good reasons. I think you are missing another, equally massive, source of information politicians are exposed to: lobbying. We see Microsoft complaining about mergers, but politicians are exposed to non-stop lobbying.

mschuster91 3y ago

> If tech and politicians agree that some policy is a good idea, then tech does it voluntarily, so no regulation is needed. The only cases where it becomes a matter of regulation are the cases where tech and politicians disagree. And these cases are the utter majority. > For example, GDPR cookie banners are a joke. They are, but only for those services that want to squeeze their customers like they're data lemons. What you need to do to provide the customer with the service they desire is covered automatically, the thing where you need a GDPR consent banner is if you want to include a truckload of external services to track your users across the Internet.

DocTomoe 3y ago
I set up a nice little webpage, that did not use any tracking at all. There was one cookie for a home-brew login functionality, and even that was only linked to an extremely limited amount of data (namely, the login name, and the password, didn't even mandate email...). By all means, this one cookie - whose use was completely voluntary - was a 'technical cookie' which I do not need consent for under the EU's cookie laws. It took about 30 minutes after the go-live before the first madmen came around and started shouting at me that I needed a cookie banner. The problem with that law is not only that it caused everyone to set up a cookie banner to operate as they used to, it also is that it created a class of people who are self-declared data protection vigilantes. I do consider publishing on Gopher (or Gemini) in the future, if only to prevent zealots - who often have no technical knowledge - from accessing my services. The people I address are capable - and willing - to use other protocols.
timmaxw 3y ago
> And these cases are the utter majority. I think it's the opposite -- tech and politicians agree on the vast majority of things, but they're considered banal so the topic never comes up. But, you could imagine an alternate universe where tech did things differently, and then politicians wanted to regulate them. Here are some examples: * Tech companies offer most of their services for free. You could imagine a world where Google charged for searches and Facebook charged for posting, and so "poor people being excluded from the Internet" became a political issue. * Tech companies translate their services into a variety of languages. You could imagine a world where Google and Facebook were only available in English, and so "non-English-speakers being excluded from the Internet" became a political issue. * Tech companies don't allow anyone to view DMs, private posts, etc. except law enforcement. You could imagine a world where Google and Facebook had a culture where it was normal for employees to snoop on other peoples' DMs, and it became a political issue. * Conversely, you could imagine a world where tech companies refused to allow law enforcement access to peoples' DMs even with a valid warrant, and it became a political issue. (This is starting to happen.) * Tech companies allow anyone to post by default. You could imagine a world where tech companies only allowed people to post if tech companies liked their political views (similar to how newspapers' biases affect which editorials they publish) and it became a political issue. (This is starting to happen: the left is pressuring tech companies to restrict certain right-wing content, and the right is talking about regulation to force tech not to do that.) * Tech companies sometimes kick people off the platform for arbitrary procedural reasons, but not for personal pettiness reasons (with the notable exception of Elon Musk kicking people off Twitter). You could imagine a world where it was normal for e.g. Google to delete a journalist's GMail account if the journalist published something Google didn't like, and it becoming a political issue. * Tech companies often contribute to open-source standards and software. For example, Google is heavily involved in defining web standards; and they made Chromium open-source, allowing rivals like Microsoft to build on it. You could imagine a world where the tech ecosystem was much more fragmented and closed-source than it is today, and it becoming a political issue. This is what I was saying about a selection effect: You can easily think of ways that politicians want to regulate tech more, because those topics are controversial and make the news. But there are actually a ton of ways that tech _could_ be much worse than it is, but those topics never come up, so it takes some imagination to think of them.

dgoldstein0 3y ago

A lot of cookie banners intended to satisfy GDPR don't - websites have to have a clear opt out, and anything "go to these other sites and opt out individually" is probably not compliant. Some big vendors however pushed the bounds of this and probably are getting their asses handed to them - but as with all legal things this would be happening in slow motion. GDPR has some good ideas, but implementation hasn't been perfect. CCPA https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa in my opinion is a more straightforward law. Basically: if you want to sell someone's information you have to get consent first. It still has some of the "banner on every site" problem but at least most which are clearly for CCPA are binary ok/don't sell my data questions.

algas 3y ago
Yeah. Cookies qua cookies are at best something obvious and measurable, but don't necessarily correlate with the company doing anything nefarious with your information. What's worse, it has always been the client's choice to keep cookies. You can, e.g., browse in a private tab on Chrome and they'll get automatically deleted. The fact that cookies are A) only loosely correlated with undesired behavior and B) already optional makes it absurd that every site I visit should waste 10 seconds of my time with a banner asking me to consent to their use of cookies. Especially because the only way for them to remember that preference is... to give you a cookie! Fortunately Brave has an option to automatically skip those banners, which works on most sites.
bad_user 3y ago
You and the parent are conflating GDPR with the "ePrivacy Directive" (cookie law). GDPR doesn't say much about cookies. What GDPR says is that you have to have a legal basis for processing user data. For example, a DPA just ruled that Facebook doesn't have a "legitimate interest" when using the user profile for ads targeting, so they'll be forced to ask for opt-in consent without the ability to deny service to those that refuse. A legitimate interest is for things the customer expects as part of the service, e.g. an address is needed for home delivery, or maybe data needed for security (IP logging). https://thisisunpacked.substack.com/p/the-eu-war-on-behavioral-advertising https://thisisunpacked.substack.com/p/the-eu-war-on-behavior... The cookie banners are needed when websites are fingerprinting users. The website may have a legitimate interest for doing analytics, but the user still needs to be informed that they are fingerprinted. NOTE: here, too, you don't need cookie banners if it's functionality that the user expects, like a session or a shopping cart cookie. At the risk of repeating myself: websites need cookie banners or GDPR consent dialogs mostly when doing shit that violates people's privacy. I've read a lot of complaints against GDPR on HN and elsewhere and I feel that it misses the forest from the trees: those banners and dialogs expose just how widespread the practice of violating people's privacy is. And I fear that a lot of the backlash coming from Silicon Valley has been from people connected to the ads industry.

lewhoo 3y ago

> GDPR cookie banners are a joke Many of the sites actually don't require cookie notifications because strictly necessary cookies^ are GDPR compliant but they still display the notification. In theory if cookie notifications were omitted when possible then sites who track more than needed would stick out immediately. ^ Strictly necessary cookies are essential for websites to provide basic functions or to access particular features of it. Such features include the ability to sign in, add items to your cart in an online store, or purchase stuff on the internet.

Ensorceled 3y ago

> I think there's a selection effect going on here [...] So, I don't think "boy who cried wolf" is a fair analogy. Tech companies aren't always right, but it's not as if they're automatically opposed to all new policies; and when they do oppose politicians' proposed policies, it's sometimes for good reasons. I think you are missing another, equally massive, source of information politicians are exposed to: lobbying. We see Microsoft complaining about mergers, but politicians are exposed to non-stop lobbying.