11 ms·

Meta unlawfully ignores the users' right to easily withdraw consent: complaint

420 points by dotcoma 3y ago

stavros 3y ago
I love NOYB, please donate to them (recurring is better), they do very impactful work to safeguard our privacy.
- jacquesm 3y ago
  It's incredible how such an important issue relies on essentially a single individual out of 300+ million.
  - stavros 3y ago
    Do you mean NOYB? Aren't they a team?
    - HenryBemis 3y ago
      That ONE person out of 300m in the EU bothered to chase this topic.
      - stavros 3y ago
        Yes, I'm asking who this "one person" is. This is being chased by NOYB, an organization of multiple people.
        zinekeller 3y ago
        Not OP, but Max Schrems (and that's why the decisions related to this are called Schrems, Schrems II et al.). To be fair, he leads NOYB (so it's not just him), but he has a personal interest here. https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
        HenryBemis 3y ago
        We don't know the name, the article states that the org is putting itself in front. I am not surprised someone doesn't want to get entangled with Meta and use his/her own resources to fight this beast.
      - avgcorrection 3y ago
        It’s a bizzarely opaque statement since the population of the EU is over 400M. (Meanwhile the US population is over 300M.)
        jacquesm 3y ago
        How many of those are 18 and over?
        avgcorrection 3y ago
        Oh, really? Even more opaque. You don’t need to be of voting age (??) in order to be an activist or political in some sort of way. I’m pretty sure that Greta Thunberg wasn’t when she became famous.
        jacquesm 3y ago
        Schrems is so much more than a teenager activist. Anyway, if this thread leaves you frustrated then maybe just don't participate in it? The EU has 100's of millions of people, not all of them are in a position to bring this kind of effort because it requires bringing suit (which children may be able to do but don't generally do) and a very large chunk of a lifetime's worth of dedication. So in an attempt to roughly indicate the order of magnitude of difference between the number of people that could have taken action but didn't I used the 300 million figure. I haven't checked it for accuracy and Greta Thunberg notwithstanding the fact that you bring her up as an example is exactly because such individuals are so rare which is exactly the point that I was making. Without Schrems for privacy and without Thunberg for climate change these subjects would get less attention than they do, and both of them have been instrumental in making meaningful change when in fact both of these subjects should concern the vast majority of that 300 million, give or take.
        deleted 3y ago
        [deleted]
        deleted 3y ago
        [deleted]
      - Tainnor 3y ago
        Ultimately, there aren't that many people who have the technical knowledge, the ideology (that the internet should be for the good of the general public, not for corporations), the dedication and the time - and those who do exist are split between multiple issues (e.g. preventing the CSAM bill). In this case, it's specifically that not all DPAs are doing their job correctly: some due to understaffing, others arguably due to ideological reasons. I partially blame the GDPR itself - I still stand behind the spirit of that law, but it's IMHO not strict enough (or has too many loopholes): I think the selling of personal data to third parties should have been banned outright.
      - sgbeal 3y ago
        > That ONE person out of 300m in the EU bothered to chase this topic. Meanwhile, others of us in the EU simply delete their FB accounts and don't look back. (Right at 5 years ago, fwiw.)
    - jacquesm 3y ago
      They're a team but if not for Schrems I doubt the whole thing would have happened.
  - chaps 3y ago
    Having done a fair amount of important-but-niche work.. yeah. There are genuinely very few incentives to do this sort of work. It's very much to the point where doing stuff like this necessitates being aggressive towards people who aren't used to that sort of interaction, which is socially extremely difficult to do. And that often even means being aggressive towards colleagues who tend to have softer opinions on things. The alternative is languishing in hidden problems. The folks who end up doing this work, IME, have been burned pretty hard in the past and have decided to continue to wade through the potential of being burned again. Not many people do that.
- cscurmudgeon 3y ago
  Have they said anything at all regarding TikTok? Search seems empty.
difosfor 3y ago
I also applaud this and personally would prefer to just pay for services instead of being the product, but I'm afraid this is not a popular opinion. People don't want to pay, at least not knowingly. I'm curious how this will play out.
- robertlagrant 3y ago
  Why do you applaud this? What's it got to do with making a pay option?
- latexr 3y ago
  > pay for services instead of being the product That cliché is no longer applicable (was it ever?) and repeating it only helps the worst infringers. You can pay and still be the product. Consider the streaming services which charge you but still serve ads, or physical appliances that you buy but send your usage habits to the manufacturer (like TVs). Paying is not a guarantee that a company will treat you or your privacy with respect.
  - deleted 3y ago
    [deleted]
  - deleted 3y ago
    [deleted]
  - happytiger 3y ago
    Here here. Paying no longer protects anything. If anything, you’re more valuable as a data brokered account if you’re KYC verified as a real person: so in fact the opposite case is now often the reality. Consider that paying makes you prime rib for Sunday dinner from a data perspective: card verified PII. And do not forget that you can be assigned an ID and disassociated from your data, which can then be tracked anonymously completely legally as a non-personally identifiable account. And let me assure you de-anonymizing a collected dataset is often not a very difficult problem in the modern data brokerage filled era. We cannot pay out way out of this. We need rights to privacy and deletion enshrined in constitutional-style law, and soon. It must become a fundamental human right.
gampleman 3y ago
The DPC (if it is legally an option) should go for the highest possible fines available to them at this point, since Meta has by repeated and wilful infringing made it pretty clear that they will try anything to get around these laws. Like I have some sympathy for a legacy business that simply mismanages their GDPR obligations and buys some dodgy "compliance management" solution and ends up infringing - there a "slap on the wrist" light enforcement is appropriate. But Meta has been entangled in GDPR enforcement since the beginning, repeatedly, who clearly understood the regulation to begin with and went straight out of the gates attempting to workaround and arguably being the reason the regulation was enacted in the first place. I really want to see those 4% of global revenue fines piling on at this point.
- Nextgrid 3y ago
  The DPC is corrupt and does not want to go for the highest possible fines. They have been extremely lenient towards Facebook despite being able to impose harsher punishments.
jddj 3y ago
I haven't touched Instagram since they offered this ultimatum. Hopefully I can wait it out. The only reason I might have needed to use it would be to reach people whose contact I only have on there.
- Lewton 3y ago
  Same with me and Facebook, I missed out on a christmas get-together among long time friends because of it :/ At least the group who did show up "blamed"* the host for only inviting to the event via FB, which I see as a massively positive sign of the culture slowly changing *Not in a negative way, but in a "what did you expect, only inviting people via facebook" kinda way
noirscape 3y ago
This is an interesting argument. I wonder how it would be handled if Facebook instead had a 2-tier system where both tiers were paid. So you'd have to pay a base fee to use Facebook (and get tracked) and then a premium tier to remove the tracking. Putting aside the obvious ethical issues with such a system (that are obviously the reason why NOYB is filing), the "as easy to withdraw as it is to give" setup would be kept in such a situation I think. Ethically, paying for privacy has in my opinion no place in a post-GDPR world (and I do support the GDPR) and it's shameful that several DPAs have tacitly approved of it for local newspapers. Facebook doing it will likely drag the practice to CJEU, which is the worst outcome for this scheme because CJEU tends to not like GAFAMs "it's not against the letter, but against the spirit" crap in the slightest. I personally wouldn't be surprised if CJEU ends up shooting down the scheme as violating the GDPR.
- TomasEkeli 3y ago
  could you please explain what those abbreviations mean? I know GDPR, but the rest are obscure to me.
  - noirscape 3y ago
    NOYB: "None of Your Business", it's the site being linked. They're a customer rights activist group led by Max Schrems whose self-declared job appears to be "drag every business in the world to the attention of the DPAs to make sure they're both compliant and don't do any funny business with the GDPR". DPA: Data Protection Authority. They're local to each EU country (including those that aren't full Member States but do follow EU laws) and it's their job to enforce the GDPR at a country level. Usually they're a government department. The one you hear the most in the context of GAFAM enforcement is the Irish one, which is infamously underequipped and overburdened because GAFAM has lobbied the Irish government to not take enforcement seriously so all GAFAM companies can put their EU headquarters there (which permits them to only have to comply with the Irish DPA, something called the "one-stop shop" solution.) CJEU: Court of Justice of the European Union. Think SCOTUS but for the EU. While technically the CJEU doesn't operate on the concept of precedent (its main job is enforcing that Member States follow EU laws and directives correctly), their interpretations of EU law are the final interpretation of those laws. Usually once a case has gone through a DPA and isn't resolved satisfactorily (or isn't complied with), it ends up before CJEU. GAFAM has dragged basically all enforcement cases before CJEU to drag out the process. GAFAM: An abbreviation referring to the five largest American tech giants: Google, Apple, Facebook, Amazon, Microsoft. Usually is used as a shorthand for the "big tech" side of the IT industry.
lnxg33k1 3y ago
I would never have expected it, it's such a nice company
- HenryBemis 3y ago
  [flagged]
  - lnxg33k1 3y ago
    [flagged]
  - tagyro 3y ago
    I read this once: There are two kinds of people: those who want to make the world a better place and those who want to make enough money to afford to not care.
    - lnxg33k1 3y ago
      Do you think that a guy that writes something like that, is going to understand/consider your message? 10/1 you're better off speaking to a chair
      - birdman3131 3y ago
        Given that they including a winky face at the end I am fairly sure you missed the sarcasm inherent in the statement.
        lnxg33k1 3y ago
        Oh that is very possible
    - replygirl 3y ago
      those who believe the above are mutually exclusive, and those who develop social infrastructure
classified 3y ago
[flagged]
- rattlesnakedave 3y ago
  [flagged]
  - salawat 3y ago
    It's pnly impossible to interpret if complying is an existential risk to your business model.
  - PeterisP 3y ago
    It's very straightforward to interpret, Meta simply doesn't like the interpretation since in any reasonable interpretation of GDPR there is no way for them to be permitted to keep tracking all their users legally, no matter what they write in their terms&conditions or do otherwise.
    - xvector 3y ago
      The "reasonable interpretation of GDPR" would kill nearly every tech company that offers services to the general public for free. You can say good bye to Maps, YouTube, WhatsApp, etc. The EU fundamentally does not understand what it takes to run the services it relies on.
      - PeterisP 3y ago
        They're free to run non-tracking ads, they're free to charge money and refuse service to non-payers, they're free to quit EU market, but they're not free to track people who do not want to be tracked (no matter if they're paying or not, no matter if they're seeing ads or not), privacy in EU is not something the users can trade away or sell in a contract, it either has to be gifted as free choice (and free to revoke) or Meta can't use it, GDPR doesn't allow for a legal option to "buy" it with discounts or free service. GDPR is a relatively uncontroversial law within EU, it's not a narrow-niche-lobby law, it's democratically passed with general acceptance from all EU regions and diverse party groups, and there is no meaningful opposition to it from EU voters, and it works quite well for all the mainstream use cases (telecomms, banking, various loyalty programs of physical and online stores and the big retail chains, targeting for phone and mail marketing, treatment of data by landlords and creditors, healthcare data, all the intermediaries for insurance or healthcare or hiring, etc, etc) which arguably are far more important to one's daily life than whatever Meta does, and only the niche of internet ads is still lagging behind due to political reasons related to how global companies run their operations through Ireland and the tiny Irish DPA couldn't (or wouldn't, there are some perverse incentives at play) enforce things in a timely manner. While I personally don't think that it "would kill nearly every tech company that offers services to the general public for free. You can say good bye to Maps, YouTube, WhatsApp, etc.", I'll accept that on this aspect perhaps I'm mistaken and you're totally right, however, that has little to do with the grandparent argument that it's hard to interpret - the law is reasonably clear to interpret and that (anti-tracking) interpretation has been reaffirmed when challenged in courts, and even if it turns out that the EU voters are making a mistake because they(we) fundamentally don't understand something, that's still not an accidental mistake, that is intentional choice. And IMHO it's quite straightforward that they(we) in EU have the right to make that choice even if it turns out to be stupid in the long run, and Meta doesn't have the right (neither legal nor moral) to deny EU people that choice, they have to follow the law as intended or leave.
numpad0 3y ago
Deliberately leaving HTTP 402 reserved and undefined so Internet will stay free beer was a grave mistake.
loa_in_ 3y ago
Meta missed the part where their reparation doesn't have to be an easy fix. They dug themselves into a hole
- sonicanatidae 3y ago
  And why would they care when this will result in a fine that is less than they generate selling their user's lives to whomever.
octacat 3y ago
Of course it does. I have noo idea what happens if I press "Save settings" on all these cookie banners. Pretty sure somewhere there is a hidden checkbox that allows everything. It probably still tracks, just makes you happy reading the giant popup list. They invented "essential cookies for marketing purposes" anyway. And after there was this "You accept tracking ads or you pay to us" popup.
- bitshiftfaced 3y ago
  Similar issue with Reddit's privacy "settings" last I checked. I'd uncheck everything. Then I'd go back. Some stayed unchecked. Some didn't. Go figure.
  - pc86 3y ago
    Could just as easily be malicious or just bad developers.
    - greyface- 3y ago
      From a compliance perspective, does the difference matter?
      - pc86 3y ago
        Not at all, malicious may even be preferable as that's easier to correct than "skill issue." But I would argue it does matter from the "$TECH_CO bad amirite" perspective.
        swiftcoder 3y ago
        An organisation is what it does. Not really relevant whether the CO is malicious or incompetent, if the result is the same.
xvector 3y ago
[flagged]
- troupo 3y ago
  Europe has an expectation of privacy that is completely lost on Americans and American companies. Europe also has this expectation of privacy for a very good reason.
  - solenoid0937 3y ago
    [dead]
- bjornsing 3y ago
  I don’t remember the details but the spirit of the GDPR is basically that processing of your personal data requires your informed consent, and service cannot be withheld if you refuse to give this consent. What Meta is doing (not refusing to provide the service, but charging for it) is interesting, but sort of goes against the spirit of the law. Personally I find this kind of condescending: I’m not allowed to enter into agreements as I see fit because some EU bureaucrat wants to “protect” me. It would be much better if the regulators focused on keeping these giant companies honest, holding them to their own terms of service and forcing them to communicate those terms in a clear and transparent way. (And yes: I never wipe my ass without checking the latest EU regulations…)
- hyggetrold 3y ago
  I wish we could ban this kind of argument on HN. It is so short-sighted and absolutely ignores reality for everyday folks who are totally uneducated about tech (and don't care to be). It always strikes me as a 'caveat emptor' argument (Latin for "let the buyer beware") and smacks of condescension. "Fuck yeah I'm ripping you off, why are you so stupid as to let me do it?"
  - xvector 3y ago
    People in the EU can consent to doing hard drugs, but somehow they can't consent to giving their data away?
londons_explore 3y ago
I completely understand Meta finding profitable ways to skirt around the law - even breaking it subtly at times. But I'm very surprised the apparent offsenses are so large and so obvious. I was expecting them do do more subtle things like 'accidentally' asking users their cookie preference every time they use the site till they hit accept, and then never asking them ever again. When investigated, they can easily say 'oh, it was a bug because the fact the user rejected cookies was itself stored in a cookie'.
- autoexec 3y ago
  > But I'm very surprised the apparent offsenses are so large and so obvious. As long as it continues to be more profitable to go big when they break the law that's what facebook will do. Same as any other company. No need for facebook to even try to hide it because the fines/slaps on the wrist just don't matter. Try locking up CEOs or shareholders and watch how quickly they start following the law.
scotty79 3y ago
Facebook should be forced to pay € 251.88 per year to all the user who consented to keep the symmetry. It's only fair if that's how much data violating basic privacy is worth to Facebook.
lakomen 3y ago
Clear violation, yet so many online "newspapers" do it. Pay or get tracked and have ads shown. Despite a ruling that it's unlawful.
- smcin 3y ago
  Which specific ruling? The DPAs of a couple of EU member countries, on "pay or okay"? Are you talking about what online newspapers do in EU, US or where?
1vuio0pswjnm7 3y ago
https://web.archive.org/web/20240111074148if_/https://noyb.eu/en/meta-ignores-users-right-easily-withdraw-consent https://web.archive.org/web/20240111074148if_/https://noyb.e...
1vuio0pswjnm7 3y ago
If one reads the complaint, really all the complainant is trying to do is to change his subscription from unpaid to paid. First he subscribes to Facebook and Instagram for free, an unpaid subscription where he agrees to receive targeted ads. Next he tries to change his subscription to paid, presumably with terms where Meta agrees not to send targeted ads.^1 Signing up for the unpaid subscription can be done with a single click. Signing up for the paid subscription cannot. "When the complainant finally reached the correct page, he was confronted with two options. The first preselected and reflecting his current situation was to continue using Facebook with trackers (Kostenfrei mit Werbung verwenden). The second entailed the purchase of a 9,99 monthly subscription, in order to have access to the service without being tracked (Aboabschlieen und ohne Werbung verwenden) see screenshot below, left side." There should really be a third option: unsubscribe. 1. But does data collection still continue. Meta would probably argue it needs to track everything the complainant does while logged in to the Facebook and Instagram servers for "security" but without any restrictions on how they can use the data collected. We have already seen Facebook and Twitter getting caught using collected telephone numbers for commercial purposes when they were collected under the guise of being needed for "security". Even more, is Meta still allowed to track the complainant on the open web, outside of Meta's websites. The claims of "security" arguably do not apply there. Is Meta still collecting and processing the complainant's data regardless of which subscription he chooses. If yes, then arguably he is only revoking consent to have ads placed on the Meta webpages that he accesses. The consent may not relate to data processing. How does the GDPR define "data processing". For example, "Data processing is the collection and manipulation of digital data to produce meaningful information." French, Carl (1996). Data Processing and Information Technology (10th ed.). Thomson. p. 2. ISBN 1844801004. Meta could still "collect and manipulate data [from the complainant] to produce meaningful information" but refrain from placing ads in webpages viewed by the complainant.
sensanaty 3y ago
I wish the EU would grow some balls and tell Ireland to fuck off with their shenanigans of letting these companies get away with everything. Meta should be getting fined for every red cent they steal from users, 4% of global revenue doesn't even come close to the sort of fines that scumfuck of a company deserves.

420 points by dotcoma 3y ago

stavros 3y ago

I love NOYB, please donate to them (recurring is better), they do very impactful work to safeguard our privacy.

jacquesm 3y ago
It's incredible how such an important issue relies on essentially a single individual out of 300+ million.
- stavros 3y ago
  Do you mean NOYB? Aren't they a team?
  - HenryBemis 3y ago
    That ONE person out of 300m in the EU bothered to chase this topic.
    - stavros 3y ago
      Yes, I'm asking who this "one person" is. This is being chased by NOYB, an organization of multiple people.
      - zinekeller 3y ago
        Not OP, but Max Schrems (and that's why the decisions related to this are called Schrems, Schrems II et al.). To be fair, he leads NOYB (so it's not just him), but he has a personal interest here. https://en.wikipedia.org/wiki/Max_Schrems https://en.wikipedia.org/wiki/Max_Schrems
      - HenryBemis 3y ago
        We don't know the name, the article states that the org is putting itself in front. I am not surprised someone doesn't want to get entangled with Meta and use his/her own resources to fight this beast.
    - avgcorrection 3y ago
      It’s a bizzarely opaque statement since the population of the EU is over 400M. (Meanwhile the US population is over 300M.)
      - jacquesm 3y ago
        How many of those are 18 and over?
        avgcorrection 3y ago
        Oh, really? Even more opaque. You don’t need to be of voting age (??) in order to be an activist or political in some sort of way. I’m pretty sure that Greta Thunberg wasn’t when she became famous.
        jacquesm 3y ago
        Schrems is so much more than a teenager activist. Anyway, if this thread leaves you frustrated then maybe just don't participate in it? The EU has 100's of millions of people, not all of them are in a position to bring this kind of effort because it requires bringing suit (which children may be able to do but don't generally do) and a very large chunk of a lifetime's worth of dedication. So in an attempt to roughly indicate the order of magnitude of difference between the number of people that could have taken action but didn't I used the 300 million figure. I haven't checked it for accuracy and Greta Thunberg notwithstanding the fact that you bring her up as an example is exactly because such individuals are so rare which is exactly the point that I was making. Without Schrems for privacy and without Thunberg for climate change these subjects would get less attention than they do, and both of them have been instrumental in making meaningful change when in fact both of these subjects should concern the vast majority of that 300 million, give or take.
        deleted 3y ago
        [deleted]
        deleted 3y ago
        [deleted]
    - Tainnor 3y ago
      Ultimately, there aren't that many people who have the technical knowledge, the ideology (that the internet should be for the good of the general public, not for corporations), the dedication and the time - and those who do exist are split between multiple issues (e.g. preventing the CSAM bill). In this case, it's specifically that not all DPAs are doing their job correctly: some due to understaffing, others arguably due to ideological reasons. I partially blame the GDPR itself - I still stand behind the spirit of that law, but it's IMHO not strict enough (or has too many loopholes): I think the selling of personal data to third parties should have been banned outright.
    - sgbeal 3y ago
      > That ONE person out of 300m in the EU bothered to chase this topic. Meanwhile, others of us in the EU simply delete their FB accounts and don't look back. (Right at 5 years ago, fwiw.)
  - jacquesm 3y ago
    They're a team but if not for Schrems I doubt the whole thing would have happened.
- chaps 3y ago
  Having done a fair amount of important-but-niche work.. yeah. There are genuinely very few incentives to do this sort of work. It's very much to the point where doing stuff like this necessitates being aggressive towards people who aren't used to that sort of interaction, which is socially extremely difficult to do. And that often even means being aggressive towards colleagues who tend to have softer opinions on things. The alternative is languishing in hidden problems. The folks who end up doing this work, IME, have been burned pretty hard in the past and have decided to continue to wade through the potential of being burned again. Not many people do that.
cscurmudgeon 3y ago
Have they said anything at all regarding TikTok? Search seems empty.

difosfor 3y ago

I also applaud this and personally would prefer to just pay for services instead of being the product, but I'm afraid this is not a popular opinion. People don't want to pay, at least not knowingly. I'm curious how this will play out.

robertlagrant 3y ago
Why do you applaud this? What's it got to do with making a pay option?
latexr 3y ago
> pay for services instead of being the product That cliché is no longer applicable (was it ever?) and repeating it only helps the worst infringers. You can pay and still be the product. Consider the streaming services which charge you but still serve ads, or physical appliances that you buy but send your usage habits to the manufacturer (like TVs). Paying is not a guarantee that a company will treat you or your privacy with respect.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- happytiger 3y ago
  Here here. Paying no longer protects anything. If anything, you’re more valuable as a data brokered account if you’re KYC verified as a real person: so in fact the opposite case is now often the reality. Consider that paying makes you prime rib for Sunday dinner from a data perspective: card verified PII. And do not forget that you can be assigned an ID and disassociated from your data, which can then be tracked anonymously completely legally as a non-personally identifiable account. And let me assure you de-anonymizing a collected dataset is often not a very difficult problem in the modern data brokerage filled era. We cannot pay out way out of this. We need rights to privacy and deletion enshrined in constitutional-style law, and soon. It must become a fundamental human right.

gampleman 3y ago

The DPC (if it is legally an option) should go for the highest possible fines available to them at this point, since Meta has by repeated and wilful infringing made it pretty clear that they will try anything to get around these laws. Like I have some sympathy for a legacy business that simply mismanages their GDPR obligations and buys some dodgy "compliance management" solution and ends up infringing - there a "slap on the wrist" light enforcement is appropriate. But Meta has been entangled in GDPR enforcement since the beginning, repeatedly, who clearly understood the regulation to begin with and went straight out of the gates attempting to workaround and arguably being the reason the regulation was enacted in the first place. I really want to see those 4% of global revenue fines piling on at this point.

Nextgrid 3y ago
The DPC is corrupt and does not want to go for the highest possible fines. They have been extremely lenient towards Facebook despite being able to impose harsher punishments.

jddj 3y ago

I haven't touched Instagram since they offered this ultimatum. Hopefully I can wait it out. The only reason I might have needed to use it would be to reach people whose contact I only have on there.

Lewton 3y ago
Same with me and Facebook, I missed out on a christmas get-together among long time friends because of it :/ At least the group who did show up "blamed"* the host for only inviting to the event via FB, which I see as a massively positive sign of the culture slowly changing *Not in a negative way, but in a "what did you expect, only inviting people via facebook" kinda way

noirscape 3y ago

This is an interesting argument. I wonder how it would be handled if Facebook instead had a 2-tier system where both tiers were paid. So you'd have to pay a base fee to use Facebook (and get tracked) and then a premium tier to remove the tracking. Putting aside the obvious ethical issues with such a system (that are obviously the reason why NOYB is filing), the "as easy to withdraw as it is to give" setup would be kept in such a situation I think. Ethically, paying for privacy has in my opinion no place in a post-GDPR world (and I do support the GDPR) and it's shameful that several DPAs have tacitly approved of it for local newspapers. Facebook doing it will likely drag the practice to CJEU, which is the worst outcome for this scheme because CJEU tends to not like GAFAMs "it's not against the letter, but against the spirit" crap in the slightest. I personally wouldn't be surprised if CJEU ends up shooting down the scheme as violating the GDPR.

TomasEkeli 3y ago
could you please explain what those abbreviations mean? I know GDPR, but the rest are obscure to me.
- noirscape 3y ago
  NOYB: "None of Your Business", it's the site being linked. They're a customer rights activist group led by Max Schrems whose self-declared job appears to be "drag every business in the world to the attention of the DPAs to make sure they're both compliant and don't do any funny business with the GDPR". DPA: Data Protection Authority. They're local to each EU country (including those that aren't full Member States but do follow EU laws) and it's their job to enforce the GDPR at a country level. Usually they're a government department. The one you hear the most in the context of GAFAM enforcement is the Irish one, which is infamously underequipped and overburdened because GAFAM has lobbied the Irish government to not take enforcement seriously so all GAFAM companies can put their EU headquarters there (which permits them to only have to comply with the Irish DPA, something called the "one-stop shop" solution.) CJEU: Court of Justice of the European Union. Think SCOTUS but for the EU. While technically the CJEU doesn't operate on the concept of precedent (its main job is enforcing that Member States follow EU laws and directives correctly), their interpretations of EU law are the final interpretation of those laws. Usually once a case has gone through a DPA and isn't resolved satisfactorily (or isn't complied with), it ends up before CJEU. GAFAM has dragged basically all enforcement cases before CJEU to drag out the process. GAFAM: An abbreviation referring to the five largest American tech giants: Google, Apple, Facebook, Amazon, Microsoft. Usually is used as a shorthand for the "big tech" side of the IT industry.

lnxg33k1 3y ago

I would never have expected it, it's such a nice company

HenryBemis 3y ago
[flagged]
- lnxg33k1 3y ago
  [flagged]
- tagyro 3y ago
  I read this once: There are two kinds of people: those who want to make the world a better place and those who want to make enough money to afford to not care.
  - lnxg33k1 3y ago
    Do you think that a guy that writes something like that, is going to understand/consider your message? 10/1 you're better off speaking to a chair
    - birdman3131 3y ago
      Given that they including a winky face at the end I am fairly sure you missed the sarcasm inherent in the statement.
      - lnxg33k1 3y ago
        Oh that is very possible
  - replygirl 3y ago
    those who believe the above are mutually exclusive, and those who develop social infrastructure

classified 3y ago

[flagged]

rattlesnakedave 3y ago
[flagged]
- salawat 3y ago
  It's pnly impossible to interpret if complying is an existential risk to your business model.
- PeterisP 3y ago
  It's very straightforward to interpret, Meta simply doesn't like the interpretation since in any reasonable interpretation of GDPR there is no way for them to be permitted to keep tracking all their users legally, no matter what they write in their terms&conditions or do otherwise.
  - xvector 3y ago
    The "reasonable interpretation of GDPR" would kill nearly every tech company that offers services to the general public for free. You can say good bye to Maps, YouTube, WhatsApp, etc. The EU fundamentally does not understand what it takes to run the services it relies on.
    - PeterisP 3y ago
      They're free to run non-tracking ads, they're free to charge money and refuse service to non-payers, they're free to quit EU market, but they're not free to track people who do not want to be tracked (no matter if they're paying or not, no matter if they're seeing ads or not), privacy in EU is not something the users can trade away or sell in a contract, it either has to be gifted as free choice (and free to revoke) or Meta can't use it, GDPR doesn't allow for a legal option to "buy" it with discounts or free service. GDPR is a relatively uncontroversial law within EU, it's not a narrow-niche-lobby law, it's democratically passed with general acceptance from all EU regions and diverse party groups, and there is no meaningful opposition to it from EU voters, and it works quite well for all the mainstream use cases (telecomms, banking, various loyalty programs of physical and online stores and the big retail chains, targeting for phone and mail marketing, treatment of data by landlords and creditors, healthcare data, all the intermediaries for insurance or healthcare or hiring, etc, etc) which arguably are far more important to one's daily life than whatever Meta does, and only the niche of internet ads is still lagging behind due to political reasons related to how global companies run their operations through Ireland and the tiny Irish DPA couldn't (or wouldn't, there are some perverse incentives at play) enforce things in a timely manner. While I personally don't think that it "would kill nearly every tech company that offers services to the general public for free. You can say good bye to Maps, YouTube, WhatsApp, etc.", I'll accept that on this aspect perhaps I'm mistaken and you're totally right, however, that has little to do with the grandparent argument that it's hard to interpret - the law is reasonably clear to interpret and that (anti-tracking) interpretation has been reaffirmed when challenged in courts, and even if it turns out that the EU voters are making a mistake because they(we) fundamentally don't understand something, that's still not an accidental mistake, that is intentional choice. And IMHO it's quite straightforward that they(we) in EU have the right to make that choice even if it turns out to be stupid in the long run, and Meta doesn't have the right (neither legal nor moral) to deny EU people that choice, they have to follow the law as intended or leave.

numpad0 3y ago

Deliberately leaving HTTP 402 reserved and undefined so Internet will stay free beer was a grave mistake.

loa_in_ 3y ago

Meta missed the part where their reparation doesn't have to be an easy fix. They dug themselves into a hole

sonicanatidae 3y ago
And why would they care when this will result in a fine that is less than they generate selling their user's lives to whomever.

octacat 3y ago

Of course it does. I have noo idea what happens if I press "Save settings" on all these cookie banners. Pretty sure somewhere there is a hidden checkbox that allows everything. It probably still tracks, just makes you happy reading the giant popup list. They invented "essential cookies for marketing purposes" anyway. And after there was this "You accept tracking ads or you pay to us" popup.

bitshiftfaced 3y ago
Similar issue with Reddit's privacy "settings" last I checked. I'd uncheck everything. Then I'd go back. Some stayed unchecked. Some didn't. Go figure.
- pc86 3y ago
  Could just as easily be malicious or just bad developers.
  - greyface- 3y ago
    From a compliance perspective, does the difference matter?
    - pc86 3y ago
      Not at all, malicious may even be preferable as that's easier to correct than "skill issue." But I would argue it does matter from the "$TECH_CO bad amirite" perspective.
      - swiftcoder 3y ago
        An organisation is what it does. Not really relevant whether the CO is malicious or incompetent, if the result is the same.

xvector 3y ago

[flagged]

troupo 3y ago
Europe has an expectation of privacy that is completely lost on Americans and American companies. Europe also has this expectation of privacy for a very good reason.
- solenoid0937 3y ago
  [dead]
bjornsing 3y ago
I don’t remember the details but the spirit of the GDPR is basically that processing of your personal data requires your informed consent, and service cannot be withheld if you refuse to give this consent. What Meta is doing (not refusing to provide the service, but charging for it) is interesting, but sort of goes against the spirit of the law. Personally I find this kind of condescending: I’m not allowed to enter into agreements as I see fit because some EU bureaucrat wants to “protect” me. It would be much better if the regulators focused on keeping these giant companies honest, holding them to their own terms of service and forcing them to communicate those terms in a clear and transparent way. (And yes: I never wipe my ass without checking the latest EU regulations…)
hyggetrold 3y ago
I wish we could ban this kind of argument on HN. It is so short-sighted and absolutely ignores reality for everyday folks who are totally uneducated about tech (and don't care to be). It always strikes me as a 'caveat emptor' argument (Latin for "let the buyer beware") and smacks of condescension. "Fuck yeah I'm ripping you off, why are you so stupid as to let me do it?"
- xvector 3y ago
  People in the EU can consent to doing hard drugs, but somehow they can't consent to giving their data away?

londons_explore 3y ago

I completely understand Meta finding profitable ways to skirt around the law - even breaking it subtly at times. But I'm very surprised the apparent offsenses are so large and so obvious. I was expecting them do do more subtle things like 'accidentally' asking users their cookie preference every time they use the site till they hit accept, and then never asking them ever again. When investigated, they can easily say 'oh, it was a bug because the fact the user rejected cookies was itself stored in a cookie'.

autoexec 3y ago
> But I'm very surprised the apparent offsenses are so large and so obvious. As long as it continues to be more profitable to go big when they break the law that's what facebook will do. Same as any other company. No need for facebook to even try to hide it because the fines/slaps on the wrist just don't matter. Try locking up CEOs or shareholders and watch how quickly they start following the law.

scotty79 3y ago

Facebook should be forced to pay € 251.88 per year to all the user who consented to keep the symmetry. It's only fair if that's how much data violating basic privacy is worth to Facebook.

lakomen 3y ago

Clear violation, yet so many online "newspapers" do it. Pay or get tracked and have ads shown. Despite a ruling that it's unlawful.

smcin 3y ago
Which specific ruling? The DPAs of a couple of EU member countries, on "pay or okay"? Are you talking about what online newspapers do in EU, US or where?

1vuio0pswjnm7 3y ago

https://web.archive.org/web/20240111074148if_/https://noyb.eu/en/meta-ignores-users-right-easily-withdraw-consent https://web.archive.org/web/20240111074148if_/https://noyb.e...

1vuio0pswjnm7 3y ago

If one reads the complaint, really all the complainant is trying to do is to change his subscription from unpaid to paid. First he subscribes to Facebook and Instagram for free, an unpaid subscription where he agrees to receive targeted ads. Next he tries to change his subscription to paid, presumably with terms where Meta agrees not to send targeted ads.^1 Signing up for the unpaid subscription can be done with a single click. Signing up for the paid subscription cannot. "When the complainant finally reached the correct page, he was confronted with two options. The first preselected and reflecting his current situation was to continue using Facebook with trackers (Kostenfrei mit Werbung verwenden). The second entailed the purchase of a 9,99 monthly subscription, in order to have access to the service without being tracked (Aboabschlieen und ohne Werbung verwenden) see screenshot below, left side." There should really be a third option: unsubscribe. 1. But does data collection still continue. Meta would probably argue it needs to track everything the complainant does while logged in to the Facebook and Instagram servers for "security" but without any restrictions on how they can use the data collected. We have already seen Facebook and Twitter getting caught using collected telephone numbers for commercial purposes when they were collected under the guise of being needed for "security". Even more, is Meta still allowed to track the complainant on the open web, outside of Meta's websites. The claims of "security" arguably do not apply there. Is Meta still collecting and processing the complainant's data regardless of which subscription he chooses. If yes, then arguably he is only revoking consent to have ads placed on the Meta webpages that he accesses. The consent may not relate to data processing. How does the GDPR define "data processing". For example, "Data processing is the collection and manipulation of digital data to produce meaningful information." French, Carl (1996). Data Processing and Information Technology (10th ed.). Thomson. p. 2. ISBN 1844801004. Meta could still "collect and manipulate data [from the complainant] to produce meaningful information" but refrain from placing ads in webpages viewed by the complainant.

sensanaty 3y ago

I wish the EU would grow some balls and tell Ireland to fuck off with their shenanigans of letting these companies get away with everything. Meta should be getting fined for every red cent they steal from users, 4% of global revenue doesn't even come close to the sort of fines that scumfuck of a company deserves.