7 ms·
ECJ finds IAB Europe responsible for TCF consent spam popups across the Internet
- filleokus 3y ago> "IAB Europe has sought to evade its responsibility for this charade. But the European Court of Justice has set it straight. This decision will not only end the biggest spam operation in history. It will deal a mortal wound to the online tracking-based advertising industry.” If this turns out to be true it would be huge. But I'm (as always) skeptical of GDPR-related de facto enforcement, let's hope I'm wrong this time.
- AJ007 3y agoMassive win for Google, Apple, Facebook. Really hard to see a future for third party ad networks.
- algo_trader 3y ago> Massive win for Google, Apple, Facebook. Yes, that is true and under appreciated > Really hard to see a future for third party ad networks For now, what are biggest programmatic exchanges still going? I have been out of the loop for a while
- troupo 3y agoInvalid conclusion stemming from a false premise. If your "poor third-party ad networks who would think of them" cannot operate without dark patterns, abuse of cookie popups and malicious non-compliance, good riddance
- kasey_junk 3y agoYou’re replying to a comment as if it’s suggesting ad networks are good. It’s not. It’s just stating, rightly in my opinion, that this is a huge win for those giant tech companies.
- p_l 3y agoNote that Google, Amazon, Microsoft and others are also involved in this ruling: Google, Amazon, Microsoft, TikTok, and hundreds of other tracking-based online advertising companies rely on IAB Europe’s consent system, which Europe’s data protection authorities have already found to be in violation of the GDPR following our complaint.
- SiempreViernes 3y agoNote that "Google, Amazon, Microsoft, TikTok, and hundreds of other tracking-based online advertising companies rely on IAB Europe’s consent system, which Europe’s data protection authorities have already found to be in violation of the GDPR following our complaint."
- WesolyKubeczek 3y agoI think it’s more of IAB being the gatekeeper than MS et al striking such deals voluntarily. If you are an online newspaper running ads in EU, you can’t so much as sneeze without IAB’s blessing. They are everywhere.
- iamacyborg 3y agoGoogle and Facebook are desperately telling credulous idiots to sent them hashed personal data as if that’s not still a massive GDPR risk.
- drgo 3y agowhy is it that only the EU seems to care about Internet privacy?
- mrtksn 3y agoNot true at all, USA begin to care about it too with foreign companies(TikTok) gaining traction in the American market. Up until now, these tech giants were all American and therefore under American control in American jurisdiction. For EU, it was always the case that the dominant tech giants were foreign - only setting up shops in EU for tax purposes. Besides EU, other countries have protections in place too.
- diggan 3y ago> Not true at all, USA begin to care about it too with foreign companies(TikTok) gaining traction in the American market I'm not sure banning foreign competitors count as "caring about internet privacy". Has there been anything lately to actually protect internet privacy in the US?
- troupo 3y agoThere's California's Consumer Privacy Act: https://oag.ca.gov/privacy/ccpa https://oag.ca.gov/privacy/ccpa
- sph 3y agoThe US government's interest in TikTok is mostly a question of national security, not privacy. If they wanted to fight for privacy, they wouldn't have to go to China to find egregious mishandling of personal data. There are plenty of examples well within their borders.
- clawoo 3y ago> Not true at all, USA begin to care about it too with foreign companies(TikTok) gaining traction in the American market. You can't seriously believe this. It's quite obvious that the TikTok debacle is mostly a protectionist measure for Facebook & Google who are looking to get their money's worth for their lobby.
- laserlight 3y agoFrom the article: > IAB Europe argued that it is not responsible under the GDPR as a “data controller” because it allegedly only sets the rules for how data should be used, but does not process the data itself. The Court rightly rejected this, and confirmed that IAB Europe, as management body for the TCF, is a “data controller” under the GDPR. IAB stands for Interactive Advertising Bureau Europe [0] [0] https://www.eesc.europa.eu/en/policies/policy-areas/enterprise/database-self-and-co-regulation-initiatives/46 https://www.eesc.europa.eu/en/policies/policy-areas/enterpri...
- diggan 3y agoI must be missing something here, what arguments could IAB Europe reasonable use to say they're not a controller? Article 4 from the GDPR: > ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; Seems so obvious that they're a controller by that definition (specifically a "Joint Controller" according to Article 26), even if "only sets the rules for how data should be used" would be true, that would put them inside the definition, so even by their own admission, they are a controller?
- yxhuvud 3y agoIf it is essential to their business, people can and will try to convince themselves and other people of just about anything, regardless of how ridiculous the arguments are.
- toyg 3y ago"It is difficult to get a man to understand something, when his salary depends upon his not understanding it!" - Upton Sinclair, 1934.
- secondcoming 3y agoThe IAB does not actually receive any personal data from anyone. It's pretty much a standards body who write specs for how consent can be granted, and how that consent is transmitted. It's all open, there are no secrets about how this operates. So, it appears that anyone/company who writes a spec around data that may be considered PII is now a Data Controller.
- throwaway2562 3y agoNamed complainants include the estimable Dr. Johnny Ryan, doing God’s work again. “People across Europe have been plagued by fake “consent” popups every day on almost every website and app since the GDPR was introduced almost six years ago”, said Dr Johnny Ryan of ICCL Enforce. Grateful to have him onside
- nottorp 3y agoI don't know about everyone else but I'd like more context. "Is responsible for the consent popups"... ok. What happens now?
- SiempreViernes 3y ago> On 2 February 2022 the Belgian Data Protection Authority, in agreement with 27 other EU data protection authorities, ruled that the [IAB controlled] “TCF” consent spam system is illegal.[3] This decision meant that the entire online advertising had unlawfully processed the data of everyone in Europe for years. > However, this was appealed at the Brussels Markets Court. [...] > The Brussels Markets Court can now proceed to rule on the matter with certainty that IAB Europe is indeed responsible, and that the data concerned are protected by the GDPR.
- gnyman 3y agoI dug out the original ruling and skimmed the last part of it. I have probably misunderstood a bunch, it's very long. But my tl.dr. as I understand it is that IAB provides a Transparency Consent Framework[2] to its users, which includes popup cookies. They lost a case where they argued they don't have any responsibility ( to the degree that they didn't even have a Data Privacy Officer or had done a Data Privacy Impact Assessment) for providing the IAB compliance popups. These popups were used by others in order to do gain "consent" to do real time bidding ads (and probably other things), it might be that they also provided some level of RBT. They lost and the court said they are jointly responsible and need to fix long list of things and pay 250k euro. IAB then appealed and the appeals court deferred it to the ECJ, who has now said that yes they do have a join responsibility. So as I understand it, this is sadly not the death-blow to valid or invalid consent popups. But at least it might improve the UX on them. [1] https://web.archive.org/web/20240109014435/https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-21-2022-english.pdf https://web.archive.org/web/20240109014435/https://www.gegev... [2] https://iabeurope.eu/transparency-consent-framework/ https://iabeurope.eu/transparency-consent-framework/
- secondcoming 3y agoJust to clarify... the IAB does not provide cookie popups. It does however provide a spec [0] for how these are supposed to operate. Website publishers then choose which popup vendor to use. [0] https://github.com/InteractiveAdvertisingBureau/GDPR-Transparency-and-Consent-Framework/blob/master/TCFv2/IAB%20Tech%20Lab%20-%20CMP%20API%20v2.md https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...
- amne 3y agoI visited US a couple of years ago and to this day I still think of how smooth all the websites felt over there.
- oliwarner 3y agoAnd they're collecting data about you without your knowledge or consent, with no mechanism for you to discover they hold data about you, or a mechanism to insist they correct or remove it. I hate the system as it is —the "do not track" header should mean something— but I'll take a disclaimer, an explanation of how they plan to use my data, and an opt-out over the Wild West. They're catching up but it'll be a while. The Federal HIPAAGLBACOPPAFERPABBQ are all pretty toothless and even the golden child, California's CCPA is a series compromises that doesn't accomplish that much.
- amne 3y agoYou go to a coffee shop. First time you mention you want ethiopian blend blah blah. Next morning the barista confirms you want ethiopian blend before you even mention it. The morning after that there's no talking needed on top of "Good morning". Coffee supplier now tells the barista he should promote some coffee and he gets paid for doing it + sales percentage. The barista next morning promotes some bags of ethiopian blend to you to increase the conversion rate. Replace said barista with a website. You did not consent to anything and I'm not aware of any laws related to this.
- kwhitefoot 3y agoThe barista didn't put your ID in a globally available database.
- deleted 3y ago[deleted]
- 15457345234 3y agoYeah it's a 60Hz country, it affects perceived vehicle and pedestrian/animal movement too - everything's noticeably a bit smoother to the eye, it takes a while to get used to it. The first time I went there I spent about half the day in the park tossing frisbees to dogs just to marvel at how smoothly everything seemed to move.
- yoavm 3y agoWe are now in the process of making the Cloudflare Zaraz Consent Managegement Platform "compliant" with the IAB demands. It's mandatory in order to run Google Ads in Europe. Their demands are completely countering privacy and will only make our CMP more hostile towards users and less privacy oriented. It's ridiculous. But they have this alignment with Google and so you have to do what they say.
- Msurrow 3y agoThat is complete BS. You could start be removing all tracking code from your site and code sharing with 3rd parties. Boom, compliant (in that part) and not even a need for a consent form in the first place. The you may add a feature to track and share with 3rds, but opt in. The you need the consent but can get it in a privacy friendly way. Oh, but you “cannot” do this because the ads won’t work and you’ll loose profit? What you dont seem to realise is that this decision is already made for you by EU: with GDPR the eu made the decision that privacy is more important than your profit. You just have to face facts and stop trying to figure a way around it. Yes that means rethinking business models, but I would wager that had people known fully how they were tracked and profiled, they would not have done business with you in the first place thus your ad/tracking based business model was only valid through deception.
- yoavm 3y agoI honestly have no idea what you're talking about, which tracking code you want me to remove and in which of my websites you saw ads. I was never part of a company that had an ad/tracking-based business model, and in fact all my work in Zaraz is around making third-party online more transparent and permissions based so that scripts don't just run uncontrollably and that it would be possible to completely block their access to cookies, network etc. Your comment looks like you just came up with a fantasy story and replied to it instead... I mean, me losing profit because my ads won't work? what?
- Msurrow 3y agoYep, the thing you wrote about IAB made me think Zaraz did something it doesnt. My bad. My comment was intended for people writing (and using) those horrible consent dialogs. Edit: why you need to care about demands from IAB I dont know, but you probably have a reason