5 ms·
UK ICO response to Google's policy change on device fingerprinting
- wbl 2y agoMaybe the ICO could talk to the competition regulators who said no to Privacy Sandbox.
- pluc 2y agoHow far we got from "Don't be evil".
- izacus 2y agoThat was the previous CEO. This one is from Boeing school of "profit at all costs even if it kills us".
- thinkingemote 2y agoThere was a historical moment (2012ish, you can search HN and find it) where they changed the motto. They changed it from "don't do evil" to "googlers shouldn't do evil" changing the emphasis away from the organisation to the employee. They moved a core principle to an employee guideline!
- scott_w 2y agoQuick note: the article header should say “ICO” and not ISO. I didn’t know about this change n in policy from Google but, in summary, it doesn’t change the legal positioning on fingerprinting as something that can fall under PII collection under UK data protection legislation. I do worry that the change from Google will make practical enforcement more difficult, however.
- _joel 2y agoICO, not ISO. "The Information Commissioner's Office (ICO) upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals. ICO is an executive non-departmental public body, sponsored by the Department for Science, Innovation and Technology." https://www.gov.uk/government/organisations/information-commissioner-s-office https://www.gov.uk/government/organisations/information-comm...
- madaxe_again 2y agoThe hell they do. Enforcement action by the IÇO is as rare as hen’s teeth, and when they do enforce, it’s a mild slap on the wrist for large businesses, and “put you out of business” for small businesses. Lose 2,000,000 sets of customer information because you accidentally left it public? Reprimand. Don’t do it again. 1000 spam calls? £100k fine. Go to prison. If you have a U.K. Ltd company, you must pay them their annual fee. Quite the gig they have. Do next to nothing, collect a tax on every business in the country. Electoral commission: 40,000,000 U.K. voter records leaked. No fine. https://ico.org.uk/action-weve-taken/enforcement/the-electoral-commission/ https://ico.org.uk/action-weve-taken/enforcement/the-elector... Random company, 60,000 spam SMS, £120k fine. https://ico.org.uk/action-weve-taken/enforcement/quick-tax-claims-limited-en/ https://ico.org.uk/action-weve-taken/enforcement/quick-tax-c... Make it make sense.
- ksec 2y agoI often wonder why on earth is UK suppose to compete in the Global Stage.
- Winblows11 2y agoInteresting so UK cannot impose rules on companies that operate and making billions in revenue in UK because "UK small". But when both a much smaller economy than UK like Australia imposes a rule on big tech like the news law, it is much different in challenging big tech. I saw a post a few weeks ago on HN asking what's the point (in general) of using a UK legal firm when legal firms in US/EU/India exist (!).
- davzie 2y agoI was absolute fuming when I got my letter from them demanding I pay them money. I knew I was closing my company down in the coming years and ignored them in the end. It's crazy this is allowed to be honest.
- akdor1154 2y ago
- mkarliner 2y agoGet your own acronym right! Someone is still recovering from New Year
- deleted 2y ago[deleted]
- sandstrom 2y agoOne thing that strikes me reading this, is that the only thing that's changed is that Google won't disallow it. But I think it would make more sense if the ICO actually just went after the companies doing fingerprinting directly, instead of being angry at Google for not enforcing things for them. There is a subtle but important difference here. If governments enforce policy by bullying HSBC/Google/E.ON to enforce policies for them, there is no legal opportunity for companies and individuals to argue for their sake. You'll just be shut out of your bank/advertising/electricity for doing something "wrong". If instead UK ICO would bring a legal case against an individual or company applying fingerprinting (and I'm no advocate of fingerprinting, but that's besides the point) then they can defend themselves in court.
- g-b-r 2y agoThere's a gazillion of companies outside UK legislation; if they only went against companies doing fingerprinting, only those subject to their legislation would refrain from doing it Having Google forbid it makes a lot of sense
- ben_w 2y agoThat argument works better against having Google be the enforcer than in favour: Google's rules are (as I understand it in this case) global, why should the UK's rules be made to apply to, say, a Japanese-language-only app sold only in the Japan? (For all I know Japan has similar rules, the point isn't the specific country, but that this would be the UK projecting power internationally that it shouldn't be).
- swores 2y agoGoogle can choose to only have it against the rules for adverts served to UK (or UK and EU and any other country with strong privacy laws), and still have better ability to target the bad actors (as they can choose to either fully ban, or just ban from advertising to those countries, any company that breaks the rule regardless of whether they're in or outside ICO's jurisdiction).
- badgersnake 2y ago> the ICO will act. That would be a first. The most useless regulator on earth.
- fmajid 2y agoIrish DPA: hold my Guinness
- Havoc 2y agoWell I’m glad they found enough backbone to at least say it bluntly. Not expecting much off the back of it but it is something
- userbinator 2y agoCloudFlare has been using fingerprinting for a long time in their "anti-bot" protection. I wonder if they'll go after them too.
- Xelbair 2y agoi wish. i can't access any sites on my firefox that use cloudflare captcha.
- usr1106 2y agoCloudflare captcha? Does such thing exist? They have Turnstyle which I never had problems on my computers (only Firefox installed). I did have problems on a niche phone running an outdated mobile Firefox, but I believe they might have been solved. Edit: Yes, seems to work now. After I complained on HN earlier their CTO asked me to send a trace. I did so and a couple of months later the problem was gone. Whether that was causal or incidental I have no idea.
- SpaceManNabs 2y agoI have never encountered this and i have been using firefox daily since 2008. So confused lol
- beejiu 2y agoAnything to do with bots, fraud, etc can generally be processed under the "legitimate interest" legal basis. You don't need consent.
- SpaceManNabs 2y agoThis came up on reddit a few years ago and maybe here. There was a case that effectively determined that cdns were not gdpr compliant. And then everyone ignored this outcome because of the implications. Ofc there is the "legitimate interests" line. Vague enough for a judge to apply as they see fit, but one judge messed up at least one time.
- cynicalsecurity 2y agoAnd? Any further actions?
- DocTomoe 2y agoI would honestly like to know how they suppose to learn whether a server does device fingerprinting. Isn't the technique purely server-side?
- nprateem 2y agoServer-side fingerprinting is useless.
- Etheryte 2y agoOutside of the IP, the server can only know data that the client collects and sends (and even the IP isn't much, because most ISPs give dynamic IPs these days, plus VPNs etc).
- DrScientist 2y agoMostly true - but there is other information in the ethernet packets themselves - for example see https://www.informatik.tu-cottbus.de/~andriy/papers/clock-skew-ntp-ieee-globecom2012.pdf https://www.informatik.tu-cottbus.de/~andriy/papers/clock-sk... and there is information added during the routing - not just information from client - from the intermediates. And you also have to consider the power of patterns - where one piece isn't enough to see the picture, but if you have enough pieces you can ( jigsaw identification ).
- threeseed 2y agoFingerprinting is done client-side using browser APIs e.g. WebMidi. The fingerprint is then associated with a user's email address or login identifier and then sent either client-side or these days server-side to Google Ads.
- loftsy 2y agoI called the ICO a few years ago asking how to comply with an ex-employee GDPR data request for access to their emails. Their recommendation: read them all to determine which contained personal data. When I told them I (as a 5 person business) obviously don't have time to go through 1000s of old emails they reacted with surprise to the amount of emails. I guess they don't send many. They didn't offer any other solution. As others have mentioned this org is a tax on all UK business.
- mytailorisrich 2y ago"For personal data protection purposes, your emails were deleted when you left the company" ;)
- swiftcoder 2y agoYeah, this. The easiest way to comply with the GDPR is not to store personal data. The second easiest is to delete it as soon as it is no longer required (this includes from backups!)
- mytailorisrich 2y agoThis was a bit tongue in cheek. In the UK I would keep business emails for at least 6 years as that's the limit for lawsuits.
- swiftcoder 2y agoDo you actually want those emails to be unearthed during a lawsuit 5 years from now? At least one firm I worked with had a mandatory 180-day delete of any correspondence not specifically tagged for archival, and the stated reason was to prevent all their random conversations being exposed during discovery if they were prosecuted.
- mytailorisrich 2y agoYou are answering your own question, I think. Yes you want to keep emails unless obviously you think they may be incriminating. The usual advice, though, is obviously not to put in writing what you don't want to be found later...
- OhioMan2943 2y agoRelevant part is this is ICO criticising google now giving free reign of fingerprinting for their advertising partners. Looks like i'm going back to mullvad browser
- RamiAwar 2y agoWho still uses google or their products anyway?
- beretguy 2y ago99% of people. I die a little bit inside every time I see my friends use google search.
- swores 2y agoA huge number of people. In 2023 they made around $80 billion of profit on $300 billion of revenue. Their ad network, search engine (Google), web browser (Chrome), mobile OS (Android), videos website (YouTube) and email service (Gmail) are all either leaders in user numbers or close to being (actually I think they might be #1 in all of those categories...)
- _joel 2y agoI'd imagine quite a few, given their ad revenue.
- cmrdporcupine 2y agoYou do. And everyone else. Google has never made money on "their products", really. They make money on ads, and those ads are everywhere
- upghost 2y agoI had to do a separate search for what "ICO" means/is because it's not within 4 clicks of landing on the site. "Information Commissioner's Office", in case anyone is wondering.
- alexrsagen 2y agoIt most definitely is: - in the bottom of the logo - when you click "About the ICO" (breadcrumb or footer link)
- oakesm9 2y agoOn the desktop version of the site, the logo says "Information Commissioner's Office" right under it. The mobile version doesn’t. It does say it right at the top of the “About the ICO” page on mobile though.
- Hilift 2y ago"businesses do not have free rein to use fingerprinting as they please." ...learns later that Reddit already fingerprints devices in the UK.
- siliconpotato 2y agogot a source for that reddit comment please? interested to learn more.
- noprocrasted 2y agoEvery single company out there uses fingerprinting and breaches the GDPR in one way or another - it's normal business practice. It's effectively impossible to run a business nowadays complying with the GDPR when your competition doesn't.
- willguest 2y agoAnd so the dance takes on a new rhythm. These well-meaning advertising execs, working diligently to support their struggling stakeholders, now have a new string to their bow. And the rest of us, the targets of their magnanimous demand-creation algorithms, we will have 'new and improved' ways to learn about and connect with out favourite brands, outrageous headlines and memetic schemes. And then there are the sneakier ones; those who dwell in digital shadow, hiding from the luminous glare of corporate glory. What will these funny fellows do, when the fingerprinters tap on their windows and ask for their papers? What of their intent, and the glasses they wear to shield their eyes from the money-grubbing rays?
- Hilift 2y agoThe Information Commissioner
- t00 2y agoOne short key point to remember. Browser is a user-agent and regulatory issue is with browsers, not how users make use of them.
- deleted 2y ago[deleted]