6 ms·

EU ruling: tracking-based advertising [...] across Europe has no legal basis

228 points by mschuster91 1y ago

jqpabc123 1y ago
"Personalized" advertising isn't good for anyone except the ad networks. It isn't good for consumers whose privacy is being violated as they are being annoyed with unwanted, irrelevant ads and they get charged higher prices due to the cost of the advertising. It isn't good for companies buying the ads by participating in sham "auctions" with no real insight into or control over the process. They are literally begging to be ripped off. It doesn't have to be this way. "Context sensitive" advertising is more privacy respecting, easier to implement and monitor and can be more cost effective. Example: The fact that I recently shopped for and bought a car is no reason to show me auto ads on a web site devoted to pet supplies. There is a logical disconnect here because context is ignored in favor of "personalization". Those paying for these dumb "personalized" ads are wasting their money and my time and bandwidth because I already made a purchase. I'm not making another one any time soon. By the way, this doesn't really happen to me any more because I now block these "personalized" ad networks. And you should too --- it's the only logical recourse to this stupidity.
- Symbiote 1y ago
  The other case for personalised advertising is when a purchase is almost made. I was recently searching for a toy across Etsy, Ali Express, eBay. I didn't buy it. A day later, I saw 'suggested' purchases on Amazon for the same toy. I boycott Amazon, so I don't often visit their website. I normally block (successfully?) almost all of this advertising, so I find it particularly creepy when I receive it.
- johannes1234321 1y ago
  > It doesn't have to be this way. "Context sensitive" advertising is more privacy respecting, easier to implement and monitor and can be more cost effective. This is what launched Google's money printing machine: Showing ads matching the current intent (current search) thus solving a current problem.
  - jonplackett 1y ago
    I actually dislike this sort of advertising even more. Because it pretends to be the solution to your current problem when often it’s not. At least out-of-context ads can be more easily ignored.
- fvdessen 1y ago
  I believe the main purpose of tracking based advertising is to know your gender, politics and social class to show you the right kind of car and pet supply. This discrimination is quite important and before internet people would self discriminate on those basis and buy different magasines, see different movies, walk different streets and advertisers could target their demographics based on that. Now everybody goes to the same social networks so the tracking is used to provide this discrimination A good example is gym membership. There's 20eur/month and 300eur/month ones. The 300eur/month ones really don't want to advertise to everybody, they have a really specific demographic target in mind.
- figassis 1y ago
  I agree. But in the crappy experience topic, it seems to me that this is just bad engineering. If I were to build an algo to show personalized ads, I would definitely account for the likelihood of someone wanting to buy 2 consecutive cars vs a car and maybe some car related products. How was that decision made, because it seems that an entire industry adopted this and called it a day.
  - piva00 1y ago
    There's no incentive for the ad platforms to account for that, real-time bidding will make money for them no matter the experience of the ad being showed. If you get another ad for a product you already bought the advertiser already paid for placement, a click through is just a bonus on top of that. Even more when information is so secretly guarded that any analysis of the impact of an ad is extremely flawed, it hasn't solved the old adage from John Wanamaker: > Half the money I spend on advertising is wasted; the trouble is I don't know which half It's meant to be that way, the ad platforms do not want advertisers to know what is waste and optimise their ads further than what's needed to keep them advertising, they just need to throw some bones here and there, convert a few people through clicks, to make themselves look indispensable. There's no incentive to improve that, at all.
  - jqpabc123 1y ago
    How was that decision made, because it seems that an entire industry adopted this and called it a day. Easy --- advertisers pay for bad ads the same as good ones --- why bother stopping the bad ones? Convincing so many advertisers to just blindly trust the system and buy into the concept of black box "personalized" advertising is actually the real marketing coup here. According to some stats, global use of ad blockers is now over 40%. Once it exceeds 50%, I believe this stupidity will slowly start to die out.
- PaulKeeble 1y ago
  They are so dumb too. It rarely actually presents ads for things I might be interested in as I search but once I buy something they will follow me for a week. Buying an item seems to be a much stronger signal to them, it makes very little sense how this currently works. Seeing ads appropriate to a site however makes me a bit wary of the site itself, it needs enough difference to the context to not harm the sites reputation.
- beejiu 1y ago
  > "Personalized" advertising isn't good for anyone except the ad networks. According to Meta, their personalized advertising alone generates over $0.5 trillion of economic activity per year. As much as the Hacker News crowd hates on ads, it's indisputable that it's good for businesses and the broad economy. https://research.facebook.com/economiccontribution/ https://research.facebook.com/economiccontribution/
  - mdhb 1y ago
    JFC… I’m begging for you to please think about things like this in ways that aren’t strictly about “the economy”. It’s so so so clearly a net loss for society it’s not even close. You have to literally ignore everything else other than this idea of “shareholder value” to come to such a ridiculous position.
  - unicamelkje 1y ago
    Not sure if relying on research made by an advertising company, about it's own positive impact, is something that you should blindly trust.
  - sensanaty 1y ago
    You mean the same Meta and their ads and data collection that have been directly and indisputably linked to literal, actual Genocides? And teen suicides? And Cambridge Analytica? Oh, but they shuffled some money around the economy (mostly into their coffers), so it was all worth it in the end, because as we all know the magic economy is the only thing that matters.
  - mrweasel 1y ago
    I think what many of us question is whether nor not those same $0.5 trillion would be generated by contextual ads. There's no doubt that ads work, but we really don't know to what extend. E.g. if I'm on a pages looking at watches, should I get ads for watches, or would it be better to show ads for the washing machine I was looking up last night? Google, the search engine, clearly thinks it's better to show ads relevant to my search term, but they are also in a special position that's not applicable to a news website. People working in the field has also previously commented, here on HN, that the ad networks are basically hustling the advertisers, selling them ad space / users that they know will perform badly, to move more "inventory". That generates economical activity, but does that benefit anyone beyond the ad networks?
- aucisson_masque 1y ago
  > It isn't good for companies buying the ads by participating in sham "auctions" with no real insight into or control over the process. They are literally begging to be ripped off. You seem to think that companies have a choice. I've been advertising for years, Google has been rolling out the standard ads in favor of automated "personalized" one for a long time. They kept removing features again and again. In more of removing features and making basic ads impossible to use, they have a team of people that will keep calling you and to offer you 'guidance' on how to run your ads. These guidance almost always revolved around enabling the automatic advertising algorithms and disabling your old school ads. I consider myself quite smart with internet things but even me, at some point, got baited into switching to these automated ads because at the end you run a business that is completely different from marketing and it's not your core business. You're not expert into marketing and especially not into Google ads so it's easy for these experts to trick you. I have seen my money syphoned by these automatic techniques with quite bad roi. And all these self made people or very small companies (which represent the vast majority of the business), they are just as easy target for Google than I was. Big companies can afford ads consultant that will run the advertising campaigns and optimize everything, but small ones are stuck doing things themselves on a system that is purposely made to hand over your money and let the computer do it's 'magic' with targeted advertising. And if you're not happy with Google, what you gonna do ? It's not like there is competition. Everyone use Google, Google is a monopoly. I tried switching to bing ads, Facebook ads, but its just not possible. No one use bing. Facebook leads were never as profitable as Google one, at least in the market I advertised.
  - bandrami 1y ago
    You know you don't actually need Google to advertise, right? I was hosting websites in 1998 when Google was still in Larry Page's garage. We sold ads the same way magazines and newspapers always have: we had a sales staff and they did their job well. There's no reason we can't go back to that.
    - deleted 1y ago
      [deleted]
    - 1y ago
- HenryBemis 1y ago
  > are wasting their money and my time and bandwidth _You_ think it doesn't work, but it does. Or at least 'on average' it does. As for your time, perhaps you value your time. But again, 'on average', there are so many people spending hours and hours on Insta, TT, etc. and those people clearly don't care about focus/time/ads, because it is their (mental/spiritual) bread and butter. When a young woman 'follows' 100 'influencers' and each posts twice per day, that young woman consumes at least two hundred ads per day and if she buys at least one item per day, that's a win for 'them'. Regarding the car/pet scenario, if they are any good they should be advertising stuff to clean dog piss, brushes, etc.. items that "will keep your car clean when you got a pet". But again.. it works. People make money.
- Aloisius 1y ago
  Have you considered that you blocking personalized ad networks might, perhaps, have led to you seeing poorly personalized ads? Like say, advertising a car to you after you recently purchased one?
craftedid 1y ago
Totally agree. The current ad model feels extractive on all sides. Context-based targeting feels like a more honest middle ground that doesn’t require spying on users.
- mrweasel 1y ago
  The "problem" is that oh so many sites have no context. They exist solely to host ads, the content on their pages provide no actual value and is rehashed press-release, direct copies of reporting from Reuters, 10 ten lists written by interns or AI junk. If this works it will be good for everyone, the many issue with today's internet is the perverse incentives to get views or "engagement" so you can sell ad space. The ads are the goal, not the message.
  - mdhb 1y ago
    See also the decline of media where they learned very early on that rage generates by far the most clicks and hollowed out their entire fucking industry to sell more ads. Honestly a number of really really significant societal problems have their roots in surveillance capitalism
    - iamacyborg 1y ago
      The decline of media is also based on the fact that advertisers no longer had to pay the big trustworthy publishers and could instead supposedly target those same users elsewhere.
  - caseyy 1y ago
    I’m sure some grifters won’t get their second Mercedes, but sites with no context and just ads disappearing would be a wonderful, almost dream-like outcome for the internet. It might even solve the dead internet problem to a degree. There’s no way the advertising industry giants will let it happen. But the thought alone clearly illustrates the damaging effects of advertising.
  - dhalucario 1y ago
    Domain parking servies are a prime example of that shit.
morjom 1y ago
Interesting that ICCL didn't link the actual press release. Press release from Belgian Data Protection Authority: https://www.dataprotectionauthority.be/citizen/the-market-court-rules-in-the-iab-europe-case https://www.dataprotectionauthority.be/citizen/the-market-co... IAB response post: https://iabeurope.eu/belgian-market-court-confirms-limited-role-of-iab-europe-in-tcf/ https://iabeurope.eu/belgian-market-court-confirms-limited-r...
- troupo 1y ago
  lol at IAB's choice of headline: "Belgian Market Court Confirms Limited Role of IAB Europe In The TCF" IAB was on the hook for the dreadful cookie "consent" popups that ruined the web (no, it wasn't GDPR that ruined it, it was a very deliberate action by "industry groups" like IAB). The only reason the Market Court annulled the previous decision was on procedural grounds, while agreeing that IAB is responsible, and keeping the 250 000 EUR fine in place. Too bad. I wish Market Court would've burned IAB to the ground, salted the earth and scattered the ashes.
- morjom 1y ago
  They have included multiple new references since the time of this comment.
lucianbr 1y ago
> It applies immediately across Europe. Does anyone know what the consequences are? I have no idea exactly what it is that applies immediately. I would guess that starting today Google and others should stop advertising as they currently do it, it being illegal. I doubt it's that simple, and even if it was, I am sure they will not simply stop. So what happens now?
- portaouflop 1y ago
  Nothing
- jeroenhd 1y ago
  Tracking has no legal basis, but it's still permitted with consent. The problem with IAB Europe (and other similar ad providers, as well as IAB's customers) is that IAB Europe didn't obtain consent; it tried to hide its tracking by using supposedly non-personal identifiers, which wouldn't necessitate consent, but the court ruled that these identifiers were actually PII. IAB also tried to weasel its way out of its responsibilities, but preventing that seems to have failed. As a result, data collected through IAB about European customers was collected unlawfully, and third parties must delete that data. IAB also can't smuggle consent like this anymore, and needs to pay a fine that was handed down a few years ago. The legal publication can be found here (translated into various languages, though I believe the original may have been Dutch or French as it was the Belgian DPA that started the suit): https://curia.europa.eu/juris/documents.jsf?num=C-604/22 https://curia.europa.eu/juris/documents.jsf?num=C-604/22 and here https://www.dataprotectionauthority.be/the-market-court-rules-in-the-iab-europe-case https://www.dataprotectionauthority.be/the-market-court-rule... I very much doubt ad companies will actually delete the illegally obtained data, but IAB and other companies in the cyberstalking industry this can be a problem, because they need to actually comply with the law.
  - secondcoming 1y ago
    The IAB doesn't track anything though? There is no IAB tracking pixel.
    - 1y ago
mdhb 1y ago
I was quite glad to see this quote in there: > Dr Johnny Ryan said "Today's court's decision shows that the consent system used by Google, Amazon, X, Microsoft, deceives hundreds of millions of Europeans. The tech industry has sought to hide its vast data breach behind sham consent popups. Tech companies turned the GDPR into a daily nuisance rather than a shield for people." I feel this so often gets lost in the conversation where a huge amount of people in communities like this one will loudly point out how annoying consent banners are but never give any thought as to why so many websites feel that just because you want to read a single article on their website that they are now entitled to sell your information often to hundreds and even thousands of different data brokers and that this is now so normalised that it’s almost every bit of content I consume now. The original purpose of the GDPR was clearly to try and put an end to this kind of thing while still leaving cutouts for legitimate purposes with informed consent. I’m so glad to see them come at this from a new angle entirely now to just firmly say that this surveillance capitalism bullshit is illegal and you can’t cookie banner your way out of it as some kind of legal protection. Good, that makes me extremely happy as an EU resident and I wholeheartedly support whatever steps you need to take in order to enforce this. There’s no reason at this point to continue playing nice with US spyware companies masquerading as “data brokers”, let them deal with the mess they made but we don’t need it here.
- crote 1y ago
  > The original purpose of the GDPR was clearly to try and put an end to this kind of thing while still leaving cutouts for legitimate purposes with informed consent. Don't forget the "legitimate interest", where somehow 635 ad companies absolutely must have my data to visit a single website...
  - lazide 1y ago
    Making the shareholders richer is certainly a legitimate interest for the owner of the website, eh?
sam_lowry_ 1y ago
> the Market Court annulled the BE DPA's decision 21/2022 on procedural grounds. It's a win for advertisers. The court says, the logic holds, but the advertisers will not be fined and will not have to follow the 21/2022 decision.
- mschuster91 1y ago
  > The court says, the logic holds, but the advertisers will not be fined. That's common in European jurisdiction. We tend to operate on a "first strike is free" principle, especially in contested / purposefully left unclear legal environments. Only when the case law is clear, it can be shown that a law was intentionally exploited or broken or it's a repeat offender, then we bring the hammer down.
  - raverbashing 1y ago
    Really? But from what HN told me, any minor violation of the GDPR would be met with a multi-million fine and the GDPR police blasting your doors to arrest everybody /s
    - mschuster91 1y ago
      The problem is, many people on HN are Americans and assume that the way their jurisdiction works should be an example for everyone else to follow. Our political and legal system prefers self-regulation first, if that doesn't work then regulation will be introduced, the first offenders will get a slap on the wrist to clarify for everyone what the courts' lines on interpreting the law are, and only then the fines follow.
      - raverbashing 1y ago
        Yup, pretty much this
    - jaoane 1y ago
      In this case the fine was annulled because the procedure wasn’t followed correctly by the public defenders. I can assure you that if the procedure is followed the way it should be you will be fined for any kind of violation of the GDPR no matter how small you are. I don’t know where you are getting from this “you can violate the law for free the first time”. I know HN likes to defend the EU any way it can (not because they love the EU but because they hate the US because they dared to choose a leader they don’t like), but this is absolute bs.
mschuster91 1y ago
Sorry for the mangled and editorialized title, I had to remove the company lists to stay in HNs length limit.
caseyy 1y ago
As I always say, you can’t outlaw being an asshole. But I am curious about what sort of assholery we will see next. Maybe all tracking will become “legitimate interest” (I’m kidding, please don’t actually entrench that garbage any more than it already is).
- troupo 1y ago
  They already do that, unfortunately
- devnullbrain 1y ago
  A number of news websites have started to make you choose between accepting cookies for free or paying to reject cookies
  - IsTom 1y ago
    Which is against with GDPR, Meta got a 200 million euro fine for this.
    - dns_snek 1y ago
      Technically Meta got fined on the basis of the DMA, not the GDPR (which I still don't fully understand). It's illegal according to my own interpretation of the GDPR too, but enforcement is seemingly non-existent.
      - caseyy 1y ago
        All these fines are coming, but corporate lawyers stall as much as they can. Then, they appeal first-instance court decisions to stall some more. And they do get fined, 3-7 years down the road. Then, they change tactics just enough to violate a different law. If they were to change the nature of the crime more often, they'd open themselves to more prosecution. But big tech can handle a few government penalties every decade. It even creates moat - artificial barriers to market entry. The multiplicity of penalties is insurmountable for new market entrants, but pocket change for the established ones. For example, the UK Online Safety Act is putting all the small social media sites out of business in the UK, but it won't change moderation standards at Facebook. Ergo, it has become Meta's moat. "If a fine is set for a crime, then it's only a crime for poor people". Tech is full of clever and fast people who run circles around slow-moving government bureaucracies (even judicial). These courts need to resolve these cases every week. If it's 1 week for first-instance, 1 week for appeals, that's the pace that would stop big tech. Twenty-seven fines with a bite a year would have the intended effect. But we're talking about a "landmark" GDPR win in this thread that took about 5 years. And the fines so far are less than 500 euros per data collector (250k euro fine / 600+ companies in IAB). It will not even warrant a footnote in GAAP financial statements at the end of the year for these companies; they'll just put it in operating expenses (along with the 1,500 euro office coffee machine, 3x more expensive than the privacy violations). A small blogger collecting analytics data incorrectly may not have much to eat in the month they get fined 500 euros (not that they will have had much to eat in the months of expensive court proceedings), but of course, they also risk the full extent of the penalties.
vv_ 1y ago
It would be nice to have an opt-in platform where you could select products that you'd like to see ads for. For example, you're looking for a TV or automobile and you want to see deals related to those products.
- figassis 1y ago
  Would not work, you’d end up with hundreds of such platforms (because why not, free market) and some would even exist for the sole purpose of inferring your consent from multiple other platforms (that would sell access) and it would then become so opaque that you would have no way of actually confirming which choices you made. I understood as a SWE that the perfect solutions we often conjure never work as expected in the real world because we do not understand basic human nature and also how society as exists today works, including many many perverse incentives.
- x0f1a 1y ago
  Not exactly, but somehow what you want: https://myadcenter.google.com/ https://myadcenter.google.com/
caseyy 1y ago
250k euros for an association of 600+ advertising agencies (IAB) is an exceedingly cheap cost of doing business.
- crote 1y ago
  Keep in mind that the fines are intended to be progressive. If they don't quit their current practices now that is is clear how the law should be interpreted, the next fine will be substantially larger.
  - caseyy 1y ago
    That’s understood. But is 250k euros an appropriate fine for the personally identifiable information that’s been collected and associated with behavioural metrics, political preferences, confidential health data, and other private data points by the 600+ companies that make up IAB and their partners? This is less than 500 euros per company. They probably pay more each month to host the illegally collected data. And they probably have the data for millions of EU citizens. Maybe a billion+ profiles worldwide. Granted, the numbers are pulled out of thin air, but what’s a reasonable estimate if not that? Unless I’m misunderstanding…
- jeroenhd 1y ago
  The fine is nothing, but their core selling point (selling ads without bothering to ask for consent) has been exposed and ruled illegal. The implication is also that data collected for years by those 600+ advertising agencies has been collected illegally, though I doubt deletion of that data will be enforced without a second suit.
- jillesvangurp 1y ago
  What do you think happens if they are caught again? By then the precedent has been set. Easy decision. Fine them again. And obviously the previous fine didn't work so increase it. Courts have no patience for repeat offenders. Also, it sends a signal to wannabe competitors to this company that there are laws and there are consequences for breaking those. And of course given that these companies have money, there are going to be lawyers paying attention to see if they can get at that money in some way. Germany is almost as bad on that front as California. Lots of enterprising lawyers here. So, one successful court case can trigger many more once the precedent is set.
ddxv 1y ago
I've been working on open source mobile app tracking for advertisers to use (an MMP specifically). Would love to connect with anyone in this thread to discuss it. Specifically, is tracking inside of a single app/property acceptable? So much mobile tracking is added due to a lack of real HTTPS links (in mobile called deferred deep links). To just know whether a user from link X did or did not open the app. Happy to chat with people opposed or pro, feel free to reach out for a longer discussion. https://openattribution.dev https://openattribution.dev
- earthnail 1y ago
  On iOS, there are two ways to work around it: 1.) use custom product pages. Users need to have a device with iOS 18, but if they do you can now assign a URL to a custom product page, and the app will receive this URL on first launch. Only works for a small number of static links because you can't dynamically create custom product pages. Good for thinks like influencer campaigns if you have a small number of influencers (e.g. a YouTube channel you support), and since iOS 18 adoption is high enough now this has very recently become a viable method. 2.) use an App Clip. I do this for referral links in my app. The user launches the App Clip, and because the App Clip can receive an invocation URL, you can store that in a shared group container - that's a shared data space between your App Clip and your app. Most users don't know what an App Clip is, so to avoid confusion and make your users assume that they already downloaded the app when in fact they didn't, I recommend just making it a single page with a download button. You can try this flow here (it's a referral link for my app); make sure to open the link on an iOS device, otherwise you will see a fallback website telling you to install the app first: https://tape.it/user_referral/1 https://tape.it/user_referral/1
- troupo 1y ago
  > Specifically, is tracking inside of a single app/property acceptable? No. Tracking is explicitly not permitted unless you receive an informed consent from the user.
- jeroenhd 1y ago
  > Specifically, is tracking inside of a single app/property acceptable? If you have any kind of unique identifier for the user (UUID, etc) and do not ask for consent before processing their data (tracking them), then this is a clear breach of privacy law. If you get explicit consent (that means the user understands what they're consenting to) before you process their data (so no setting up identifiers and then showing a popup), then you're in the clear. If you put unique identifiers in the link the user clicks so you can see if the user opened your app, then you need to ask for consent before generating the link. And of course, apps/services should all function if the user doesn't provide consent. "Give consent to enter" is explicitly illegal. Theoretically, you could build something like this, but it's not what advertisers want, because they want to track their users without interrupting the conversion flow with a yes/no popup "do you want company Y to know you installed app X because of them".
sensanaty 1y ago
IMO data should be radioactive for companies, especially if it approaches PII. Companies should be forced into thinking deeply about every single bit of data they collect from people, and they should be terrified of receiving data and be chomping at the bit to get rid of it ASAP. To intercept the usual argument of "But my business can't exist without all this data!", to that I say "Good!". If your business can't exist without tracking every single iota of your customer's existence, then it truly shouldn't. I couldn't tell you the amount of times I've had to fight back against implementing yet another tracking tool at work, just to collect data that I know for a fact no one will look at after the first few weeks of the tool being there. The amount of times I've heard some stupid shit like "Well we don't need this data yet, but what if we need to have their mother's maiden name at some point in the future?!" is depressing, and I'm glad that we're starting to have legal channels to push back against such idiocy.
- JumpCrisscross 1y ago
  > data should be radioactive for companies, especially if it approaches PII Cute theory. Fails in practice. Especially with LLMs on the horizon, this would be tantamount to unilateral nuclear disarmament. (Practically, it fails in that we haven't quantified the cost of breaches commensurate with what those of us who are security minded estimate it to be.) I have advocated for privacy issues for a short while. "Data is radioactive" is the "defund the police" of our movement.
  - unicamelkje 1y ago
    I don't see any parallels with unilateral nuclear disarmament and making exploiting user data unviable >we haven't quantified the cost of breaches commensurate with what those of us who are security minded estimate it to be We don't estimate GDPR violations as the true materialized damages either, we put a heavy % of yearly income per offense, large enough to deter it.
    - JumpCrisscross 1y ago
      > We don't estimate GDPR violations as the true materialized damages either, we put a heavy % of yearly income per offense, large enough to deter it Not remotely analogous to turning data into a liability. Particularly when the EU laws seem almost explicitly written to allow for offloading such risks to America and China.
IvanK_net 1y ago
I think that 70 % of web users believe, that each website that they open can see their real name, their address, their phone number, the files on their computer, their browsing history and a lot more, and they believe that the GDPR laws are the only attempt to prevent websites from misusing (e.g. selling) all their private data.
debuggerson 1y ago
The ruling today shows how consent pop-ups used by tech giants like Google and Amazon have been misleading Europeans, turning GDPR into a nuisance rather than a protection. With real-time bidding and tracking cookies at the heart of online ads, it’s clear that the entire system needs a serious overhaul. But how will this ruling change the game for advertisers? Will they actually be forced to respect privacy, or will we just see more ways to sidestep the rules?
- iamacyborg 1y ago
  Advertisers are not at fault here, publishers and ad networks are.
amarcheschi 1y ago
Here's an interesting read from noyb that tells the tale of how scummy Xandr, the Microsoft advertising network, is. https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-0 https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-... I've tried to do the same steps in the past and eventually, the xandr pages linked there were removed - now being in Microsoft something page - and being even harder to contact (even if it's still possible to fill a form asking for your data when you get there. I received the same answer as noyb)
seydor 1y ago
Translation: Ad-supported revenue, which is most Tech revenue, is not allowed in europe -> Tech will never be allowed to grow in europe
- _ink_ 1y ago
  It is allowed. It just has to come up with a different revenue stream. Doesn't sound impossible.
- iamacyborg 1y ago
  Ad-supported revenue is fine. Contextual advertising is fine. RTB without adequate consent is not fine.
- imiric 1y ago
  You're right. What a ridiculous idea to force companies to make a profit from selling their actual product, instead of from selling their users' data to a middle-man that exploits it in perpetuity. Europe is doomed.
  - seydor 1y ago
    their actual product is attention grabbing
- rsynnott 1y ago
  Contextual advertising is fine. The advertising industry (even the web advertising industry; personally targeted advertising wasn't really a thing until sometime in the noughties) existed happily enough for a couple of centuries without personal targeting.
- devnullbrain 1y ago
  >which is most Tech revenue Not true https://fortune.com/ranking/global500/2023/?sector=Technology https://fortune.com/ranking/global500/2023/?sector=Technolog...
- sensanaty 1y ago
  If this is what "growth" looks like, I'm good with stagnation.
geremiiah 1y ago
What's the likely outcome of this? I cannot see Google et. al. giving up their surveillance apparatus. Instead I suspect we will end up with more extensive consent forms, which will end up making the surrendering of privacy from the user even more explicit. I hope I'm wrong, but I cannot see a more plausible outcome.
brador 1y ago
Corporations should pay $0.01 per data point stored, per day, to that citizens country. For once, a corporations actions will then disproportionately affect the rich, since they will be the only ones worth holding data points on. Those best able to financially and legally enforce the rule. A clean win win.
senko 1y ago
I hate tracking with a passion. I browse internet in incognito mode with ublock origin. That said, I don't understand how TC String can be considered PII. I haven't been following this case so probably miss a lot of context, but my understanding is that the TC String encodes user's preferences for which advertises to share your info with. For example, I visit example.com and deselect everything. This information then gets passed around so that advertisers know I don't want their advertising. Isn't that kind of the point? I want them to know I don't want them. I'd rather setup that once and then not do it again for every site under the sun. Is the issue here that you can somehow be identified based on your tracking preferences alone? The ruling here is confirmation of an earlier ruling where TC String was considered personal data. As an effect, the organization coordinating all this tracking (IAB) is considered data processor. Is the ruling just a technicality (the fine is pretty low) because IAB isn't listed in data processor lists for all the sites I visit, or is there a deeper consequence arising from the ruling?
- buzer 1y ago
  > That said, I don't understand how TC String can be considered PII. IANAL (or even Belgian). There wasn't a direct ruling on if TC strings itself were PII. They were personal data that can be linked to individual since CMP will get both the IP address and the TC string. As for IAB being (joint) data controller, the reason (sections 68 to 80) given for that is that they determine purpose and means of processing. They might not hold any data, but they set the rules for the framework.

228 points by mschuster91 1y ago

"Personalized" advertising isn't good for anyone except the ad networks. It isn't good for consumers whose privacy is being violated as they are being annoyed with unwanted, irrelevant ads and they get charged higher prices due to the cost of the advertising. It isn't good for companies buying the ads by participating in sham "auctions" with no real insight into or control over the process. They are literally begging to be ripped off. It doesn't have to be this way. "Context sensitive" advertising is more privacy respecting, easier to implement and monitor and can be more cost effective. Example: The fact that I recently shopped for and bought a car is no reason to show me auto ads on a web site devoted to pet supplies. There is a logical disconnect here because context is ignored in favor of "personalization". Those paying for these dumb "personalized" ads are wasting their money and my time and bandwidth because I already made a purchase. I'm not making another one any time soon. By the way, this doesn't really happen to me any more because I now block these "personalized" ad networks. And you should too --- it's the only logical recourse to this stupidity.

Symbiote 1y ago
The other case for personalised advertising is when a purchase is almost made. I was recently searching for a toy across Etsy, Ali Express, eBay. I didn't buy it. A day later, I saw 'suggested' purchases on Amazon for the same toy. I boycott Amazon, so I don't often visit their website. I normally block (successfully?) almost all of this advertising, so I find it particularly creepy when I receive it.
johannes1234321 1y ago
> It doesn't have to be this way. "Context sensitive" advertising is more privacy respecting, easier to implement and monitor and can be more cost effective. This is what launched Google's money printing machine: Showing ads matching the current intent (current search) thus solving a current problem.
- jonplackett 1y ago
  I actually dislike this sort of advertising even more. Because it pretends to be the solution to your current problem when often it’s not. At least out-of-context ads can be more easily ignored.
fvdessen 1y ago
I believe the main purpose of tracking based advertising is to know your gender, politics and social class to show you the right kind of car and pet supply. This discrimination is quite important and before internet people would self discriminate on those basis and buy different magasines, see different movies, walk different streets and advertisers could target their demographics based on that. Now everybody goes to the same social networks so the tracking is used to provide this discrimination A good example is gym membership. There's 20eur/month and 300eur/month ones. The 300eur/month ones really don't want to advertise to everybody, they have a really specific demographic target in mind.
figassis 1y ago
I agree. But in the crappy experience topic, it seems to me that this is just bad engineering. If I were to build an algo to show personalized ads, I would definitely account for the likelihood of someone wanting to buy 2 consecutive cars vs a car and maybe some car related products. How was that decision made, because it seems that an entire industry adopted this and called it a day.
- piva00 1y ago
  There's no incentive for the ad platforms to account for that, real-time bidding will make money for them no matter the experience of the ad being showed. If you get another ad for a product you already bought the advertiser already paid for placement, a click through is just a bonus on top of that. Even more when information is so secretly guarded that any analysis of the impact of an ad is extremely flawed, it hasn't solved the old adage from John Wanamaker: > Half the money I spend on advertising is wasted; the trouble is I don't know which half It's meant to be that way, the ad platforms do not want advertisers to know what is waste and optimise their ads further than what's needed to keep them advertising, they just need to throw some bones here and there, convert a few people through clicks, to make themselves look indispensable. There's no incentive to improve that, at all.
- jqpabc123 1y ago
  How was that decision made, because it seems that an entire industry adopted this and called it a day. Easy --- advertisers pay for bad ads the same as good ones --- why bother stopping the bad ones? Convincing so many advertisers to just blindly trust the system and buy into the concept of black box "personalized" advertising is actually the real marketing coup here. According to some stats, global use of ad blockers is now over 40%. Once it exceeds 50%, I believe this stupidity will slowly start to die out.
PaulKeeble 1y ago
They are so dumb too. It rarely actually presents ads for things I might be interested in as I search but once I buy something they will follow me for a week. Buying an item seems to be a much stronger signal to them, it makes very little sense how this currently works. Seeing ads appropriate to a site however makes me a bit wary of the site itself, it needs enough difference to the context to not harm the sites reputation.
beejiu 1y ago
> "Personalized" advertising isn't good for anyone except the ad networks. According to Meta, their personalized advertising alone generates over $0.5 trillion of economic activity per year. As much as the Hacker News crowd hates on ads, it's indisputable that it's good for businesses and the broad economy. https://research.facebook.com/economiccontribution/ https://research.facebook.com/economiccontribution/
- mdhb 1y ago
  JFC… I’m begging for you to please think about things like this in ways that aren’t strictly about “the economy”. It’s so so so clearly a net loss for society it’s not even close. You have to literally ignore everything else other than this idea of “shareholder value” to come to such a ridiculous position.
- unicamelkje 1y ago
  Not sure if relying on research made by an advertising company, about it's own positive impact, is something that you should blindly trust.
- sensanaty 1y ago
  You mean the same Meta and their ads and data collection that have been directly and indisputably linked to literal, actual Genocides? And teen suicides? And Cambridge Analytica? Oh, but they shuffled some money around the economy (mostly into their coffers), so it was all worth it in the end, because as we all know the magic economy is the only thing that matters.
- mrweasel 1y ago
  I think what many of us question is whether nor not those same $0.5 trillion would be generated by contextual ads. There's no doubt that ads work, but we really don't know to what extend. E.g. if I'm on a pages looking at watches, should I get ads for watches, or would it be better to show ads for the washing machine I was looking up last night? Google, the search engine, clearly thinks it's better to show ads relevant to my search term, but they are also in a special position that's not applicable to a news website. People working in the field has also previously commented, here on HN, that the ad networks are basically hustling the advertisers, selling them ad space / users that they know will perform badly, to move more "inventory". That generates economical activity, but does that benefit anyone beyond the ad networks?
aucisson_masque 1y ago
> It isn't good for companies buying the ads by participating in sham "auctions" with no real insight into or control over the process. They are literally begging to be ripped off. You seem to think that companies have a choice. I've been advertising for years, Google has been rolling out the standard ads in favor of automated "personalized" one for a long time. They kept removing features again and again. In more of removing features and making basic ads impossible to use, they have a team of people that will keep calling you and to offer you 'guidance' on how to run your ads. These guidance almost always revolved around enabling the automatic advertising algorithms and disabling your old school ads. I consider myself quite smart with internet things but even me, at some point, got baited into switching to these automated ads because at the end you run a business that is completely different from marketing and it's not your core business. You're not expert into marketing and especially not into Google ads so it's easy for these experts to trick you. I have seen my money syphoned by these automatic techniques with quite bad roi. And all these self made people or very small companies (which represent the vast majority of the business), they are just as easy target for Google than I was. Big companies can afford ads consultant that will run the advertising campaigns and optimize everything, but small ones are stuck doing things themselves on a system that is purposely made to hand over your money and let the computer do it's 'magic' with targeted advertising. And if you're not happy with Google, what you gonna do ? It's not like there is competition. Everyone use Google, Google is a monopoly. I tried switching to bing ads, Facebook ads, but its just not possible. No one use bing. Facebook leads were never as profitable as Google one, at least in the market I advertised.
- bandrami 1y ago
  You know you don't actually need Google to advertise, right? I was hosting websites in 1998 when Google was still in Larry Page's garage. We sold ads the same way magazines and newspapers always have: we had a sales staff and they did their job well. There's no reason we can't go back to that.
  - deleted 1y ago
    [deleted]
  - 1y ago
HenryBemis 1y ago
> are wasting their money and my time and bandwidth _You_ think it doesn't work, but it does. Or at least 'on average' it does. As for your time, perhaps you value your time. But again, 'on average', there are so many people spending hours and hours on Insta, TT, etc. and those people clearly don't care about focus/time/ads, because it is their (mental/spiritual) bread and butter. When a young woman 'follows' 100 'influencers' and each posts twice per day, that young woman consumes at least two hundred ads per day and if she buys at least one item per day, that's a win for 'them'. Regarding the car/pet scenario, if they are any good they should be advertising stuff to clean dog piss, brushes, etc.. items that "will keep your car clean when you got a pet". But again.. it works. People make money.
Aloisius 1y ago
Have you considered that you blocking personalized ad networks might, perhaps, have led to you seeing poorly personalized ads? Like say, advertising a car to you after you recently purchased one?

craftedid 1y ago

Totally agree. The current ad model feels extractive on all sides. Context-based targeting feels like a more honest middle ground that doesn’t require spying on users.

mrweasel 1y ago
The "problem" is that oh so many sites have no context. They exist solely to host ads, the content on their pages provide no actual value and is rehashed press-release, direct copies of reporting from Reuters, 10 ten lists written by interns or AI junk. If this works it will be good for everyone, the many issue with today's internet is the perverse incentives to get views or "engagement" so you can sell ad space. The ads are the goal, not the message.
- mdhb 1y ago
  See also the decline of media where they learned very early on that rage generates by far the most clicks and hollowed out their entire fucking industry to sell more ads. Honestly a number of really really significant societal problems have their roots in surveillance capitalism
  - iamacyborg 1y ago
    The decline of media is also based on the fact that advertisers no longer had to pay the big trustworthy publishers and could instead supposedly target those same users elsewhere.
- caseyy 1y ago
  I’m sure some grifters won’t get their second Mercedes, but sites with no context and just ads disappearing would be a wonderful, almost dream-like outcome for the internet. It might even solve the dead internet problem to a degree. There’s no way the advertising industry giants will let it happen. But the thought alone clearly illustrates the damaging effects of advertising.
- dhalucario 1y ago
  Domain parking servies are a prime example of that shit.

morjom 1y ago

Interesting that ICCL didn't link the actual press release. Press release from Belgian Data Protection Authority: https://www.dataprotectionauthority.be/citizen/the-market-court-rules-in-the-iab-europe-case https://www.dataprotectionauthority.be/citizen/the-market-co... IAB response post: https://iabeurope.eu/belgian-market-court-confirms-limited-role-of-iab-europe-in-tcf/ https://iabeurope.eu/belgian-market-court-confirms-limited-r...

troupo 1y ago
lol at IAB's choice of headline: "Belgian Market Court Confirms Limited Role of IAB Europe In The TCF" IAB was on the hook for the dreadful cookie "consent" popups that ruined the web (no, it wasn't GDPR that ruined it, it was a very deliberate action by "industry groups" like IAB). The only reason the Market Court annulled the previous decision was on procedural grounds, while agreeing that IAB is responsible, and keeping the 250 000 EUR fine in place. Too bad. I wish Market Court would've burned IAB to the ground, salted the earth and scattered the ashes.
morjom 1y ago
They have included multiple new references since the time of this comment.

lucianbr 1y ago

> It applies immediately across Europe. Does anyone know what the consequences are? I have no idea exactly what it is that applies immediately. I would guess that starting today Google and others should stop advertising as they currently do it, it being illegal. I doubt it's that simple, and even if it was, I am sure they will not simply stop. So what happens now?

portaouflop 1y ago
Nothing
jeroenhd 1y ago
Tracking has no legal basis, but it's still permitted with consent. The problem with IAB Europe (and other similar ad providers, as well as IAB's customers) is that IAB Europe didn't obtain consent; it tried to hide its tracking by using supposedly non-personal identifiers, which wouldn't necessitate consent, but the court ruled that these identifiers were actually PII. IAB also tried to weasel its way out of its responsibilities, but preventing that seems to have failed. As a result, data collected through IAB about European customers was collected unlawfully, and third parties must delete that data. IAB also can't smuggle consent like this anymore, and needs to pay a fine that was handed down a few years ago. The legal publication can be found here (translated into various languages, though I believe the original may have been Dutch or French as it was the Belgian DPA that started the suit): https://curia.europa.eu/juris/documents.jsf?num=C-604/22 https://curia.europa.eu/juris/documents.jsf?num=C-604/22 and here https://www.dataprotectionauthority.be/the-market-court-rules-in-the-iab-europe-case https://www.dataprotectionauthority.be/the-market-court-rule... I very much doubt ad companies will actually delete the illegally obtained data, but IAB and other companies in the cyberstalking industry this can be a problem, because they need to actually comply with the law.
- secondcoming 1y ago
  The IAB doesn't track anything though? There is no IAB tracking pixel.
  - 1y ago

mdhb 1y ago

I was quite glad to see this quote in there: > Dr Johnny Ryan said "Today's court's decision shows that the consent system used by Google, Amazon, X, Microsoft, deceives hundreds of millions of Europeans. The tech industry has sought to hide its vast data breach behind sham consent popups. Tech companies turned the GDPR into a daily nuisance rather than a shield for people." I feel this so often gets lost in the conversation where a huge amount of people in communities like this one will loudly point out how annoying consent banners are but never give any thought as to why so many websites feel that just because you want to read a single article on their website that they are now entitled to sell your information often to hundreds and even thousands of different data brokers and that this is now so normalised that it’s almost every bit of content I consume now. The original purpose of the GDPR was clearly to try and put an end to this kind of thing while still leaving cutouts for legitimate purposes with informed consent. I’m so glad to see them come at this from a new angle entirely now to just firmly say that this surveillance capitalism bullshit is illegal and you can’t cookie banner your way out of it as some kind of legal protection. Good, that makes me extremely happy as an EU resident and I wholeheartedly support whatever steps you need to take in order to enforce this. There’s no reason at this point to continue playing nice with US spyware companies masquerading as “data brokers”, let them deal with the mess they made but we don’t need it here.

crote 1y ago
> The original purpose of the GDPR was clearly to try and put an end to this kind of thing while still leaving cutouts for legitimate purposes with informed consent. Don't forget the "legitimate interest", where somehow 635 ad companies absolutely must have my data to visit a single website...
- lazide 1y ago
  Making the shareholders richer is certainly a legitimate interest for the owner of the website, eh?

sam_lowry_ 1y ago

> the Market Court annulled the BE DPA's decision 21/2022 on procedural grounds. It's a win for advertisers. The court says, the logic holds, but the advertisers will not be fined and will not have to follow the 21/2022 decision.

mschuster91 1y ago
> The court says, the logic holds, but the advertisers will not be fined. That's common in European jurisdiction. We tend to operate on a "first strike is free" principle, especially in contested / purposefully left unclear legal environments. Only when the case law is clear, it can be shown that a law was intentionally exploited or broken or it's a repeat offender, then we bring the hammer down.
- raverbashing 1y ago
  Really? But from what HN told me, any minor violation of the GDPR would be met with a multi-million fine and the GDPR police blasting your doors to arrest everybody /s
  - mschuster91 1y ago
    The problem is, many people on HN are Americans and assume that the way their jurisdiction works should be an example for everyone else to follow. Our political and legal system prefers self-regulation first, if that doesn't work then regulation will be introduced, the first offenders will get a slap on the wrist to clarify for everyone what the courts' lines on interpreting the law are, and only then the fines follow.
    - raverbashing 1y ago
      Yup, pretty much this
  - jaoane 1y ago
    In this case the fine was annulled because the procedure wasn’t followed correctly by the public defenders. I can assure you that if the procedure is followed the way it should be you will be fined for any kind of violation of the GDPR no matter how small you are. I don’t know where you are getting from this “you can violate the law for free the first time”. I know HN likes to defend the EU any way it can (not because they love the EU but because they hate the US because they dared to choose a leader they don’t like), but this is absolute bs.

mschuster91 1y ago

Sorry for the mangled and editorialized title, I had to remove the company lists to stay in HNs length limit.

caseyy 1y ago

As I always say, you can’t outlaw being an asshole. But I am curious about what sort of assholery we will see next. Maybe all tracking will become “legitimate interest” (I’m kidding, please don’t actually entrench that garbage any more than it already is).

troupo 1y ago
They already do that, unfortunately
devnullbrain 1y ago
A number of news websites have started to make you choose between accepting cookies for free or paying to reject cookies
- IsTom 1y ago
  Which is against with GDPR, Meta got a 200 million euro fine for this.
  - dns_snek 1y ago
    Technically Meta got fined on the basis of the DMA, not the GDPR (which I still don't fully understand). It's illegal according to my own interpretation of the GDPR too, but enforcement is seemingly non-existent.
    - caseyy 1y ago
      All these fines are coming, but corporate lawyers stall as much as they can. Then, they appeal first-instance court decisions to stall some more. And they do get fined, 3-7 years down the road. Then, they change tactics just enough to violate a different law. If they were to change the nature of the crime more often, they'd open themselves to more prosecution. But big tech can handle a few government penalties every decade. It even creates moat - artificial barriers to market entry. The multiplicity of penalties is insurmountable for new market entrants, but pocket change for the established ones. For example, the UK Online Safety Act is putting all the small social media sites out of business in the UK, but it won't change moderation standards at Facebook. Ergo, it has become Meta's moat. "If a fine is set for a crime, then it's only a crime for poor people". Tech is full of clever and fast people who run circles around slow-moving government bureaucracies (even judicial). These courts need to resolve these cases every week. If it's 1 week for first-instance, 1 week for appeals, that's the pace that would stop big tech. Twenty-seven fines with a bite a year would have the intended effect. But we're talking about a "landmark" GDPR win in this thread that took about 5 years. And the fines so far are less than 500 euros per data collector (250k euro fine / 600+ companies in IAB). It will not even warrant a footnote in GAAP financial statements at the end of the year for these companies; they'll just put it in operating expenses (along with the 1,500 euro office coffee machine, 3x more expensive than the privacy violations). A small blogger collecting analytics data incorrectly may not have much to eat in the month they get fined 500 euros (not that they will have had much to eat in the months of expensive court proceedings), but of course, they also risk the full extent of the penalties.

vv_ 1y ago

It would be nice to have an opt-in platform where you could select products that you'd like to see ads for. For example, you're looking for a TV or automobile and you want to see deals related to those products.

figassis 1y ago
Would not work, you’d end up with hundreds of such platforms (because why not, free market) and some would even exist for the sole purpose of inferring your consent from multiple other platforms (that would sell access) and it would then become so opaque that you would have no way of actually confirming which choices you made. I understood as a SWE that the perfect solutions we often conjure never work as expected in the real world because we do not understand basic human nature and also how society as exists today works, including many many perverse incentives.
x0f1a 1y ago
Not exactly, but somehow what you want: https://myadcenter.google.com/ https://myadcenter.google.com/

caseyy 1y ago

250k euros for an association of 600+ advertising agencies (IAB) is an exceedingly cheap cost of doing business.

crote 1y ago
Keep in mind that the fines are intended to be progressive. If they don't quit their current practices now that is is clear how the law should be interpreted, the next fine will be substantially larger.
- caseyy 1y ago
  That’s understood. But is 250k euros an appropriate fine for the personally identifiable information that’s been collected and associated with behavioural metrics, political preferences, confidential health data, and other private data points by the 600+ companies that make up IAB and their partners? This is less than 500 euros per company. They probably pay more each month to host the illegally collected data. And they probably have the data for millions of EU citizens. Maybe a billion+ profiles worldwide. Granted, the numbers are pulled out of thin air, but what’s a reasonable estimate if not that? Unless I’m misunderstanding…
jeroenhd 1y ago
The fine is nothing, but their core selling point (selling ads without bothering to ask for consent) has been exposed and ruled illegal. The implication is also that data collected for years by those 600+ advertising agencies has been collected illegally, though I doubt deletion of that data will be enforced without a second suit.
jillesvangurp 1y ago
What do you think happens if they are caught again? By then the precedent has been set. Easy decision. Fine them again. And obviously the previous fine didn't work so increase it. Courts have no patience for repeat offenders. Also, it sends a signal to wannabe competitors to this company that there are laws and there are consequences for breaking those. And of course given that these companies have money, there are going to be lawyers paying attention to see if they can get at that money in some way. Germany is almost as bad on that front as California. Lots of enterprising lawyers here. So, one successful court case can trigger many more once the precedent is set.

ddxv 1y ago

I've been working on open source mobile app tracking for advertisers to use (an MMP specifically). Would love to connect with anyone in this thread to discuss it. Specifically, is tracking inside of a single app/property acceptable? So much mobile tracking is added due to a lack of real HTTPS links (in mobile called deferred deep links). To just know whether a user from link X did or did not open the app. Happy to chat with people opposed or pro, feel free to reach out for a longer discussion. https://openattribution.dev https://openattribution.dev

earthnail 1y ago
On iOS, there are two ways to work around it: 1.) use custom product pages. Users need to have a device with iOS 18, but if they do you can now assign a URL to a custom product page, and the app will receive this URL on first launch. Only works for a small number of static links because you can't dynamically create custom product pages. Good for thinks like influencer campaigns if you have a small number of influencers (e.g. a YouTube channel you support), and since iOS 18 adoption is high enough now this has very recently become a viable method. 2.) use an App Clip. I do this for referral links in my app. The user launches the App Clip, and because the App Clip can receive an invocation URL, you can store that in a shared group container - that's a shared data space between your App Clip and your app. Most users don't know what an App Clip is, so to avoid confusion and make your users assume that they already downloaded the app when in fact they didn't, I recommend just making it a single page with a download button. You can try this flow here (it's a referral link for my app); make sure to open the link on an iOS device, otherwise you will see a fallback website telling you to install the app first: https://tape.it/user_referral/1 https://tape.it/user_referral/1
troupo 1y ago
> Specifically, is tracking inside of a single app/property acceptable? No. Tracking is explicitly not permitted unless you receive an informed consent from the user.
jeroenhd 1y ago
> Specifically, is tracking inside of a single app/property acceptable? If you have any kind of unique identifier for the user (UUID, etc) and do not ask for consent before processing their data (tracking them), then this is a clear breach of privacy law. If you get explicit consent (that means the user understands what they're consenting to) before you process their data (so no setting up identifiers and then showing a popup), then you're in the clear. If you put unique identifiers in the link the user clicks so you can see if the user opened your app, then you need to ask for consent before generating the link. And of course, apps/services should all function if the user doesn't provide consent. "Give consent to enter" is explicitly illegal. Theoretically, you could build something like this, but it's not what advertisers want, because they want to track their users without interrupting the conversion flow with a yes/no popup "do you want company Y to know you installed app X because of them".

sensanaty 1y ago

IMO data should be radioactive for companies, especially if it approaches PII. Companies should be forced into thinking deeply about every single bit of data they collect from people, and they should be terrified of receiving data and be chomping at the bit to get rid of it ASAP. To intercept the usual argument of "But my business can't exist without all this data!", to that I say "Good!". If your business can't exist without tracking every single iota of your customer's existence, then it truly shouldn't. I couldn't tell you the amount of times I've had to fight back against implementing yet another tracking tool at work, just to collect data that I know for a fact no one will look at after the first few weeks of the tool being there. The amount of times I've heard some stupid shit like "Well we don't need this data yet, but what if we need to have their mother's maiden name at some point in the future?!" is depressing, and I'm glad that we're starting to have legal channels to push back against such idiocy.

JumpCrisscross 1y ago
> data should be radioactive for companies, especially if it approaches PII Cute theory. Fails in practice. Especially with LLMs on the horizon, this would be tantamount to unilateral nuclear disarmament. (Practically, it fails in that we haven't quantified the cost of breaches commensurate with what those of us who are security minded estimate it to be.) I have advocated for privacy issues for a short while. "Data is radioactive" is the "defund the police" of our movement.
- unicamelkje 1y ago
  I don't see any parallels with unilateral nuclear disarmament and making exploiting user data unviable >we haven't quantified the cost of breaches commensurate with what those of us who are security minded estimate it to be We don't estimate GDPR violations as the true materialized damages either, we put a heavy % of yearly income per offense, large enough to deter it.
  - JumpCrisscross 1y ago
    > We don't estimate GDPR violations as the true materialized damages either, we put a heavy % of yearly income per offense, large enough to deter it Not remotely analogous to turning data into a liability. Particularly when the EU laws seem almost explicitly written to allow for offloading such risks to America and China.

IvanK_net 1y ago

I think that 70 % of web users believe, that each website that they open can see their real name, their address, their phone number, the files on their computer, their browsing history and a lot more, and they believe that the GDPR laws are the only attempt to prevent websites from misusing (e.g. selling) all their private data.

debuggerson 1y ago

The ruling today shows how consent pop-ups used by tech giants like Google and Amazon have been misleading Europeans, turning GDPR into a nuisance rather than a protection. With real-time bidding and tracking cookies at the heart of online ads, it’s clear that the entire system needs a serious overhaul. But how will this ruling change the game for advertisers? Will they actually be forced to respect privacy, or will we just see more ways to sidestep the rules?

iamacyborg 1y ago
Advertisers are not at fault here, publishers and ad networks are.

amarcheschi 1y ago

Here's an interesting read from noyb that tells the tale of how scummy Xandr, the Microsoft advertising network, is. https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-0 https://noyb.eu/en/microsofts-xandr-grants-gdpr-rights-rate-... I've tried to do the same steps in the past and eventually, the xandr pages linked there were removed - now being in Microsoft something page - and being even harder to contact (even if it's still possible to fill a form asking for your data when you get there. I received the same answer as noyb)

seydor 1y ago

Translation: Ad-supported revenue, which is most Tech revenue, is not allowed in europe -> Tech will never be allowed to grow in europe

_ink_ 1y ago
It is allowed. It just has to come up with a different revenue stream. Doesn't sound impossible.
iamacyborg 1y ago
Ad-supported revenue is fine. Contextual advertising is fine. RTB without adequate consent is not fine.
imiric 1y ago
You're right. What a ridiculous idea to force companies to make a profit from selling their actual product, instead of from selling their users' data to a middle-man that exploits it in perpetuity. Europe is doomed.
- seydor 1y ago
  their actual product is attention grabbing
rsynnott 1y ago
Contextual advertising is fine. The advertising industry (even the web advertising industry; personally targeted advertising wasn't really a thing until sometime in the noughties) existed happily enough for a couple of centuries without personal targeting.
devnullbrain 1y ago
>which is most Tech revenue Not true https://fortune.com/ranking/global500/2023/?sector=Technology https://fortune.com/ranking/global500/2023/?sector=Technolog...
sensanaty 1y ago
If this is what "growth" looks like, I'm good with stagnation.

geremiiah 1y ago

What's the likely outcome of this? I cannot see Google et. al. giving up their surveillance apparatus. Instead I suspect we will end up with more extensive consent forms, which will end up making the surrendering of privacy from the user even more explicit. I hope I'm wrong, but I cannot see a more plausible outcome.

brador 1y ago

Corporations should pay $0.01 per data point stored, per day, to that citizens country. For once, a corporations actions will then disproportionately affect the rich, since they will be the only ones worth holding data points on. Those best able to financially and legally enforce the rule. A clean win win.

senko 1y ago

I hate tracking with a passion. I browse internet in incognito mode with ublock origin. That said, I don't understand how TC String can be considered PII. I haven't been following this case so probably miss a lot of context, but my understanding is that the TC String encodes user's preferences for which advertises to share your info with. For example, I visit example.com and deselect everything. This information then gets passed around so that advertisers know I don't want their advertising. Isn't that kind of the point? I want them to know I don't want them. I'd rather setup that once and then not do it again for every site under the sun. Is the issue here that you can somehow be identified based on your tracking preferences alone? The ruling here is confirmation of an earlier ruling where TC String was considered personal data. As an effect, the organization coordinating all this tracking (IAB) is considered data processor. Is the ruling just a technicality (the fine is pretty low) because IAB isn't listed in data processor lists for all the sites I visit, or is there a deeper consequence arising from the ruling?

buzer 1y ago
> That said, I don't understand how TC String can be considered PII. IANAL (or even Belgian). There wasn't a direct ruling on if TC strings itself were PII. They were personal data that can be linked to individual since CMP will get both the IP address and the TC string. As for IAB being (joint) data controller, the reason (sections 68 to 80) given for that is that they determine purpose and means of processing. They might not hold any data, but they set the rules for the framework.