8 ms·
German court rules Meta tracking technology violates European privacy laws
- gherkinnn 1y agoMeta and their scummy little ways. And this is just what we know they're up to.
- anon191928 1y ago[flagged]
- atoav 1y agoThe footballification of everything. Most important is to score a point against "the other team", nevermind the world going to shit in the process. And that is 90% of the issue US culture has at the moment. You are not thinking about topics and how they impact your lifes, you're thinking about whose team that topic is on and how you can show them. Only issue is that voting politicians whose topics negatively impact your life out of office is your only agency within a democracy. Giving it up while thinking "my tribe strong" is the ultimate ideocracy.
- joules77 1y agoThat's the typical German/Oswald Spengler cynical view of things with inevitable decline being the conclusion. You have to look elsewhere for more hope - probably from the Brits (who have great experience with highs and lows) - Toynbee perhaps whose work shows a different cycle - Challenge arises (ecological, military, social) - creative minority responds with new vision/structure - the majority follows - if response fails or becomes rigid - civilization ossifies.
- atoav 1y agoPlease explain how "inevitable decline" follows from my view, cause I can't see it. If by "inevitable decline" you mean I think tribalized conflicts are a waste of human potential that are bad, I take it, but I do not think it inevitably leads to decline. It just does do so now, demonstrably. And again, within a democracy voting people out is your agency and that is Karl Popper and not Oswald Sprengler. You may think you vote people into office, but those can promise everything and do the opposite. So our true power is voting people out of office without pitchforks and torches. So what happens when a politicians makes you believe waving their party-political-flag is more important than keeping them acountable is that they fuck you over in more brazen ways more often, but you can't ditch them because then the other team would "win". Throw away the party flag and you stopped decline, thus it is not inevitable.
- verst 1y agoThese tracking "pixels" are used across the entire ad tech industry. It is very pervasive. Amazon, Twitter / X, Facebook / Meta, Pinterest, Snap, TikTok...
- Walf 1y agoIt's not just pixels. They strongly encourage site owners to send (normalised and hashed) personal data from every interaction to them, with the promise of better targeting for the site's ads. You cannot block this or opt out because it's server-side.
- herbst 1y agoAnother reason not to deal with any company that has any kind of Facebook focus at all
- JimDabell 1y ago> You cannot block this or opt out because it's server-side. Facebook’s latest approach is to give people instructions on setting up a relay server in their own infrastructure so that privacy software that blocks third-party tracking still works, even when it looks at IP addresses to detect things like CNAME cloaking. https://developers.facebook.com/docs/marketing-api/conversions-api/guides/gtm-server-side/ https://developers.facebook.com/docs/marketing-api/conversio...
- Walf 1y agoThe positive of that approach (for users) is that it relies on client-side scripts, so it's possible for privacy tools to target those.
- rkagerer 1y agoYep, and it doesn't make it right. I recently told my bank I don't agree to their new privacy terms. I sent them all 26 pages, marked up with various red lines crossing out the objectionable clauses. One was about tracking pixels, web beacons and the like. There was also much worse stuff contained like behavioral profiling and sharing my data with outside advertising conglomerates. After-the-fact opt out mechanisms were described for a lot of it, but I explained very clearly that I am not consenting in the first place. The fact they provide an opt out for some of the most shameful portions reinforces that they don't need consent in the first place to provide me with banking services. I don't know who in their right mind would accept such terms. Unfortunately most individuals I know wouldn't have a clue what the jargon means or how it affects them. A meeting was set up with my bank manager, and to underscore my point I brought in the original, aged-parchment paperwork I signed over two decades ago to open the account. That was only 5 pages long by comparison. I also brought in a screenshot from Facebook that proved the bank uploaded some information about me to them in a Custom Audience customer list (a tool offered to advertisers that perversely deputizes them in Meta's quest to ingest all of our personal information). They have no business telling Meta or other third parties who I bank with (which is what the hashed uploaded lists are used to match & confirm). The manager was quite understanding of my concerns and agreed none of what I objected to is legitimately needed to provide me with banking. I politely explained if they expected me to agree to this garbage I would take my personal and business deposits elsewhere. I was pragmatic, and realize they're not going to reprogram their whole web portal just for me, but told them if they were going to go ahead and embed web beacons and the like in pages served up to me, or engage in more aggressive privacy violations, then they're doing so without my consent (an important distinction if I suffer damages down the line). In the end, my redlined version of their policy was affixed to my file to document that I do not in fact accept their terms, and they got to keep me as a customer. Not as good as a countersigned revised agreement, but enough to indicate my intent should consensus ad idem come into question. I realize this was a lot of time and effort (and some risk of further nuisance if it failed and my accounts had to be closed), expended for something most people don't seem to care about. But the growing trend of companies outside tech adopting all our worst dark patterns really gets my gears grinding. The story goes to show that if you choose to push back, sometimes you can win. Good job Europe, keep blazing a trail which I hope my country eventually decides to follow.
- PicassoCTs 1y agoThe denial to market by vetoing is working, but its not a long term strategy. To push that back, the eu would have to push its own social network alternative, that undermines Metas growth in those fields. I can not see that yet-
- deleted 1y ago[deleted]
- tossandthrow 1y ago> the eu would have to push its own social network alternative Why? A thing it seems like a lot of people are missing is that European companies are taken to the same (if not a higher) standard for compliance with EU law. The EU regulates to ensure that market participants work fairly - these rules are generally not about trading barriers (if they were, they'd do it poorly)
- nitwit005 1y agoIf there were some huge multi-national social media company headquartered in France, I don't see any reason to believe things would be better. It might be theoretically easier to hold them accountable, but I suspect EU governments would be more prone to listen to their lobbying instead.
- veunes 1y agoRegulatory pressure can slow Meta down...
- 1y ago
- moo_man 1y ago[flagged]
- tossandthrow 1y agoMeta has the same obligations to seek consent regardless Og how they obtain the data - that seems fair, no?
- yard2010 1y agoMy unpopular opinion: they shouldn't seek consent, this should be completely opt in. Draconian laws should make this happen and flip this backward industry so everything is opposite.
- saubeidl 1y agoWhat's the difference between consent and opt-in? Both require the user to actively say yes before it happens, no?
- martijnvds 1y ago"Asking consent" is the popup that comes up to ask you if you'd like to be tracked. "Opt-in" is an option hidden somewhere in your "user preferences" page you have to actively go looking for.
- tossandthrow 1y agoIn that case I don't think this would be an unpopular opinion - I can't think of anyone who would rather have a pop up thrown at you than having adverse side effects (tracking) hidden in some obscure setting you never see.
- hnlmorg 1y ago“Asking for consent” doesnt automatically mean a pop up. “Asking for consent” isn’t even a technical term. It just means that personal needs to give permission. Exactly like an opt-in option does. Moreover, popup is still technically a form of “opt-in”. “Opt-in” doesn’t mean the option is hidden. In fact plenty of sites use dark patterns to trick people into opting in.
- jxjnskkzxxhx 1y agoYou guys remember how 5+ years ago, an headline like this on HN would invariably prompt cries from the Americans that this was just the Europeans finding excuses to take advantage and steal from poor innocent American companies. How the mood has changed on this huh. I'm glad to see the European approach vindicated, even if at times not strong enough.
- thaumasiotes 1y ago> How the mood has changed on this huh. I don't think you're right on the timing, but a related essay: https://www.imightbewrong.org/p/why-doesnt-hitler-mcfuckface-like https://www.imightbewrong.org/p/why-doesnt-hitler-mcfuckface...
- saubeidl 1y agoI don't think the mood of Americans has really changed. It's just that right now only the Europeans are awake.
- detaro 1y ago[flagged]
- BoorishBears 1y ago[flagged]
- bigyabai 1y agoThen leave. Take your big, beautiful American business and walk it the fuck out of the European economic zone. It's that easy! That said... it will be awfully hard for Americans to wriggle their way out of the $125 billion annual trade deficit they run with the EU. If the US stops trading to defend "principled" economic development, then the citizens will be paying down America's debt with their income taxes. No biggie. It's only like ~$800/taxpayer/year when you run the numbers.
- elAhmo 1y agoAnd, just like always, nothing meaningful will be done.
- pb060 1y ago[flagged]
- alkonaut 1y agoCan't some shady legal firm now just dig out who is in the exact same situation as this user, and sue on behalf of them, keeping (say) 10%? I'd be happy to let them. But in the end this kind of thing shouldn't be regulated by lawsuits from individuals. The fines as I remember it can be up to 4% global annual revenue and it's about time someone actually handed a fine of 4% global annual revenue to a company the size of Meta, so companies finally realize that the law isn't just a recommendation.
- veunes 1y agoYeah, class action-style suits are probably coming, especially now that this ruling sets a precedent
- ekunazanu 1y agoAFAIK Germany (and most European countries) has civil law, so court rulings probably won't have as much of an impact as it would in countries like the US
- oblio 1y ago> AFAIK Germany (and most European countries) has civil law Most of the world, actually. Pure common law systems are just in CANZUKUS (and a few dozen of other minuscule former British colonies).
- adw 1y agoNot even all of the UK. Scotland is a hybrid system.
- alkonaut 1y agoOnce it reaches the highest court, it will set precedent. So there is no real difference in the end it just takes more time because no precedent is set in a lower court.
- pedro_caetano 1y ago
- dabedee 1y agoThis Leipzig ruling is notable, but the practical impact may be more limited than the €5,000 figure suggests. While the court explicitly said users don't need to prove individual damages to sue, European class action mechanisms are still quite different from US-style litigation. Germany doesn't have the same litigation incentive structures as the US - no contingency fees, loser-pays costs, and relatively limited collective redress options. Most German consumers aren't going to file individual €5,000 lawsuits over tracking pixels, especially given the legal costs and time involved. Personally, I hope this gets picked up by a consumer protection organization or a well-funded litigation group. Germany has been gradually expanding its collective action framework, but it's still primarily driven by qualified entities rather than individual plaintiffs.
- hsbauauvhabzb 1y agoSounds like something someone could commoditise. 2500 free euro! Sign here!
- oytis 1y agoAFAIK that business model already works with rental contracts.
- piva00 1y agoIn Sweden I've seen quite a few businesses sprung up for that, collecting overpaid rent through a legal firm. Completely agree that if it's a similarly straightforward process there will be businesses offering to litigate on the users' behalf and collect a fee, I'd be jumping on it if I only had to file a report and wait for the work to be done to collect a couple thousand €.
- coev 1y ago> In Sweden I've seen quite a few businesses sprung up for that, collecting overpaid rent through a legal firm. This seems like the bizarro world version of American debt collection firms, cool!
- juliangmp 1y agoI really hope it turns into a class action because I'd so wish to be part of it
- sidcool 1y agoCall me cynical, but nothing's going to change
- herbst 1y agoImo a lot of change is already happening. The sentiment wasn't good the last years but now it's turning into going away from American services rather sooner than to late. More and more European alternatives pop up, governments and companies are switching stack. It will take a while to migrate, but I am sure effects will be visible soon enough to US companies
- emsign 1y agoIf these rulings and laws were meaningless, the Trump administration wouldn't be blackmailing the EU over it.
- veunes 1y agoInteresting that the court emphasized identifiability even without logging in. That cuts right through the usual "anonymous tracking" defense a lot of companies hide behind
- emsign 1y agoNice!
- lauritz 1y agoIt should be noted that this may not stand on appeal. The full decision is not yet available. All we know is from the press statement. For example, the court ruled that the plaintiff is entitled to these damages without even hearing them personally on what kind of injury they sustained. This is an interesting direction, and we will see how it is argued in the decision itself. I would assume this could be something that Meta challenges on appeal. Another way to go would be to argue that this lawsuit involves unresolved questions of EU law that need to be addressed by the ECJ. In either case, this verdict will create some legal uncertainty in the short term, and I assume many people will sue---but we shall see what happens on appeal and perhaps at the ECJ, which will perhaps be a couple of years out.
- fauigerzigerk 1y agoWhat I don't understand is the responsibility of Facebook vs the operator of the website where the tracking takes place. I thought that under GDPR it was the responsibility of the website to get consent from users before passing on data to ad networks.
- cess11 1y agoWhat do you mean by website as a "place"? I'm not so sure the GDPR mentions tracking. Here's what the court said was relevant: "Meta, Betreiberin der sozialen Netzwerke Instagram und Facebook, hat Business Tools entwickelt, die von zahlreichen Betreibern auf ihren Webseiten und Apps eingebunden werden und die Daten der Nutzer von Instagram und Facebook an Meta senden. Jeder Nutzer ist für Meta zu jeder Zeit individuell erkennbar, sobald er sich auf den Dritt-Webseiten bewegt oder eine App benutzt hat, auch wenn er sich nicht über den Account von Instagram und Facebook angemeldet hat. Die Daten sendet Meta Ireland ausnahmslos weltweit in Drittstaaten, insbesondere in die USA. Dort wertet sie die Daten in für den Nutzer unbekanntem Maß aus."
- fauigerzigerk 1y agoI mean that under GDPR, website owners as data controllers must get user consent before embedding third party tracking technologies on their websites to pass on data to Facebook. It doesn't matter whether GDPR mentions any specific word. What matters is what the technologies referred to by the word "tracking" actually do. And what they do clearly requires consent under GDPR. The paragraph you posted implies (but does not explicitly state) that Facebook's ability to identify individual users would still be noncompliant even if the website has received consent from the user to embed Facebook's technology. Or does the court blame the website's noncompliance on Facebook?
- Biologist123 1y agoVery interesting. Could become a geopolitical and trade football between Europe and US. Tariffs anyone? Ultimately it’s a question of power: will Europe allow its citizens to be predated upon? My guess is probably.
- redleader55 1y agoI have a few big problems with this ruling: 1. The sum. You are tracked and you get shown some ads. How does that causes you 5k EUR in damages? 2. Responsibility. If a site decides to add tracking or ads from a company, is only the ads company responsible for the tracking and damages? 3. Many of the services on the internet are free or cheaper because of ads. Because of that I find the attitude of the judges making these rulings disingenuous. 4. How much of this is outrage against American companies caused by the rift between US and Europe?
- subscribed 1y agoCan't wait for this to hit the fan: https://wire.com/en/blog/metas-stealth-tracking-another-eu-wake-up-call https://wire.com/en/blog/metas-stealth-tracking-another-eu-w...
- VikingTechGuy 1y agoYou can read full analysis here: https://www.linkedin.com/pulse/5000-pixel-tracker-why-latest-german-ruling-should-christiansen-sac2c/ https://www.linkedin.com/pulse/5000-pixel-tracker-why-latest... In Germany consumers does not need to file a lawsuit, they are included by default, which is very different than all other European countries.
- VikingTechGuy 1y agoYou can scan any website or ecommerce solution and see which 3rd parties they load before consent using this free privacy scanner -> https://privacyscanner.aesirx.io/ https://privacyscanner.aesirx.io/
- charcircuit 1y agoJust because a profile can be valuable, that doesn't mean that someone creating that profile damages you by that amount. If I document a celebrity's hobbies I'm not damaging the celebrity.
- VikingTechGuy 1y ago73% of Danish Business Websites Found in Violation of GDPR Consent Rules. After scanning 36,496 company domains in Denmark, we found that over 73% load trackers before consent - including Google Tag Manager, Google Analytics, Facebook, and even third-party CMPs. https://news.ycombinator.com/item?id=44533592 https://news.ycombinator.com/item?id=44533592
- msgodel 1y agoThere's a very easy solution to this: ban 3rd party tracking altogether. Then there wouldn't be any confusion.
- Thinggaard 1y agoWild numbers that prove that something needs to be done about the problems
- deleted 1y ago[deleted]