Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR will pop the adtech bubble

blogs.harvard.edu

Post reply on HN
Print view View original

171–180 of 454 posts

Re: GDPR will pop the adtech bubble

#171

Post by ealexhudson »

geocar wrote: post #150
ealexhudson wrote: post #67

Earlier quoted context omitted.

That's not true; I can only assume you're reading the 2011-era DPA guidance. Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities: https://ico.org.uk/for-organisations/guide-to-the-general-da... As another commenter has mentioned, this is included in the legislation. There isn't much interpretation t…

Yes it's absolutely true, insofar as I do not have to obtain someone's consent to have logs of their IP address (which is what we're talking about[1]) [1]: https://news.ycombinator.com/item?id=17060280 The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not unde…

Jurisprudence in this area disagrees with you:

"online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user"

http://curia.europa.eu/juris/document/document.jsf?text=&doc...

This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data).

So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig.

I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example).

I understand that's not the outcome you're looking for.

Re: GDPR will pop the adtech bubble

#172

Post by bostik »

lajhsdfkl wrote: post #137
ocdtrekkie wrote: post #9

Earlier quoted context omitted.

You shouldn't need to keep any personal information on your visitors to get meaningful data.

How can AB testing work without storing personally identifiable information?

Generate stand-alone, opaque identifiers for whatever sessions you want to analyse. Make sure these tags are ephemeral and decoupled from anything else.

Then, store only the flow data, discard everything else. Or if you need to keep some data around for the test duration, delete all of it once your A/B test has concluded.

Re: GDPR will pop the adtech bubble

#173

Post by losteric »

jamiequint wrote: post #72
enraged_camel wrote: post #54

Earlier quoted context omitted.

Website owners can have visibility on their visitors if those visitors explicitly consent to it. Not sure what is so difficult to understand about this.

So if I don't think that Walmart should be able to record me with security cameras while I'm in the store I should have the right to demand that they ask me to sign a waiver before entering the store? Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?

GDPR has exemptions for security. Your free to track information for the purposes of blocking vulnerability bots, but only the minimum data required for that purpose... and your visitor's data cannot be used for other applications without their consent.

> Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?

No. Property "rights" are secondary to human rights. Like, Walmart can't knowingly sell poison as food just because it's their property...

In your example, Walmart is free to record you on security cameras for security / theft purposes. However, they can't record what you're looking at and reuse that information for targeted advertising without consent - profling is simply not required to do business, so your right not to be profiled wins.

Re: GDPR will pop the adtech bubble

#175

Post by greglindahl »

nikanj wrote: post #8
shawn wrote: post #2

And that’s on top of the main problem: tracking people without their knowledge, approval or a court order is just flat-out wrong. The fact that it can be done is no excuse. Nor is the monstrous sum of money made by it. I use Piwik ( https://github.com/matomo-org/matomo ) and track visitors without their knowledge or consent, because I need analytics. Piwik is also configured to respect the "Do not track" header, so o…

Why do you need analytics, aside from ads and ad-tech?

Analytics is a broad term, and covers things like "how many of my users use this new section of my website" or "Let's A/B test a new navigation menu".

Re: GDPR will pop the adtech bubble

#177

Post by isostatic »

alkonaut wrote: post #85
icebraining wrote: post #66

Earlier quoted context omitted.

The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully. Maybe not technically, but in practice, yes. You may be able to keep them, but you can't actually open and view them. As per MAI Systems Corp. v. Peak Computer, Inc. , loading something into RAM counts as copying, so you need a license to do that. And even if you had one once, it can be revok…

This sounds like a US legal case however, so I wouldn’t extrapolate this to odds of it being illegal worldwide.

There are several cases of US copyright law applying worldwide

Re: GDPR will pop the adtech bubble

#178

Post by [deleted] »

vowelless wrote: post #57
solomatov wrote: post #30

One surprising side effect of this might be that the hordes of machine learners and data scientists who used to work for adtech might go to healthcare/bioinformatics where we might get new breakthroughs.

A lot will just move to finance... However, financial firms are usually pretty against open academic research that would allow publication of papers. Many researchers truly value the ability to contribute to this field openly. Perhaps you are right and they will move to health.

[deleted]

Re: GDPR will pop the adtech bubble

#179

Post by jimktrains2 »

toomuchtodo wrote: post #34
jimktrains2 wrote: post #27

Earlier quoted context omitted.

Are you also against access logs?

Only if you’re not scrubbing IP addresses and other PII within a reasonable window of time.

IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.)

Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.

Re: GDPR will pop the adtech bubble

#180

Post by quotemstr »

icebraining wrote: post #76
qwerty456127 wrote: post #68

> tracking people without their knowledge, approval or a court order is just flat-out wrong. Requiring them to check an "I agree to be tracked" checkbox and signing an agreement (which has just happened to me yesterday in an EU country in accordance to GDPR) before they can use a product/service is hardly much better. This reminds me of the Android app permission system which requires you to allow an app to do everyt…

Requiring them to check an "I agree to be tracked" checkbox and signing an agreement (which has just happened to me yesterday in an EU country in accordance to GDPR) before they can use a product/service is hardly much better. That's specifically not allowed under the GDPR. Either the information is needed to provide the service (and needed means actually needed, not "my business model depends on it"), in which case…

How is "my business model depends on it" not a bona fide legitimate purpose for information collection? Nobody is forcing anyone to patronize a business that relies on data collection for profitability.

I'm extremely skeptical of regulation that interferes with consensual deals between economic actors. You want transparency? Fine. But you don't get to randomly outlaw certain entire classes of business.

Post reply on HN