Google Maps won't let you save home address without allowing all Google tracking

Yeah, I use youtube-dl a lot. They other thing I do is open a youtube link in VLC.

But given that VLC can open a youtube link and yt-dl can grab most content, I'd love to build an app that has a proper UX.

I keep designing one in my mind - I should get around to at least proposing it to see what others think

Disclaimer: I myself am an employee of Google, but my opinions and views do not represent those of Google in any way.

Just to be completely fair, there's a balance to be had. I think Googlers are a very passionate group about many issues. That doesn't mean they know what's best for the company or the world.

If Googlers lead Google's business decisions, I think it would be a worse place. Firstly, developers are often very blind to privacy issues left on their own. Well-intentioned developers can cause a lot of trouble, as you can see from countless startups. Secondly, I think the realities of running a business are much more difficult than people want to believe, and sometimes you make tough decisions nobody wants but are truly in the best interest of the company.

To be fair I still do not agree with everything I've heard Google doing in the news, but those are outliers. The narrative given by blogs and media sometimes (maybe even unintentionally) makes everything feel like a giant scheme, but I'd advise you to apply Occam's razor as much as possible. The people making the decision you don't like could legitimately just not understand what the "big deal" is. We don't always have the necessary context to really judge something, and our inclination when filling in gaps rarely likes to be kind. The Chrome login fiasco is a great example of good intentions that went over poorly with people.

I try to stay neutral as much as possible when looking at issues, be they from Google or other entities. People make mistakes and misjudgements all the time, and people assume malice far too often it feels.

Ask someone in the US who/what "HERE" is, or ask an app developer what mapping API they are using and if HERE is even remotely on the radar. Because, you'll quickly learn that brand penetration, despite operating for a long period of time, is basically 0 in the US. I have tried to implement Bing and OpenStreetMap but customers immediately complain that we're not using Google. Why? Because Google has brilliantly tied marketing of business/AdWords with their map bundle. There's no escape.

As a user your contract is with the company you give the data to. That's simply how contracts work. If the contract says they can give that data to someone else, that's fine. If it doesn't, they can't. That shouldn't be surprising.

The GDPR treats personal information as property of the user. Even if access to and processing of that data is permitted by the user, it remains the property of the user. If the company is permitted to also pass that data on, they're still responsible for ensuring the data is handled appropriately.

I'm not sure what you are doubting. The GDPR is (in)famous for this.

This is why GDPR compliance makes it nearly impossible to hand over information to third parties who aren't GDPR compliant and why EU companies are nervous about working with Google and other US companies (because the Privacy Shield is not any more trustworthy than Safe Harbor which died an extremely swift death).

As far as the user concerned there's no difference between you "selling" their data and you handing it over to a third party as a data processor. You can't "sell" it because it's not yours, you can just take money for handing it over -- but that's between you and the third party, the user isn't part of that transaction.

Think of it this way: users can't sell you their data (they literally can't) so the data isn't your property. You can't sell what isn't yours, so the data you hand over to a third party is still owned by the user who gave it to you with the (GDPR-backed) expectation that you're retaining the control necessary to comply with their requests.

FWIW I'm not sure how this works for third-party tracking (e.g. Facebook widgets). Google Analytics avoids this by requiring compliant websites to enable IP anonymization (which supposedly should be sufficient) but liability still resides with the website owner (and the Data Protection Agreement makes this perfectly clear).

As you want sources, here's what a quick Google yields:

https://iapp.org/news/a/threes-a-crowd-third-party-risk-unde...

https://martechtoday.com/gdpr-mean-third-party-data-processo...

https://www.out-law.com/en/articles/2017/november/stricter-c...

And especially this:

http://www.infocore.com/insights/data-privacy-a-marketers-lo...

> Under the GDPR, EU citizens must be given the easy ability to withdraw their consent, often called "the right to be forgotten". If consent is withdrawn, those data subjects have the right to have their personal data erased and no longer used for processing by the data collector, and by any other entity who has ever used or purchased that data.

So in other words: "selling" user data is no different from handing the data to a data processor.

The point of the GDPR is that personal information is something that taints your product's data and therefore something you want to avoid. Selling it to dodgy companies that abuse the heck out of it is exactly what the GDPR is meant to combat.