Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google’s GDPR Workaround

brave.com

Post reply on HN
Print view View original

591–600 of 629 posts

Re: Google’s GDPR Workaround

#591

Post by rpastuszak »

aeorgnoieang wrote: post #454
rpastuszak wrote: post #252

Earlier quoted context omitted.

Why the downvote? Care to provide a reason?

From [the guidelines]( https://news.ycombinator.com/newsguidelines.html ): > Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

Thanks, didn’t know about that. I wish I had received a better feedback there, though, as I’m deeply interested in the topic and generally it’s quite hard for me to find negative opinions, counterarguments I could work on. I find negative feedback more helpful, if it’s constructive.

Re: Google’s GDPR Workaround

#592

Post by hnarn »

nudded wrote: post #447
drusepth wrote: post #413

Earlier quoted context omitted.

Is it really? If Alice tells Bob she has diabetes and Bob tells Charlie, is Bob in violation of GDPR?

No, GDPR does not apply between 2 persons.

> Individuals can also face fines for GDPR violations if they use other parties' personal data for anything other than personal purposes.

https://www.coredna.com/blogs/gdpr-fines

Re: Google’s GDPR Workaround

#593

Post by falsedan »

I think a large cause of impedance for engineers to understand the issue is: randomly-assigned ids don’t anonymise users, because you can still attribute an action uniquely to one user (even if you don’t know their name/personal details).

I think of it like the UID I get on a UNIX machine: it identifies me, and anyone with /etc/passed can get my name, and things that don’t have access to it can still see “oh uid 1099 is logging in again to play nethack”.

Re: Google’s GDPR Workaround

#594

Post by soraminazuki »

drusepth wrote: post #423
teamspirit wrote: post #187

I think the HN community, and most consumers, tend to look at things from only one angle. Imagine you start work at some small shop that manufacturers widgets for consumers. What would you do when you have to advertise your product? You'd have to turn to Google is a similar company. Are there any real alternatives? (I am asking because I really want to know) I say this because I am in this position now. I have to fig…

The alternative is to spend hundreds of hours finding widget-related websites, trying to contact the owner(s), negotiating what ad spots are available, what ads are acceptable to run, and what pricing/terms will work for both parties, then managing that relationship over time to ensure ads are actually being displayed, being paid on time, contracts renewed, etc. It's definitely possible, but you're just doing everyth…

> It's definitely possible, but you're just doing everything manually that ad networks do for you.

You've just explained how contexual ads used to work, which doesn't need all the invasive surveillance modern internet users have to put up with.

Re: Google’s GDPR Workaround

#595

Post by laythea »

bduerst wrote: post #560
laythea wrote: post #520

Presumably ads are so valuable because people click through them and go on to purchase. I realise I am in a minority, but I have never clicked on a digital ad and went through to buy something, and I never will. The minute I see ads on a webpage, I automatically associate that site with trash. (Please take note HN :)) It is as if humanity cannot be trusted with technology. This creates a certain "ceiling" for us in t…

The ads you're referring to here are called display ads . Most of these ads are not about getting you to click, but about awareness. It's the same thing as a full-page advert in a magazine that you flip through. For some readers, they will stop an read it, raising awareness to that brand/product/company etc.

I take your point about being "exposed" to the product, however it must be the case that ads want you to click them, otherwise clicking them would not do anything. Which is not the case.

A company spamming my eyeballs with visual ads to "raise awareness" does not get my money. I take particular offence to that, as it is my screen. Not a Billboard for example.

My point is proven in the HN website, where it enjoys a large readership, largely influenced by the sites clean, ad-free design.

Slashdot used to be like that until they started displaying ads, and that is what brought me to HN. Thank you HN for not doing this.

Re: Google’s GDPR Workaround

#596

Post by laythea »

tapland wrote: post #580
laythea wrote: post #524

Earlier quoted context omitted.

Care to elaborate a little?

I've visited plenty of sites made by small developers who simply use them to try to offset hosting costs with a banner ad. Hosting isn't a negligible cost for everyone and content should be judged based of content, but you can of course judge a site as a whole with ads included.

That does not excuse it in my book.

Re: Google’s GDPR Workaround

#597

Post by inlined »

seanhunter wrote: post #575
bluesign wrote: post #492

Earlier quoted context omitted.

Considering google_gid is valid for you for 14 days only. It is very unlikely to build a profile around it.

The time of validity and how hard it might be to build a profile are not factors in whether or not this is legal under GDPR. Here's the actual text from GDPR on pseudonyms and synthetic keys of this type[1] > The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natu…

> The pseudonym (gid) is itself considered PII under GDPR.

I know of multiple systems that use a UID but throw away a user’s information, including the UID mapping, when the user leaves. This allows historic metrics to be retained without ever identifying a user who isn’t still using the system.

AFAICT, guids are a grey area.

Re: Google’s GDPR Workaround

#598

Post by gnud »

bluesign wrote: post #486
mintplant wrote: post #373

Earlier quoted context omitted.

This log [0], right? Did you miss in the article that it's the `google_push` identifier that's being used for syncing between adtech companies? If you search for it (AHNF13KKSmBxGD6oDK9GEw5O0kvgmFa3qM30zpNaKl72Og), you can see it being included in requests to lots of different adtech firms' domains. [0] https://brave.com/wp-content/uploads/files_2019-9-2/sample_p...

There is unfortunately no way to prevent that part. BidRequest Data [0] and Request Time is already enough to fingerprint the user. "Google prohibits multiple buyers from joining their match tables." part is not technical, it is contract based. [0] Sample Data from Bid Request ip: "F\303\006" user_agent: "Mozilla/5.0 (Linux; Android 7.1.1; Pixel XL Build/NOF26V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924…

> There is unfortunately no way to prevent that part.

Couldn't each buyer get their own "auction ID" as well as their own "user ID"? Am I completely misunderstanding things?

Re: Google’s GDPR Workaround

#599

Post by pmlnr »

pornel wrote: post #318
teamspirit wrote: post #187

I think the HN community, and most consumers, tend to look at things from only one angle. Imagine you start work at some small shop that manufacturers widgets for consumers. What would you do when you have to advertise your product? You'd have to turn to Google is a similar company. Are there any real alternatives? (I am asking because I really want to know) I say this because I am in this position now. I have to fig…

You advertise on a website for widget fans. That's how it successfully worked for a long time. The whole targeted advertising is to allow adtech companies to identify users of the "widget fans" site, and then advertise to the same people, but on another, cheaper site.

That's how it successfully worked for a long time... ... until google search and facebook groups killed thematic sites and communities.

I'd love seeing this turned around though.

Re: Google’s GDPR Workaround

#600

Post by bertil »

avanderveen wrote: post #488
joefkelley wrote: post #421

I'm an engineer who has worked on ad systems like this and I'm really struggling to make sense of this article - what hope does a layman have? Here's my understanding: Google runs real-time bidding ad auctions by sending anonymized profiles to marketers, who bid on those impressions. The anonymous id used in each auction was the same for each bidder, which is in violation of GDPR. If Google were to send different ids…

This is a problem because companies can use this ID to correlate private user data, without anyone's knowledge or consent. There are companies that specialise in sharing user information. Some of them work by only sharing data with companies that first share data with them (an exchange). If you got this Google ID, and you had a few other pieces of information about the user, you could share that data with an exchange…

Thank you: that explanation is the first that makes sense to me.

I get the impression that this structure would require an exchange: retailers would not trust each other otherwise.

Wouldn’t commercial pamphlets, interviews with salespeople, etc., from the exchange be obvious proof of illegal behaviour there? Google’s implementation is imperfect but, for the loophole to work, it would need coordination between several competitors and third party with a business model explicitly and almost exclusively about going around against GDPR.

If I can risk a comparison, that would be Google is like a chemical company selling fertilizer, and the exchange is selling bombs made from raw material bought by other people.

Am I missing the point? Shouldn’t this article be about those exchange and their clients, not Google?

Post reply on HN