Grindr to be fined almost €10M over GDPR complaint • Hacker News Board

Re: Grindr to be fined almost €10M over GDPR complaint

#281

Post by TeMPOraL » Tue, Jan 26, 2021, 11:30 PM UTC

colejohnson66 wrote: post #267

Moru wrote: post #266

Earlier quoted context omitted.

The way of things in EU is a bit different than some other areas. The goal is to change the industry slowly. You don't change industry by killing them quickly so these things are first made into law, then there is usually a number of warnings, then the fines starts showing up small and then the gets ramped up if the industry doesn't change. These dark patterns we keep seeing shows that the sites didn't do their homew…

> The goal is to change the industry slowly. You don't change industry by killing them quickly... I completely agree. People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy. If a “pitiful” fine of $200,000 fixes the behavior, why fine the living daylights out of them? I’m just wondering why the fines have been so “slow” to happen. Enforcement Tracker[0] lists only 533 of wh…

> People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy.

As a person who calls for these, my reasoning isn't that they should dismantle the entire web because of it[0] - but that destroying a few small businesses and seriously hurting some big ones would set an example for all the rest to fall in line. Right now, companies seem to correctly reason that they're statistically unlikely to be noticed and fined.

--

[0] - Even though my belief is that advertising industry in particular is a social cancer and absolutely needs to be torched down to the ground.

Re: Grindr to be fined almost €10M over GDPR complaint

#282

Post by mrep » Tue, Jan 26, 2021, 11:31 PM UTC

TeMPOraL wrote: post #201

Hitton wrote: post #99

Earlier quoted context omitted.

How is giving choice between paying with money or paying with data forcing users into signing their rights away?

I'm not sure if I've ever seen such choice being offered in the first place. It's always either "pay with your data or don't use it at all", or "pay with your money and your data, or don't use it at all". Also, prior to GDPR, the "pay with your data" aspect wasn't even mentioned by the companies. Ultimately, GDPR doesn't prevent people from donating their data - it just requires that it's explicit and not mandatory.

Really? Going to der spiegel as someone from Chicago I get a "Continue reading with ads, Visit SPIEGEL.de as you normally would with the advertising and the usual tracking. (You can revoke your consent at any time.)" with an accept and continue box or "… or purchase a PUR subscription, It allows you to visit our site without any ad tracking and mostly free of advertising. €4.99/month, €1.99 for SPIEGEL+ subscribers".

Re: Grindr to be fined almost €10M over GDPR complaint

#283

Post by TeMPOraL » Tue, Jan 26, 2021, 11:40 PM UTC

Blikkentrekker wrote: post #239

anticristi wrote: post #227

Earlier quoted context omitted.

Couldn't this be done based on content, without looking at personal data? "Here is an article on investment. How about I show an ad of an investment bank." If only one company does it, they lose. But if everyone is forced to do it, noone will lose.

And it's more commercially effective to be more specific than that and take the reader's profile into account. It's also not a zero sum at all. An advertisement that is not within the user's interest is wasted, rather than going to the competitor.

> An advertisement that is not within the user's interest is wasted, rather than going to the competitor.

Not completely, if there is anything to the concept of "brand awareness" (and I believe there is, and a good chunk of advertisers do too). An ad that is not within user's interest still makes an imprint of the brand, product and vendor in their head. Later on, where user's interest change, that brand/product/vendor is a bit more likely to be recalled by them. A mistargeted ad is better than no ad at all.

Re: Grindr to be fined almost €10M over GDPR complaint

#284

Post by TeMPOraL » Tue, Jan 26, 2021, 11:53 PM UTC

mrep wrote: post #282

TeMPOraL wrote: post #201

Earlier quoted context omitted.

I'm not sure if I've ever seen such choice being offered in the first place. It's always either "pay with your data or don't use it at all", or "pay with your money and your data, or don't use it at all". Also, prior to GDPR, the "pay with your data" aspect wasn't even mentioned by the companies. Ultimately, GDPR doesn't prevent people from donating their data - it just requires that it's explicit and not mandatory.

Really? Going to der spiegel as someone from Chicago I get a "Continue reading with ads, Visit SPIEGEL.de as you normally would with the advertising and the usual tracking. (You can revoke your consent at any time.)" with an accept and continue box or "… or purchase a PUR subscription, It allows you to visit our site without any ad tracking and mostly free of advertising. €4.99/month, €1.99 for SPIEGEL+ subscribers".

I've never been there before. I went on to read the details of their "PUR subscription" via Google Translate, and it seems to truly be a "pay OR give up data" model, the first one I've ever seen. That said, it still isn't advertising-free[0] and contains some amount of internal, first-party tracking[1] (but see [2]).

Below are excerpts run via Google Translate. I'm truly very surprised by what I just saw - the directness and honesty of communications is even more refreshing than privacy-friendliness itself. Their FAQ covers privacy and advertising concerns separately, and is very specific. If I had a need for German-language news, I'd subscribe to this just as a token of appreciation.

--

[0] - "We continue to advertise our own products discreetly because SPIEGEL readers expect information about new products from the company. We cannot technically remove advertising from podcasts and our digital edition, but this is played without tracking. Individual sponsorships are just as difficult to fade out, and separate page areas such as voucher and sports betting marketplaces that are independently offered by the providers there are only to be made inaccessible in the navigation of our journalistic offers - but not, for example, for searches from outside. This is the level at which the exceptions move."

[1] - "We depend on it [internal usage measurements] for both basic control and further development of the news site, especially in order to optimize our payment model: Which texts are of interest to readers, where do operating elements not work, which pay offer might interest a reader and which rather not?"

[2] - "What data does DER SPIEGEL collect from PUR subscribers? The customary reach comparisons and usage statistics for the control and optimization of the site, especially via our first-party service provider Adobe." - I'm not sure what they mean by Adobe being a "first-party service provider", but I don't like it collecting anything.

--

EDIT: here [3] is a list of cookies they set for PUR subscribers. Seems to be true to their word (and it's nice this list wasn't hard to find in the first place), but I'm worried about the presence of Outbrain on that list. I can't imagine any legitimate interest a third-party chumbox provider would have.

--

[3] - https://odbdegi64ni2b3m74jattyok7i--www-spiegel-de.translate...

Re: Grindr to be fined almost €10M over GDPR complaint

#285

Post by birksherty » Wed, Jan 27, 2021, 2:17 AM UTC

mamon wrote: post #241

Nasrudith wrote: post #188

Earlier quoted context omitted.

It sounds like a fear of backlash - essentially if you find like 3% of the population with parking tickets it is fine. If you fine 40% to 60% then you get a large contingent pissed off at you - regardless of validity of the laws and enforcement unpopularity is perilous to laws and officials.

If 40% to 60% of population gets fined then that means the law is stupid* and should be abolished. Backlash on law enforcement is totaly understandable. *"stupid" is relative term. Laws are made for particular society, if almost a half of that society disagrees with the rule then it shouldn't be a rule.

Not half of society, half of profit at any cost companies that doesn't care about ethics ever.

So great laws actually even if gets 100% of those.

Re: Grindr to be fined almost €10M over GDPR complaint

#286

Post by killingtime74 » Wed, Jan 27, 2021, 5:14 AM UTC

Blikkentrekker wrote: post #175

killingtime74 wrote: post #85

Earlier quoted context omitted.

A lawyer would know for sure

I think you underestimate how specialized law can be. I have a relative who is a lawyer and legal attorney who would definitely not know this and when asked would answer that it is not his speciality and that he would have to do more research. He's an attorney in employment law, and I asked him some things about criminal law and he did not know, and when pressed to make a guess, his guess was wrong. It seems that law…

Yes and it seems like this would be an even more specialised area. if we don’t even know which lawyer to ask how can we even hope to follow the law meaningfully

Re: Grindr to be fined almost €10M over GDPR complaint

#287

Post by rorykoehler » Wed, Jan 27, 2021, 6:10 AM UTC

neilsense wrote: post #43

martin_a wrote: post #33

Earlier quoted context omitted.

Being gay can still get you arrested or killed in some countries of the world. Even if not, discrimination of gay people surely is a thing all over the world. Besides that, dating apps of any kind should be held to very high data protection standards for the sometimes very delicate matters.

Being Hindu can get you killed in some countries too, that doesn't make me, a Hindu, in the UK, vulnerable. Has everyone just decided that words have no meaning anymore?

I live in Berlin. It's one of the freest places for gays in the world and you still hear of attacks for no reason on gay couples.

Re: Grindr to be fined almost €10M over GDPR complaint

#288

Post by rorykoehler » Wed, Jan 27, 2021, 6:23 AM UTC

Nasrudith wrote: post #192

sleepyhead wrote: post #142

Earlier quoted context omitted.

No because GDPR has exceptions for state usage. Tax returns are not published but some key figures are available but you need to authenticate to retrieve it and it is logged and the log is available to the searched person.

The point is that comes across as hypocritical and makes the rationales come across as lies. "Consent for data sharing is important - except when we do it!" isn't a very good look even if there are valid reasons for tax return transparency it goes against their own stated principles.

Governments are run on hypocrisy. They can kill you, imprison you, extort you etc all under their legal framework. This isn't anything new. It's kind of essential in order to function as if they couldn't do it a vacuum would develop and eventually be filled by someone else who is willing to do these things.

Re: Grindr to be fined almost €10M over GDPR complaint

#289

Post by anticristi » Wed, Jan 27, 2021, 6:42 AM UTC

Blikkentrekker wrote: post #257

anticristi wrote: post #253

Earlier quoted context omitted.

A database of names and addresses does not tell you who in that list is a minority. You can't do: SELECT address AS to_harm WHERE sexual_orientation IN ('unusual');

Neither does biometric data? How can I tell minority status from a fingerprint or retinal scan? It seems rather arbitrary to treat name and address differently from fingerprints. I would argue that minority status correlates more heavily with name than with retinal patterns.

I'm guessing that biometric data is sensitive, since it cannot be changed. You can change your name and address, but your biometric data will follow you for the rest of your life.

Re: Grindr to be fined almost €10M over GDPR complaint

#290

Post by why_Mr_Anderson » Wed, Jan 27, 2021, 9:24 AM UTC

xtracto wrote: post #125

The GDPR has always amazed me. It changed the playing field from "you can use our free app as long as you give us data for marketing or not use it" to "you can provide a free service in the EU as long as you dont collect data for marketing or dont provide it" Without making a judgement on the merits of the approach, as a user/individual I appreciate the power this gives to protect my data. As a company/developer the…

What you and many others are missing is the fact that major part of GDPR is about collecting unnecessary data, specifically PII, personally identifiable information. If your web/app/whatever has legitimate reason why it needs the data, GDPR is fine with that. For example it's perfectly OK for a dating app to collect information about person's eye color and height or for medical app to have access to your heath-related information, even though it could be used (with other data) to identify specific individual.