Google Tag Manager, the new anti-adblock weapon (2020)

Things has changed indeed. Modern economy (I mean the one that has started somewhere deep in the Middle-ages) which finally led to the appearance of capitalism, was built on several foundations, one of them was ethics - in the olden days, in the times of lack of communication, invoices, the state authority that could enforce any law quickly, people had to count on the honesty of the others. One merchant had to trust another, otherwise no trade would be possible, there were no courts that could block dishonest party bank account or take any action to prevent fraud.

There were dishonest merchants, sure, but when finally message was spread, nobody would trade with them (if they managed to stay alive).

In the western world this ethics come from Christianity, those who were stealing, cheating, were going to hell - People really believed that and were afraid of this. Today for a lot of people, and for sure for Google management, this sounds like some fairy tale of the Princess Mononoke or Little Red Riding Hood type. Nobody (including a lot of Christians) is not scared by the devil, hell and all that stuff any more.

Unfortunately, as we see, ethics is still needed. Whatever EU does, Google will find the way to circumvent any regulation as it happens with GDPR, which is easily bypassed by the maze of buttons, 6pt light grey text, etc. And even if Google will be forced at some point to close its service officially in Europe (escalation that probably will never happen, but I also though that probably there will no war in Europe during my lifetime), people will use VPN-s, etc. to keep using it, as there is no viable alternative (the issue in itself).

It all can stop only if some people in Google would just decide that doing X is nasty and that they are abandoning the idea, even if income will be smaller next year.

This would be an ethical behavior, but nowadays to be ethical company it is cheap - it is sufficient to add to your company management board "person of color", person from "oppressed minority" (luckily there is so many such minorities to chose from so this is not a problem) which costs somewhere around $500K per year plus change your company logo to LGBT+ rainbow once a year ($100 for an HTML expert to handle this).

Once this is covered, company is ethical in the eyes of the public and can use all possible tax avoidance schemes, exploit it workers as Amazon does in its warehouses, steal their data and use them to create conflicts between people and manipulate them like Facebook does. And so on.

As a result Google can do what it wants and nobody will stop them. More, people would not even know about this outside tech/privacy oriented circles as mass media are living from the ads, so this change is actually what they dream of.

But this actually highlights exactly what I mean. What if I simply stood up a plain old Apache server to host my website but that happened to be hosted in the US. No analytics, just a few HTML files and that’s it.

I’m still in this scenario sending PII of EU citizens in the form of IP addresses to the US which are just written to /var/log/apache

It seems obviously different and yet as that ruling seems to imply it wouldn’t be unless I’m missing something here between first and third party capture or something?

With PlatformStorage on Android 12, which lets apps share key/values and things like this, it really looks like two steps back, one step forward for privacy if Topics/FLEDGE ever make it to browsers. The cat and mouse games need to stop.

A strong privacy law that cracks down on fingerprinting and lets users opt-out of tracking and delete their data really seems necessary. Even ephemeral data collection online needs to be checked. The user should be in control, and be served context-based or random ads, unless they approve interest based ads. The LiveRamps of the world will still be able to collect 3rd party data offline, but it's not anonymous, and can be deleted, at least if you're in CA for now through the CCPA.

Most users would likely be fine with consented context-based or interest-based ads, but an option for no analytics tracking or other tracking should be respected.

> we accepted two non-democratic countries in EU, Poland and Hungary, and these are the results.

I can't speak for Poland, but the political landscape of Hungary was different when it joined the EU, and the country was by no means considered non-democratic or EU-skeptic.

> They infected all the other countries

The EU was infected by rising inequality and the degradation of purchasing power by the middle class, which is a global issue that gives an opportunity for populists to gain power, and for the population to find scapegoats, like pointing fingers at a foreign country.

Previously GA and GTM would share private data with Google but we could at least see requests going out to google, so if you had rejected data being shared with 3rd parties or hadn't been asked at all (think GDPR) you could see that the website was breaking the law. This clever solution from Google hides it from us, consumers, so that we will just have to trust that if a website doesn't ask if it may share our details with Google, or when we tell them not to share data with Google, they actually won't do that.

Just to enphasise: for GDPR it really doesn't matter where your data is shared with a third party, from the browser or server. It's your data so they have to ask your permission to share it and otherwise they can't.