Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR complaint claims Google and IAB ad category lists leak intimate data

techcrunch.com

Post reply on HN
Print view View original

11–20 of 68 posts

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#11

Post by seren »

SquareWheel wrote: post #6
seren wrote: post #2

I am curious, if you ask for a dump of your data from Google, where do you have to look to find your ad category ? As far I know, this is not directly accessible from your profile or privacy settings. Looking at the data selection to export, I am not even sure this is included somewhere.

I have ad personalization turned off, but you should be able to view and edit your interests from your settings page. https://support.google.com/ads/answer/2662856

It is mostly empty just my age and sex.

However I am sure I got an interest profile, at least being used with the Discover feed on Android.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#13

Post by m4r35n357 »

Maarten88 wrote: post #9
seren wrote: post #2

I am curious, if you ask for a dump of your data from Google, where do you have to look to find your ad category ? As far I know, this is not directly accessible from your profile or privacy settings. Looking at the data selection to export, I am not even sure this is included somewhere.

Maybe Google doesn't store it, and just uses these categories in the process of auctioning advertisements, sending them as context? The problem with that being, of course, that any company participating in the bidding process can decide to store that information and build a profile that does have this information.

I think you mean "participating"

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#14

Post by icebraining »

mehrdadn wrote: post #10
te_chris wrote: post #5

Earlier quoted context omitted.

I'm pretty sure GDPR is meant to force disclosure of derived data too.

Are you sure? I didn't find a clear sentence on this last time I looked. It seems hard to define what is derived data (if they guess that a 20 year old is a student, is that derived data? or just a guess) and I can imagine it leaking information about other people if it involved aggregating together pieces of data from multiple people.

The GDPR says "'personal data’ means any information relating to an identified or identifiable natural person". So as long as this derived data is directly related to a person, the GDPR applies.

More explicitly, the UK's regulator says: "You should however note that if this ‘inferred’ or ‘derived’ data is personal data, you still need to provide it to an individual if they make a subject access request."

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#15

Post by jenscow »

te_chris wrote: post #5
kerng wrote: post #4

Earlier quoted context omitted.

Yes, it seems that service providers confuse the "provide a dump of my data" with just being the information a user actively uploaded and stored. The point of this is to get access to any information the service provide might have about the individual requesting the data. And have it all deleted upon request also!

I'm pretty sure GDPR is meant to force disclosure of derived data too.

In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#16

Post by zaarn »

mehrdadn wrote: post #8
dessant wrote: post #7

We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.

I agree but is this a Google specific thing? So many companies gather data on people without letting them see anything... I feel like we need legislation regarding this for all of them.

GDPR already requires all that data access and control even for people that don't have a formal account and haven't agreed to your ToS. No additional legislation in the EU needed.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#17

Post by mehrdadn »

icebraining wrote: post #14
mehrdadn wrote: post #10

Earlier quoted context omitted.

Are you sure? I didn't find a clear sentence on this last time I looked. It seems hard to define what is derived data (if they guess that a 20 year old is a student, is that derived data? or just a guess) and I can imagine it leaking information about other people if it involved aggregating together pieces of data from multiple people.

The GDPR says "'personal data’ means any information relating to an identified or identifiable natural person" . So as long as this derived data is directly related to a person, the GDPR applies. More explicitly, the UK's regulator says: "You should however note that if this ‘inferred’ or ‘derived’ data is personal data, you still need to provide it to an individual if they make a subject access request."

Huh, thanks for that. So e.g. LinkedIn not providing any information on (say) emails they've scraped seems blatantly illegal too?

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#18

Post by jsty »

jenscow wrote: post #15
te_chris wrote: post #5

Earlier quoted context omitted.

I'm pretty sure GDPR is meant to force disclosure of derived data too.

In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.

Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#19

Post by Tsubasachan »

Advertising and marketing is a trillion dollar industry that employs millions of people across the globe and I want nothing to do with it.

Advertising atheism and I wouldn't be entirely surprised if in the future people will be prosecuted for it.

Post reply on HN