GDPR complaint claims Google and IAB ad category lists leak intimate data • Hacker News Board

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#21

Post by isostatic » Mon, Jan 28, 2019, 10:29 AM UTC

jsty wrote: post #18

jenscow wrote: post #15

Earlier quoted context omitted.

In that case, if I stored your date of birth then I'd also have to "disclose" your age and star-sign.

Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'

What if you don't store the inference, but instead process it when needed internally in a function?

  if (dob.month == december) $birthstone = quartz
  select advert from adverts where stone = $birthstone

Or whatever

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#22

Post by tyfon » Mon, Jan 28, 2019, 10:43 AM UTC

isostatic wrote: post #21

jsty wrote: post #18

Earlier quoted context omitted.

Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'

What if you don't store the inference, but instead process it when needed internally in a function? if (dob.month == december) $birthstone = quartz select advert from adverts where stone = $birthstone Or whatever

GDPR requires that you log when you use information from a user in models, reports etc so this would probably have to be logged and disclosed.

You would also need explicit concent to use the date of birth for advertising purposes.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#23

Post by icebraining » Mon, Jan 28, 2019, 10:47 AM UTC

isostatic wrote: post #21

jsty wrote: post #18

Earlier quoted context omitted.

Only if you actively stored or processed their age or star sign. It's not 'disclose every possible inference you could make given the data you hold'

What if you don't store the inference, but instead process it when needed internally in a function? if (dob.month == december) $birthstone = quartz select advert from adverts where stone = $birthstone Or whatever

For ads, you probably don't need to tell people about the "birthstone". But if that automatic processing "produces legal effects concerning him or her or similarly significantly affects him or her" (such as denying a credit card or job offer), then you have to give the person "meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for [them]."

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#24

Post by ckastner » Mon, Jan 28, 2019, 10:57 AM UTC

Key quotes:

> Lack of transparency makes it impossible for users to exercise their rights under GDPR. There is no way to verify, correct or delete marketing categories that have been assigned to us, even though we are talking about our personal data.

and

> Under GDPR, processing special category [medical information; political affiliation; religious or philosophical views; sexuality; and information revealing racial or ethnic origin] data generally requires explicit consent from users — with only very narrow exceptions, such as for protecting the vital interests of the data subjects

The last quote is particularly troublesome, as Article 9 GDPR [1] is explicit about this: processing this data is prohibited by default, and none of the exemptions seem to apply even by a stretch of imagination.

Assigning such labels may be the norm from the Ad industry's point of view, but that is simply no longer possible under the GDPR.

[1] https://gdpr-info.eu/art-9-gdpr/

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#25

Post by Maarten88 » Mon, Jan 28, 2019, 10:59 AM UTC

m4r35n357 wrote: post #13

Maarten88 wrote: post #9

Earlier quoted context omitted.

Maybe Google doesn't store it, and just uses these categories in the process of auctioning advertisements, sending them as context? The problem with that being, of course, that any company participating in the bidding process can decide to store that information and build a profile that does have this information.

I think you mean "participating"

tnx, updated

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#26

Post by ndnxhs » Mon, Jan 28, 2019, 11:18 AM UTC

dessant wrote: post #7

We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.

Better yet, google should not be able to store any personal data about users who are not registered

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#27

Post by a_imho » Mon, Jan 28, 2019, 11:44 AM UTC

Google is the elephant, but it is very rare to see compliant services/sites. The interesting question is when/if EU is going to flex its GDPR muscles.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#28

Post by throw2016 » Mon, Jan 28, 2019, 11:49 AM UTC

It just gets creepier and creepier and to think there are hundreds of thousands of people involved in this sordid endeavour who think nothing of and stalking, profiling and dehumanizing others for personal gain.

More evidence there is zero moral compass in SV and given enough money people are willing to do whatever away from public view and posture and pretend to care about niceties like ethics in public. And these are educated folks who are not starving and desperate.

Discussions should move from a default human base ethical position to any discussion about ethics is posturing and empty, its only by actions that any sense of ethics can be gleaned.

But people who behave unethically cannot then expect an ethical society or ethical behavior from others. These others too have a right to exchange their values for money and attempt to normalize, redefine or hand wave away their actions.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#29

Post by chopin » Mon, Jan 28, 2019, 11:55 AM UTC

zaarn wrote: post #16

mehrdadn wrote: post #8

Earlier quoted context omitted.

I agree but is this a Google specific thing? So many companies gather data on people without letting them see anything... I feel like we need legislation regarding this for all of them.

GDPR already requires all that data access and control even for people that don't have a formal account and haven't agreed to your ToS. No additional legislation in the EU needed.

But more enforcement. GDPR enforcement has been disappointing so far.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#30

Post by est31 » Mon, Jan 28, 2019, 11:58 AM UTC

dessant wrote: post #7

We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.

How sure are they that it's one individual person that they are tracking? If you and others use the same computer, then maybe stuff might get mixed up. If "accessing" marketing categories includes read-access then your situation is worse than before.

What about the legal risk for Google if you opted out of the tracking a month ago but now google thinks you are a different person and is tracking you?