Ban the sale of precise geolocation • Hacker News Board

Re: Ban the sale of precise geolocation

#21

Post by ryandrake » Fri, Apr 17, 2026, 3:14 PM UTC

ch4s3 wrote: post #16

Dwedit wrote: post #8

Earlier quoted context omitted.

Contractual agreement? Nobody reads things like EULAs or terms of service. It's probably in there already.

I should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.

There is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.

Re: Ban the sale of precise geolocation

#22

Post by pocksuppet » Fri, Apr 17, 2026, 3:16 PM UTC

ryandrake wrote: post #21

ch4s3 wrote: post #16

Earlier quoted context omitted.

I should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.

There is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.

Then it's not a valid contract and therefore does not absolve them of criminal liability for stalking you.

Re: Ban the sale of precise geolocation

#23

Post by Eextra953 » Fri, Apr 17, 2026, 3:16 PM UTC

Does anyone know of any groups that are organizing and lobbying to get things like this into law? I know about the EFF but they seem to be more focused on documenting and reporting instead of lobbying and getting things passed.

Re: Ban the sale of precise geolocation

#24

Post by pocksuppet » Fri, Apr 17, 2026, 3:17 PM UTC

ch4s3 wrote: post #18

troupo wrote: post #15

Earlier quoted context omitted.

> IMO we should ban gathering this data without GDPR tried. And the narrative around GDPR was deliberately completely derailed by adtech. Lack of enforcement didn't help either

GDPR like all EU regulation is needlessly complicated and aimed at a compliance model that seems designed for SAP.

Have you read it? It's not that bad, unless you're thinking like an adtech programmer trying to find the exact edge case for the maximal amount of tracking you're allowed to do, because such a bright line does not exist and that fact infuriates adtech professionals. It is vague because reality is vague and complex; each specific case of alleged violation has to be interpreted by multiple humans; there is no algorithm.

Re: Ban the sale of precise geolocation

#25

Post by ryandrake » Fri, Apr 17, 2026, 3:18 PM UTC

troupo wrote: post #20

ch4s3 wrote: post #18

Earlier quoted context omitted.

GDPR like all EU regulation is needlessly complicated and aimed at a compliance model that seems designed for SAP.

You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats on gullibly believing the ad tech narrative.

The "GDPR is complicated" meme has been circulating among software developers since probably before it was even written. It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it!

Re: Ban the sale of precise geolocation

#26

Post by pocksuppet » Fri, Apr 17, 2026, 3:18 PM UTC

troupo wrote: post #19

wolvoleo wrote: post #6

Just ban the sale of any kind of adtracking. That way we can get rid of the cookiewalls too. Missed opportunity by the EU when they wrote GDPR.

GDPR literally prohibits the sale of user data and tracking without user consent (because yes, you want to give people the possibility to opt in for a variety of reasons). GDPR has literally nothing to do with cookie popups. That was, and is, adtech

I think they are saying GDPR did not ban websites from noisily asking for consent and trying to trick you into giving consent.

Re: Ban the sale of precise geolocation

#27

Post by pocksuppet » Fri, Apr 17, 2026, 3:19 PM UTC

ryandrake wrote: post #25

troupo wrote: post #20

Earlier quoted context omitted.

You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats on gullibly believing the ad tech narrative.

The "GDPR is complicated" meme has been circulating among software developers since probably before it was even written. It's so wild that HN dunks on it so much: Here we have a societal problem in computing we've been complaining about for decades, someone offers an incremental but imperfect regulation to start taking steps to correct it, and everyone hates it!

Same with the California age input box.

Re: Ban the sale of precise geolocation

#28

Post by 1121redblackgo » Fri, Apr 17, 2026, 3:21 PM UTC

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

Yep. With side channel/one order of thinking above the laws, its trivial to get around said laws. Need better laws.

Re: Ban the sale of precise geolocation

#29

Post by lotu » Fri, Apr 17, 2026, 3:21 PM UTC

troupo wrote: post #19

wolvoleo wrote: post #6

Just ban the sale of any kind of adtracking. That way we can get rid of the cookiewalls too. Missed opportunity by the EU when they wrote GDPR.

GDPR literally prohibits the sale of user data and tracking without user consent (because yes, you want to give people the possibility to opt in for a variety of reasons). GDPR has literally nothing to do with cookie popups. That was, and is, adtech

My job was building cookie walls in response to GDPR. It might not have been the “intent” but it certainly was the consequence of that law.

Re: Ban the sale of precise geolocation

#30

Post by ch4s3 » Fri, Apr 17, 2026, 3:23 PM UTC

ryandrake wrote: post #21

ch4s3 wrote: post #16

Earlier quoted context omitted.

I should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.

There is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.

You can't just bury literally anything in an EULA. There's a fair amount of case law establishing that EULAs clauses that are surprising or illegal aren't enforceable.