Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR enforcer rules that IAB Europe’s consent popups are unlawful

iccl.ie

Post reply on HN
Print view View original

211–220 of 433 posts

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#211

Post by 9dev »

endisneigh wrote: post #173
9dev wrote: post #162

Earlier quoted context omitted.

I think the point is that megacorps' business structure is way too complex for anyone to actually understand. Why is Gmail free? It makes money for Google, that part is clear, but I have no idea how exactly. I'm not even sure they can measure it exactly. Those companies have transformed the internet, and its users, by offering services for free, in exchange for user data. We have raised an entire generation (two, may…

> Of course, we cannot simply ban all advertising and start charging for everything. But I'm of the firm opinion that, in order to go forward, we have to leave this business model behind, as humanity. The only way to achieve this is by making it unattractive via legislation. What exactly are you proposing? Anyone who wants to pay for email can do so already. It's very trivial to not use any of Google's services or be…

The issue isn't that I'm personally inconvenienced, this is not about me. It's that the internet is dominated by ad-based companies, and that is not a good thing?

I propose that we try to move humanity past this way of generating revenue, because it's wasting productivity and resources, encouraging shady behaviour, and leads to less freedom overall.

We have social networks manipulating users into staying on the platforms as long as possible, scrolling down infinite feeds, to expose them to as much advertising as possible, thus wasting productivity.

We have big players such as the IAB and its members tracking and spying on users to obtain more data to sell, as an alternative revenue stream to charging for their services.

We have quality journalism disappear in favour of whatever generates the most clicks, in order to expose more readers to advertisements. YouTube stars pushing hidden ads on children. Advertisers crossing ever more boundaries of privacy, by aggregating data from thousands of companies, with basically no oversight by anyone.

That is the issue. I think we should do something against that, and I think "something" may be to nudge the market into another direction, from ad-based to transaction-based revenue sources.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#212

Post by kmlx »

rendall wrote: post #83
dmitryminkovsky wrote: post #35

Earlier quoted context omitted.

This comment is being downvoted but I’m also wondering: how will this be enforced? Will authorities go and audit the data? How will they know where to look? Etc. “Hey did you delete the data?” “Yes, we deleted it” would, indeed, be laughable. This is not to mention the problem of identifying “the data” which has certainly now been processed ad nauseum. I think the reason companies don’t take these things seriously is…

> how will this be enforced? Will authorities go and audit the data? How will they know where to look? Etc. “Hey did you delete the data?” “Yes, we deleted it” would, indeed, be laughable. If you're not familiar with Northern European culture, I'm quite sure the companies can expect literal inspectors in their offices expecting clear answers to where the data is and what was done with it. They will be pleasant but fi…

> If you're not familiar with Northern European culture, I'm quite sure the companies can expect literal inspectors in their offices expecting clear answers to where the data is and what was done with it.

zero chance of this ever happening.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#213

Post by Nextgrid »

kmlx wrote: post #199
parkingrift wrote: post #42

Collecting and selling digital data is not a legitimate business enterprise. It’s spyware. If no one wants to pay for your product, the market has spoken. Too bad. We must correct the insanity and digital economic imbalance that spyware businesses have created.

this looks like a classic "flame bait" comment. > Collecting and selling digital data is not a legitimate business enterprise. a whole international industry, legislators across the planet, entrepreneurs, employees, voters, users and clients disagree. > If no one wants to pay for your product who doesn't want to pay for the product?

> a whole international industry, legislators across the planet, entrepreneurs, employees, voters, users and clients disagree.

It's not like the GDPR was one guy's idea that got formalized into law overnight. It's has its roots in existing data protection legislation that is decades old as well as previous, failed attempts (ePrivacy directive aka cookie law), so there's equally a significant number of people who disagree with nonconsensual data collection.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#215

Post by rkangel »

Nextgrid wrote: post #205
0xcde4c3db wrote: post #69

Earlier quoted context omitted.

It's also extremely important that companies can't insulate themselves from consequences by outsourcing compliance functions to a "designated villain".

It seems like that's what's happening here though. The IAB appears to take all the blame while everyone else gets away.

They lose all the data though. They may have avoided some name smearing but it's the data that they really want.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#216

Post by johannes1234321 »

Scarblac wrote: post #194
johannes1234321 wrote: post #96

Earlier quoted context omitted.

The "EU doing things" is not detached from your national government. In fact all EU legislation is being approved by your national government in the EU Council and the EU commission has to report there. (As well as the EU parliament, however the EU parliament is weak ...) Edit: maybe as addition in the last point in parentheses: The EU parliament is purposely weak, as the EU is a union of states and the member state…

I know that. What I consider "scary" is that the EU can only do this because they're aren't directly elected and so not as subject to the typical democratic pressures. It points at a clear weakness of democracy.

Pressure your government to vote "no" on policies you don't like or pressure your government to initiate other legislation. They have the power and responsibility.

And yes, I personally would like to have a stronger EU Parliament relative to the Commission and Council. However there is no reason to let the national government escape with "it's EU law" after they approved it. (And yes, Council doesn't require unanimous vote for most items anymore since the Lisbon treaty, thus it is possible your government voted "no", but that then is democracy and they have to convince other governments ...)

(Just a side note: I like GDPR and think it is to large parts good and push my government to support it)

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#217

Post by Nextgrid »

endisneigh wrote: post #209
parkingrift wrote: post #193

Earlier quoted context omitted.

>Though I'd agree that most internet users don't like ads, what's true is that most internet users don't like paying for things. Using YouTube as an example, the most popular site on the internet, the vast majority of people do not pay for YouTube premium even though it's available. This is a bit circular. People would rather use a free service than a paid service. So long as free services exist it will be hard or im…

> This is a bit circular. People would rather use a free service than a paid service. So long as free services exist it will be hard or impossible for paid services to exist or thrive. Of course. If a paid product wants to thrive it needs to be better. People do use paid search engines, email, maps, etc. most people don’t because most people don’t value it that much. > There's no reason that we should have to make th…

> paid search engines, [...], maps

Can you find me one? The only one I know about is Kagi which is in beta and invite-only.

The problem with the current status-quo is that as long as advertising powered by illicit data collection is possible in practice, it's not viable for a paid service to compete.

> Just change it for yourself and then you’re good.

It doesn't matter what you do if ad-tech scum will track you anyway and create a shadow profile by tricking your friends into giving out information about you such as how Facebook infers social graphs (including non-users) by sneaking into people's contacts lists.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#218

Post by Nextgrid »

endisneigh wrote: post #169
Helmut10001 wrote: post #168

Earlier quoted context omitted.

There is not much that would be lost if Youtube ceased to exist, either. People are wasting hours on this platform that could be spend better in many ways.

That's only your opinion. There are billions who disagree. At the end of the day no one is forcing you to use YouTube.

There should be enough people in those billions to sustain a paid alternative.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#219

Post by endisneigh »

Nextgrid wrote: post #200
endisneigh wrote: post #171

Earlier quoted context omitted.

I highly doubt you've personally watched even 1% of what's on YouTube, so you can hardly determine what's clickbait. That being said, who are we to say what's valuable?

I'm extrapolating based on what I see on the front page and in suggestions as well as other social networks. Most of this content is only there to solicit an ad impression, not enough people would pay money for it. > That being said, who are we to say what's valuable? We can infer this based on whether enough people pay for the content. There's a reason you don't see a Patreon or other way of paying for the vast majo…

> Most of this content is only there to solicit an ad impression, not enough people would pay money for it.

Exactly. There’s no issue.

> There's a reason you don't see a Patreon or other way of paying for the vast majority of clickbait content.

The vast majority of content, clickbait or not doesn’t have a patreon to begin with. Most patreon have social media presence which includes ads. Sounds like the worst of both worlds.

Re: GDPR enforcer rules that IAB Europe’s consent popups are unlawful

#220

Post by Macha »

riddleronroof wrote: post #184
bajtos wrote: post #2

Google, Amazon, and the entire tracking industry relies on IAB Europe’s consent system, which has now been found to be illegal following complaints coordinated by ICCL. EU data protection authorities find that the consent popups that plagued Europeans for years are illegal. All data collected through them must be deleted. This decision impacts Google’s, Amazon’s and Microsoft’s online advertising businesses.

Ok but I don’t get how this consent system ran for years? How can one get pre approved? The issue here isn’t that they collected data (it’s own problems), but they they didn’t use the right language! Does this mean it will be a long term of conditions like apple does every time we use a website? ICCL might have made internet worse with this. Not better.

The DPAs are not in the business of pre-approving, much like your local court won't pre-approve your pre-nup and so you might have to fight over it in court in an acrimonious divorce.

You can of course retain outside help to advise you but there's no guarantee that they are right and many of the consultancies and providers were incentivized to compete on maximum opt ins. Maybe the CMPs and the adtech companies can fight it out in court over whether the CMPs misled the adtech companies or they just gave the adtech companies options which the adtech companies misused.

The ruling is not just "fix your language", though that's what the industry will be incentivized to try, again. They all bandwagoned on hiding secondary opt out checkboxes under "legitimate interest" and this wrist slap tells them it's not ok:

> Fails to properly request consent, and relies on a lawful basis (legitimate interest) that is not permissible because of the severe risk posed by the online advertising tracking (Article 5(1)a, and Article 6 GDPR)

> Fails to respect the requirement for “data protection by design” (Article 25 GDPR)

The route to complying is clear. Don't track without opt in. Know where the user data is going, not just "whichever vendor happens to be in the winning ad". Don't use dark patterns to encourage the opt in. It's the industry's attempts to bury its head in the sand because it hurts their bottom line and their search for increasingly convoluted workarounds that is making this complicated.

Post reply on HN