Setting aside penalties for a moment, what is the minimum set of changes to programmatic advertising practices that would bring it into compliance with GDPR? Would removing the targeting categories that relate to intimate data be sufficient? Or is something deeper, more structural in the crosshairs?
GDPR complaint claims Google and IAB ad category lists leak intimate data
31–40 of 68 posts
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#32We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.
How sure are they that it's one individual person that they are tracking? If you and others use the same computer, then maybe stuff might get mixed up. If "accessing" marketing categories includes read-access then your situation is worse than before. What about the legal risk for Google if you opted out of the tracking a month ago but now google thinks you are a different person and is tracking you?
There's subtle ways to fingerprint someone, even how they move their mouse:
https://motherboard.vice.com/en_us/article/78k8pz/how-you-mo...
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#33We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.
How sure are they that it's one individual person that they are tracking? If you and others use the same computer, then maybe stuff might get mixed up. If "accessing" marketing categories includes read-access then your situation is worse than before. What about the legal risk for Google if you opted out of the tracking a month ago but now google thinks you are a different person and is tracking you?
These are indeed tricky problems to solve.
They're also googles problems to solve, not societies. We're not required to provide solutions for them.
If google can't solve them, maybe that means google's business model is illegal.
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#34Setting aside penalties for a moment, what is the minimum set of changes to programmatic advertising practices that would bring it into compliance with GDPR? Would removing the targeting categories that relate to intimate data be sufficient? Or is something deeper, more structural in the crosshairs?
I by no means and expert on the subject, but I believe that the "simplest" change would be to target based on content, rather than the individual user.
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#35Setting aside penalties for a moment, what is the minimum set of changes to programmatic advertising practices that would bring it into compliance with GDPR? Would removing the targeting categories that relate to intimate data be sufficient? Or is something deeper, more structural in the crosshairs?
I by no means and expert on the subject, but I believe that the "simplest" change would be to target based on content, rather than the individual user.
Yes, but that's also a torpedo to the way programmatic ads are currently bought and sold. (FWIW I am in favor of such a change, but there are a lot of very large tech companies selling data management platforms whose core value prop is being able to stitch together audiences from this sort of data and precisely target them everywhere their browser cookie or device ID goes.)
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#36Earlier quoted context omitted.
I by no means and expert on the subject, but I believe that the "simplest" change would be to target based on content, rather than the individual user.
Yes, but that's also a torpedo to the way programmatic ads are currently bought and sold. (FWIW I am in favor of such a change, but there are a lot of very large tech companies selling data management platforms whose core value prop is being able to stitch together audiences from this sort of data and precisely target them everywhere their browser cookie or device ID goes.)
Agree. GDPR and programmatic ads are totally incompatible.
I believe this is intentional on part of the EU.
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#37I'm familiar with RTB (real-time bidding protocol) details, so I can assess this from the technical POV.
Most ironical thing here -- IAB categories applied not to user profiles but to URL's.
So, their goal is to facilitate ads targeting not to user profile, but to page content. This is the use case which is often discussed on HN as ethical and "right" way of showing ads -- you get the bid request with "Nature, travel" IAB categories and you show ad about outdoor gear. You don't need to crunch user data to make this simple decision.
However, I have to admit this complaint has it's own merit. Bid request usually contains not just page URL and IAB categories, but user cookie as well. So, by data-mining bidstream, you can theoretically find people (well, at least their unique cookies) who are looking for a cure for impotence, and this is against GDPR, for sure.
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#38We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.
I agree but is this a Google specific thing? So many companies gather data on people without letting them see anything... I feel like we need legislation regarding this for all of them.
How is legislation going to fix this unless you mandate region locking of the internet? The moment a website loads some script from a Chinese site all bets are off from a legislative protection standpoint.
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#39Earlier quoted context omitted.
GDPR already requires all that data access and control even for people that don't have a formal account and haven't agreed to your ToS. No additional legislation in the EU needed.
But more enforcement. GDPR enforcement has been disappointing so far.
That's because DPAs understand that if they reinforced GDPR properly then half the companies, particularly small businesses, in Europe would have to be fined. I'm not just talking tech companies either.
Re: GDPR complaint claims Google and IAB ad category lists leak intimate data
#40Earlier quoted context omitted.
Yes, but that's also a torpedo to the way programmatic ads are currently bought and sold. (FWIW I am in favor of such a change, but there are a lot of very large tech companies selling data management platforms whose core value prop is being able to stitch together audiences from this sort of data and precisely target them everywhere their browser cookie or device ID goes.)
Agree. GDPR and programmatic ads are totally incompatible. I believe this is intentional on part of the EU.
Basically anything that hurts American tech companies is intentional on the part of the EU. That's why they're keeping both eyes shut on the plethora of violations many European companies are doing.