Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GDPR complaint claims Google and IAB ad category lists leak intimate data

techcrunch.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#41

Post by Mirioron »

a_imho wrote: post #27

Google is the elephant, but it is very rare to see compliant services/sites. The interesting question is when/if EU is going to flex its GDPR muscles.

Never. This is used as another tool to selectively target companies the EU doesn't like while maintaining appearances.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#42

Post by kasey_junk »

mrweasel wrote: post #34
chronotis wrote: post #31

Setting aside penalties for a moment, what is the minimum set of changes to programmatic advertising practices that would bring it into compliance with GDPR? Would removing the targeting categories that relate to intimate data be sufficient? Or is something deeper, more structural in the crosshairs?

I by no means and expert on the subject, but I believe that the "simplest" change would be to target based on content, rather than the individual user.

The ad categories mentioned in this complaint are the content categories.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#43

Post by jake_the_third »

Mirioron wrote: post #40
donohoe wrote: post #36

Earlier quoted context omitted.

Agree. GDPR and programmatic ads are totally incompatible. I believe this is intentional on part of the EU.

Basically anything that hurts American tech companies is intentional on the part of the EU. That's why they're keeping both eyes shut on the plethora of violations many European companies are doing.

> That's why they're keeping both eyes shut on the plethora of violations many European companies are doing.

Name and shame. List the EU companies that are shitting on user privacy the way Google, Twitter, and Facebook currently are.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#44

Post by londons_explore »

seren wrote: post #11
SquareWheel wrote: post #6

Earlier quoted context omitted.

I have ad personalization turned off, but you should be able to view and edit your interests from your settings page. https://support.google.com/ads/answer/2662856

It is mostly empty just my age and sex. However I am sure I got an interest profile, at least being used with the Discover feed on Android.

Google ad data isn't really linked to data for other non-ad services for privacy reasons.

The discover feed on android is mostly powered by web search history, chrome browsing history, and location history. You can see all that here:

https://support.google.com/accounts/answer/162744?hl=en

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#45

Post by londons_explore »

Maarten88 wrote: post #9
seren wrote: post #2

I am curious, if you ask for a dump of your data from Google, where do you have to look to find your ad category ? As far I know, this is not directly accessible from your profile or privacy settings. Looking at the data selection to export, I am not even sure this is included somewhere.

Maybe Google doesn't store it, and just uses these categories in the process of auctioning advertisements, sending them as context? The problem with that being, of course, that any company participating in the bidding process can decide to store that information and build a profile that does have this information.

Bidders don't get as much info as googles internal models get. For example, bidders get to 'track' users by a unique id for up to 30 days, but then the id gets reset, so they can never persist any data beyond that unless they can correlate the new id with the old.

That correlation tends to take weeks worth of data to do with any accuracy, and by that time, all the opportunity to actually use the knowledge to place bids has gone.

The bidders can re-correlate if they actually make a bid, and use a creative to inspect their own cookies, and then resell that ad-spot, but typically that isn't worth it for small bidders (there's just too many devices on the internet - you'd need a huge ad budget), and large bidders are bound by privacy laws that stop them doing it (no investor wants the company the wrong side of an EU fine).

A few bidders used to do that on iOS devices, since the ads there are sufficiently valuable to make it worth it, but I haven't seen it for a few years.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#46

Post by tyfon »

Mirioron wrote: post #40
donohoe wrote: post #36

Earlier quoted context omitted.

Agree. GDPR and programmatic ads are totally incompatible. I believe this is intentional on part of the EU.

Basically anything that hurts American tech companies is intentional on the part of the EU. That's why they're keeping both eyes shut on the plethora of violations many European companies are doing.

The first fines were leveraged against EU companies [1], your whining falls flat on it's face and has no basis in reality.

[1] https://iapp.org/news/a/germanys-first-fine-under-the-gdpr-o...

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#47

Post by detaro »

Mirioron wrote: post #41
a_imho wrote: post #27

Google is the elephant, but it is very rare to see compliant services/sites. The interesting question is when/if EU is going to flex its GDPR muscles.

Never. This is used as another tool to selectively target companies the EU doesn't like while maintaining appearances.

Germany (well, German states actually) alone has handed out fines to 41 companies, and has hundreds of proceedings in flight (i.e. one German state is currently investigating 50 local companies), the vast majority against locals. The average cases just don't make headlines, especially not in english-speaking media, because who cares?

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#48

Post by Angostura »

Mirioron wrote: post #39
chopin wrote: post #29

Earlier quoted context omitted.

But more enforcement. GDPR enforcement has been disappointing so far.

That's because DPAs understand that if they reinforced GDPR properly then half the companies, particularly small businesses, in Europe would have to be fined. I'm not just talking tech companies either.

That's also because fining isn't the first step, its pretty much the last. You will have received a warning that you are not compliant and been given a deadline ito fix it in most cases.

Re: GDPR complaint claims Google and IAB ad category lists leak intimate data

#49

Post by xf00 »

ndnxhs wrote: post #26
dessant wrote: post #7

We should also be able to access our marketing categories without a Google account, since sensitive data is collected and a profile is built even if you don't have a Google account.

Better yet, google should not be able to store any personal data about users who are not registered

I feel like this is another example of something which can only be enforced by creating a new framework that inevitably benefits the few corrupt actors and defeats its own purpose.
Post reply on HN