Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

France fines Apple €150M for “excessive” pop-ups that let users reject tracking

arstechnica.com

Post reply on HN
Print view View original

41–50 of 217 posts

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#41

Post by gruez »

Swenrekcah wrote: post #33
gruez wrote: post #30

Earlier quoted context omitted.

You can definitely check on whether the user answered yes to the prompt, because if they declined you'll get a null (ie. all 0s) uuid. Whether app developers can rely on that as confirmation for tracking on their side is a purely legal question, and I wish the French government would try to resolve it on their side rather than going straight to fining Apple.

As a European Apple user I welcome any and all fines that can be levied on Apple for their anticompetitive practices.

What's "anticompetitive" here? If the description provided in my previous comment is correct, it seems to be more of a failure on the part of the regulators than anything else.

The EU (through GDPR) also wants some sort of affirmative consent for tracking. That's fair, and results in one prompt. However, iOS obviously can't accept a "trust me bro" from the app itself that it's okay to enable cross-app tracking, so you need a second prompt. The obvious solution would be to combine the two, by allowing the ATT prompt to be used as consent for the purposes of GDPR. Why didn't French regulators go with this solution and decide to fine Apple instead?

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#42

Post by refulgentis »

duskwuff wrote: post #36
bilbo0s wrote: post #27

Earlier quoted context omitted.

Right. I'm not sure this is fixable? Or maybe there is widespread misunderstanding of the requirements in this scenario? But I also thought the rule was tough enough to require verifying that extra consent? Maybe it's not? Truly confused here.

> I'm not sure this is fixable? Not from Apple's end. Apple mandates that all requests for permissions go through a single, OS-provided dialog. If a user accepts, the permission is granted; if the user rejects, the permission is not granted, and the app can't ask again. Simple enough. App developers try to maximize their chances of getting that permission granted by adding another warm-up dialog before actually doing…

> There is nothing which requires third-party developers to use these additional dialogs.

Well, yes there is: I don't have carte blanche to do whatever I want with your data because you tapped an Apple dialog: I have to obtain your consent first.

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#43

Post by gruez »

Nullabillity wrote: post #37
gruez wrote: post #21

No good deed goes unpunished. Don't protect users' privacy, and you get flak from regulators for "not doing enough". Protect users' privacy, and you get flak from regulators because it's "too complex and hurts small companies that rely on advertising revenue". You see similar levels of cynicism directed at Google. When firefox banned third party cookies, it was almost universally welcomed, but when Chrome does it the…

The difference is that Firefox didn't do it as an excuse to sneak in a new tracking system instead.

You mean this? https://support.mozilla.org/en-US/kb/privacy-preserving-attr...

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#45

Post by refulgentis »

gruez wrote: post #41
Swenrekcah wrote: post #33

Earlier quoted context omitted.

As a European Apple user I welcome any and all fines that can be levied on Apple for their anticompetitive practices.

What's "anticompetitive" here? If the description provided in my previous comment is correct, it seems to be more of a failure on the part of the regulators than anything else. The EU (through GDPR) also wants some sort of affirmative consent for tracking. That's fair, and results in one prompt. However, iOS obviously can't accept a "trust me bro" from the app itself that it's okay to enable cross-app tracking, so yo…

"there is an "asymmetry" in which user consent for Apple's own data collection is obtained with a single pop-up, but other publishers are "required to obtain double consent from users for tracking on third-party sites and applications."

more @ https://news.ycombinator.com/item?id=24109695 (via https://www.forbes.com/sites/johnkoetsier/2020/08/07/apple-a...)

EDIT: Throttled, so reply can go here:

> My previous comment directly addresses the "asymmetry" aspect.

Apologies, you asked what the asymmetry was and I guess I'm still rather confused even after reviewing the thread. I think I've had too much caffeine...or not enough? :)

> The obvious solution would be to combine the two, by allowing the ATT prompt to be used as consent for the purposes of GDPR. Why didn't French regulators go with this solution and decide to fine Apple instead?

I've been involved in regulatory stuff before and it's considered overreach, generally, when the government does UX design for you. Hopefully, that's a solution Apple can consider, it's a great idea on your end, excellent for users and competition.

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#46

Post by gruez »

refulgentis wrote: post #45
gruez wrote: post #41

Earlier quoted context omitted.

What's "anticompetitive" here? If the description provided in my previous comment is correct, it seems to be more of a failure on the part of the regulators than anything else. The EU (through GDPR) also wants some sort of affirmative consent for tracking. That's fair, and results in one prompt. However, iOS obviously can't accept a "trust me bro" from the app itself that it's okay to enable cross-app tracking, so yo…

"there is an "asymmetry" in which user consent for Apple's own data collection is obtained with a single pop-up, but other publishers are "required to obtain double consent from users for tracking on third-party sites and applications." more @ https://news.ycombinator.com/item?id=24109695 (via https://www.forbes.com/sites/johnkoetsier/2020/08/07/apple-a... ) EDIT: Throttled, so reply can go here: > My previous commen…

My previous comment directly addresses the "asymmetry" aspect.

>The obvious solution would be to combine the two, by allowing the ATT prompt to be used as consent for the purposes of GDPR. Why didn't French regulators go with this solution and decide to fine Apple instead?

edit:

>Apologies, you asked what the asymmetry was and I guess I'm still rather confused even after reviewing the thread. I think I've had too much caffeine...or not enough? :)

The point is, I can see where the "asymmetry" is, but I don't understand why they went decided to fine Apple rather than do something on their side (ie. rework the idea of consent in GDPR to allow for reusing the ATT prompt) to fix the "asymmetry". I think most people would agree that the ATT prompt from iOS must stay, and it's better to address the "asymmetry" by making third party apps more streamlined, than by making iOS worse[1]. That would be entirely within the French regulators' remit.

[1] https://en.wikipedia.org/wiki/Harrison_Bergeron

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#47

Post by refulgentis »

thebruce87m wrote: post #29

> Benoit Coeure, the head of France's competition authority, "told reporters the regulator had not spelled out how Apple should change its app, but that it was up to the company to make sure it now complied with the ruling," Sounds like a good shakedown to me. Wait until they tweak it then fine them again for getting it “wrong”. I wonder if they even got the chance to change anything before they were fined the first…

> "told reporters the regulator had not spelled out how Apple should change its app, but that it was up to the company to make sure it now complied with the ruling,"...shakedown

I wonder if this sheds light: if they said exactly what to do, there's a strong argument that they went too far when business regulators became UI designers.

> Wait until they tweak it then fine them again for getting it “wrong”

I don't worry too much about it, I used to work at Google, companies and regulatory authorities are in constant contact. Generally, I haven't yet seen a company claim to have addressed a situation then gotten fined again.

> And all because the regulator wants users to be advertised to more?

I can't find that bit in the article and I haven't heard it before: could you share some more?

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#48

Post by cosmic_cheese »

duskwuff wrote: post #36
bilbo0s wrote: post #27

Earlier quoted context omitted.

Right. I'm not sure this is fixable? Or maybe there is widespread misunderstanding of the requirements in this scenario? But I also thought the rule was tough enough to require verifying that extra consent? Maybe it's not? Truly confused here.

> I'm not sure this is fixable? Not from Apple's end. Apple mandates that all requests for permissions go through a single, OS-provided dialog. If a user accepts, the permission is granted; if the user rejects, the permission is not granted, and the app can't ask again. Simple enough. App developers try to maximize their chances of getting that permission granted by adding another warm-up dialog before actually doing…

That, “we need to maintain the ability to pester the user again” pattern is really annoying. Apple should add a screen at initial setup that allows the user to default every permission that it’s possible to use that pattern with to “no” and skip the one time dialog just to screw with apps that do it.

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#49

Post by dinkblam »

gruez wrote: post #21

No good deed goes unpunished. Don't protect users' privacy, and you get flak from regulators for "not doing enough". Protect users' privacy, and you get flak from regulators because it's "too complex and hurts small companies that rely on advertising revenue". You see similar levels of cynicism directed at Google. When firefox banned third party cookies, it was almost universally welcomed, but when Chrome does it the…

[flagged]

Re: France fines Apple €150M for “excessive” pop-ups that let users reject tracking

#50

Post by benmanns »

refulgentis wrote: post #42
duskwuff wrote: post #36

Earlier quoted context omitted.

> I'm not sure this is fixable? Not from Apple's end. Apple mandates that all requests for permissions go through a single, OS-provided dialog. If a user accepts, the permission is granted; if the user rejects, the permission is not granted, and the app can't ask again. Simple enough. App developers try to maximize their chances of getting that permission granted by adding another warm-up dialog before actually doing…

> There is nothing which requires third-party developers to use these additional dialogs. Well, yes there is: I don't have carte blanche to do whatever I want with your data because you tapped an Apple dialog: I have to obtain your consent first.

This is interesting to me—are you an app developer that does this pattern for that reason? I definitely figured it was exclusively because they can request repeatedly for the fake prompt, and only “use” their prompt when the user is inclined to accept. There are times where I’ll accept the first prompt and reject the second prompt when apps are spammy about it.
Post reply on HN