Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ban the sale of precise geolocation

lawfaremedia.org

Post reply on HN
Print view View original

41–50 of 205 posts

Re: Ban the sale of precise geolocation

#41

Post by romaniv »

The problem with all these discussions about banning stuff is that privacy is always on the back foot. It's by design. People who want to surveil and manipulate us are actively investigating new ways of doing it, they get paid for it and they risk nothing in the long run. All of these discussions about specifics are just reactions. They aren't even reactions to the surveillance itself, but rather to a discovery by someone that a new surveillance machine has been constructed and launched.

So the current feedback process involves: construction → exploitation → reporting → public awareness → legislation. This is too slow. Moreover, operating in this environment is exhausting.

We need a different feedback loop altogether. I'm not sure which one would work best, but something different needs to be considered.

Re: Ban the sale of precise geolocation

#42

Post by stavros »

ryandrake wrote: post #21
ch4s3 wrote: post #16

Earlier quoted context omitted.

I should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.

There is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.

There is the GDPR.

Re: Ban the sale of precise geolocation

#44

Post by stavros »

ch4s3 wrote: post #35
troupo wrote: post #20

Earlier quoted context omitted.

You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it. Congrats on gullibly believing the ad tech narrative.

Being able to read something in one sitting doesn't make it simple or obvious. The law establishes a board that gets to set new requirements.

As someone who has to implement it, it's really not bad at all: Ask the user for consent to use their data, and don't be misleading about it. That's it.

The rest of the "It'S So LaRgE AnD UndErSpEciFieD" is just FUD. The regulators don't just slap fines, they work with you to get you to comply, and they just want to see that you're putting in the effort instead of messing them about.

I have literally never been surprised by the GDPR. Whenever I thought "surely this is allowed" it was, whenever I thought "this can't be allowed", it wasn't. For everything in the middle, nobody will punish you for an honest mistake.

Re: Ban the sale of precise geolocation

#45

Post by [deleted] »

rockskon wrote: post #38
Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

There is no such thing as anonymized location data when you have the location of something where and when they sleep and work. It's a rhetorical fiction the ad industry tells itself.

[deleted]

Re: Ban the sale of precise geolocation

#46

Post by [deleted] »

rockskon wrote: post #38
Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

There is no such thing as anonymized location data when you have the location of something where and when they sleep and work. It's a rhetorical fiction the ad industry tells itself.

[deleted]

Re: Ban the sale of precise geolocation

#47

Post by jandrewrogers »

pocksuppet wrote: post #24
ch4s3 wrote: post #18

Earlier quoted context omitted.

GDPR like all EU regulation is needlessly complicated and aimed at a compliance model that seems designed for SAP.

Have you read it? It's not that bad, unless you're thinking like an adtech programmer trying to find the exact edge case for the maximal amount of tracking you're allowed to do, because such a bright line does not exist and that fact infuriates adtech professionals. It is vague because reality is vague and complex; each specific case of alleged violation has to be interpreted by multiple humans; there is no algorithm…

It is regulation that imagines companies are a government bureaucracy.

I have read GDPR and don't work in adtech. It is vague and it is pretty easy to find pathological scenarios that don't make much sense or impose an unusually high burden for no benefit. Every European law firm seems to agree with this assessment despite what proponents assert. Consequently, it forces a lot of expensive defensive activity in practice.

To some extent, it was just a failure of imagination on the part of GDPR's authors. Many things are not nearly as simple as it seems to assume and it bleeds into data models that have nothing to do with people.

It is what it is but no one should pretend it is not a burden for companies that have nothing to do with adtech or even data about people.

Re: Ban the sale of precise geolocation

#48

Post by ImPostingOnHN »

sroussey wrote: post #36
Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

Companies exist that de-anonymize other data brokers data. Lets the other data brokers claim they have anonymized data while end end users get everything.

you could probably run a anonymization company at the same time you run a de-anonymization company

Re: Ban the sale of precise geolocation

#49

Post by malfist »

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

> A lot of geolocation data on the market is anonymized

A lot isn't good enough.

Re: Ban the sale of precise geolocation

#50

Post by davebren »

glitchc wrote: post #32

How about we just ban the collection of precise geolocation? Wouldn't that be a better solution?

You can have legitimate use cases where it's a core functionality of the application to store it, so the user obviously knows it's being collected and agrees by using it.
Post reply on HN