Ban the sale of precise geolocation • Hacker News Board

Re: Ban the sale of precise geolocation

#51

Post by microtonal » Fri, Apr 17, 2026, 3:52 PM UTC

vovanidze wrote: post #40

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

exactly. calling it 'anonymized' is pure security theater once you have enough data points to map out someones daily routine. waiting for legislation or eulas to fix this is a lost cause since adtech always finds a loophole. the fix has to be architectural. moving toward stateless proxies that strip device identifiers at the edge before they even hit upstream servers. if the payload never touches a persistent db ther…

To be honest, I feel like this is where iOS and Android are failing us. Why is every app allowed to embed a bunch of trackers? Only blocking cross-app tracking on user request as iOS does is not enough (and data of different apps/websites can be correlated externally).

Re: Ban the sale of precise geolocation

#52

Post by dminor » Fri, Apr 17, 2026, 3:56 PM UTC

Eextra953 wrote: post #23

Does anyone know of any groups that are organizing and lobbying to get things like this into law? I know about the EFF but they seem to be more focused on documenting and reporting instead of lobbying and getting things passed.

Senator Wyden has been pretty focused on it. I think it's going to take some changes in Congress before it happens though.

Re: Ban the sale of precise geolocation

#53

Post by jandrewrogers » Fri, Apr 17, 2026, 3:57 PM UTC

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

Location and identity are inextricably linked. You can't destroy identity without also destroying location and location is critical for myriad purposes.

The analytic reconstruction of identity from location is far more sophisticated than the scenarios people imagine. You don't need to know where they live to figure out who they are. Every human leaves a fingerprint in space-time.

Re: Ban the sale of precise geolocation

#54

Post by Forgeties79 » Fri, Apr 17, 2026, 3:58 PM UTC

rockskon wrote: post #38

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

There is no such thing as anonymized location data when you have the location of something where and when they sleep and work. It's a rhetorical fiction the ad industry tells itself.

And with LLM’s now it’s easier than ever to piece the parts together. Companies were doing it before we even knew what LLM’s were capable of.

Edit: It's a rhetorical fiction the ad industry tells us.

Re: Ban the sale of precise geolocation

#55

Post by microtonal » Fri, Apr 17, 2026, 3:59 PM UTC

ch4s3 wrote: post #18

troupo wrote: post #15

Earlier quoted context omitted.

> IMO we should ban gathering this data without GDPR tried. And the narrative around GDPR was deliberately completely derailed by adtech. Lack of enforcement didn't help either

GDPR like all EU regulation is needlessly complicated and aimed at a compliance model that seems designed for SAP.

The compliance model is very simple. Do not collect data. Problem solved. If you need to collect data (e.g. because you are a webshop), only collect the minimum necessary.

The problem is not the GDPR, the problem is the surveillance industry that wants to grab as much data as possible and try to do as much malicious compliance as possible.

Re: Ban the sale of precise geolocation

#56

Post by SoftTalker » Fri, Apr 17, 2026, 3:59 PM UTC

em-bee wrote: post #31

troupo wrote: post #19

Earlier quoted context omitted.

GDPR literally prohibits the sale of user data and tracking without user consent (because yes, you want to give people the possibility to opt in for a variety of reasons). GDPR has literally nothing to do with cookie popups. That was, and is, adtech

prohibits [...] without user consent that's what causes the popups. it should prohibit it outright, consent or not.

But the only reason the popups are needed is the adtech tracking cookies. You don't need a popup for cookies that are related to essential site functionality.

Re: Ban the sale of precise geolocation

#57

Post by redwall_hp » Fri, Apr 17, 2026, 4:00 PM UTC

stavros wrote: post #44

ch4s3 wrote: post #35

Earlier quoted context omitted.

Being able to read something in one sitting doesn't make it simple or obvious. The law establishes a board that gets to set new requirements.

As someone who has to implement it, it's really not bad at all: Ask the user for consent to use their data, and don't be misleading about it. That's it. The rest of the "It'S So LaRgE AnD UndErSpEciFieD" is just FUD. The regulators don't just slap fines, they work with you to get you to comply, and they just want to see that you're putting in the effort instead of messing them about. I have literally never been surpr…

Anti GDPR people: "it's so complicated not being able to walk into someone's house and take their things! Which things can I not take? How about this? And now I need a lawyer if I take someone's things? Ridiculous!"

Just don't spy on people.

Re: Ban the sale of precise geolocation

#58

Post by [deleted] » Fri, Apr 17, 2026, 4:02 PM UTC

jandrewrogers wrote: post #53

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

Location and identity are inextricably linked. You can't destroy identity without also destroying location and location is critical for myriad purposes. The analytic reconstruction of identity from location is far more sophisticated than the scenarios people imagine. You don't need to know where they live to figure out who they are. Every human leaves a fingerprint in space-time.

[deleted]

Re: Ban the sale of precise geolocation

#59

Post by nickburns » Fri, Apr 17, 2026, 4:03 PM UTC

jandrewrogers wrote: post #53

Johnbot wrote: post #9

A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by chec…

Location and identity are inextricably linked. You can't destroy identity without also destroying location and location is critical for myriad purposes. The analytic reconstruction of identity from location is far more sophisticated than the scenarios people imagine. You don't need to know where they live to figure out who they are. Every human leaves a fingerprint in space-time.

> and location is critical for myriad purposes.

It's not though.

Critical for myriad elective purposes? Sure.

Re: Ban the sale of precise geolocation

#60

Post by stavros » Fri, Apr 17, 2026, 4:04 PM UTC

redwall_hp wrote: post #57

stavros wrote: post #44

Earlier quoted context omitted.

As someone who has to implement it, it's really not bad at all: Ask the user for consent to use their data, and don't be misleading about it. That's it. The rest of the "It'S So LaRgE AnD UndErSpEciFieD" is just FUD. The regulators don't just slap fines, they work with you to get you to comply, and they just want to see that you're putting in the effort instead of messing them about. I have literally never been surpr…

Anti GDPR people: "it's so complicated not being able to walk into someone's house and take their things! Which things can I not take? How about this? And now I need a lawyer if I take someone's things? Ridiculous!" Just don't spy on people.

Yeah that's pretty much what it feels like, or sometimes it's "what if someone's stuff is lying on the street? Can I take it then?" and the regulator is kind of like "look around and ask if it belongs to anyone, and if not, sure".