Study: Google is the biggest beneficiary of the GDPR

https://cliqz.com/en/magazine/study-google-is-the-biggest-beneficiary-of-the-gdpr

by kkm • 8 years ago

191 135 8 years ago

VMG• 8 years ago

But who could have known?

davidhyde• 8 years ago

The author of this article didn't bother to read even a summary of the GDPR law. It doesn't matter what the user consents to, you cannot use their personal data ad hoc. You need to justify its collection, storage and transfer to the regulator, not the user. This is in contrast to the ill thought out cookie law where websites could get away with it by irritating consent banners.

Sort of like, but not exactly the same as, those consent forms you sign when you go river rafting. They do not legally protect the rafting company from negligence. In fact, they're almost a waste of paper.

sarabande• 8 years ago

I bet rafting consent forms are still useful in the sense that they discourage most people with trivial-to-moderate injuries from thinking about holding the company liable.

justtopost• 8 years ago

Same as 'Stay Back 500ft, Not responsible for damage' signs on the back of gravel trucks. Youd better bet they are 100% liable for anything that flies out. But it discourages the unmotivated and the uneducated from seeking their entitled legal relief.

ghaff• 8 years ago

As someone who leads outdoor trips, I've been told (not sure how true) that one of the supposed benefits is that it informs about dangers. So someone who suffers an injury--not through negligence on the part of the trip leader--would have a tougher case arguing that no one told them that the activity was other than completely safe and they wouldn't have done it had they known.

On the other hand, I've also been told by lawyers that the usual scrawl your signature at the bottom of a paper after a quick glance probably doesn't make much of a difference.

paganel• 8 years ago

It doesn't matter what the user consents to, you cannot use their personal data ad hoc. You need to justify its collection, storage and transfer to the regulator, not the user.

I think one of the points is that there are very few companies that have the financial resources to do that, one of those companies that can afford it being Google. The next retort is "but then those companies should stop using trackers all-together" which leaves most of those companies that don't have Google's financial resources without ad money, meaning they're most likely to go out of business, practically creating an oligopoly where a handful of companies control most of what's published on the Internet. Granted, we would have gotten there regardless, only that legislation like GDPR is accelerating this process.

rypskar• 8 years ago

but then those companies should stop using trackers all-together

Yes, why do they have to track their users? Why don't use real targeted advertisement instead? If I go to a car forum, car related ads would be relevant for me. Using ML, tracking and profiling to give me ads for the fridge I did buy last week is not relevant

nwellnhof3• 8 years ago

It doesn't matter what the user consents to

That's not entirely true. If a user really consents to being tracked for advertising purposes, the GDPR allows tracking. Whether the consent banners inform users honestly about the extent of tracking is another question. I think they don't.

What's worse is that Google still tracks users by default, even if they never visited an actual Google property, let alone have a Google account. That's an obvious violation of the GDPR but Google will probably try to shift the blame on publishers.

mtgx• 8 years ago

I think the biggest issue with GDPR so far is enforcement.

It's still early days, but many companies don't even follow GDPR as they're supposed to, including Google and Facebook. That will only be settled after an enforcement wave against both large and average-sized companies (GDPR is more lenient towards small companies).

brennebeck2• 8 years ago

Somewhat tangential: have you seen GitLab’s notice? And what’s your opinion of that style, as far as informing/consent?

kruczek3• 8 years ago

If a user really consents to being tracked for advertising purposes, the GDPR allows tracking.

That's not exactly true either. For the consent to be valid, it must be freely given - that is:

1. The user must have a choice to give consent or not give it

2. The service provided should be the same regardless of #1, unless the consent is necessary for the service (e.g. consent to store address for delivery of goods - although in such case this shouldn't really be based on consent)

Unfortunately many sites either do not give opt out at all, or make it hard to find it - in such cases consent can't really be considered to be freely given.

kristianc5• 8 years ago

This was always going to be the case. Google benefits from having a direct relationship with the customer, meaning that consent is relatively trivial to get. None of these third party tracker companies have that relationship, so rely on securing opt ins on a piecemeal basis. This is why a large number of the third party tracker companies all shut up shop in Europe in the months before GDPR.

Drakim5• 8 years ago

If I go to a random website and they serve third party google ads, I don't have a direct relationship with Google in that scenario. It's not enough to say that because I have a gmail account I consent to being tracked all over the web on every website.

kristianc5• 8 years ago

You don’t have a GMail account, though, as there’s no such thing as a GMail account. You have a Google account, and GMail is bundled in as a service.

FWIW - ‘tracked all over the world on every website’ also comes with some significant caveats.

blub2• 8 years ago

From what I've heard from people with Google and FB accounts, both basically ignored the law and presented their users with take it or leave it pop-ups on their online properties. That's why they're getting sued...

mattlondon2• 8 years ago

Are they getting sued? I'm not aware of any GDPR-related cases against Facebook or Google so far?

icebraining4• 8 years ago

https://www.irishtimes.com/business/technology/max-schrems-f...

lucian1900• 8 years ago

Not terribly surprising.

The purpose of GDPR wasn't to hurt large companies, but to protect citizens.

maltalex• 8 years ago

Market share is only part of the picture. What happened to the size of the market in the EU after GDPR?

ericdykstra• 8 years ago

Is there any evidence of GDPR having the desired effect for which it was put in place? Is citizens' data being protected more than before?

The second-order effects that everyone predicted are already happening (big tech companies change nothing significant, many small companies shutting down).

The long-term and unforseen second-order effects have yet to bear fruit, as far as I know (please let me know if you've seen anything).

louhike• 8 years ago

It's just my personal anecdote, but I'm happy to be able to choose which cookies can be used. And when I see the changes the companies I worked with and the comany in which I work had to make, I think it's a good thing. People are more cautious with how they use the data of users now.

Brotkrumen• 8 years ago

Yes, the amount of tracking cookies is declining.

https://www.techradar.com/news/gdpr-sees-cookies-crumble-on-...

The shutting down of companies is a desired effect, because those are the companies that won't get consent. Data resellers for example that dont provide any advantage tto the user.

We haven't even seen the actual effects yet because google Facebook et al are probably in violation and are waiting to be sued to fight it out in courts

yardstick2• 8 years ago

One nasty side effect is some large organisations are shutting out Europe. I can no longer access severs popular US based sites and instead get messages about the content not being available in your region. (Most recently: latimes.con and fox8.com)

Cthulhu_2• 8 years ago

That's also fine - was their content worth your privacy? If they can't be GDPR compliant we don't want them.

wongarsu• 8 years ago

One positive effect you can already see: people think about privacy laws. Most of the GDPR was already law in various EU countries, just largely ignored by everybody. GDPR gave the laws more teeth and publicity.

For real improvements, we will have to wait a few years to find out what and who regulators will persue for violations, and how the courts interpret the GDPR. If regulators never look at small companies, the second order effects on small companies will vanish. If regulators miss to successfully prosecute the obvious violations by tech giants, no meaningful effects will stay at all. It all comes down to what regulators will do, and it's way too early to tell.

thefounder• 8 years ago

More companies go public when they get hacked

nwellnhof3• 8 years ago

The GDPR isn't only about the Internet economy. It affects offline businesses as well. You start to notice things like a plumbing company asking for consent to use your contact data on a paper form. The fact that people think a lot more about data protection and privacy is a good thing in itself.

stordoff• 8 years ago

It's led to one company I use supporting (and forcing) HTTPS. They should have been doing it before, but it's still a win. They've also stopped asking for addresses, and are removing existing addresses:

To reduce the amount of personal data we process for you, we have stopped asking for address, city, state and zip code in our shop (we do not ship physical goods anyway). Also, we are in the process of removing all existing address information from our customer database.

cribbles• 8 years ago

One effect I haven't seen mentioned yet is that EU data subjects can permanently delete their Facebook accounts, along with all associated data. (Previously you could only indefinitely 'deactivate'.)

stanislavb• 8 years ago

Anyone surprised? It was clear since the beginning that that’s going to happen...

vbsteven• 8 years ago

If I read that graph correctly the number of trackers per page has gone UP 20% since April in some categories for US visitors.

akerro• 8 years ago

But it went down in the EU, so I guess they need to make more money on tracking and profiling somewhere else now.

TekMol2• 8 years ago

Plus it knocked a lot of potential competitors off the internet.

I know multiple young startups and entrepreneurs in Europe that killed their projects/ideas because the additional burden of coping with GDPR was too much for them.

robin_reala2• 8 years ago

Really? Because I haven’t heard of any, and I live and work here. Any sources?

TekMol2• 8 years ago

They are young single founders in the idea or mvc stage. So nobody that is mentioned by any sources.

mocae• 8 years ago

Like who?

Seriously. Besides that one blogger who was screaming because he didn't even want to bother with the help wordpress provided, I did not hear of a single person/company that quit because of that.

It would also be quite embarrassing considering the time you had to prepare, the help that is all over now or the fact that nobody seems to enforce it. Especially for businesses.

pmiller26• 8 years ago

Here you go: https://www.theguardian.com/technology/2018/may/24/sites-blo...

First hit from a google search for “GDPR shut down”.

Cthulhu_2• 8 years ago

It's not that big a burden - just have an officer and don't collect certain types of data without the user's consent. If you can't do that minimal amount of effort and either ensure the user's privacy, or get the user's consent, then you shouldn't be in the business.

It's like complaining about how new credit card businesses or banks can't just start up but need a load of compliancy. That was tried with cryptocurrencies and billions of user's monies was lost due to poor security and scummy companies.

pmiller26• 8 years ago

You really don’t think having a data protection officer (even if not a dedicated one) isn’t a significant burden to a tiny business?

seszett• 8 years ago

I've read that many times here, but it's weird because I don't know any. None of my neighbours, clients or partners have had any significant problems with GDPR, in a kinda large tech complex in France (with about 300 startups, though of course I don't interact with all of them).

Maybe you mostly have relations with startups that work in the ad industry?

DomreiRoam• 8 years ago

In France, the CNIL did already enforce constrains on data management. The GDPR could be seen has an enhancement of current constrains/laws.

realusername2• 8 years ago

Why would they give up specifically because of GDPR? It just makes no sense, there's thousands of regulations already on all the parts of the day-to-day life of running a business, I wonder how they planned to manage the rest of them.

icebraining4• 8 years ago

Seriously. The Data Protection Directive alone already included most of the GDPR.

hannasanarion• 8 years ago

Sounds like you need better friends.

The only way GDPR could kill a business in the conception stage is if the business model was to secretly collect user data and sell it for profit. A business that can't get started due to GDPR is a business that never deserved to exist.

anoncake5• 8 years ago

Saying Google is the biggest beneficiary is grossly misleading. Their reach increased by a whopping 0.9% while everyone else's declined. Even if reach is the only relevant metric, that's hardly worth talking about.

The actual biggest beneficiaries are the citizens whose data is protected.

oytis4• 8 years ago

Über-fucking-raschung. Regulation is beneficial to big companies.

anoncake5• 8 years ago

Meanwhile, little players like looks at diagram Facebook lose.

oytis4• 8 years ago

Too much has happened to Facebook recently to really assert connection of decline with GDPR.

mattlondon2• 8 years ago

Is Google the biggest "beneficiary" here, or is it more that a lot of shady operations were totally shafting people on their data/privacy and so they've finally had to close down or expose themselves to massive legal risks?

The significant drop in trackers on EU sites reported here (and not a huge surge in Google trackers on EU sites) suggests to me that it is other adtech/tracker companies that have lost, rather than google gaining.

Either way, it is good to see some hard figures on tracking being rolled-back a bit. Now we just need some enforcement to fix the badly-implemented consent-walls (e.g. slate.com).

buboard• 8 years ago

it is google because they have the largest pot of data which allows them to very granularly target you with confidence. Whatever data the shady small business had, it was probably partial, old and outdated.

wastedhours2• 8 years ago

You're not looking for a surge from Google though - they're already the 1000lb gorilla, what you're looking for is the limitation in competition, which is what's occurring.

As with a lot of EU digital regulations, they're essentially centralising power to organisations who have the legal resources to either go through the process (and find loopholes), or the cash to fight it.

A lack of competition in the tracking space won't really mean the practice will disappear, but that the organisation who has the biggest consent database will take all the money by default.

I might be biased as a marketer, but I'd prefer to have multiple small companies who're tracking limited pieces of info about me across different parts of my web experience (and who may fuck up occasionally), than one huge company knowing 100% of my information.

(Edit: as a side note, the linked article is doing something shitty with the scrolling on the site, which is more annoying than semi-targeted advertising to me...)

blub2• 8 years ago

The multiple small companies tracking limited pieces of info about you would anyway be happy to sell and share that for money, this is partly how those huge DMP databases are built.

pmontra3• 8 years ago

Offtopic: am I the only one to see the optical illusion of the 0% line bendin upwards to the left in the "change in the number of trackers per page, by category, EU vs US"? [1]

[1] deep link: https://static.cliqz.com/wp-content/uploads/2018/10/trackers...

pantulis• 8 years ago

No, you're not.

rectang• 8 years ago

The biggest beneficiaries of the GDPR are individual citizens.

But that doesn't even enter into the tech industry zeitgeist, where commentators are enthralled by the bloodsport between corporate champions and the lives lived by actual humans are incidental and inconsequential.

raziel414• 8 years ago

I'm not surprised. I used to work on a team at Google that had to deal with GDPR (I still work at Google, but on a different team), and we had to get legal review for a lot use-cases. For example, we had a backup system that took snapshots of our user-provided data. If a user requested their data be purged, should we purge all the backups as well?

Since we had legal counsel in house, it wasn't too terrible. For a smaller company that doesn't have those resources though, GDPR compliance must have been a huge burden.

Angostura3• 8 years ago

You know what? It's only a huge burden for organisations that process a lot of personal data in a variety of interesting ways.

pmiller26• 8 years ago

I disagree. The sheer magnitude of fines that can be imposed makes the potential damage huge, even if the probability of being hit by them is small. This makes the risk of noncompliance high.

Matticus_Rex3• 8 years ago

As someone leading the privacy program at an organization that doesn't have that much personal data (relative to most businesses in our industry at least, and probably overall) and doesn't process it in particularly "interesting ways," I strongly disagree. The GDPR was and is a huge burden. You can believe that it's worth it without engaging in the fantasy that it's not burdensome, but don't deny the reality of the burden.

pmiller26• 8 years ago

More generally, I am wondering: how do smaller companies go about even attempting to comply with the GDPR? The “head in the sand” approach of simply not serving requests to people physically in the EU doesn’t work for a number of reasons, and I don’t see how you can even sell anything on the internet without being within its reach. (Of course, now that I think about it, how is the EU going to fine a small business in the US that has no overseas operations?)

Are there any resources for small businesses in the US that want to protect themselves from onerous fines the data regulators can impose? How can they even begin to assess the risks of noncompliance?

Angostura3• 8 years ago

From the final paragraph of the article

In the end, users should never only rely on laws and regulations such as the GDPR to protect their privacy. Instead, they should be aware of who they are providing which data to.

Ignoring the fact that GDPR is primarily a regulation ensuring that they know who they are providing which data to, and ensuring they have a choice about providing it.

tpush• 8 years ago

Yeah, I wouldn't trust this source on anything privacy related.

They present themselves as user privacy champions but primarily make money via, you guessed it, advertisements.

They are owned by Burda, a large German media organization who, again, make money by advertisement and processing of their user's data.

"We’re breaking new grounds when it comes to developing our business model. Bringing together targeting and privacy, we are currently testing a technology which allows companies and brands to show you relevant offers directly in the browser."[0]

[0] https://cliqz.com/en/about

rbinv• 8 years ago

This is also the company that acquired Ghostery.

hddherman• 8 years ago

And also the company that caused quite a stir when they partnered with Firefox to carry out a study, which included collecting and sending browser data to Cliqz servers.

edwhitesell• 8 years ago

That explains why the latest Ghostery update on Android was so terrible. It lost all of my tabs and had 3 different places to disable some form of tracking.

bjoern_cliqz• 8 years ago

Hey, Björn from Cliqz here. Great to see the post has generated some interesting discussions on matters of privacy, compliance, and as you point out - business models.

Cliqz never has collected any personal data on its users, and never will. Over the course of the last 4 years, we started building a private search engine, to only realize that if we are to truly offer a usable alternative to navigate the web privately - we had to do much more. So we quickly found ourselves building an anti-tracking technology, anti-phishing, and anonymous rate limiting using Direct Anonymous Attestation. This research has been published / presented in the WWW Conference, Crypto and Privacy Village at DEF CON and CCC's Privacy Week.

We have packed all these technologies in desktop and mobile browsers. This is what we do and it's what got Mozilla interested in Cliqz, and why they are an investor, just like Burda Media. All the technologies we have built share 2 attributes:

1. None collect personal data

2. Rely on client-side logic (computers are powerful enough these days to be used for more than display interfaces)

Offers is part of how we monetize (we're exploring paid products too). Like any other technology at Cliqz, they share the same 2 attributes (No personal data, all triggering logic resides in the client). The code is open sourced here [1]. You can read a high-level description here [2].

We believe our approach is a healthy alternative to monetizing products on the web. At all times we allow the user to control what features from Cliqz they want to use; including offers. We understand there are plenty of reasons to be frustrated with the state of the web (we are too) - but blatantly rejecting any business model that brings privacy-preserving products to the market is not healthy.

[1] https://github.com/cliqz-oss/browser-core/tree/master/module...

[2] https://cliqz.com/en/cliqz-angebote

jansan• 8 years ago

What I am still missing from Google is a clear instruction that explains how to adjust the Analytics settings to be 100% compliant with GDPR. The fact that this is missing made me decide to drop Google Analytics in the foreseeable future.

yuhong• 8 years ago

There was another HN thread with BrendanEich in it talking about this: https://news.ycombinator.com/item?id=18119367

virgilp• 8 years ago

Although the number of trackers is decreasing overall, a few large tracking operators such as Google receive even more user data.

This won't be a popular opinion here, but... it's actually good news/ what you observe is GDPR protecting user privacy. You think that Google is bad? Then, you probablly haven't seen the smaller players. With e.g. Mouseflow, you can literally watch users enter their personal email in your "register account" field, then change their mind and use a disposable account. Or glean other kind of sensitive details (passwords too, I think).

sleepyhead• 8 years ago

"WhoTracks.me is a joint initiative of Cliqz and Ghostery. It provides structured information on tracking technologies, market structure and data-sharing on the web and thus creates more transparency. On the WhoTracks.me website, interested parties will find visualized monthly tracker statistics. They are based on the evaluation of around 300 million-page loads and more than half a million websites."

Considering IP-address is considered personal information it sounds like this study is based on data that was illegally collected according to GDPR.

Vinnl• 8 years ago

I assuming the data was collected through the Ghostery browser extensions, which requires explicit opt-in to share that data.

arountheworld• 8 years ago

I was looking at a couple of non technical friends browsing the Internet. Not one took time to read consent prompts, they just mindlessly click whatever takes the notice out of the way. GDPR is dangerous and doesn't fix anything.

PunchTornado• 8 years ago

The average number of trackers per page has dropped by almost 4% from April to July. The opposite is true in the US: there, the average number of trackers per page has increased by 8 percent over the same period.

since when is this a bad thing? i want my page less bloated with 100 trackers...

awkward• 8 years ago

I'm surprised at the US number of trackers count - I would have expected some degree of free rider benefit for US based consumers. Otherwise, the numbers seem to bear out some consolidation, with web pages giving up trackers but more likely to hold onto boutique solutions (the ranked <150 group) for specialized needs.

tveita• 8 years ago

Oh no, not the smaller advertising trackers.

This is interesting data but I'm not sure it supports the title - It shows Google's market share in the EU going up a tiny bit, but total tracking goes down in the same period, while the baseline is probably runaway growth like the US. Google may be hurt the least, but I doubt they're a "beneficiary" in economic terms.

It's a shame Project Wonderful just shut down - it felt like the kind of project that the GDPR should help. There must be a market for content-based, non-tracking ads that you can put up on any website without GDPR concerns. Google can and will fill that market, but since they can't lean on their global panopticon other ad providers can compete on fair terms.

From Project Wonderful's shutdown notice:

Some advertising networks have held on by adopting more and more invasive user tracking, forcing their publishers to sign binding contracts, or by trying to train publishers (and readers!) to expect that "sometimes a bad ad will sneak through", but that's something we always refused to do. We believed - and still believe - that you deserve better. We believed - and still believe - in a world where an ad blocker wouldn't be an obvious thing to install, because advertising would be good, interesting, and non-invasive.

obmelvin• 8 years ago

Google may be hurt the least, but I doubt they're a "beneficiary" in economic terms.

So, relatively Google is the biggest beneficiary.

ucaetano2• 8 years ago

Google may be hurt the least, but I doubt they're a "beneficiary" in economic terms.

Quite the opposite, if you pass a 20% tax on every company, except for Google, who gets a 10% tax, it is a beneficiary.

Everything is relative.

kerng• 8 years ago

Yeah, beneficiaries are the end users and their privacy being worth something now. Which is something that wasn't the case before.

oh_hello• 8 years ago

Outside of the specifics of this article, I've wondered what effect GDPR has had on smaller companies and even individual developers. My company spent a lot of time and money to become compliant. Not only was this expensive, but we relied on lawyers to advise on where we could draw the line for compliance. If the company were a bit smaller I imagine it would be impossible to tackle this project.

Study: Google is the biggest beneficiary of the GDPR

Related Stories