A small French privacy ruling could remake adtech

https://techcrunch.com/2018/11/20/how-a-small-french-privacy-ruling-could-remake-adtech-for-good/

by gbugniot • 8 years ago

250 160 8 years ago

gnud2• 8 years ago

In plainer English, this is being interpreted by data experts as the regulator stating that consent to processing personal data cannot be gained through a framework arrangement which bundles a number of uses behind a single “I agree” button that, when clicked, passes consent to partners via a contractual relationship.

Now, I guess it's obvious to complain about the idiotic, user-hostile and down-right evil Oath consent pop-over that I got when I visited TC. I'm gonna do it anyway.

Here's hoping this ruling stands.

peteri2• 8 years ago

I haven't read techcrunch or any site with that oauth pop-over since GDPR came in. It's super obnoxious.

gnud2• 8 years ago

Pretty sure it's not OAuth, but Oath.

Also pretty sure they named the company Oath so that people would think "oh this is another OAuth permission box, OK".

karrotwaltz• 8 years ago

When GDPR popups started appearing, I modified my Kill Sticky bookmark-script to also re-enable scrolling. Works most of the time for any kind of popup.

Here's the script: https://pastebin.com/NfCyDLw8

shakna2• 8 years ago

It's even more ironic in French [0], here we have a single click "I agree" button, in French, covering up a reading about a French ruling that suggests it's worthless.

[0] https://shakna.keybase.pub/oath_techcrunch.png

ElBarto• 8 years ago

That is really horrible.

It says "Select 'OK' to authorise 'Oath' and our partners to use your data."

Is there a more general, less specific, way to phrase this? It's basically "please let anyone use your data for anything".

Nursie7• 8 years ago

Of the dark patterns I've found in this space, theirs is the worst so far. They hide away what they plan to do, and if you start digging in to try to find controls... well good luck, I haven't found any. You can get to all sorts of policies, various login pages and lots of spurious info, but as yet no controls.

Other dark patterns I've seen are -

A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them (though they of course have a handy 'enable all' button).

A page gives you a big green "Accept All" button, and a 'reject all' option which looks greyed out and is smaller. When pressed it takes you to another dialog with a big green "Go Back" button and another, smaller, dimmer link for "Leave". The "Leave" link is the one that gets you back to the page, rejection preference intact.

These seem contrary to the spirit of the GDPR, I guess we'll see in time if they are deemed to contravene the law. The TC/Oath one definitely seems to be over the line.

--edit-- Missed one - A page allows you to set various controls and sliders to reject its data sharing, but then sits for several minutes "processing" your lack of consent. When it eventually completes you get a message saying that they don't have a version of the page they can show you without the data sharing cookies, so sorry, please check again in a few months.

cr1895• 8 years ago

A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them (though they of course have a handy 'enable all' button).

I see this often too. Doesn't this directly contravene the text of the GDPR, much less the spirit of it?

dspillett2• 8 years ago

A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them

Some of which are marked as "opt-out through partner", with no link or other details about how one would do that.

While the trackers are making it a faf to opt out (rather than as the legislation actually required: making it an opt-in situation) I'll just keep on with my side of the arms war that is ad-blocking. Their loss, not mine. I can't say I feel I've missed out on anything by sites failing/refusing to display with ads blocked, links that redirect through trackers not working at all, or just plain backing out of sites that are obnoxious (and in breach) with "by continuing or closing this banner..." and other such.

scoot_718• 8 years ago

Yup. No more contracts to provide services. France is idiotic.

icebraining5• 8 years ago

Contracts are fine. You just can't pay with your first-born, your freedom or your private data.

fraserharris• 8 years ago

The stronger GDPR is interpreted by the courts, the stronger Google & Facebook's oligopoly is. To compete as an ad network you will first need to have consented first-party data at scale - in other words, a (or network of) website/application that a majority of European's visit daily.

kryptiskt• 8 years ago

Google and Facebook relies on other collecting consent on their behalf, lots of Google business takes place on other sites than their own, this is trouble for them too.

shakna2• 8 years ago

That doesn't seem to be the case here. In fact, Google asking other's to collect consent, and then performing auditing, may well not be considered compliant after this ruling.'

The requirement based on the article 7 above-mentioned isn’t fulfilled with a contractual clause that guarantees validly collected initial consent. The company VECTAURY should be able to show, for all data that it is processing, the validity of the expressed consent.

Google hasn't first-party consented through each of the publishing contracts. They may be able to turn it around.

However, the industry would now favour someone who had no need to collect consent, if we're just talking about the base ability. The ad-world's dependency on personalised data is a problem, and may continue having issues with the GDPR.

candybar• 8 years ago

I think you're confusing Google's ad-tech platform (DFP and such) with Google's actual primary business as a publisher. Google's ad-tech business competes with other ad-tech platforms and provides services for other publishers to monetize their inventory. This is a relatively small part of their overall business that they could live without and Google the publisher doesn't need any of that to stay massively profitable. Google's own inventory would certainly be more valuable in a world where Google's ad-tech platform could not effectively help monetize other publishers' inventory.

simias• 8 years ago

That's the drawback indeed. That being said overall I'm not sure I'm willing to lament the loss of potential innovation in the profiling industry. Have people compete by offering different monetization schemes.

Furthermore I personally don't use Facebook and only rarely Google so I don't really care about that, everybody is free to decide the first parties they use or don't use. If people find value in these services and use them over the competition is it really unfair that they benefit from it?

Meanwhile third party trackers are on most websites these days so I actually benefit from regulation in that sector because otherwise I simply cannot opt-out of that tracking (unless I manage to block them all with extensions but it's virtually impossible to catch them all).

So IMO this regulation puts the power back into the hands of the users, they decide who gets access to their personal data. That's valuable.

aaaaaaaaaab• 8 years ago

Then maybe stop using our personal data for advertising? DuckDuckGo can do it, so why can’t you?

dspillett2• 8 years ago

the stronger Google & Facebook's oligopoly is

Blocking a few big players is easier than blocking many small ones, so from the point of view of blocking ads until the advertisers stop being shady this might no tbe a bad thing.

If the ad/tracking industry wants me to play the game their way instead of not at all, they need to start playing by decent rules which includes following GDPR's various stipulations.

fyfy18• 8 years ago

Good. I always saw the intention of the GDPR as legislation to fundamentally change the way personal data is processed, to prevent the freely spreading of it, with blatant disregard to the consequences, by basically any company that handles personal data. Instead most companies have just opted for clickwrap consent, and continued as they always have.

The more rulings we have like this, the better. Yes it may cause some business models to disappear, but I feel it's worth it to take back control of our privacy.

isostatic5• 8 years ago

Yes it may cause some business models to disappear, but I feel it's worth it to take back control of our privacy.

Good, hopefully we'll see some real innovation, with wide spread micropayments, rather than brainwashing which costs the viewer of the site far more than the recipient of the site gets.

fabricexpert4• 8 years ago

wide spread micropayments

I see this on HN a LOT, but I am really not sure it's a great model. The thing about ad-supported revenue is that you can still consume the content if you can't afford it.

I'm simplifying a little, but the people who convert on ads are basically subsidizing the content for the rest of us. In our society the people that fall into the conversion group are generally wealthy and the people who fall into the latter group may or not be.

But the point is that with micropayments only the rich have access, and with ad-supported revenue everyone has access. I think most people prefer the latter.

apatters• 8 years ago

I think micropayments are a classic example of a solution that seems sensible to engineering under the assumption that humans are rational beings, but in the real world it falls apart because they aren't.

The hardest part of making a sale isn't the price--it's getting the customer to say yes. With micropayments you ask the customer to say yes every time they click a link. This imposes a cognitive/mood/whatever penalty every time they consider viewing your content. No wonder it hasn't taken off.

A better solution from a market psychology standpoint would be to sell an all access pass to the content on 10, 100, or 1000 websites. Monthly auto rebill. Just one purchase decision for life and with enough sites the perceived value is high. Not sure why we aren't seeing more of this -- if anyone works at a media conglomerate feel free to reply :)

ankit2193• 8 years ago

I think something like the concept of reddit gold can work on the content/news sites as well. At its core, its about the ones who liked/found the content useful can reward it with some payment.

Usually, in most of the business models, your most heavy users tend to subsidize/bear the cost of not so heavy but casual users. At the very core that is. For adverts it fails, since the heavy users are of less value than the casual ones. (how many times you can show the same ad to a user? Also, they are well trained on how to look past the ads).

With gold-like concept, great content is rewarded, and incentivized as well. Also, given the scale of reddit, it works really well (along with ads) but not too sure how well it will work with ad dependent publications.

tzs• 8 years ago

Good, hopefully we'll see some real innovation, with wide spread micropayments

Micropayments raise difficult tax issues, especially for small sites.

In the United States, for example, if I've counted correctly 34 states require or will require by early 2019 out of state sellers of goods or services into the state to collect, report, and remit that state's sales tax. Another 13 states could do so, but have not yet amended their laws to require it [1]. 4 have no sales tax at all. (I'm counting DC as a state here).

Whether or not a state actually can force this on a given seller depends on whether or not the seller has a "nexus" with the state. 24 states' laws say you have a nexus if you have 200 sales a year in the state or sales in a year totaling $100k.

With micropayments, a site could hit 200 sales in a state easily and have to deal with sales tax, while only earning a small amount of revenue. For example, suppose your site accepted micropayments for reading articles. Say you did $0.05 per article. If 200 people in a "200 or $100k state" bought articles, that would $10 revenue.

Congratulations...you have to collect tax on that! Worse, tax depends on exactly where the person lives in the state. You have to get their address, and lookup the tax based on that. Going just by state, or even just by zip code within the state, is not sufficient as you might collect too little [2]. You also have to file quarterly tax reports, which have a filing fee in most states, which will almost certainly swamp your $10 revenue.

There are services you can use to do this for you. 24 states have banded together and formed a Streamlines Sales Tax group (SST), letting you register and file and remit taxes for all 24 through a single entity, and they have agreed to provide tax data (rates and tax district boundaries) in a common file format. Even better, if you agree to collect tax for all 24 of those states, then the states will pay the costs of you using any of several third party tax services companies (Avalara, TaxCloud, TaxJar, and a few others), including the costs of using those company's APIs to handle all the lookups up and calculation, and the costs of preparing and filing the reports.

Unfortunately, there are some big states that are not part of SST. California, Texas, Pennsylvania, Illinois, Colorado, New York for example. CA, TX, and NY don't collect on out of state sellers (yet), but those others do.

Avalara, TaxCloud, TaxJar, etc., can handle those states for you too, but that won't be free. TaxCloud, for example, if you use their "automatic compliance" plan, which requires collecting tax in all the SST states (so that the SST states pay TaxCloud), you can add non-SST states for 0.5% (less for large volume sellers) of your revenue in each such state, and that will cover address verification, tax lookups, reports, and filing. (No affiliation with TaxCloud. I just happen to be using them for my first attempt to get our site at work to handle out of state US sales taxes--before we had just been collecting for sales in our own state and collecting VAT for EU sales. VAT is vastly simpler since it is per country, and the EU has something equivalent to the US Streamlined Sales Tax called VAT MOSS, so VAT was pretty trivial to deal with without needing an outside service).

Anyway, all of the above probably will dampen interest at a lot of sites. Especially having to collect address information to calculate the tax. That raises privacy issues that I think many will find more troubling than the current ad site privacy issues.

[1] It was only in the middle of this year that it became legal for states to require out of state sellers to collect. In 1992, the Supreme Court had ruled that it was unconstitutional for states to do so, unless Congress specifically authorized them to do so. Congress never did so. But this year, the Supreme Court revisited that issue and decided that it is OK, after all.

[2] Realistically, the state probably won't come after you for the difference or penalties, but it is a risk you need to evaluate.

nothis• 8 years ago

I hate the "cookie law" for this very reason. It just resulted in more popups which became at best white noise, at worst a genuine annoyance for users. Cookie-consent popups are a part of most ad-blockers, which should make you think.

Instead, the end result should be less abuse and hoarding of data. In other words, ad services should be held accountable for what they collect, not just inform users that they collect your data. Cookies are actually the one thing you can control, it's in your browser, it's not the problem, you can block or delete the data. What should be regulated are what companies store server-side and how they connect that data and that should be done between the government and the companies, not between the company and its users who might not have the expertise and, in many cases, are stuck with some quasi-monopoly like Google or Facebook.

LiterallyDoge• 8 years ago

Of course. But if you recall when you first learned about information security, it would likely involve cookies. Probably the general population is going through that kind of adolescent awakening that we did when we were 10 or so, they just took longer because they sit on the shortbus in comparison.

bad_user• 8 years ago

People confuse GDPR with ePrivacy.

GDPR is not about cookies and it’s not about mere informing of users, but about getting consent for data processing. Publishers and service providers are required to ask for consent, with clear language and the default is opt-out.

Also from what I understand you can’t block users from using your service when they opt out of any data purpose that isn’t legitimate and the definition of legitimate data purposes is very narrow. For example it doesn’t really matter that ads profiling is how the company makes revenue, making more money is not a legitimate interest.

Some companies, like Facebook, are of course trying to resist this. But I’m pretty sure they’ll end up with big fines.

On popups, IAB’s specification uses the consensu.org domain for the cookie, so that consent can be shared between multiple domains. A publisher cannot share that consent with other publishers in case the list of partners used is custom of course, but you can still share it between your own domains. The purpose being to minimize the popups.

Given that publishers have a legal obligation to get the user’s consent, I strongly believe that ad-blockers blocking GDPR popups is legal trouble for both publishers and ad-blockers.

Blocking ads wasn’t deemed illegal thus far and it wasn’t for a lack of trying. Blocking GDPR pop-ups on the other hand will imo not have that same fate.

Also some users will legitimately want to have their data used for personalization and you can’t regulate against that.

This might be an unpopular opinion however given the choice between personalized ads and a paywall, I predict that most people will choose personalized ads.

kodablah4• 8 years ago

I always saw the intention of the GDPR as legislation [...] Instead [...] The more rulings we have like this, the better.

How many examples do we need to recognize that legislation like this on the internet, well intended it may be, doesn't solve the problem? Why do we watch an approach continually fail and tell ourselves that we must continue that approach? Insanity and foolishness. One day I hope people can separate what they want and what they can get, but in the meantime, I guess smaller businesses will just continually fret over regional compliance with unnecessary and unbeneficial societal costs. This ruling isn't going to change much except increase internet balkanization against EU. You shouldn't decry the workarounds, you should accept responsibility for them.

(I've talked about it on this board ad nauseam so I won't make a long rant here, but in general there are other approaches or even more practical ones with legislation you can take if government interference in this medium is absolutely required which is debatable. You can't just look at other regulated sectors and magically apply that logic everywhere.)

tjoff5• 8 years ago

Well, GDPR is a massive win and has helped tremendously.

That many sites isn't yet compliant is expected but I actually notice that sites do improve the UX (as in, won't try to force you to consent as strongly).

Though I didn't opt to read this article because it is behind oath.

paulddraper• 8 years ago

Instead most companies have just opted for clickwrap consent, and continued as they always have.

But isn't that what people want to do?

Why can't I sell my personal data in exchange for services? It's mine isn't it?

tuacker• 8 years ago

I have a feeling the reason why most companies just went with the clickwrap consent is because there isn't really an alternative right now. And it was the path of least resistance ('just add this popup and you're good') to 'conform' with GDPR.

I'm about to have skin in the game as I'm working on an alternative (https://www.adsfromsource.com). Goal is to make advertising more respectful, both in regards to data privacy and in disallowing abusive/misdirecting/etc. ads.

downandout3• 8 years ago

Yes it may cause some business models to disappear

You’re talking about ~95% of Internet publishers and platform providers. Fortunately GDPR doesn’t apply to US sites that don’t “envisage” serving EU customers (see Recital 23). So those of us in the US will have the resources to keep publishing and innovating. But most companies/entrepreneurs that have to actually comply and aren’t big enough to essentially force users to do our bidding (Google, Facebook, etc) are going to have to close up shop.

Nursie7• 8 years ago

Perhaps ironically, I can't access this article because I'm unwilling to just click "OK" and allow TechCrunch to pass my data to all and sundry, and their 'controls' links lead to a warren of pages at their parent company's site, and eventually to some sort of login page, with no controls in sight.

In apparent contravention of the GDPR, various parts of the page say that I must agree to their use of my data for third party advertising or I cannot access the site.

Semaphor• 8 years ago

FWIW, TC works perfectly well with the default uMatrix config (as in block everything third party) and only sets a single, empty session cookie.

exergy2• 8 years ago

uMatrix is a life changer. No one can understand the sheer scope of how much one gets tracked until you log into a random article on the internet where bloody Pinterest or LinkedIn scripts and cookies are present. It's maddening, and uMatrix is amazing.

laurent123456• 8 years ago

I'm wondering actually, is there any browser extension that would get rid of these popups (as well as all these "we use cookies" useless banners)?

nephrite• 8 years ago

Switch off JS or use uBlock - it can block arbitrary elements in any page, and works in two clicks.

downandout3• 8 years ago

In apparent contravention of the GDPR, various parts of the page say that I must agree to their use of my data for third party advertising or I cannot access the site.

They can say that they have a legitimate interest exemption - and they do. Sites must be able to earn money from their content, or they cannot operate. Therefore, they have a "legitimate interest" exemption for this practice (allowed under GDPR) - they cannot provide you with the service you requested because you are unwilling to help pay for it by allowing third party ads.

Edit: By the way, none of this addresses the other elephant in the room. TechCrunch is US based, and to my knowledge they do not offer foreign language translations of their site, at least on the .com version of the site. This meets the test under Recital 23, which says that if it doesn’t “envisage” serving EU users, it isn’t even subject to the GDPR. Any privacy notices on TechCrunch.com are essentially a courtesy.

hadrien013• 8 years ago

It has nothing to do with showing ads or not, it's about the use of your data to show "relevant" ads. Publishers can still show ads.

Nursie7• 8 years ago

They can say that they have a legitimate interest exemption - and they do

They don't. That's not a legitimate interest. Making money from the data is not covered and if it was then the entire law would be moot.

they cannot provide you with the service you requested because you are unwilling to help pay for it by allowing ads.

You missed the word targeted there. And the massive background dissemination of data that accompanies them. That's the issue.

icebraining5• 8 years ago

It's hard to say they don't target EU users, when they host a whole conference in Berlin: https://techcrunch.com/events/disrupt-berlin-2019/

Nursie7• 8 years ago

> it doesn’t “envisage” serving EU users

Strange then that "techcrunch.co.uk" redirects to techcrunch.com/europe

farazzz• 8 years ago

https://outline.com/7WY9hk

emiliobumachar• 8 years ago

consent [...] cannot be gained through a framework arrangement which bundles a number of uses behind a single “I agree” button [...]

I'm a bit worried that the interface of old Windows installers might make a comeback in the internet, but with "I agree" instead of "Next" written on that button that you have to click a dozen times.

Reason0772• 8 years ago

The interminable pile of pop-ups on the EU web has become extremely annoying, and I don't blame ad firms and publishers for seeking to minimise the disruption to the user experience.

At the same time, the protections that the GDPR seeks to provide are very important and it's absolutely right to protect them in law.

But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? It devalues the whole point of the GDPR because no sane person would actually read the policies for every single website to see if their data is being used reasonably or not.

I personally think that there should be a limited, well-defined set of data that can be transmitted to ad exchanges under an assumed consent. Fully anonymised and broad demographic data (eg: age range, sex, city, etc) for example. Anything beyond that should require an explicit consent.

This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good.

Krasnol• 8 years ago

You only have to read the policies if you are interested in sharing the data and this can be linked properly. I don't see a problem there (besides the fact that many pages are not even able to link to the proper pages of course).

The design of the wall of buttons is another topic. There is a design opportunity for a good solution there. Unfortunately what I see is the opposite. Pages that try to trick you into consent, pages who seem to link to other pages "checking something", "loading", "I'm sorry, try later", plainly not working buttons or no way to check all to "do not allow" but one button to "allow all". I really hope people who install those will pay and disappear when someone has finally enough of this crap.

brain5ide• 8 years ago

One could also argue that by avoiding the symmetric controls in these the websites are already aware of their malicious practices of the data they collect. This is cleverness, not stupidity.

Nursie7• 8 years ago

But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys?

There is none, however it seems to me that a lot of these are going to be considered illegal after a while, particularly the ones that default-enable a ton of stuff under the cover of a single OK button.

What would be really, really nice to see would be the web industry engaging with this properly, and changing their attitudes to private data, instead of effectively trying to hide behind multiple levels of disclaimer and implementing dark patterns to try to work around it.

This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good.

This is already the case, as far as a lot of privacy campaigners are concerned. If you're not planning on using my data in nefarious ways (sharing it with commercial interests for money), but only use it in ways that support providing me the service (technically, not financially) we're golden, and you don't need any consent.

jeroenhd• 8 years ago

The constant boxes are actually against the spirit of the GDPR and it's only a matter of time until they are banned as well.

The GDPR requires all tracking to be opt-in and to be completely optional. Blocking access to a page by requiring the users to tick one or more permission boxes is not opt-in. The same is true for many other GDPR permission forms (like Tumblr's) where all uses and parties were/are enabled by default and one needs to disable each one individually.

It's a matter of time before one of these big firms gets investigated for these practices and a fine is dropped. Publishers will learn to stick to the rules soon enough.

hartator2• 8 years ago

How can you be opt-in and be optional at the same time?

Reason0772• 8 years ago

"The constant boxes are actually against the spirit of the GDPR and it's only a matter of time until they are banned as well."

I note that some of the EU's own websites have them.

icebraining5• 8 years ago

Your proposal is exactly what the GDPR pushes for in Recital 26 - it exempts from the regulation "personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable".

So the onus is completely on ad firms and publishers to stop trying to find tricks and loopholes, and actually follow the regulation as it's intended.

seszett• 8 years ago

But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys?

Ideally, it adds a cost to including third-party cookies and tracking users. Editors of websites could choose to be more respectful of their visitors's data, and then they would be able to provide a more seamless experience without annoying popups.

In practice, apparently they are not willing to do that, either because money brought in by privacy-violating ads offsets the cost of losing users, or because they have not given much thought to it and are already used to showing lots of popups anyway, and think that one more will not change much.

I personally think that there should be a limited, well-defined set of data that can be transmitted to ad exchanges under an assumed consent. Fully anonymised and broad demographic data (eg: age range, sex, city, etc) for example. Anything beyond that should require an explicit consent.

Fully anonymised and broad demographic data does not require consent, since it does not allow identifying users. As far as I know you could store the age range of users in a cookie and give just that to your ad exchange, although you should tell them at the time you ask for their age.

simonh• 8 years ago

But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys?

If the consent boxes all have sharing options disabled by default, which they should, and only appear once for each site then I don't really mind all that much. click

hrktb• 8 years ago

But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys?

Setting aside if it's in line with GDPR, the interesting effect for me is that it adds a whole lot more friction to sites like TechCrunch for instance.

Up until now the cookies banner was annoying, but at this point I'll never go to a site with heavy GDPR screens except if I really really want to read an article that is heavily discussed. Put it another way, I'm not sure we get trained to click these disclaimer, just opting out of the site becomes a simple option.

In comparison arstechnica for instance is frictionless, and I hope it brings them a boost in visits comparatively.

BlackFly• 8 years ago

But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys?

The truth is that on the privacy advocacy side of this issue there is an understanding that those boxes are not meaningful, informed consent. On the programmatic advertising, suck up all the data side of the issue there is an understanding that an intrusive pop up with psychological nudges towards acceptance is meaningful, informed consent.

The GDPR was drafted in the way it was because of the industry's poor reaction to the tracking cookie law. They added hefty fines and a necessity of informed, meaningful consent because the industry reacted with a wink and a nudge by implementing loop holes. This ruling seems to confirm that the commission was not joking, that it wasn't just political posturing, that they want the industry to cease and desist.

Given that I have edited the html of any form ever given to me to change "I agree" to some form of "I don't agree and waive no rights", in what way have they diligently acquired meaningful, informed consent from me and therefore from anyone?

hyperman13• 8 years ago

I like the way they are punished:

  no fine, but CNIL ordered the firm to delete all data it had 
  not already deleted (having judged collection illegal given 
  consent was not valid); and to stop processing data without 
  consent.

So this is a warning shot to them and the ad industry: If they change the way they do business, they were almost not hurt (There is probably the court costs to pay, plus their defence, plus opportunity costs).

For now, the maximum fines seem to be just that, at least in France: Maxima, only for those who really do not want to mend their ways

remify• 8 years ago

There's no need for punishment but pedagogy.

Since there is still a lot of moving part regarding RGPD, the CNIL is just laying the foundation for futur cases.

hyperman13• 8 years ago

Exactly. And the fact that CNIL takes this approach, deserves some applause. They could take out bigger guns if they wanted.

hyperman13• 8 years ago

I'm wondering if we can't start micropayments today: Create an ad provider which bids together with all the others, but in your name (and you give them some money).

If you pay enough via that ad provider, it will claim the ad space on that page for you and leave it empty or puts some todolist or whatever you want there. Ask a monthly fee of a euro for computer costs.

As this is the raison d'aitre of this pseudo ad company, all its GDPR troubles are resolved at once. If it gains traction, publishers can use it as a preferred ad provider and resolve their GDPR troubles too.

Only question: Who would want to pay for this. It might prove people prefer ads to micropayments.

hartator2• 8 years ago

Or use an Adblock.

wild_preference• 8 years ago

Unless we want the internet to continue centralizing into the websites that don't need a business model (like VC funding), or to the few that people are willing to take out their wallet for (like Netflix), we need a new solution if we're going to unanimously block ads.

denisvlr• 8 years ago

To my knowledge that's basically what Google Contributor does: https://contributor.google.com/v/beta

I don't think it ever caught on.

icebraining5• 8 years ago

Privacy protections undermine that, since it would required individual targeting of ads (unless you could afford to pay for any ads shown to everyone in your demographics).

You could try to form a coalition to do group purchases, but it's a hard thing to start, since the individual benefits would be small until you got a large number of members, whereas an adblocker is free and more effective.

Plus, the ad network could still track you, which is one of the problems people have with ads.

pmontra• 8 years ago

This is not only about advertising, it's about any service that trasfers consent to another one. There is a full thread about micro payments here, but they could solve only some cases. There are plenty of legitimate third-party services added to web sites (example: customer service) that according to this ruling (if I understood it well) should verify consent on their own. This could be possible or not, it depends on the nature of the service.

Tsubasachan2• 8 years ago

Anything that makes it more difficult for the advertising industry is good in my book. Reminds me of how our ancestors built cathedrals instead of hospitals.

throw2016• 8 years ago

There seems to be a significant ethical problem of dehumanization and predation in the tech community that must be analyzed and understood.

Here are people living in a civilized world with rules and regulations and posture as civilized human beings who function in an ethical society.

But at work they seem to be operating in neolitic wild lands engaging in increasingly invasive predatory behavior that systematically reduces the entirety of the human population going about their daily lives into objects of profit lacking agency, merely tools to be stalked and analyzed for revenue, to be prodded for value in any way possible. There is a dehumanization here with no respect of personal space, privacy and basic human dignity.

This would not be as bad if there was explicit consent and self declared transparency of the all processes in play, and commitments to ethical frameworks of operation. It's the surreptitious, misleading and often deceptive communication and behavior that betrays their willful complicity that is troubling.

Fiahil• 8 years ago

Maybe, at some point, ad companies would prefer asking a visitor which topic he is interested in, instead of trying to collect some giant amount of shitty data to feed their profiling engine and then being GDPRed for failure to register consent. Sometimes the best solution is also the simplest.

buboard2• 8 years ago

The solution is to replace the cookie consents with an explicit form where users select their interests, so that the publisher can request ads tailored to the user. It's a lot more transparent and it can save a lot of publishers in the EU which are now at a dead end. (People who think that donations/subscriptions will save websites are deluded. Tracking is bad , but targeted advertising is not. Advertising is a perfectly valid model but context-based advertising is horrible - i know because i ve been seeing and serving those "russian bride" and "click here to get iphone" ads since May).

reitanqild2• 8 years ago

context-based advertising is horrible - i know because i ve been seeing and serving those "russian bride" and "click here to get iphone" ads since May).

Doesn't exactly seem like you got context-based ads but rather completely pointless ads?

buboard2• 8 years ago

thats what you will get if you have anything other than a blog, though. I bet news websites have the same problem. Reporting about a death doesnt mean you want to advertise coffins.

cm2012• 8 years ago

This decision would be super good for Facebook and Google by the way. If you can't share/pool cookie data, then the smaller ad players will die out even faster than they are now.

rhacker• 8 years ago

I've always felt that one way to change the way internet companies do business with a loose-style relationship with our data is to pass laws in small towns or even just one large city. Imagine if Portland OR made severe legal consequences for specific kinds of privacy breeches for people in its own town. The giants would have to decide to block people in that city or change general data processing rules internally. But I think it acts more of a starting point of an avalanche as more and more places see the good that comes from that.

It's also NOT just the big corps. Companies that use public records (and public records in and of themselves needs a LOT of additional laws in the digital age) so you can find your ex-girlfriends, etc... Can you imagine these ASSHAT websites being sued for 100k by people in Portland? Then New York, etc.. I would love to see that happen.

A small French privacy ruling could remake adtech

Related Stories