Google’s GDPR Workaround

https://brave.com/google-gdpr-workaround/

by donohoe • 7 years ago

1868 576 7 years ago

priansh8• 7 years ago

EDIT: since everyone seems to be mentioning the 4% rule, I'd just like to point out that I'm not denying the existence of this, just denying that it is actually effective. Google has violated antitrust before, and walked away with a "big" fine that's a slap on the wrist. They've violated GDPR before as well once or twice, and got a "record breaking" 57MM$ fine. The 4% rule exists and clearly isn't enforced well. I know a lot of people love GDPR but I would be beyond shocked if the EU actually managed to hit Google with something that sticks. I very much hope I'm proved wrong!

This sort of resolution was inevitable.

I said it before and I'll say it again: GDPR is an annoying measure for developers, small businesses and startups. It doesn't do much other than put in place so many steps that growth tools for startups become risky to use. For big businesses that (ab)use big data, it's not much of a hassle because they can afford the legal steps as well as the change in infrastructure. They can even work around it and keep abusing data without consequences.

If they're able to beat Google's lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that'll be more than covered by their daily revs.

kd5bjo• 7 years ago

From my (admittedly limited) understanding, this is not actually legal under the GDPR. Certainly the alleged (but not demonstrated) behind-the-scenes trading of personal info isn’t, but the shared id is also personally-identifying information, and directly regulated.

hexadec4• 7 years ago

It is very not legal, but I think the parent was saying these regulations are more onerous to small dev shops rather than Google and the fine for this will be minuscule. Hopefully companies will find paths to revenue that do not require selling out there users to this level, maybe by just having ad auctions without any identifying information at all.

priansh8• 7 years ago

It's not legal but there isn't much the EU can really do. It would be shocking if they actually managed to prosecute Google which has so far avoided much hassle in antitrust and the like, taking I think a billion dollar fine which sounds like a lot but is basically a slap on the wrist.

That's why, IMO, GDPR sucks for small businesses that can be outed to the ICO for a minor oversight and not so much for big data abusers that can take on GDPR and come out unscathed.

simias• 7 years ago

And I'm very annoyed that your initial reaction to reading this article is to blame the GDPR instead of blaming Google for these shady practices. Boycott that crap, move to other services. This shouldn't be acceptable.

I'm very happy that the GDPR exist, if only because it forced all these websites from explicitly giving me a list of the literally hundreds of partners they want to share my data with, along with a way to say "hell no". Of course Google and friends will try to work around it but hopefully that won't come to pass and they'll have to actually bother changing their crappy business model. I think the spirit of the law is fairly clear, I wonder why Google thinks this scheme can work. Maybe they're just trying to buy some time.

As for startups that sink because they can't be bothered to sanely handle my personal data: good riddance.

priansh8• 7 years ago

- my initial reaction is to blame GDPR, yes, because it's just security theater that does so little to actually ensure privacy. Sure Google is at fault but GDPR was supposed to regulate this and it is clearly failing to do so. And if you want to boycott it you're welcome to but they've built an empire with their cloud, search, email, etc to the point where that would be pretty difficult and annoying to the average consumer. They're effectively too big to be boycotted at this point.

- It doesn't explicitly force them to do that. And most sites aren't explicitly sharing the data either; i.e. almost every site uses Google analytics which doesn't really comply with do not track all too well, and Google will then share their data with everybody else (which is part of their violations in this article). Also saying "no" doesn't do much either as most of these big sites either already stored the cookie or won't do much to delete it. And it's not that they'll try to work around it, they either don't put forth the effort because GDPR is like a pebble for them, or they already worked around it in a way that changes nothing. Their business model is still the exact same.

I think the spirit of this law is fine, but the actual law does nothing and is just privacy theater. Google isn't buying time, almost 4 years later nothing has changed -- they just know they can't be touched.

- They're not going to sink, they'll just grow much slower and thus won't be an alternative to the big data abusers you hate so much. And they're not failing to handle your data, most of the time startups aren't selling you out they're just trying to figure out who their customer is internally. To do this they collect some data that is usually optional and very much with your consent; GDPR just puts a bunch of hoops in front of this so that it's an enormous pain to do so. I run a startup that collects basically no data (literally, we do not have a database for 2 of our products). It was a pain for us to become GDPR compliant because that disables our metrics entirely and requires a bunch of banners and checkboxes everywhere even though we literally store nothing.

I'm all for the spirit of the law. I just think the execution sucks and they definitely didn't think it through enough. I think the evidence for this is clear based on the sheer number of privacy violations we've had since GDPR was enacted alone, and how little enforcement and regulation has actually gone on.

mola3• 7 years ago

The European Union has decided that growth based on clandestine tracking of users, selling their PII without consent is not a legitimate growth tool. You know, like the way we outlawed violence as a "growth tool"

Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be.

Sean1708• 7 years ago

Unless I'm misunderstanding what you mean by absolute and relative, I think the law is already relative:

The maximum fine under the GDPR is up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements.

From here: https://www.itgovernance.co.uk/dpa-and-gdpr-penalties

owenmarshall3• 7 years ago

Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be.

GDPR penalties are a flat fee or a percentage of revenue, whichever is higher.

If Google is truly willfully violating the GDPR, the maximum penalty by law could be up to 4% of their global turnover. I would not call that pocket change. But more importantly, it is a relative increase in fine based on the law breaking company.

(Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!)

priansh8• 7 years ago

The fine is already kinda big for GDPR (4% global rev for big companies) but Google has gotten away with way worse on way more regulated fronts i.e. their antitrust case which slapped them on the wrist.

If GDPR wants to be effective they need a ridiculous company-breaking fine for big abusers like COPPA and the like. Something like a per-user fine for violations that means they either can't do business in the EU or they have to become compliant otherwise risk being basically destroyed (for reference, violating child protection laws in the US can break and have broken companies before).

EDIT: also as for the tracking growth comment -- I agree on this, but the effects of GDPR on growth tools reach far beyond this. Even basic metrics are hard to get without a bunch of hoops. Even if you store no data you have to have a bunch of checkboxes and banners everywhere. Just for using Google Analytics that just relies on what they know about your computer (fingerprinting), and uses no PII at all, you need a banner and privacy policy. The laws are making it hard to use even basic analytics without fearing a misstep.

ceejayoz2• 7 years ago

If they're able to beat Google's lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that'll be more than covered by their daily revs.

This is why the 4% of global annual revenue fine option exists. A few of those add up quick.

ht_th• 7 years ago

Furthermore, if organizations are explicitly accepting penalties to keep on violating the law, that law will be adjusted accordingly. It might take a while, but it will happen. Laws with the intention to change behavior / culture cannot "work" from day one. This is a continuous process steered by politics, courts, governments, and public opinion.

hexadec4• 7 years ago

This some great work on tracking down all of these measures to track users. I really hope we get to the point where dumb ads rules the web once more. Hopefully this results in more than a slap on the wrist, but I doubt it.

intopieces• 7 years ago

Why should ads rule the web at all? Surely the cleverest engineers to walk the planet can come up with a new way of making money that doesn’t involve psychological manipulation.

hexadec4• 7 years ago

I agree with you in theory, but until we can figure out micro-transactional payments that work globally it seems ads are good stepping stone. People want to get paid for work, some users are willing to pay (cash) some with attention to ads. We should not give up our privacy or anonymity for this attention though.

tsumnia• 7 years ago

I think there are simply engineers that are fine with the current state of things. You mention specifically "come up with a new way of making money"; however, for extrinsically motivated people, why reinvent the wheel? Problem solving can mean thinking up a solution or implementing a solution.

In the same vein, there may be engineers that enjoy working on this type of problem - how to identify someone that is actively avoiding you. The current iteration of Do Not Track mentality only makes the problem more interesting by putting up restrictions.

hobofan7• 7 years ago

Surely the cleverest engineers to walk the planet can come up with a new way of making money that doesn’t involve psychological manipulation.

If they could, they would've already done so.

One of the things "the cleverest engineers to walk the planet" would probably need to do is to increase consumers willingness to pay for good content by a factor of ~10 for e.g. online newspapers with quality journalism to be profitable, which frankly sounds near-impossible.

DaiPlusPlus• 7 years ago

Engineers aren’t businesspeople. We’re tools of the businesspeople - we only stick around to do their bidding because they offer us equity.

paulddraper2• 7 years ago

Surely the cleverest engineers...can come up with a new way of making money

New ways of building things is the province of engineering.

New ways of making money is the province of MBAs.

Not that really matters; I doubt you will succeed in replacing ads with something "better".

rvz• 7 years ago

It's really funny to see that yesterday, I was branded as a 'privacy nut' after the release of Android 10 as I was concerned about the privacy issues that are in Android. Then the Go modules proxy issue around the Go Programming language that raised suspicions about tracking usage statistics around downloading modules turned on by default without any consent and now this.

I think there are some folks at Google who have just read too deep into both 1984 and The Google Book to go on to think that privacy violations like this is a normal thing. But what do I know? I'm just another 'privacy lunatic' on the net that wears a metal helmet (tinfoil hats are just not good enough) trying to protect my privacy.

zdw• 7 years ago

The Go module hash checking seems to be more about avoiding the problems encountered by other language repos integrity and versioning issues (cough NPM), and in terms of tracking it seems about as invasive as Debian's popcon.

Enabled by default can and should be the default for security-related features.

I tend to agree about the rest of the creepiness, especially anything personally behavioral.

ptx• 7 years ago

Debian's popcon is not enabled by default.

SomeOldThrow• 7 years ago

in terms of tracking it seems about as invasive as Debian's popcon.

How do you figure?

raxxorrax3• 7 years ago

Enabled by default can and should be the default for security-related features.

Not since Google uses the argument of increased security to justify data collection for quite some time in the interest of itself.

nindalf3• 7 years ago

On HN it is taken as gospel that any information sent to a server will absolutely compromise your privacy. If anyone points out that the information is trivial or useless the rebuttal is instant - it can be cross referenced with other sources to build a complete profile of you.

If you want to know which Go modules I use, go check out my github. They're listed right there in import statements. If I'm hacking on a project that I want to keep private, I'll disable this feature with a command line flag - easy.

My issue with the paranoid folks in that thread is not that they made no sense (they can't help that), it was they were attacking the person who implemented the feature viciously. He had implemented a feature that a majority of Go developers had been requesting for 5+ years, had done it in a way that improved clean build time, improved security and could easily be disabled or replaced with a private DB. Literally what else could that man have done?

Even though all his work could be verified trivially (Go is open source!), they still chose to attack him.

kerng2• 7 years ago

Google (as well as surveillance states) use security arguments conveniently a bit too often to try and justify their actions.

auslander5• 7 years ago

branded as a 'privacy nut'

Only the Paranoid Survive. A book by The President and CEO of Intel.

https://en.m.wikipedia.org/wiki/Andrew_Grove

slowhand09• 7 years ago

Great book! Read it prob 20yrs ago.

ethbro• 7 years ago

Wide-ranging thoughts and examining what-ifs makes you a curious individual. Failure to counterbalance confirmation bias by critically examining and deconstructing your own hypotheses makes you a crackpot.

The main difference between the two is just which paranoid thoughts you give credence to.

Iv3• 7 years ago

"You know, that PATRIOT act really allows spying on everyone"

"Come on that's just paranoia"

Snowden leaks secret program that implements everything details in the patriot act.

"WHO COULD HAVE SUSPECTED?"

moyix• 7 years ago

If I remember right, after the leaks the faux-sophisticated take was "well of course, everyone knew this was going on, are you naive?".

hobofan7• 7 years ago

I probably saw those movies at an age where I was too impressionable, but growing of with portrayals of US intelligence units like in Enemy of the State, I always assumed that they did spy on everyone (and didn't even think that this would be some absurd view, or that I was being clever with that thought).

lern_too_spel5• 7 years ago

What program did Snowden leak that shows the US government spying on everyone?

arkh• 7 years ago

10 years ago you'd be called a privacy lunatic when you said that website owners who used google analytics were just selling their users' data to Google. Same reflexion about those using ad scripts.

bcaa7f3a8bbc• 7 years ago

Different types of Hacker News article trends to attract slightly nonoverlap different subgroups of people. You'll sometimes find different sentiments over the same topic under, e.g. U.S. politics, silicon valley startups, cryptography, or urban life.

jeremyjh2• 7 years ago

I’ve noticed this as well. Would love to see some analytics on this.

kodablah• 7 years ago

A reasonable debate about your privacy concerns cannot be had if you take the most extreme response and pretend it represents what you are or what everyone thinks you are.

You are assuming you were branded by a large swath while similarly branding an entire company that is clearly represented by many diverse opinions on diverse products. The debate needs more nuance lest everyone pulls out their broad brushes while also taking offense to receiving a fleck of paint. Conflating the Go proxy w/ Google's ad business is a perfect way to ignore nuance in the debate downplaying the real, tangible effects.

wtmt• 7 years ago

It's really funny to see that yesterday, I was branded as a 'privacy nut' after the release of Android 10 as I was concerned about the privacy issues that are in Android.

What are the privacy issues in Android 10? Anything new compared to previous versions?

drusepth7• 7 years ago

I think the biggest one is some bad wording on the marketing around the "share your wifi" feature, where it mentions that you can share "secure" passwords with QR codes now but doesn't mention that the QR code has the plaintext password encoded in it.

Other than that, it seems that privacy controls have been generally improved in Android 10.

3xblah• 7 years ago

"Then the Go modules proxy issue..."

https://sum.golang.org/privacy

This links to the Google Privacy Policy which is an additional 27 pages.

"I think there are some folks at Google who have just read too deep into both 1984 and The Google Book..."

Is this The Google Book?

http://blog.outer-court.com/googlebook/

lern_too_spel5• 7 years ago

You were branded a privacy nut for https://news.ycombinator.com/item?id=20868489 because you didn't note any actual privacy issues in Android.

SEJeff• 7 years ago

FWIW, it is very easy to setup the athens proxy and run it. You could even have it route traffic through Tor if you were so inclined. We use it and are a fan as is works nicely:

https://github.com/gomods/athens

alexnewman• 7 years ago

I've found that whenever I post anything anti google on hackernews I'm downvoted and people call me names.

salawat• 7 years ago

Obligatory post:

https://cryptome.org/2012/07/gent-forum-spies.htm

It's just as valid a technique for large organizations as it is for governments.

Active Perception Management is most definitely a thing. Of course it only works because most people aren't aware it is a thing.

https://en.m.wikipedia.org/wiki/Perception_management

dwild• 7 years ago

I was branded as a 'privacy nut' after the release of Android 10

You were doing baseless accusation on something you don't know anything about. Your comment was basically "they market it as being better to handle privacy thus they clearly are worst with your privacy!".

You didn't raise anything substantial at all in that comment.

cj3• 7 years ago

Snippets from the article:

The evidence further reveals that Google allowed [...]
Google has no control over what happens to these data once broadcast [...]

Is it possible that Google does have "control" over the data after broadcast, albeit legal control via contracts with advertisers (as opposed to technical control)?

Perhaps Google's GDPR compliance strategy relies on the participating advertisers to comply with their contract with Google. If that assumption is accurate, perhaps Google's advertisers are in breach of their contract with Google which makes it appear as though Google itself is in breach?

I could be off-base, the details in the article aren't incredibly clear to me.

(For the record, I don't like Google's business model and I don't like Google's pervasive tracking -- I'm playing devil's advocate to better understand the issue)

jjoonathan• 7 years ago

"control" over the data after broadcast, albeit legal control via contracts with advertisers

Now there's a claim only a court would buy!

A court probably would buy it, though.

Sigh.

luckylion8• 7 years ago

That is the GDPR-default though. You're still allowed to give data to third parties, you just need to have contracts with them regarding the handling, deletion etc of that data. Of course, mostly that's for data processors, which I don't think ad networks working with Google would fall under.

SpicyLemonZest2• 7 years ago

The article doesn’t appear to claim that the author has been tracked in violation of the GDPR, only that the described mechanism makes it technologically feasible to do so.

inlined5• 7 years ago

Indeed. I fully admit I’d need to sit down and diagram some of Brave’s claims, but the large identifier screams “cryptographic entropy” to me.

The GDPR has separate rules that effectively deal with whether you are the business with which the customer works or one of their contractors. I could imagine a world where google is the second party and needs a secure feature like this so the first party can perform (consented) tracking across multiple domains they own. This is just a devils advocate argument since I can’t guess intent.

michaelbuckbee• 7 years ago

The real time bidding on ad placements seems like a thing that a user could never give consent to as it's literally feeding your info to a massive ever churning list of companies that get to bid on it.

Aka - you land on a site, it send your IP and whatever identifiers it has to 10,000+ companies who all then figure out if they want to bid on showing you an ad.

SpicyLemonZest2• 7 years ago

Do you have to give consent for each individual third party your data gets shared with? I’d thought that if you give consent for some purpose, the company can use whatever processors it wants as long as it ensures they protect your privacy.

pas2• 7 years ago

But where does your PII end up, only at Google, no?

bertil2• 7 years ago

Is it possible that Google does have "control" over the data after broadcast, albeit legal control via contracts with advertisers (as opposed to technical control)?

That distinction is important. I’m happy that privacy advocates are realising that platforms having access to enforceable contracts is key–too many are quick to paint platforms as the source of the problem and not an agent who, with the right tools, could organise a market.

Facebook has suggested having an independent court what is acceptable content in their platform. Google could think about delegating the control of how its IDs are used to an independent entity with the power to audit its partners’ data practice properly.

JohnFen6• 7 years ago

Is it possible that Google does have "control" over the data after broadcast, albeit legal control via contracts with advertisers

I don't actually put much faith in such "control".

wtdata4• 7 years ago

What is sad is that the EU commission doesn't take real action against Google. At best we are to expect a slap in the hand, at worst, the investigations will drag on and nothing will happen.

Barrin92• 7 years ago

Google has been fined a 5 billion dollar fine already last year, that claim simply isn't true. But I agree with the implicit demand, they clearly haven't gotten the message. The EU should slap them with billion dollar fines again until they learn their lesson.

moomin• 7 years ago

Q4 2018 earnings were around $40 billion. EU will have to try significantly harder.

cryoshon• 7 years ago

5 billion is peanuts to google. if the fine is low enough that it can be written off as a cost of business, it's too low. effective fines devastate profit margins rather than merely crimping them.

wtdata4• 7 years ago

That fine qualifies as a "slap in the hand" for Google if it happens infrequently enough (which is the case).

cj3• 7 years ago

I believe the $5 billion was an antitrust violation, not related to GDPR. I could be wrong.

docker_up3• 7 years ago

The executives should face jail time. That would certainly light a fire under Google's ass to finally "do no evil".

Dirlewanger• 7 years ago

Sure you didn't mean to say that what's actually sad is that the US federal government/DoJ doesn't take real action?

wtdata4• 7 years ago

Well, I am an European, it's sad about the US Gov./DoJ, but that is not something I have the right to demand from my part.

huntermeyer• 7 years ago

FTC fined Facebook $5 billion this year for mishandling users’ personal information. The SEC fined them $100 million.

cj3• 7 years ago

I was curious what the maximum fine for Google could be under GDPR.

Google's 2018 revenue was $136.22 billion. GDPR allows for a maximum fine of 4% of global turnover.

At a maximum 4%, GDPR could impose up to a $5.5 billion fine. I agree, getting something closer to the maximum might help the situation. Although ultimately, my bet is that Google is already baking the 4% revenue risk into their business model. If that's the case, GDPR's maximum penalty should be reconsidered.

ceejayoz2• 7 years ago

They can assess that fine for each major incident, can't they?

_Codemonkeyism• 7 years ago

Executives commit crimes and the company pays the fine. This way crimes are not prevented.

whenchamenia• 7 years ago

Maybe someone will finally take googles abusive practices to task.

sam1r• 7 years ago

Just learned about Brave for the first time. Pretty neat stuff.

Kiro2• 7 years ago

Only if you're into cryptocurrencies. I wish there was an alternative without the BAT stuff.

buboard• 7 years ago

BAT is traded in all crypto exchanges. you can instantly exchange it for a stablecoin or even write a script to exchange it to USD every day in e.g. coinbase. I don't see why the fuss

colordrops3• 7 years ago

That makes no sense. BAT is opt-in and isn't even mentioned when you install the browser.

bhaavan• 7 years ago

The whole intention of this clickbait article by Brave, without any technical details, is to sell it's browser.

Aperocky• 7 years ago

Yeah, it's so annoying. WHAT PERSONAL DATA? The entire article is basically a rant about "personal data can be leaked" without any examples. Names? Browser Habits? What is it?

NullPrefix• 7 years ago

I was branded as a 'privacy nut'

Companies do actually employ shills to go on forums and try to sway public opinion. They call them something like public advocates, doesn't change the idea though.

kaolti2• 7 years ago

I get the feeling this is much more prevalent than any of us realize. Would explain why most comments seem ridiculous.

tboyd47• 7 years ago

You mean how there are somehow always commenters in every topic ready to leap to the defense of China and major US tech companies?

aserafini• 7 years ago

It doesn’t even require a ‘paid agent’ theory to explain. Large companies actively court allegiance from their employees and spend serious effort to retain it by, for example, relentlessly offering mandatory courses in the company’s Cultural Values and evaluating promotions through that lens.

So it’s not surprising that some BigTech employees are going to actively defend their employer’s values on forums.

The best way to understand modern tech company culture is to consider them all very successful cults.

navigatesol2• 7 years ago

Would explain why most comments seem ridiculous.

Or maybe people have widely differing views on all kinds of subjects?

I've been called all kinds of things, which I definitely am not, so I'm inclined to think that people put far to much weight on the conspiracies.

kspacewalk2• 7 years ago

Should their point of view just not be heard then, in such discussions?

whatshisface2• 7 years ago

Is it really a point of view, or is it a carefully engineered sequence of words designed to program people with certain opinions? There are lots of ways to "program" people that bypass their rational mind, and creating a false sense of social consensus is one of them.

hobofan7• 7 years ago

Not if it's disguised as a private individual (which is the default assumption in discussion forums such as this one).

If a company wants to present its views, they can do so via press releases or clearly mark their posts as such (or via verified accounts like on Twitter).

owenmarshall3• 7 years ago

I think if you want the point of view of a corporation you should feel free to go read their official blog, press releases, etc. They have plenty of ways to spread their point of view that aren't people pretending to be individual commenters.

criddell• 7 years ago

I would love it for companies to jump into these conversations and defend or explain what's going on. It's less interesting for them to speak through a secret proxy.

That said, I don't think there are nearly as many shills as some people think nor do I think they are very effective.

kaibee2• 7 years ago

Hi kspacewalk2,

I'm John and I have views on privacy that are completely genuine and happen to align with what benefits the corporation(s) that my company, TotallyLegitimateComments LLC, contracts for. I believe advertisement is a force for good in the world and can bring together people and products that enrich their lives while creating value for shareholders! While I'd love to share what wonderful businesses my company works with, various privacy agreements prevent us from doing so. However, I can tell you that they all appreciate the fact that you find their views important! We will continue to lobby your congressmen on your behalf to ensure that these views are reflected in the nations laws! Thanks and remember, corporations are people like you and me!

Sincerely, John

kerkeslager• 7 years ago

If they want their view heard, they're welcome to share it like everyone else.

Paying someone else to share a very sanitized, market researched version of your opinion while pretending that they're organically sharing their own opinion isn't that. It's dishonest, and it's eroding honest conversations for the sake of advertising.

narcoleptic• 7 years ago

I used to wonder if this was the case. Would you have any idea how their performance is measured by their employers?

paulcole• 7 years ago

What's more likely: that Google's willing to risk being outed for employing shills or that there are people who actually hold the opposing viewpoint?

Personally I tend to think of most people on HN as privacy nuts. Honestly of all the problems in the world to get worked up over, online advertising is pretty low on my list. There's nothing I can do about Google/FB/whatever, so why even think about it.

If Google or whoever wants to pay me to keep posting, I'm listening.

whatshisface2• 7 years ago

that Google's willing to risk being outed for employing shills

This risk might be lower than you think, the key phrase is, "we didn't realize that the marketing firm we contracted was subcontracting to other, shadier marketing firms, who themselves aren't evil, but fell in with the wrong crowd and ended up trusting a yet deeper level of marketing firm, who was in fact evil."

Beldin• 7 years ago

There's nothing I can do about Google/FB/whatever, so why even think about it.

Actually, of all the stuff going on in the world, this is the one thing where you have an actual degree of control that matters.

Sure, one individual won't change business policies. But: you can easily take steps to prevent or reduce the amount of data these companies have on you.

Don't use their services, use an ad blocker, use tracking preventing, etc. You can even easily tailor it to your specific needs.

Compared to stuff like Brexit, fires in the Amazon, Hong Kong, ethnic cleansing in Myanmar, attacks on democracy in Turkey, Hungary etc., it is trivial to do something against Google/FB that has at least the effect of protecting you.

daxorid• 7 years ago

online advertising is pretty low on my list

The threat that Google's tracking infrastructure represents is not limited to ads. If they stayed in their proverbial lane and used their panopticon exclusively to sell me things, many of us wouldn't mind as much as we do.

But they lend the power and reach of their machine to governments, whether it's China looking to smoke out dissidents, or the NSA PRISM program, or even the DEA itching to score another weed possession arrest, Google gladly and happily does whatever governments ask of them, frequently with no warrant required.

Aunche• 7 years ago

I'm no marketing expert, but I doubt that the best way Google can think of to sway public opinion is to call people privacy nuts. Google employs over 100,000 people and even more people work at similar companies like Facebook or buy targeted ads. Many of these people browse Hackernews and get offended if others accuse their livelihoods of being evil.

paul79865• 7 years ago

I can attest to that as when you point of things like Google gets caught stealing IP from a MIT student they invited for an interview (a popular thread here on HN) it gets downvoted voraciously.

Either its employees, hired guns and or something...

philwelch5• 7 years ago

Every company I've worked at has had an explicit policy of not commenting on that company's business on the internet.

kakwa_• 7 years ago

I doubt the vast majority of employees would get offended that easily. I work for a tech company providing marketing tools (basically, I help send marketing emails (aka spam)), I like the pay, the overall environment and the technical challenges, but I'm under no illusion that I contribute to the betterment of our societies.

If you see these kind of behavior online, it's almost always people paid to explicitly monitor forums and "protect" a company image.

lalos• 7 years ago

Could also be selfishness, I remember reading an article about leaked internal Facebook employees where some employees would pressure others to not talk about privacy or sensitive topics because it would hurt the stock price further and therefore hurt all employees. I can't seem to find the article. I can see employees of big companies trying to sway or minimize decisions to feel like they are protecting their future earnings.

plankers• 7 years ago

"It is difficult to get a man to understand something, when his salary depends on his not understanding it."

--Upton Sinclair

stareatgoats• 7 years ago

Companies do actually employ shills to go on forums and try to sway public opinion

I'm inclined to believe you, but sources please. Especially interested if you (or anyone) have anything on Google in this respect.

cheschire• 7 years ago

https://www.reddit.com/r/shills/

It's not going to be entirely legitimate but there's going to be some eye opening items in there for you I suspect.

prophesi• 7 years ago

Not exactly a company, but if https://en.wikipedia.org/wiki/50_Cent_Party is a thing, I can't imagine that it's not also happening in a corporate context.

dredmorbius• 7 years ago

The Microsoft v. Novell case documented numerous examples and instances of a specific FUD campaign.

The book Merchants of Doubt highlights the practice across decades and industries.

Ralph Nader was subject to corporate smear tactics and surveillance in the 1970s.

The idea that companies would suddenly stop using these tactics the moment they become divinely powerful defies all reason.

Reddit's /r/shills and /r/HailCorporate highlight some modern instances.

oarsinsync• 7 years ago

Amazon employees what it calls "FC Ambassadors". These people have openly admitted that they are paid by the hour to tweet about the company[0].

Full thread in a nicely readable format at https://www.thepoke.co.uk/2019/08/15/amazon-ambassadors-take...

[0] https://twitter.com/rulesObeyer/status/1161758672973811712

ColanR3• 7 years ago

Monsanto is a good example. Paid internet shills: https://www.baumhedlundlaw.com/monsanto-paid-internet-trolls.... Influenced research about its Roundup products: https://www.nytimes.com/2017/08/01/business/monsantos-sway-o....

navigatesol2• 7 years ago

Companies do actually employ shills to go on forums and try to sway public opinion.

This is the lazy and ignorant method of dismissing other people's arguments. Shill or not, what does it matter if what they state are facts?

axaxs2• 7 years ago

Because literally anything is a fact, when worded the right way. In fact, that's most of what is wrong with the state of our 'News' today. Even little word changes can be used to sway public opinion (ex: 'victim' vs 'drunk woman', in a case an assault victim happened to have been drinking).

jhayward• 7 years ago

This is the lazy and ignorant method of dismissing other people's arguments.

First, please observe the principle of charity when posting.

Shill or not, what does it matter if what they state are facts?

Because it is entirely possible to tell large lies using small facts.

Because propaganda and disinformation are actual, real things and are very difficult to combat once unleashed in the commons.

Because the "let the marketplace of ideas figure it out" excuse to not police propaganda and disinformation attacks is hopelessly naive at best, and deliberately ineffective at worst.

oneepic• 7 years ago

...is this supposed to prove or suggest that Google does the same?

joelx• 7 years ago

Nation states employ shills to attack other countries best companies like Google, Facebook, and Amazon. There has been a sustained PR campaign against our companies.

Dictatorships use Whataboutism to help cover stuff like this... https://www.reddit.com/r/pics/comments/cz75gj/hong_kong_poli...

6gvONxR4sf7o• 7 years ago

I've seen a huge number of accusations that people espousing my views are shills in some thread here or on reddit. I'm sure there are paid shills, and even in large numbers. I'd bet it's a problem. But we have to be reeeeeeeeallly careful about throwing that label around.

When you're wrong, you shutting down discourse by effectively saying the other person isn't even a person. This gets us to far more extreme us-vs-them dynamics than otherwise possible.

ColanR3• 7 years ago

I recall that this is exactly what Monsanto was caught doing about a year ago, to cover up the dangerous effects of the chemicals they used (iirc). Paid shills on the internet who had facts at the ready to disprove Monsanto's bad actions, and were willing to use 'conspiracy theorist' to shut up anyone who didn't believe them. And, the facts they used came from legit-looking research, which Monsanto was also exposed to have created fraudulently, by suppressing bad results and elevating 'good' results.

dang7• 7 years ago

We detached this subthread from https://news.ycombinator.com/item?id=20877072.

_pmf_• 7 years ago

Slap on the wrist incoming. But looks like a solid case with a EU national (?) as plaintiff.

amelius4• 7 years ago

Targeted ads are already a serious leak of information.

If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me.

Also, if a malicious actor targets an ad to a group of people, and some of these people buy the advertised items, then the actor can infer things about those people not necessarily related to the items sold.

billyc74• 7 years ago

if someone looked over your shoulder and saw you browsing HN they could infer things too

thebouv• 7 years ago

Yet, they choose to surf to HN.

They're not choosing to have targeted ads that share their info around the web and cause someone over their shoulder to infer things about them.

That's the point -- we should have that choice. And the default should be "no".

amelius4• 7 years ago

Yeah, but HN is not shown as part of every website out there.

pbhjpbhj• 7 years ago

My children tease me about "being a hacker", by which they mean unlawfully breaching security of internet systems, because they've seen me reading "hacker news".

samantohermes• 7 years ago

The problem is if the person looking over your shoulder has power over you.

CoolGuySteve• 7 years ago

At my last job the traffic was filtered through a proxy due to FINRA regulations. I’d see Portuguese ads for diabetes medication and there were 2 Brazilian guys in the office.

Seemed like a major HIPAA violation to me.

GavinMcG• 7 years ago

HIPAA only keeps healthcare providers from sharing your information. It's not an omnibus shield for your health information. If Alice tells her coworker Bob that she had diabetes, it's not a HIPAA violation for Bob to tell Charlie.

jeena• 7 years ago

It would have been a more funny story if it were ads for Viagra ;)

ahallock3• 7 years ago

If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me.

You have to take some personal responsibility, though. If they saw your Youtube recommendations or your Spotify playlist, they'd probably make inferences as well. That porn link in your history you forgot to clear? Be aware of who's watching and browse anonymously if you're concerned.

ta0987• 7 years ago

I've had ads for sketchy shit I googled at home on my personal computer show up on my work computer at the office.

tantalor• 7 years ago

"somebody looking over your shoulder" can see a lot more than you ads, like your private messages, bank info, medical info, etc.

amelius4• 7 years ago

Not if I'm just showing them a random website. The problem with targeted ads is, they show up at random websites.

ryan93• 7 years ago

Why are so many people that paranoid. No one is gonna destroy your life because they saw your ads

rdbell• 7 years ago

Imagine someone giving a presentation to room full of co-workers and a web ad comes up saying something like "Resubscribe to Cannabis Weekly Delivery and get 10% off."

It's not hard to imagine a person's career being affected by something like that.

drevil-v2• 7 years ago

What if I was anti-abortion or pro-trump in a progressive tech company? Would my co-workers feel more comfortable destroying my life then?

therealmarv• 7 years ago

Surprise... I'm thinking every state outside of EU does not even need that sophisticated workarounds... just go directly to the target (you).

juanbyrge2• 7 years ago

Kind of a ratty move by Brave to leverage all of Google's tech in their browser (blink, v8, etc..) while simultaneously suing them as a PR tactic.

ummonk2• 7 years ago

Google didn't have to open source it. They open sourced it knowing it would encourage adoption.

juanbyrge2• 7 years ago

Regardless this is a very calculated PR move by Brave. And the privacy zealots and anti-google cadre on HN and elsewhere are eating this up. They are effectively giving Brave free advertising and playing right into their hands.

mfer2• 7 years ago

Free startup idea: An ad service that did things simply without any targeted stalking involved.

alkonaut2• 7 years ago

These exist. But so long as adivertisers can buy ads with tracking, fraud detection etc, they will.

The key to getting reasonable ads back is making the bad ads impossible for advertisers to buy.

mfer2• 7 years ago

Do you have a reference? Looking around I didn't see anything. I might have missed it though.

rpastuszak7• 7 years ago

Also, curious to see how an ad network can guarantee that its creatives don’t misbehave, this is brand safety played on “godlike” (sorry for bad Unreal reference).

rishav_sharan• 7 years ago

Do you think any ad purchaser will actually buy such an ad? What would be the engagement rates of such ads be?

I am not sure how viable such a company will be in the real world.

dumbfounder• 7 years ago

One big problem is that ad fraud is rampant. Knowing a person is really seeing the ad is very important, which tracking helps you confirm to a certain degree.

lanevorockz• 7 years ago

Google has been very naughty in the past few years. It does look like they removed the “don’t” be evil motto for a clear reason. And people thought that Investment Banks were bad.

DrScientist2• 7 years ago

Are Google engineers quietly working on alternatives? What is this repo? https://github.com/PolymerLabs/arcs

Also there was an interesting story a while back about a clash between advertising and the Fuchsia engineering team https://9to5google.com/2018/07/20/fuchsia-friday-respecting-...

colordrops3• 7 years ago

What is Arcs

ChoGGi2• 7 years ago

It seems to be 'an open ecosystem for privacy-preserving, AI-first computing'?

carapace• 7 years ago

Fuchsia’s engineers wanted to create a secure platform, but the advertising team, at the time, believed that privacy “goes against everything [they] stood for.”

csours2• 7 years ago

Do they have to prove that the RTB ID can be used to retrieve PII? Or only that the RTB ID is correlated with personally protected information?

Is it enough that a RTB ID is pseudo-anonymous? (it always identifies the same person, but cannot be used to find that person's real information) - OR - is a RTB ID not even pseudo-anonymous?

simpss• 7 years ago

GDPR definitions are slightly different.

A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII.

the ID would be pseudo-anonymous if one would need some extra data, to which they don't have access to, for linking the ID to one specific user in the whole dataset[2].

So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them.

[1] It's also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. https://www.lexico.com/en/definition/identifiable

[2] Definition of pseudonymisation, 5'th bullet-point: https://gdpr-info.eu/art-4-gdpr/ sheds some light on this.

csours2• 7 years ago

Awesome, thanks.

(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

metalliqaz• 7 years ago

Just 17 days ago I was downvoted into the abyss for suggesting that Google's GDPR "compliance" doesn't protect my privacy. And now this.

teamspirit2• 7 years ago

I think the HN community, and most consumers, tend to look at things from only one angle. Imagine you start work at some small shop that manufacturers widgets for consumers. What would you do when you have to advertise your product? You'd have to turn to Google is a similar company. Are there any real alternatives? (I am asking because I really want to know)

I say this because I am in this position now. I have to figure out how to advertise my company's products and am torn on how to go about it.

dleslie• 7 years ago

For actual, physical widgets the traditional advertising markets still work: trade magazines and trade shows. Contacting vendors who specialize in your market of interest and running promotions with them also works.

However, it's all a whole lot more expensive and effortful than running some Google ads.

teamspirit2• 7 years ago

And there lies the problem. The cost in both time and money is much higher. I'd love to run TV and magazine ads on all the shows and in all the magazines my customers are reading, it just costs a whole lot more. Way more than we have just starting out.

samtheprogram• 7 years ago

I think the point that's missing from the discussion is that adtech companies should be targeting solely on placement (i.e. what ads should show up on a particular website based on the content of the website), and not select individuals (i.e. based on user interests regardless of the place on the web an ad is shown), when faced with this kind of legislation.

This is exactly how marketing worked before and how people can go about it now, as you describe, through traditional advertising markets.

I'd personally prefer it that way in general, but legislation is necessary for them to optimize on those restrictions.

pornel2• 7 years ago

You advertise on a website for widget fans. That's how it successfully worked for a long time.

The whole targeted advertising is to allow adtech companies to identify users of the "widget fans" site, and then advertise to the same people, but on another, cheaper site.

pmlnr• 7 years ago

That's how it successfully worked for a long time... ... until google search and facebook groups killed thematic sites and communities.

I'd love seeing this turned around though.

bogwog• 7 years ago

Targeting existed long before computers. The difference today is the massive amount of very personal data being collected on people without their knowledge or consent and the risks it puts on them.

Imagine if you went back to say the 1920s, and you told a marketing director that you could install a one-way mirror room and back door into every household in the country, and staff them all with analysts who will secretly observe people in their homes 24 hours a day, 365 days a year. People would think you were crazy. In fact, I bet most people today would be completely against that idea, yet wouldn't realize that what companies like Google and Amazon are doing today is effectively the same thing, except _much more_ invasive.

aledalgrande2• 7 years ago

You find your audience and you target them directly.

mottosso• 7 years ago

Yes, thank you. I logged in just so that I could upvote this. Why isn't this more accepted of an answer? Why is spam everyone's goto?

drusepth7• 7 years ago

The alternative is to spend hundreds of hours finding widget-related websites, trying to contact the owner(s), negotiating what ad spots are available, what ads are acceptable to run, and what pricing/terms will work for both parties, then managing that relationship over time to ensure ads are actually being displayed, being paid on time, contracts renewed, etc.

It's definitely possible, but you're just doing everything manually that ad networks do for you. Whether that is worth your time (or worth it to hire someone to do this kind of thing for you...) is up to you.

frabcus• 7 years ago

AdSense used to do this for you before it tracked individuals...

You can still target adverts at content on a site, and have an aggregate system to make that easy and granular.

There could even be services which collected lists of websites and categorised them, and the rough demographics of their audience, and retailed slots.

Individual tracking is unnecessary financially, you can make as much revenue without. See example of the New York Time dropping tacking for EU readers for GDPR reasons, and continuing to grow ad revenue: https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut...

rhizome3• 7 years ago

Native ads like those can certainly be automated to a great degree, and at the very least use a self-serve interface. "Advertise with us!" links in the sidebar or footer or wherever.

Kalium• 7 years ago

At which point you'll very likely learn that a lot of widget-related websites use ad networks because it saves the 2-3 administrators involved a lot of time and energy.

It's definitely possible for small websites to do ads directly, but it's a lot of work. Often more than is justified for a few thousand dollars a year in ads.

soraminazuki2• 7 years ago

It's definitely possible, but you're just doing everything manually that ad networks do for you.

You've just explained how contexual ads used to work, which doesn't need all the invasive surveillance modern internet users have to put up with.

sailfast• 7 years ago

Online shop only, or brick and mortar?

Trade "print" media with an online presence. Online media that doesn't sell all their pixels to Google? Radio, depending on your audience and required reach? Forums specific to your audience that don't sell all their pixels to Google. Podcasts. Submarine articles in the trades? Open source ad networks that don't embed insanity or real-time bidding?

Mostly, I would try to target your initial audience as precisely as possible where they live, rather than with a wide net. Perhaps a Google search returns results for top websites dealing with your product - if they are not vendors, then perhaps you advertise on that site?

Disclaimer: I'm not a growth hacker, but I've thought about these things and run a couple of poor Facebook campaigns for a brick and mortar business.

harry8• 7 years ago

Look for genuine, verified success marketing stories for people in similar positions and follow similar strategies.

I've personally never heard of a success story for what you describe that involves paying google. But maybe they exist and they're just keeping it quiet?

gregknicholson3• 7 years ago

Surely Google has an obvious competitor, right? Because otherwise it would clearly be a monopoly.

JohnFen6• 7 years ago

I've started a few successful businesses, and all I can say is what's worked for me.

I've never needed to turn to Google or other ad-slingers. Instead, I've done things the old-fashioned way, by going to where my potential customers tend to congregate and engaging with them (this kickstarts word-of-mouth, which is still the best advertising you can get), hosting my own online forums for customers, going to trade shows as appropriate, and supplementing everything with a few direct-placement ads in carefully selected media.

Yes, it's more work -- what Google et. al. are actually selling you is convenience, after all. But the rewards in terms of of ROI as well as fostering a real community, complete with evangelists, are more than worth it to me.

Of course, ymmv.

idlerig• 7 years ago

This is exactly what happened in the McDonald's "hot coffee" lawsuit. It wasn't some "Karen" who hit a bump while driving. It was an elderly woman (in her 70s, IIRC), sitting in the passenger seat.

McDonalds already had complaints (and some lawsuits) over the (significantly higher than industry standard) temperature of their coffee, so this wasn't exactly out of the blue.

She ended up with 3rd degree burns on her legs and crotch. She asked only for her medical bills to be paid. McDonald's refused, so she eventually took them to court. Even then, she only asked for medical bills (and now legal expenses).

The jury decided that McDonalds was not only liable for those costs, but had treated the woman so poorly that they should pay punitive damages. The massive amount you heard about in the news was based on the amount of money McDonalds makes selling coffee in one day.

But that's not the story that was spread by the shills...

fmajid5• 7 years ago

And the money went to Shriners' Hospital, not the burn victim (I saw the photos, they are beyond horrific). What's more, McDonalds had been advised their coffee temperature was dangerous, but decided to ignore this for marketing reasons, because people like the look of steaming coffee.

WrtCdEvrydy• 7 years ago

Not even that... if you put the coffee that high, people would be less likely to ask for a refill as the coffee took longer to cool off.

mumblemumble• 7 years ago

The most interesting thing to me about that McDonald's "hot coffee" lawsuit is how different the narrative is in popular circles vs. in legal circles. It's a little bit like in Rashomon.

In popular circles, the story is framed in a way that does make the lawsuit look frivolous. But this is also a case that has made it into the legal textbooks as an example of corporate negligence that's clear-cut enough to use for demonstrating the concept in introductory textbooks.

Of course, in the legal textbooks, the version of the story that's told includes a lot of details that, as you point out, get excluded from the popular version.

endorphone2• 7 years ago

Are you a lawyer? Because this take is quite remarkable, especially given that the overwhelming public sentiment is that McDonalds was heinously negligent, coupled with a lot of supporting but not entirely factual claims to justify that position. I feel like the same people who were jeering at the victim just marched over to sainting her and demonizing McDonalds.

The Internet extreme position machine. Everything has to be clear cut.

How McDonalds no longer engages in "corporate negligence": they put pronounced warnings on the cup that it's a dangerously hot substance. That's it. They did not lower the temperature (as is frequently claimed, nor is the temperature at all outside of normal industry standards, yet this is being repeatedly stated throughout this thread -- coffee, brewing with boiling water, is hot). You can get a searingly hot cup of coffee from most quick-serve restaurants today depending upon how freshly it was brewed. This is a case where the solution is more warnings on things.

This case was, however, an example of bad brand management, and perhaps throwing good money after bad for something they could have privately settled early on.

This is certainly not a hill I want to die on, and generally arguing against the prevalent opinion (which is overwhelming the one that you and the GP have expressed, albeit almost always positioning it like it's contrarian) is self-defeating, however this whole case is fascinating in how public perception shifts.

frogpelt• 7 years ago

The reason the McDonald's lawsuit is framed that way in popular circles is because it is easily fits the mold for a frivolous lawsuit.

1. A woman willingly purchased hot coffee from McDonald's.

2. She spilled it on herself.

3. She sued McDonald's because of her injuries.

Those three things are true no matter which circle you ask.

A lot of people I talk to, even when given all of the facts of the case still consider it a frivolous lawsuit because they place almost all of the blame on the woman.

duxup• 7 years ago

But that's not the story that was spread by the shills...

I'm not sure that was the case at the time... specifically there being "paid shills" on the internet.

Concern / outrage over the legal system seems to be a bit of the human condition, I'm not convinced there was a conspiracy required to have folks retell an inaccurate story about that incident.

Sometimes it feels like anything that is perceived to be corporate friendly is called a "shill" as if individuals (mistaken or not) couldn't organically have X opinion.

throwaway_law• 7 years ago

Its actually even worse factually...its not just the coffee was hot and McD's had prior complaints, there are industry standards, which McDonald's knowingly and willfully violated.

It actually all relates to trucking/truckers who use their own special cups, but demand the coffee be scalding so it stays hot longer on the road. McDonald's catered to these truckers to grow their coffee business, they knew the risks and gave no warnings to customers. I think the employee was also negligent in securing the lid leading to the spill itself.

As you say the coffee was so hot it scalded this woman so badly through her jeans she needed skin grafts. And sure enough there was massive money spent to spin this in the media as "woman burned by coffee sues for millions, everything wrong with our litigious society." Where this should have read: giant corporation disregards safety standards to boost their bottom line to the detriment of its customers leading to boiling coffee that scalded a woman's privates requiring skin grafts, then in bad faith the insurer denies the woman's claim to pay her medical bills, drags her through court which they lose, then they drag her through the appeals process which she didn't want any part of either.

PJDK• 7 years ago

Curious how this one has changed on the internet.

From a UK perspective I'd always thought of it as a case of crazy pay-out. Why does this one women get several million dollars (although googling reveals this number went down a bit on appeal)? Especially if others had a similar experience. Either there should be a limit on the temperature of hot drinks, or there shouldn't.

The fact a warning is deemed adequate seems weird too, people will actively try and avoid spilling a stone cold cup of coffee on their lap!

It feels to me like the internet moved from shilling for big burger to shilling for big law firm.

dccoolgai• 7 years ago

The payout is because _without it_ companies wouldn't change what they do. The punitive damages serve as an "example" for other corps to not do the same thing or risk losing that much money, too. If anything, I think punitive damages for corporate negligence would be _higher_. Maybe some of the payment could be directed to funds for victims instead of all going to one person, but that person (and their lawyers) also had to combat a multi-million dollar defense team.

fencepost2• 7 years ago

From memory I believe the case was settled for a presumably lower undisclosed amount rather than go through a long appeals process.

briandear2• 7 years ago

How did the coffee spill? Did she hold a cup of a beverage that is traditionally served very hot between her legs?

That lawsuit was frivolous. Coffee is hot. If you spill it, it might burn you.

As far as just asking for medical bills — that might have been true until her lawyers smelled a multi-million payday.

Lawyers like that are the reason we have warnings on hair dryers to not use while showering and warnings on coffee cups that warn of the hot beverage inside. Coffee is traditionally made using boiling or near boiling water — unless McDonalds super-heated the water, the temperature at which it was served was consistent with how coffee is normally served.

That it was an elderly lady makes no difference. That’s just emotional distraction and has no relevance. The McDonalds lawsuit ushered in the “nanny” era where people have to be warned against such hazards as “boating carries a risk of serious injury or drowning.” And product costs (including medical care) is dramatically more expensive than it should be because the trial lawyers had to all get paid. Punishment under statute is one thing, but unlimited punitive damages is absurd. We talk about CEOs getting paid to much — not even close to the payday trial lawyers get.

eropple• 7 years ago

This is a bad and frankly cruel reading of a lawsuit that addresses systemic failures of a corporate entity that had been previously alerted to a design and practice failure of their operation. Similar lawsuits regarding coffee at 179 deg F, rather than 190 deg F, have been thrown out. Almost as if there was an actual problem with what McDonalds' was doing, you know?

That corporate entity had decided it was cheaper to not fix it than to fix it, until a human being who they contributed to significantly harming brought the problem before a jury. And she was found partially responsible for her own injuries, a fact which you elide (while speaking so authoritatively that I must assume you know this to be true, otherwise you wouldn't, yes?), while the jury also found that McDonalds' had been reckless in their operation--that most of the money awarded was a punitive penalty assessed because that corporate entity was cavalier in their treatment of actual, real-not-fictive people.

While we're at it, the punitive award granted was $480,000, not "multi-million"--though the jury asked for it, as two days of McDonalds' coffee revenue, and was reduced by the judge.

You've either been had, or you're trying to do the having. I shall not speculate on which.

mitchty• 7 years ago

Its pretty obvious you've not read up on the facts of the case and have jumped to a few conclusions. Nobody contests that hot coffee causes mild burns, hot coffee that causes third degree burns in seconds is another matter entirely.

https://segarlaw.com/blog/myths-and-facts-of-the-mcdonalds-h...

Have a read and then come back here and lets hear you argue that the lawsuit wasn't warranted.

nitwit0052• 7 years ago

McDonnalds didn't hire any internet shills or anything like that. The media bought into their lawyers public claims about the case without bothering to investigate anything, and the TV talk show circuits picked it up.

Unfortunately, you often don't need to try particularly hard to get the media to repeat false claims.

DamnYuppie• 7 years ago

Especially when you have one of the largest advertising budgets in the world!

zajio1am2• 7 years ago

This is exactly what happened in the McDonald's "hot coffee" lawsuit. ... But that's not the story that was spread by the shills...

Well, all of these changes (perhaps with the exception of industry standards) are IMHO irrelevant to responsibility of McDonald for the incident.

dang7• 7 years ago

We detached this subthread from https://news.ycombinator.com/item?id=20877309 and marked it off-topic.

tbodt• 7 years ago

There's some documentation for this mechanism: https://developers.google.com/authorized-buyers/rtb/cookie-g...

bogomipz• 7 years ago

The article states:

"The primary targets of this campaign are Google and the IAB, which control the RTB system."

Can someone say who makes up the IAB exactly? Is this just an industry trade group?

singron2• 7 years ago

Yes. Take a look at their board of directors: https://www.iab.com/our-story/#board-of-directors

It's a mix of the major players in the digital advertising industry. Historically the IAB has taken actions that are good for the industry overall. It focuses on standardization/interoperability in the ad-tech space. It generally isn't a watchdog and doesn't regulate the industry except when the industry as a whole would benefit (e.g. self-regulatory programs that have no real effect but stave off state regulation).

la_barba4• 7 years ago

Is there any way to improve the matching of ads to the viewer without violating their privacy?

fmajid5• 7 years ago

The matching is in itself a violation of privacy, at least if you interpret the right of privacy as "The right to be left alone", as former Supreme Court Justice Louis Brandeis put it.

rpastuszak7• 7 years ago

I think that’s incorrect, relevant ads could be displayed based purely on the site content, without user info attached to ad calls. We’ve been there.

la_barba4• 7 years ago

Yes, thats what I was thinking too. For Google, being in the ad business itself necessitates that Google's trajectory will be on shaky ground w.r.t privacy.

gowld2• 7 years ago

They will leave you alone if you choose not to send an HTTP GET call requesting content.

rpastuszak7• 7 years ago

Yes! Contextual Targeting (target based on what I am reading) could work, although the industry seems to be clinging to Behavioural Targeting (target based on who I am). This will become more important for Open Web due to the 3p cookie constraints, regulatory changes etc..., but Google/Amazon/FB are less likely to be impacted.

In fact Contextual Targeting predates the current approaches, but it became less important once advertises/adtech companies started preaching the thinly veiled idea of using behaviourism to trigger conversions/less products.

Changes like this are slow to introduce due to technical and (mainly) structural/cultural issues in the Advertising Industry, but that’s a topic for an entire essay/series of blog posts.

Source: I work in AdTech and deal with privacy/the ethical impact of programmatic, content monetisation models. Opinions obv. mine.

la_barba4• 7 years ago

Yes, we can do contextual targeting, but after that, what are the ways to improve upon the outcomes (from an advertisers standpoint) without violating privacy?

shostack• 7 years ago

Mind sharing which company you work for? I'm interested in scaling contextual, privacy-focused publisher targeting solutions.

On the PG/PMP side, the usage is obvious, but I'm also curious what it will take for publisher-provided data to be trusted in the open exchange environment where historically advertisers and DSPs have tended to not trust the publisher-supplied categorization.

lpgauth• 7 years ago

I really doubt Google Adx would pass buyer_uid to buyers in EU28 countries. They were the first ones to truncate IPs in EU for privacy reasons.

We've stopped cookie matching in EU28 countries so I can't verify if they do pass the buyer_uid.

notatoad• 7 years ago

can somebody explain in simple terms what Brave is actually accusing Google of doing? The article seems to be written in a way that matches the language of the GDPR legistlation, instead of language actually meant to be read by people, and i can't figure out what the "workaround" actually is.

unityByFreedom• 7 years ago

Agreed, this is so wordy, this is what I got,

Google claims to prevent the many companies ... from combining their profiles about those visitors
Brave’s new evidence reveals that Google allowed not only one additional party, but many, to match with Google identifiers. The evidence further reveals that Google allowed multiple parties to match their identifiers for the data subject with each other.

BTW, many comments in here seem quick to agree w/this headline given how buried the details are. If someone has better detail, please share it.

gundmc• 7 years ago

I take exception with Brave's phrasing here.

Essentially, Google assigns an anonymized identifier to a user and sends that to prospective ad buyers. The idea is that the ad buyer can use this to target ads to people who have visited their site as they browse other areas of the internet participating in Google's auction. This is called remarketing.

An example. You go to footlocker.com and put a pair of sneakers in your shopping cart but decide not to buy. When you go read an article on the New York Times site, a potential advertiser recognizes your anonymized id and bids to serve you an ad for the sneakers.

The issue Brave is raising is that the same anonymized id is served to each potential ad buyer. This isn't an issue with data Google collects or exposes, but Brave states that buyers could theoretically collude to build profiles by sharing the data collected on their own sites with each other joining by Google's identifier. There is no evidence of this actually happening and Google's contract with ad buyers specifically prohibits this activity.

Ayesh2• 7 years ago

It's also written in third-party speech, with emphasis on spooky details rather than technical details.

cavneb• 7 years ago

I am so glad that this violation is being exposed. Well done Brave!

I invite any developer / blogger to check out https://CodeFund.io. We are a non-tracking 100% open source ethical ad platform that focuses on funding open source.

dang7• 7 years ago

It's ok to occasionally link to one's own site in relevant contexts, but only as a small part of using HN as intended—i.e. for gratifying intellectual curiosity: https://news.ycombinator.com/newsguidelines.html

But it looks like you've been using HN primarily to do this. That crosses into spamming, so please don't.

gnud2• 7 years ago

Is it really a "workaround" if they're just breaking the law?

I mean, if the allegations are correct, Google didn't find any loophole, they're just hiding the fact that they're selling person identifiers.

TheArcane• 7 years ago

EU should raise the 4% annual turnover rule to 10%. Google doesn't seem to be deterred

rat9988• 7 years ago

There is a reason they didn't. They fear the US government's reaction.

Edit: Why downvote? Do you really think that the US government will stay silent if the European Union threatens with such fines? Political tensions are something you take heavily into account.

pgeorgi• 7 years ago

GDPR enforcement is 15 months old and regulators aren't the fastest bunch. They're also cooperation based as the goal isn't to serve fines but to ensure compliance: If you cooperate, you might get away with no fine at all (depending on circumstances).

Also the 4% global revenue fine wasn't exercised yet because it's the maximum fine, and there needs to be room for escalation: hard to serve a bigger punch if you're already at the maximum.

jiveturkey• 7 years ago

This, combined with other cookies supplied by Google, allows companies to pseudonymously identify the person in circumstances where this would not otherwise be possible.

At first glance, I would have thought this isn't a workaround at all. GDPR allows for pseudonymisation as a method of data protection. But, Recital 26 of the GDPR disallows this:

The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. [...]

That said, I don't think this is cut and dried, because Google themselves isn't providing the linkage to an identifiable natural person. The person that can make that linkage necessarily already has the identifying information. Get ready for a major legal battle.

bluesign4• 7 years ago

I checked the sample log provided.

Below is the google_gid for different publishers, there is no proof of overlap, they have different google_gid for same person. Which is exactly what google describes. [1]

I don't understand what Brave claims.

  d.agkn.com          CAESEP-S3Zs5f0_kq11XTCZP_mE
  id.rlcdn.com          CAESEPpf2T4-2AsAR_4rer3RfNs
  image6.pubmatic.com          CAESEB9H3qdV26kxEiz-BJ_TY-M
  pippio.com          CAESEJyqG1Pg1j-_scqW8kDzTkg
  token.rubiconproject.com         CAESEE1DyZ245WggYaQZEWpQWI8
  us-u.openx.net          CAESEPIJ9jHcY2j4jK3-DPmfar4

[1] https://developers.google.com/authorized-buyers/rtb/cookie-g...

ggg3• 7 years ago

which is the "workaround" to the gdpr the article badly describes (probably because brave upcoming ad network will do the same but more workaroundily)

now those are used to match a 3rd party id. you just need a gdpr_workaround schema in your data base with two columns user-id, google-random-id with N-1 records indexed both ways.

gdpr has restrictions on pin pointing a single person. this is effectively doing that, but claim it is not, because random ids. apple is just a little better with how device-advertiser-id works.

halr9000• 7 years ago

Well, the “right” workaround is an opt-in system. But that would drastically reduce the number of qualified ad prospects, reducing their wholesale value, killing the online ad business, drying up the websites themselves who exist for this revenue (some/many of which are trash, but not nearly all).

I don’t think we can have it both ways, or at least it is very difficult and we don’t have a great compromise solution.

jancsika• 7 years ago

probably because brave upcoming ad network will do the same but more workaroundily

AFAICT Brave's plan is to send a block of potential ads to the client and use a client-side machine learning algorithm to choose specific ads. So the claim is that none of client events, inferences from the algo, nor ad choices travel from the client to the ad networks. (But ad networks retain their crazy microtargetting which I guess is the selling point.)

Even if Brave were to choose the blocks of ads based on geolocation and other install-time/runtime data which they then sell to third parties, it's still significantly less data leaking from the client's browser compared to, say, a default Chrome install. But them storing/selling that would be a clear GDPR violation as well as going directly against all their explicit public claims so far.

What is your understanding of Brave's upcoming ad network that leads you to believe it requires a surreptitious GDPR violation?

mintplant3• 7 years ago

This log [0], right? Did you miss in the article that it's the `google_push` identifier that's being used for syncing between adtech companies? If you search for it (AHNF13KKSmBxGD6oDK9GEw5O0kvgmFa3qM30zpNaKl72Og), you can see it being included in requests to lots of different adtech firms' domains.

[0] https://brave.com/wp-content/uploads/files_2019-9-2/sample_p...

bluesign4• 7 years ago

There is unfortunately no way to prevent that part.

BidRequest Data [0] and Request Time is already enough to fingerprint the user.

"Google prohibits multiple buyers from joining their match tables." part is not technical, it is contract based.

[0] Sample Data from Bid Request

  ip: "F\303\006"
  user_agent: "Mozilla/5.0 (Linux; Android 7.1.1; Pixel XL Build/NOF26V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36"
  url: "http://www.myfitnesspal.com/food/calories/popeyes-buttermilk-biscuit-29980768"
  cookie_version: 1
  google_user_id: "CAESEIMlaNwMN-rtiDFzjwNIX6Y"
  timezone_offset: -360
  detected_content_label: 39
  mobile { is_app: false 3: "android" 8: 1 12: "google" 13: "pixel xl" 14 { 1: 7 2: 1 3: 1 } 15: 412 16: 732 18: 70092 19: 3500 }
  cookie_age_seconds: 12960000
  geo_criteria_id: 9023221
  device { device_type: HIGHEND_PHONE platform: "android" brand: "google" model: "pixel xl" os_version { major: 7 minor: 1 micro: 1 } carrier_id: 70092 screen_width: 412 screen_height: 732 screen_pixel_ratio_millis: 3500 }

bluesign4• 7 years ago

Also another benefit of google_user_id vs Google's Ad Manager cookie is, it expires after 14 days. So after 14 days, you will get new google_user_id for same user. So syncing between adtech companies does not have much value.

matempo334• 7 years ago

You are implying that this mechanism is already used by adtech providers, we have no proof. Those players are often competitors that are not working together so they won’t share their user data (not a user identifier, only a “page load” identifier). If they want to sync their user ids (because one is buying inventory from the other), they can launch a cookie sync between themselves (same process as with google_gid, persistant user identifier, much more efficient)

rtbthrowaway• 7 years ago

I've worked in the sector for years and honestly thought this was well documented, common knowledge: https://developers.google.com/authorized-buyers/rtb/cookie-g...

The only thing Google did in regards to GPRR was limit the number of parties in RTB they're including by default for syncing to a "trusted set" of parties.

annoyingnoob• 7 years ago

I think the silent/invisible nature of cookie sync'ing is what upsets people when they discover it. T

he diagrams in your link show a single hop for the 302, in my experience that can be many hops going between different advertisers. The same thing happens on non-google platforms, like TradeDesk and others.

The sync scenario can make it next to impossible to delete cookies when those cookies can be rebuilt using data from others.

matempo334• 7 years ago

Sad that Brave did not do their work correctly, the google_push parameter they are talking about is not an identifier. Otherwise it’s true that RTB should not exist and violate GDPR, but it’s so complex that even Brave was not able to correctly state the workflow.

See their release note (15 April 2013); https://developers.google.com/authorized-buyers/rtb/relnotes

“Starting in mid-April, we will begin assigning a URL-safe string value to the google_push parameter in our pixel match requests and we will expect that same URL-safe string to be returned in the google_push parameter you set. This change will help us with our latency troubleshooting efforts and improve our pixel match efficiency.”

mintplant3• 7 years ago

Okay, but the `google_push` parameter seems to be the same for all adtech providers swarming on the same user in the same RTB session. Nothing in your comment contradicts the claim that this allows them to sync up profiles for that user across providers, in the way that the switch to per-provider `google_gid` values supposedly blocks.

matempo334• 7 years ago

Well, for 2 page views (same session), I have 2 different ‘google_push’ (Chrome with default parameters, no extensions).

aphextim3• 7 years ago

a_imho2• 7 years ago

Google has been violating GDPR from day one.

drusepth7• 7 years ago

That's not surprising seeing as how GDPR was pretty much drafted explicitly against Google.

a_imho2• 7 years ago

That's just your bias and no grounds for violating it. In fact, if it was true the more reason to comply. But it is obviously false, seeing Google can still do whatever they wish without serious repercussions.

panpanna3• 7 years ago

Friendly reminder that this is all to show you "targeted ads".

You can fight back by providing fake and bogus data. For example, there are browser extensions that do this for you.

aledalgrande2• 7 years ago

After this, do you still want to use Chrome? Who knows what data they are sending when they control your desktop experience.

nautilus12• 7 years ago

"Don't worry about being evil"

joefkelley• 7 years ago

I'm an engineer who has worked on ad systems like this and I'm really struggling to make sense of this article - what hope does a layman have?

Here's my understanding: Google runs real-time bidding ad auctions by sending anonymized profiles to marketers, who bid on those impressions. The anonymous id used in each auction was the same for each bidder, which is in violation of GDPR. If Google were to send different ids for each bidder, it would be ok? Is this correct?

Why would it matter that the bidders are able to match up the IDs with each other, aren't they all receiving the same profile anyway? Wouldn't privacy advocates consider the sending of the profiles at all an issue?

aeorgnoieang4• 7 years ago

Why would it matter that the bidders are able to match up the IDs with each other, aren't they all receiving the same profile anyway?

I would guess that yes, they're all receiving – _from Google_ – the "same profile" but they also are collecting additional info that they can then share with each other and, because they can match profiles exactly, they can access each other's info about specific people.

Wouldn't privacy advocates consider the sending of the profiles at all an issue?

I'd imagine that the profile Google has and shares is by itself fairly anodyne, but I could be (very) wrong about that. The problem seems to be more (if not entirely) that different advertisers can share info using a common profile ID.

I'd imagine that even a single advertiser would be able to perform a similar 'attack' by, e.g. running multiple different campaigns, but I may be misunderstanding exactly what info is being shared. It's possible advertisers are able to match the Google profiles to specific unique identities and thus are sharing much more than just the info they're collecting directly from their ads.

chii• 7 years ago

If it's the different advertisers who are going to share info, then why aren't they responsible for their own adherence to GDPR, rather than Google?

whamlastxmas• 7 years ago

Are they maybe only receiving a partial profile, with info relevant to that ad buy? And by compiling that data with the unique identifier, they can match it with other partial data from other ad buys?

Despegar• 7 years ago

The answer is: RTB is illegal and we're just waiting for the courts to decide on it.

avanderveen• 7 years ago

This is a problem because companies can use this ID to correlate private user data, without anyone's knowledge or consent.

There are companies that specialise in sharing user information. Some of them work by only sharing data with companies that first share data with them (an exchange).

If you got this Google ID, and you had a few other pieces of information about the user, you could share that data with an exchange, indicating that the Google ID is a unique identifier. Then, the exchange would check if it has a matching profile, add the information you provided to that profile, and then return all of the information they have for that profile to you.

So, let's say you're an online retailer, and you have Google IDs for your customers. You probably have some useful and sensitive customer information, like names, emails, addresses, and purchase histories. In order to better target your ads, you could participate in one of these exchanges, so that you can use the information you receive to suggest products that are as relevant as possible to each customer.

To participate, you send all this sensitive information, along with a Google ID, and receive similar information from other retailers, online services, video games, banks, credit card providers, insurers, mortgage brokers, service providers, and more! And now you know what sort of vehicles your customers drive, how much they make, whether they're married, how many kids they have, which websites they browse, etc. So useful! And not only do you get all these juicy private details, but you've also shared your customers sensitive purchase history with anyone else who is connected to the exchange.

bluesign4• 7 years ago

Considering google_gid is valid for you for 14 days only. It is very unlikely to build a profile around it.

koffiezet• 7 years ago

To participate, you send all this sensitive information, along with a Google ID

Isn't that also a GDPR violation?

bertil2• 7 years ago

Thank you: that explanation is the first that makes sense to me.

I get the impression that this structure would require an exchange: retailers would not trust each other otherwise.

Wouldn’t commercial pamphlets, interviews with salespeople, etc., from the exchange be obvious proof of illegal behaviour there? Google’s implementation is imperfect but, for the loophole to work, it would need coordination between several competitors and third party with a business model explicitly and almost exclusively about going around against GDPR.

If I can risk a comparison, that would be Google is like a chemical company selling fertilizer, and the exchange is selling bombs made from raw material bought by other people.

Am I missing the point? Shouldn’t this article be about those exchange and their clients, not Google?

stunt• 7 years ago

I remember they dropped "Don't be evil" from their code of conduct a couple of years ago.

crtlaltdel• 7 years ago

brave is incentivized to push this narrative, accurate or inaccurate as it may be. i am not ad-tech guru, nor digital marketer. i do know that brave's entire premise hangs on traditional ad-tech strategy remaining static, consumer sentiment around "big tech" to sour and a groundswell of "privacy focused consumers" to materialize. that groundswell is their identified target market for their product.

trpc• 7 years ago

What's funnier is that Brave """product""" is nothing more but a theme over Chrome that any 12 yo kid can do in 2 hours, an adblocker based on FOSS blacklists and some compilation flags that prevent Google from enabling its own server features and tracking system and redirecting the tracking system to their own servers. Yet their entire PR and marketing is based on "Google is evil!". In any other industry this scam would have been shut down and the management would have been sued to probably jail time. But in tech, many things are blurry.

Ayesh2• 7 years ago

I also see how Brave likes to thrive on anti-Google pro-privacy camp and I personally pick Firefox over Brave any day if the week.

There is de-Googled Chromium OS project, but Brave takes a few steps sideways by making further changes such as proxying location services, safe browsing API, etc. I doubt a 12 y/o could compile it though, let alone in 2 hours.

danis1• 7 years ago

Which is the reason Brave is in a good position to do this kind of work. They represent a growing portion of web users, and their research helps to give these users a voice.

jwildeboer• 7 years ago

Hundreds of deflecting comments about coffee at McDonalds and astroturfing. Well done! Can we now talk about how Google uses creepy tactics to undermine privacy and the GDPR?

senegoid• 7 years ago

The sharing of data is what makes RTB valuable and most likely viable.

Because what Google are doing is not dissimilar to how any other RTB participant is acting, saying this is a Google workaround seems disingenuous.

Unfortunately I fear this will only embolden Google to further monopolize digital advertising.

downandout3• 7 years ago

Yeah. Brave is desperately trying to compete with Chrome and can’t figure out why they aren’t making much headway, despite having better privacy (hint: users just don’t care about privacy, except for the HN crowd).

These complaints filed by Brave, with their own employees posing as professional “victims” intentionally grasping at straws for evidence of privacy violations, smack of desperation. This is not the first claim they have filed, and sadly, it won’t be the last. Their claims thus far have been disingenuous at best, downright dishonest at worst.

GDPR was not meant as a weapon with which one could hobble their far more successful competitors. It’s sad to see that a company that claims to care so much about privacy is undermining GDPR by bringing the worst fears of those that opposed it to life.

rhizome3• 7 years ago

(hint: users just don’t care about privacy, except for the HN crowd).

I'm not sure that's true: uBlock Origin has twice as many installations as Brave does. You might say "oh, but that's just blocking ads!" But if you don't block ads, privacy problems are going to spring out of the woodwork like nobody's business. That is, they might not care about privacy by name, but they certainly care about it in effect.

downandout3• 7 years ago

I’d say the vast majority of uBlock users care about user experience. The current ad experience sucks. Most local newspaper sites, for example, are unusable because of ads. But if it still preserved their privacy behind the scenes and didn’t significantly improve their experience, the install base on uBlock and other ad blockers would be near 0.

gtallen1187• 7 years ago

I'm glad this story was reported, and I'm thankful to the author for putting in the work required to report this story. But after the first five paragraphs, the author's shameless, repetitive self-promotion and insistence on referring to himself in the third person almost made this unreadable.

The headline was enough to pique my curiosity to explore Brave's product offering. Unfortunately, actually reading the article had the exact opposite affect.

dvcrn• 7 years ago

I thought the exact same thing after reading the first few paragraphs but didn't even notice that the author IS Johnny Ryan, the person mentioned in the story, until you pointed it out.

I didn't make it to the end, closed the tab and went over to HN comments for a summary.

laythea4• 7 years ago

Presumably ads are so valuable because people click through them and go on to purchase.

I realise I am in a minority, but I have never clicked on a digital ad and went through to buy something, and I never will.

The minute I see ads on a webpage, I automatically associate that site with trash. (Please take note HN :))

It is as if humanity cannot be trusted with technology. This creates a certain "ceiling" for us in terms of development as a species. Such a shame.

tapland2• 7 years ago

The minute I see ads on a webpage, I automatically associate that site with trash.

You might want to reconsider

laythea4• 7 years ago

Care to elaborate a little?

craftinator• 7 years ago

You might not want to reconsider.

bduerst2• 7 years ago

The ads you're referring to here are called display ads. Most of these ads are not about getting you to click, but about awareness.

It's the same thing as a full-page advert in a magazine that you flip through. For some readers, they will stop an read it, raising awareness to that brand/product/company etc.

laythea4• 7 years ago

I take your point about being "exposed" to the product, however it must be the case that ads want you to click them, otherwise clicking them would not do anything. Which is not the case.

A company spamming my eyeballs with visual ads to "raise awareness" does not get my money. I take particular offence to that, as it is my screen. Not a Billboard for example.

My point is proven in the HN website, where it enjoys a large readership, largely influenced by the sites clean, ad-free design.

Slashdot used to be like that until they started displaying ads, and that is what brought me to HN. Thank you HN for not doing this.

erichocean• 7 years ago

Does GDPR only apply to individuals, or can I find out all of the information that is being held by Google (or anyone else) on my EU-based business?

afarviral• 7 years ago

At this point I'm just waiting for some of these tech companies to drop their analytics and drop targeted advertising, and just ask users for their advertising preferences or do advertising the traditional way... why do we HAVE to have targeted advertising? It's either hit or miss, or too creepy anyway...

banku_brougham• 7 years ago

People are missing the point. Google is trying to manage GDPR and their previous business model which is selling all that user data. They are not going succeed and GDPR is going to prevail.

decide1000• 7 years ago

The article claims that personal data is shared along 2000 companies. As far I understand those companies do not receive personal information. I do not see real proof.

falsedan• 7 years ago

I think a large cause of impedance for engineers to understand the issue is: randomly-assigned ids don’t anonymise users, because you can still attribute an action uniquely to one user (even if you don’t know their name/personal details).

I think of it like the UID I get on a UNIX machine: it identifies me, and anyone with /etc/passed can get my name, and things that don’t have access to it can still see “oh uid 1099 is logging in again to play nethack”.

leegr• 7 years ago

Cringe

Google’s GDPR Workaround

Related Stories