Max Schrems wins privacy case against Meta over data on sexual orientation

https://apnews.com/article/facebook-meta-schrems-privacy-80fd4e6c59f48a3b583d6665af3ede86

by c420 • 2 years ago

144 107 2 years ago

sofixa• 2 years ago

Max Schrems is an international treasure.

Meta said it was awaiting publication of the court’s full judgment and that it “takes privacy very seriously.”

I wonder how Meta employees can keep a straight face lying their faces off. I'm getting second hand embarrassment from them. Imagine being caught in such a blatant and egregious privacy violation and having to gall to make such a claim.

hyggetrold2• 2 years ago

I wonder how Meta employees can keep a straight face lying their faces off.

Did you see that Social Dilemma documentary? People only find their conscience after they've checked a big bankroll.

I've been in tech for almost two decades now and I've seen many many many good people throw their values right out the window once the price was right.

paul79863• 2 years ago

If you're a startup founder with high morality you could never go against you are going to have trouble succeeding!

diggan• 2 years ago

Meta/Facebook kind of have a track record of strong claims that doesn't really hold up when scrutinized.

From https://www.llama.com/

The open-source AI model [...] Llama is the leading open source model family

Then from https://huggingface.co/meta-llama/Llama-3.2-1B

License: Use of Llama 3.2 is governed by the Llama 3.2 Community License (a custom, commercial license agreement).

In that license: Section 1(b)(i) requires you to display "Built with Llama" (branding requirements, really?). Section 2 has additional restrictive licensing requirements. Section 5(c) has retaliation that your license is terminated if you initiate legal proceedings. There is probably more too.

Pretty close to "Not Open Source". Yet, Meta continue marketing Llama as such.

mistrial9• 2 years ago

yes and, it is essential that Meta is doing this with LLama at this time.. it is literally at their whim. so, complicated...

gopher_space• 2 years ago

It feels safe to ignore licenses on models trained with copyrighted material. Meta should feel free to open that can of worms if they’re bothered by it.

HeatrayEnjoyer• 2 years ago

There is no way that legal proceedings clause could hold up.

scotty79• 2 years ago

They are taking privacy, very seriously.

imron• 2 years ago

Beautifully placed comma

CommieBobDole• 2 years ago

That's just basic PR-speak; it's apparently important to release a statement saying "we are and have always been very serious about not doing (thing that we do and got caught doing)" after you've been caught doing a thing.

I think the idea is there's some percentage of the public that will just uncritically accept the last thing they were told as gospel truth, and the rest don't believe you any less than they did before, so it's a net win.

makeitdouble2• 2 years ago

To note, they're not talking about not screwing X.

All they're saying is they take X very seriously. Which can be interpreted positively by some, yet doesn't put them too much at risk when tomorrow they're found again screwing X. They'll still be taking X very seriously at that time.

nprateem3• 2 years ago

And of course that you welcome the judgment against you and look forward to blah blah blah

CatWChainsaw• 2 years ago

I just mentally translate any PR statement like that as "fuck you we'll keep doing what we're doing, enjoy your portion of the paltry fine we pay once you receive it after a decade of appeals."

Alupis• 2 years ago

The article is short on details. Schrems alleges that Facebook somehow picked up his sexual orientation from a panel meeting, and then advertised to him based on that?

Is it not more likely that the group of people/profiles and activities he participated on Facebook are what "outed" him instead?

I had hoped for more details about how Schrems and/or a court were able to prove Facebook took his off-site meeting into account and based ads on that alone.

stavros• 2 years ago

Yes he is, please donate yearly to https://noyb.eu/.

1vuio0pswjnm7• 2 years ago

Meta does take privacy seriously. It is an existential threat to their "business". Meta is serious about violating privacy for profit.

kibwen• 2 years ago

I wonder how Meta employees can keep a straight face lying their faces off.

We have created a dystopian system where honesty is punished and lying is incentivized. This is the only natural outcome anyone should expect.

suprjami• 2 years ago

2024: When asking companies to comply with the law is being an "activist".

macintux• 2 years ago

Taking a company to court is definitely in the realm of activism.

elric• 2 years ago

Demanding that your basic rights be respected by billion-dollar scale ad-peddlers doesn't sound like activism to me.

infamouscow• 2 years ago

This says more about the (low) quality of the AP and it's (mediocre) editorial staff than about TFA and EU citizens exercising their rights in a court of law under the GDPR.

makeitdouble2• 2 years ago

Perhaps the lesson is we should all be activists. We set activism as a civic duty, and teach it in primary school.

crazygringo2• 2 years ago

What does 2024 have to do with it?

That's always been a major component of activism, because legal compliance is never automatic or something you should take for granted. Nothing has changed.

Other major components include changing the law, and changing people's behaviors where law is irrelevant.

teddyh• 2 years ago

“You want justice? You’re a troublemaker.”

— <http://freefall.purrsia.com/ff2700/fv02673.htm>

jmd423• 2 years ago

Schrems has launched several strategic court cases like this to push back on privacy issues, and even runs a non-profit focused on doing so.

I think "activist" is just giving him well-deserved credit for the amount of legwork he puts in to see these cases through.

He is absolutely doing this out of principle / for a cause, and not because of his own individual grievance - he just needs to be able to point to something affecting him personally to give him the legal footing to bring the case to court.

JumpCrisscross5• 2 years ago

Do these rulings assign damages or fines?

buzer• 2 years ago

As far as I understand CJEU does not, at least not on this type of case where their opinion regarding EU law is asked by national court. Damages & fines are left to national courts, in this case Austria's Supreme Court (who might send it back to lower courts, I do not have any specific knowledge of Austria's court system).

AStonesThrow5• 2 years ago

The court decision pertains only to targeting advertising to the same user.

They didn't say that the data can't be collected. They didn't say the data can't be processed at all. They didn't say that the data can't be "aggregated and analysed" for some purpose other than "to offer him personalised advertising".

Meta does indeed offer controls to disable personalised and targeted advertising. If Schrems had disabled these settings appropriately, would Schrems have learned what Meta knew? It would seem that the targeting and personalisation is often the only way a user will find out what social media knows about us.

So IMHO, this is a sad, sad day for your privacy and Schrem's privacy, because if Meta can't reveal what they know about us through advertising and targeting, then Meta does indeed take Meta's privacy very seriously.

impossiblefork• 2 years ago

Article 9 of the GDPR says:

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

There is a list of exceptions, but I'm not sure any of them apply. I don't really see how what the court says matters all that much. They can't overturn the law.

welcome_dragon• 2 years ago

Wait so someone at Meta entered somewhere that this person is gay? Or was this based on, say, cookies and general browsing habits?

I think of the story where Target was pushing diaper ads on someone before her dad (maybe even her?) knew she was pregnant

AStonesThrow5• 2 years ago

Sure, Schrems' claims seem to hinge on the fact that the only evidence of direct self-identification by Schrems is that one instance of a verbal claim on a panel discussion. (That is not how sexual orientation works, by the way: it necessarily involves conduct, activity or interests...)

But if advertising works on a recommendation engine basis, or groups similar tastes together, then if someone uses the Meta platform enough, there will be circumstancial evidence that this person's interests and activities coincide with other gay people.

Perhaps the merit of the case rested with Schrems barely using Meta/FB, not providing any direct data or engagement, and only to discover that advertising was targeted. Of course, Meta is a vast platform, including comments sections and widgets and third-party cookies across many websites.

But Meta takes Meta's privacy very seriously, so perhaps nobody but the court will ever see what Meta and their partners learned about Schrems, or how they learned it.

tbrownaw• 2 years ago

Perhaps the merit of the case rested with

If only the AP had gone web-first instead of staying legacy, we'd all probably be able to just follow a link to the actual case information instead of having to guess.

froh3• 2 years ago

it necessarily involves conduct, activity or interests.

nit: did you mean conduct (which connotes moral principles) or did you mean plain behaviour (which doesn't lump what you do together with if it's "right" or "wrong", according to some but maybe not some other rulebook)

nprateem3• 2 years ago

That is not how sexual orientation works, by the way

The way it works according to this judgement seems to be that if you don't explicitly tell FB something, they can't use the data anyway for targetting ads.

This sounds like it'll kill the vast majority of their inferred data points, as well as any ingested from 3rd parties.

Sounds fair enough to me. Glad I sold my FB shares last month.

helsinkiandrew• 2 years ago

Wait so someone at Meta entered somewhere that this person is gay? Or was this based on, say, cookies and general browsing habits?

General browsing habits - he interacted with ‘gay content’ - websites, facebook groups etc. so could be targeted by advertisers that wanted their ads shown to people who interacted with that content.

I don’t think FB have a gay checkbox for targeting now but advertisers can choose websites and FB groups. Im not sure if this ruling effectively kills FB targeted advertising using data from outside FB or just if you're gay or not

jfengel• 2 years ago

Huh. I would have expected the company to go with "we didn't say gay and we didn't use external information. We just noticed that users who like X page buy a lot of copies of Playgirl so we hooked you up".

Sounds like he managed to prove more in his case than is apparent from the article.

contravariant• 2 years ago

Privacy legislation has always been a bit iffy about the distinction between data and information. Depending on how this ruling treats that issue it could have knock-on effects.

Basically the issue here is that meta was almost certainly in possession of information on Max's sexual orientation and was using this information for advertising, but it's unclear if they had any data.

Privacy wise it is great that even partial information counts, but practically almost any data about a person is tainted with fractions of bits of information about their sexual orientation (or political views, or almost any of the protected classes of information). Without resorting to information theory I don't really see any way forward that doesn't end up in endless court cases over how much information is too much.

Then again we could just ban targeted advertising and avoid the whole issue in the first place. When differential privacy gets to a usable state we can worry about those instances where it would be nice to use some information for the public good without infringing privacy.

jmd423• 2 years ago

I don't think he even needed to prove that.

Rather it's that, in the course of evaluating this case, the court has been forced to make statements clarifying how certain rules and principles in GDPR are to be interpreted. And this has, in effect, narrowed the way Meta etc can use data.

Which for Schrems is really his ultimate goal anyway - his case is just a way to force the courts to rule / establish legal precedent on broader issues.

crazygringo2• 2 years ago

Schrems had complained that Facebook had processed personal data including information about his sexual orientation to target him with online advertising, even though he had never disclosed on his account that he was gay. The only time he had publicly revealed this fact was during a panel discussion.

But processed what personal data? Where would Facebook even get reliable data on users' sexual orientation in bulk? It's not like you can buy that the way you can get credit scores or geographic locations. (Or can you? I've never heard of it.)

I'm very curious for the actual details here. And just because you get ads for products that seem to be marketed to the gay population, what leads the court to determine FB "identified" him as gay? My YouTube regularly has random ads in Spanish probably just because of some bug. Most ads seem to mistarget me, in fact.

bastawhiz7• 2 years ago

I'd guess that it's inferred from the content you interact with. If you spend a lot of time liking fireman calendar photoshoots and give no likes to women in swimsuits, there's a reasonable inference to be made.

I'd also guess that Facebook can do this pretty reliably for gender and age, martial status, parental status, and lots of other things.

kgeist2• 2 years ago

What if the underlying algorithm simply matches "users who like X also like Y" without having concepts like sexual orientation baked in. And it just happened that it accidentally suggested certain things gay people generally like, because Max Schrems liked that "X" once.

justinclift5• 2 years ago

If you spend a lot of time liking fireman calendar photoshoots ...

That could be incorrect if (say) someone was researching fireman calenders for some non-sexual reason. ie boss assigned them the task of writing an article about fireman calenders through history

I'd have to wonder what other weird things such a person would be labelled with, given that they'd probably be researching a bunch of topics every week or so. ;)

dumbo-octopus• 2 years ago

FB trackers that phone home on various websites, for one.

phito2• 2 years ago

Facebook (and others) don't just track you on their website. They do so on every website that includes their "like button", "analytics", "ads" and such

7bit• 2 years ago

Reading your reply I just became aware that I haven't seen a single thumbs up button outside Facebook for maybe ten years. In 2011 they were everywhere and I remember that I implemented them on my personal website. I'm a hobby dev, so that was a big deal for me. How curious!

nprateem3• 2 years ago

They can infer it from your friends who do publicise it. Same as political views, etc

naming_the_user2• 2 years ago

So, you claim that you're not interested in software development, but somehow according to this data we have here, you spend an hour a day reading Linux kernel mailing lists.

Curious.

justinclift5• 2 years ago

That'd be explaining by someone trying to "fix the damn disconnection bug with this new usb $THING I bought a few weeks ago".

Stuff like that often ends up trawling through LKML posts trying to figure out wtf kernel might have a fix, potential things to try, and so on.

Probably also by people with zero interest in software development themselves.

maeil• 2 years ago

To add one row of anecdata: I recently got an ad on Instagram (= Meta) for an "only for gay men" holiday resort. I'm straight. Took a screenshot of it because I thought it was funny and I'd never seen it (nor such a place) before.

squigz2• 2 years ago

Why do you think you can't buy that? These companies have been building up profiles on millions (billions?) of people for many years now. It is not unreasonable to think they could infer stuff that they don't directly measure. Nor that these profiles would be shared/sold.

d1sxeyes• 2 years ago

The GDPR does not care about the specifics of tech.

The GDPR does not care if FB has a database column for “sexuality” or if FB never gathers that information directly. All it cares about is the fact that Facebook process personal data, and, using some of the data Facebook processes, sexuality can be inferred.

I think we in tech get hung up on technicalities, while the GDPR was specifically written to be as citizen-focussed and tech-agnostic as possible.

Regardless, this specific ruling seems a bit odd-it implies that FB took a fact he mentioned in a panel discussion (not on the platform), and used that information to serve him targeted ads based on his sexuality.

I have no idea of the mechanisms he supposes led to this.

TheMagicHorsey• 2 years ago

How did Facebook determine that Schrems was gay? Do they even know he's gay? Just because they showed him an ad for something that gay people would find relevant doesn't mean they targeted him for being gay. Its possible he likes a lot of stuff gay people like. I get targeted by advertisements for institutions offering degrees in Christian studies or some such thing, even though I'm an atheist. But say I was a Christian, should I then deduce that Facebook knew I was Christian and used that information?

They are just spraying and praying with their ads on best guesses as to what is relevant to you.

How is this a lawsuit?

AStonesThrow5• 2 years ago

You get targeted by advertisements for institutions offering degrees in Christian studies or some such thing, because you're an atheist.

I fixed that quote for you, because advertising is often targeted to the opposite demographic for various reasons.

Just try enjoying your favorite show on radio or regular TV, and you'll perceive ads for stuff you would never touch, but they are paying good $$$ to support that show you like, and to get in front of everyone possible, and perhaps wear you down with brand recognition and exciting jingles to influence your buying decisions in a moment of weakness.

However, targeted advertising may know exactly what you like, and be an effective means of call-to-action and conversion to sales.

On the back end, Meta advertisers fill out a list of audience interests and demographics. So yes, if the advertisements and their buyers were documented, Meta should also have sales info on the intended audiences.

jmd423• 2 years ago

It's a lawsuit because Schrems only needs enough of a basis to force the courts to consider certain issues, and to make statements about how GDPR should apply in principle in certain situations, in order to effectively restrict big tech's use of data.

It's a case brought strategically in order to trigger certain questions of interpretation of GDPR rules to be litigated.

Schrems' specific claim only needs to hold enough water to give him standing to get the case through enough filters in the court system to facilitate this.

pembrook2• 2 years ago

Facebook didn’t determine he was gay, it’s just spray-and-pray by the algorithm exactly like you said. He’s just bringing the court case in bad faith to raise the issue and create another foothold for the EU to extract further billions in fines. The outcome will be more laws so nobody creates anything new in the consumer space or takes any risks that aren’t sanctioned by EU central planners ever again.

Knocking over US big tech companies for fines is literally the fastest growing EU industry by total profits.

phito2• 2 years ago

Making profit by punishing foreign surveillance malware, I love it!

spencerchubb3• 2 years ago

This is a weird thing to be upset about. As a gay person, I don't want to see ads that are meant for straight people. I would rather see ads relevant to me.

mr90210• 2 years ago

Here is a provocative thought experiment that might help you get the point:

Replace the word gay with bone cancer, which just so happened that you’ve been diagnosed with. Would you feel comfortable with Meta inferring that from your activity and flood you with ads related to cancer?

spencerchubb3• 2 years ago

I wouldn't care. I might even be glad if one of those ads informed me of a lifesaving cure.

Xylakant• 2 years ago

Or pregnancy and no subsequent childbirth in any of the many states in the US that harshly penalize abortion.

sub7• 2 years ago

I logged into Twitter after years and it was clear the ad algo was trying to determine my sexual preference - it would start by throwing in a hot girl, if I ignored then the image became a hot girl in bikini, then a hot girl's butt etc etc. Eventually it just showed me a fully nude girl with her legs open. In the middle, it threw in tweets about homo topics with images of dudes kissing.

These were always 1 tweet, below the fold, and once a day.

Eventually I just clicked one of the hot girls and I've never got anything since.

Max Schrems wins privacy case against Meta over data on sexual orientation

Related Stories