HN user
Personalization, AB Testing, Web Analytics, Privacy, Security
Even if you do not have to comply with GDPR, 12 States have passed data privacy regulations to date. You may still need to comply with data protection law regardless if you qualify for various State laws.
Even if State law doesn't apply - you have have HIPAA, GLBA, SOX etc.
The U.S. and the EU signed the Data Privacy Framework over this past summer. https://www.dataprivacyframework.gov/s/ This offers methods for EU residents to exercise claims against U.S. businesses.
Among other requirements, a participating organization must provide you:
Information on the types of personal data collected
Information on the purposes of collection and use
Information on the type or identity of third parties to which your personal data is disclosed
Choices for limiting use and disclosure of your personal data
Access to your personal data
Notification of the organization’s liability if it transfers your personal data
Notification of the requirement to disclose your personal data in response to lawful requests by public authorities
Reasonable and appropriate security for your personal data
A response to your complaint within 45 days
Cost-free independent dispute resolution to address your data protection concerns
The ability to invoke binding arbitration to address any complaint that the organization has violated its obligations under the DPF Principles to you and that has not been resolved by other means
While you asked about GDPR, the banners are actually required for many use cases by the EU ePrivacy Directive[1]. This use case is both more broad, and different than those afford by GDPR. However it's possible both can overlap and you can be sanctioned for both items at once.
Not every website is subject to GDPR - applicability is determined by GDPR Article 3[2]. When a site is subject to GDPR - you need a legal basis to process personal data[3] subject to Article 6[4]. Sites which use the 'consent' legal basis, thus get consent with a banner.
If you do not have a valid legal basis (such as consent) to process data, but are found to be - complaints with the relevant Data Protection Authority may be lodged and investigations may be carried out subject to Article 77[5]. In the event of an adverse decision corrective action, including fines may be levied. There are two fine structures in the GDPR, and those can be found in Article 83.[6]
Now, a site can use geofencing, to determine if you are in the EU (or other relevant location) and selectively show you a banner or not based on your believed location as is determined by a reverse IP Address lookup.
You may be re-prompted between visits depending on if the persistence mechanic you select is maintained. Some browsers delete cookies aggressively[7], and if the preference cookie is removed by the browser you will likely be issued a banner on the next visit to re-establish your preferences.
[1]https://gdpr.eu/cookies/ [2]https://gdpr-info.eu/art-3-gdpr/ [3]https://gdpr-info.eu/art-4-gdpr/ [4]https://gdpr-info.eu/art-6-gdpr/ [5]https://gdpr-info.eu/art-77-gdpr/ [6]https://gdpr-info.eu/art-83-gdpr/ [7]https://webkit.org/tracking-prevention/
Data Privacy efforts are heavily slated to impact Analytics quality / volume in the next several years.
On the technical side we have things like Apple's Intelligent Tracking Prevention, App Tracking Transparency, Mail Tracking Transparency and Link Tracking Protection, Chrome is finally about to phase out 3rd party cookies and browsers like Firefox and Edge lock down or block common web tracking technologies. - just to name a few. All of this combines to add noise, or a reduction in volume which impacts analysis efforts.
On the regulation side, we have global laws such as Europe's GDPR, 4 US States with current data privacy laws in effect, and a total of 12 US slated to take effect before 2026 - all of which are slightly different in impact scope. This results in scenarios that even if you technically can collect data, you may not be legally allowed to, or, alternatively prevented from using it in specific ways.
This will force companies to switch back to Media Mix Models for attribution and adopt new privacy focused solutions for existing use cases to some extent.
Data analytics is getting more complex, not less. However that results in a massive amount of needed learning on a continued basis - which may not be for everyone.
Write a blog (history is valuable here, speak on Podcasts, Present at Conferences, be active on social media.
This can lead to people offering you positions that aren't publicly posted, because via your engagement they feel they understand you enough that you should be able to fill the role they have in mind.
For example - I write 20 blog posts going in depth on some topic - there's a decent chance I may actually know that topic. When that skill set becomes critical to someone - the odds are higher they'll contact me for that skill set because chances are, I'll be top of mind through sheer volume or quality of information I have written about that skill.
The author does gloss over the fact that Twitter has FTC Consent & GDPR requirements to meet, which means it does have to slow down during feature development at the risk of fines.
2021
Not Legal Advice.
Once your request is verified by Lexis-Nexus, they should have kicked off multiple work streams (disclosure, limited purpose, deletion) which may resolve in different orders, but must resolve in 'x' days, where 'x' is related to the duration defined by law, plus any extra extensions they may have notified you of, this may mean that the entire request could reasonably take upwards of 90 days, depending on the specific scenario. Note that some data may qualify as exempt from deletion requests, when they are required by other laws (such as gun sale records) the specifics are very context dependent.
If, after that time you believe that Lexus-Nexus did not comply with the request, then they may be in violation. Currently, for California residents, that means you can file a formal complaint with the CA Attorney General (https://oag.ca.gov/contact/consumer-complaint-against-busine...).
Note that this process will change on January 1st 2023 when the amendments of the CPRA will go into effect and enforcement authority shifts to the California Privacy Protection Agency (https://cppa.ca.gov/). This will also subject Lexis-Nexus to additional requirements and more strict definitions of terms such as 'sale'.
I think we have to look at Recital 23 through 31 they clarify what 'goods and services' mean.
Well I mean think of a store which doesn't accept EU payment or ship to EU addresses, nor target EU residents with Advertising. You'd be hard pressed to say they service EU residents even if the site was able to be visited by EU residents.
The last two data exchange agreements between US/EU were overturned. I think it's unlikely at this point unless the USA adjusts some of its surveillance laws.
It depends on Art 3.
https://gdpr-info.eu/art-3-gdpr/
Just because a website exists and may be visited by a EU resident, does not mean that the site automatically has to comply.
The author of the blog apparently also wrote about Zaraz in this post:
https://cunderwood.dev/2022/01/30/tag-management-is-no-longe...
30 Days from notice.
Apps must update to have the consent prompting. If they don't within the allotted time - they'll be delisted.
Having the global flag in settings > privacy > tracking set to off will auto-decline any system prompts, and you won't see them.
The final nail in the coffin for client side companies that care about long term persistence. I see this as really hurting Recommendation companies and AB testing platforms in absence of some server side set identifier - which is quite the change in infrastructure - since not all platforms allow you to do that.
Then take it up with his boss, fight him on it, or look for work elsewhere. It's unreasonable that you'd be adversely graded on something that industry has historically struggled with.
It's not exactly fair.. and also not likely without extensive time spent doing the estimation, like sure - you can be more precise, but the more precise you need to be, the longer it takes you to frame the estimate.
Two books help with methods of doing this.
Rapid Development: Taming Wild Software Schedules: https://www.amazon.com/Rapid-Development-Taming-Software-Sch...
Software Estimation: Demystifying the Black Art https://www.amazon.com/Software-Estimation-Demystifying-Deve...
This likely does mean you'll need to be allowed to deploy automated test cases, develop documentation and the entire nine yards, because it's going to be far harder to hit any reasonable deadline if you don't have a known development pipeline.
You'll need to reduce your uncertainty as much as you can to even have a chance - and even then, things will still blindside you and double (or more) the actual vs. the original estimate.
Getting given a system someone else worked on, spending days understanding the system, to identify that at the present rate it'll start to fail inside of a few months, escalating that, being ignored, then seeing the system begin to fail as expected.
It's like watching a train wreck in slow motion, except I am in the train.
Internal to a Retail org, and I suspect it's not being viewed internally as Data Science.
Agreed, I am wondering if it could be something as simply as changing the titles people have.
I am the primary developer for what I listed, but I believe us to be fairly single threaded. While I am not looking for work - I do believe that given the range of skills required, it's not easy for someone to just jump in should something happen.
While it's not really my issue to correct - I am trying to be helpful, and attempting to figure out if a lot of people just dislike this work, or maybe it's how we're presenting it, or both.
Correct, Conversion Rate Optimization. Use of tech such as surveys, AB tests, MVT tests, analytics, and so on to increase conversion rates for a particular action(s). A solid mix of Programming, Math and Science.
Tagging - use of pre-built tags in a Tag Manager (Google Tag Manager, Tealium) which send pre-defined data via the Tag Manager to 3rd parties.
I've also found people want to skip metrics, and I feel not only is that a bad plan, but it makes it difficult to figure out what may be going wrong without any data to prove a particular theory.
Thanks, and I know it's harder to come by, but ideally I'd like to encourage passion for that kind of work if possible. It doesn't seem like that's an interesting field for most, in my experience however.
It's a way to filter out the really 'out there' people. Say your example of a disagreement with your manager. You may have all kinds of reasonable points. The next guy could come back with 'I slashed his tires' or 'I decided to call out for a week'.
Clearly, the second guy should be throwing up red flags. However, it can be hard to uncover that type of thing if you were to only ask technical questions.
I use knowledge of Stats and experiment design to work on A/B testing websites (Website Optimization).
It comes in handy to think through use cases to ensure you can actually learn from the experiment, and you can develop it in ways to avoid confounding variables, such as cell jumping.
Thank you so much, I may take you up on that - this looks very interesting to me, and I started watching the Learn TLA+ video series.
I'll for sure be looking over the stuff you just linked.
Depends a lot about the data you are collecting I suppose. Not a Lawyer, don't know the use case. Can't really venture a guess on where it'd fall.
You can set the cookies but that doesn't mean the browser won't remove them, or a ad-blocker prevent them from being set in the first place. I'm saying if you want something that always works, cookies likely aren't it.
You could do something like an iFrame, with the parent site passing information to the frame. Here's an example: https://medium.com/building-contently/tracking-people-across...