I noticed their 'opt out for interest based ads' was through a cookie set by some consortium of creeps companies. at the time I remember thinking its like 'if I dont want you to track and follow me all over the internet then I need to allow you to track me and follow me all over the place so you know who I am.. Riiight'. plus that setting resets if you delete the cookie. so I dont know how will that work with the container. perhaps somebody who knows more can enlighten me.

honestly given that FB is after my healthcare data, my patience has worn quite thin with them. IMHO the creep factor and unintended consequences are way to many.

You can't claim that because you need to provide service for someone else you need to process data of non-users.

The users of which you collect data is required to be part of the service or contract to fulfill unless you have a damn good reason not to and "we need to provide this service because we go belly up otherwise" won't fly, IMO. A legitimate interest would be stuff like "we will make backups of our data, ensuring that deletion requests are carried out upon restore, to continue providing service in case of disaster" or "we will log your IP temporarily because we need to provide essential network and information security"

[Laid out in https://gdpr-info.eu/recitals/no-40/]

Ad revenue may be essential to Facebook being commercially viable, but it's not required at all to provide the social networking features that users actually want.

My guess is that FB will continue to work even without this other data just given what they know on the site.

But if they have data acquired with users' consent for social networking purposes, they won't be allowed to process that data for purposes such as targeting ads without consent.

The only other business model I’ve seen work is “be owned by a billionaire”.

FWIW, Google's commercial terms are not the same as consumer terms ... again, like every other software vendor.

The number of facebook user accounts never goes down with new bots getting accounts constantly but people activty logging in and sharing, posting or caring is down.

uBlock Origin with either "Fanboy's Third Party Social" or "Fanboy's Social Blocking List" selected will block all third-party connections to Facebook servers, period. Of course Facebook can still spy on you via other spy companies, but the "EasyPrivacy" list cuts that down a lot too.

On the other hand, Facebook Container still happily connect to Facebook servers from third-party websites, leaking your IP, useragent, the URL of the webpage you're viewing, headers containing fingerprinting information like fonts , etc. Facebook Container does one thing and one thing only: strip off the Facebook cookie. But this is almost worthless from an information theoretic perspective, because Facebook can trivially de-anonymize you through IP/timestamp/header correlation.

I imagine that you simply won't be able to use websites anymore if you are from the EU and don't give consent. You'll just be told to go away.

1. I bought one of those spinning face brushes for my girlfriend. A few minutes after purchasing online, I started seeing advertisements from that same store, for the same exact brush. Literally 90% of the page views were showing that advertisement.

2. I was browsing Airbnb accommodation for a trip to let's say Mexico. I was checking apartments on and off for weeks. I didn't see any Airbnb advertisements during that time. The minute I book that accommodation, Airbnb starts showing advertisements for rooms in Mexico.

3. I'm browsing barbers in a new city. No advertisements until I book an appointment with one online. Then, I start seeing advertisements for the same barbershop. Now, that has potential, but the advertisements stopped after a week. Why do I need to book a second hair appointment in the same week? Why not recognize I booked a men's haircut, and start showing me ads in a few weeks?

For all the tracking, privacy invasion, and fancy "machine learning", advertising sure is dumb.

For almost A YEAR afterwards, I would constantly see ads about RAM trucks and various dealerships in my area (including the one I Googled and bought the truck from) when browsing the web on my iPad. Not every ad, of course, but certainly often enough that I would notice it a couple times a week and just laugh and shake my head at the dealerships who were just throwing their ad dollars away.

Any links?

So basically prior to serving any content, you do an IP check. If they are from a GDPR country, you serve the delay loading script. If they aren't, you just load as normal. Pretty straightforward. I don't think you'd want to do it universally for all users, as you'd be at a competitive disadvantage to other sites. But you can easily enough just do it for EU countries. The other option is to just block them entirely if you have no need for EU traffic. Many sites - US local businesses etc. have no use for EU traffic or the liability that comes with it.

On a side note, with all the walled garden stuff that will be going on due to GDPR, I'll be interested to see how badly the SERPs get fractured, since every site will have a different scheme to require consent and not all of them will have people behind them that are savvy enough to make it not ask Googlebot for affirmative consent. This will put smaller businesses in the EU that don't have the resources to hire someone to deal with these issues at a serious disadvantage if they can no longer be indexed.

This just leads to a bunch of questions: where an image is loaded from FB by a site, who is the data controller? Surely it's the primary site, not FB? In that case, then is FB a data processor (and subject to more restrictions)? If FB is a controller in its own right then how does FB gather consent in this case?

per GDPR, without consent, fb cannot legally use that data (for EU residents).

And you don't need to trust that; fb knows they're going to be spending some quality time in front of their privacy regulator.

Also, OP was the first one to make the assertion that fb is losing users and thus the onus falls on him to prove vs. me trying to disprove it.

I know it is not the answer you want to hear but FB is doing well in terms of their user growth. Get over it.

If the likes of Facebook and Google all turned off their services across the EU for a day, and replaced them with a SOPA-blackout-style message explaining that they can't afford to continue providing services without the ad model that pays for them, a lot of people would notice, and the EU probably wouldn't get nearly as easy a ride afterwards. I don't know how much damage would be caused if those same big tech firms cut off EU citizens permanently, but for better or worse, very many people now rely on the likes of Facebook and Google Mail for their everyday lives, and I'm betting the damage would be worse to the EU citizens than it would be to Facebook's and Google's financial statements (assuming the alternative is that they continue to operate but with a heavily damaged business model).

That part of what he said is incorrect. The EU may be able to do alot of things, but they can't make me give you access to private documents on my server that is not based in the EU if I don't want to. You can simply tell them to go away if they disagree with your terms, or you can block all EU users from the beginning.

I read the entire document a few weeks back and recall no such provisions. Could you cite one for me? I'm trying to be as informed on this as possible.

Article 3, "Territorial scope", lays out where GDPR applies, and it contains no derogations for "but I didn't know they were european, honest". It is not, in fact, specifically about european citizens. It covers the processing of data for "natural persons in the Union", which is a bit unclear to me but I interpret it as covering anyone physically located in a country that forms a Supervisory Authority under section 51.

How this will ultimately interact with your websites and/or businesses if you are not based in the EU is unclear at this time.

It would be absolutely incredible if Facebook et al "took their ball and went home" throwing away 500 million customers.

You can use a combination of advertising and payment to fund services that connect people and facilitate commerce without extensive privacy destroying data collection. This model worked fine previously and it will work fine in the future. If anything hardware and tools are damn near amazing compared to the bygone past.

I struggle to think of any service in the world that is impossible or even challenging to replace. If anyone decides to take their ball and go home they will be replaced by a competitor who will use that extra revenue to improve their positions in other market to the original fools detriment.

There is in fact no reason to believe other markets including the US wont ultimately discover the merits of protecting their citizens privacy considering that in the US perhaps 171k work in the advertising industry out of 300 millions.

How the 0.02% can do an effective job without trampling the rights of the 99.98% is an exercise I leave to them and if they can't figure it out, then I hope the food stamp program still exists so they wont have to stand outside 7-11 with placards reading "will lie for food".

And leave millions and millions in profit on the table for everyone else?

That the same argument used against changing the tax codes so companies would actually have to pay taxes in the countries in which they do business, by closing the loopholes.

They're not going to throw away profitable markets just like that. And if they do, good riddance.

Experts say a lot of things on GDPR, one of the really interesting things about reading it myself is that I've found a lot of them seem to be wrong. I've heard a few people talking about a "social media exception" that doesn't seem to exist, for example.

It's possible that there have been preliminary rulings on GDPR that I'm not aware of, because I'm not a lawyer. So I'm not by any means declaring that your experts are definitely wrong, but I am nigh on certain that their source of information for making such statements is not the GDPR text itself.

I disagree that GDPR is an overly broad law by the way. The GDPR text is actually fairly specific. It encompasses a large domain, but it clearly defines that domain (Article 9 is an example of a large but specific definition, although it is only one of multiple such articles) and tells you clearly what you need to do within that domain to be compliant.

People just /think/ it's overly broad because it impacts a lot of tech companies and none of them have actually read the text. The human brain interprets this as "inspecific", whereas it's actually carefully targeted at a handful of specific things that lots of tech companies are doing (or not doing).

I have a business. And yes, I have spoken to GSPR compliance people, so GDPR has already cost me enough money. Compliance is a murky proposition at best, since this law can be interpreted in different ways in 28 different countries - all of whom will be looking for ways to maximize the fines they collect under it from foreign companies.

Since you are in the GDPR compliance space, surely you know that it does apply not just to businesses that are hosted in the EU or do business there. Rather, anyone that knowingly accepts traffic/data from the EU is vulnerable to it.