Oh, that's right — those were good times.

;-)

Your particular concept of freedom doesn't account for asymmetries in information and power. The average person does not have the time or knowledge to truly understand the implicit bargain that goes with using Facebook. Partly because Facebook is very aggressive in keeping users in the dark. But even if Facebook were totally open about everything, people just don't have the time to independently investigate every company they do business with.

What your high-theory freedom means in practice for the average person is the freedom to be exploited. That's how it went in the early 1900s before we had labor laws and anti-trust laws. Did hundreds of millions of workers lose the freedom to work overtime for free? Undoubtedly. Are they missing it? Generally not.

They (the EU) don't and I don't understand why you would understand it that way.

For example, if you join a cycling-in-Berlin group, they can still use that information to show you ads for protein bars and lederhosen.

They can't do it based on external browsing activity.

In-Facebook likes, comments, group memberships, clicks, etc. sound like they'd still be applicable, and give pretty good targeting info for a lot of folks.

Probably the same in several other Eu parliaments, too.

Presumably, since Facebook has no way to contact those people, they will just shut down the no-logged-in-but-tracked half of their business in Europe?

(If you don't know what I mean by shadow profile: When you first create a Facebook account, it helpfully produces a prepopulated list of your friends, and links in a pile of consumer tracking data before the onboarding flow is done.)

To recap: a law was put in place 5 years ago that said if you get consent you can basically use data in any way, with some very vague and general language about how consent can be gathered and what it means.

Meanwhile, Facebook has invested billions of dollars in building and developing a platform according to their fair reading of that law.

Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and all of those billions of dollars have gone to waste.

So absurdly inefficient. No regulator has had the idea of just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better? No; we prefer to thrive by ignoring problems for a long time then smashing them with a hammer.

I am not exactly breaking the news: If companies make less money through ads, they have to make it "some other way" (which so far has resolved in "making the user pay directly"). A lot of people have been suggesting that it's not their business to figure that part out; privacy is paramount and above all else. That's fine up to the point where zealousness effectively worsens the life of others, and maybe even more than that, our collective lives.

(To me, one example of that might be restricted access to a lot of important news outlets. I know that it is currently pretty hip to attack the NYT anyway, and I can see a lot of good reasoning behind the critique, but if that then resolved to people getting information from random internet personalities on Twitter or IG, we seem to have significantly worsened a bad situation)

The HN community is for the most part probably not negatively impacted by having to pay for more stuff and actually might net gain through stronger privacy rules. However I expect the privileged to also think for others, in the terms of the others' problems (i.e. if struggle was poverty and you tried to work through that, would privacy really be more important to you than having unpaid for access to Google?)

I know this is terribly biased topic on HN, but alas: Pennies for your thoughts.

Alas, as always with such news:

"The EU decision will not have direct consequences for users, unfortunately, as it can be appealed to. Such an appeal would lead to a lengthy judicial process."

It's been truly shit to own Facebook stock the last year.. Let's end this now and get back to writing the growth story. Please.

Should not be just Meta; we need to go further and cover all social networks.

I can see that there's not much point in serving me ads for e.g. women's clothing, because I'm not a woman. But even if you knew everything I read online, I think you'd be hard-pressed to guess what I want to buy.

So I don't believe that advertisers need to know all about me. They just need a few data points: am I a man or a woman, do I ever buy anything (do I have any money), and that's about it. Beyond that, I don't see how having more data makes it easier to get ad conversions.

I've never worked in this area, and I drive with ads turned off, so I honestly don't know.

On the other I use free services like Google, YouTube, Facebook all the time.

They make money selling our data, on the other, the fact that it is free for everyone is the democratization of the access to information. I suspect that even a subscription of $1 / month will push away more than half of the users for these services.

I prefer to live in the world where people have free access to search engines and large social networks.

So companies can flout the law for years, making massive profits, and continue to do so for as long as they can string along an appeal process? Seems like a pretty nice loophole.

- https://news.ycombinator.com/item?id=33893240

- https://news.ycombinator.com/item?id=33884343

- https://news.ycombinator.com/item?id=33890865

... and more

Would that be the Valley of the Silicone Dolls?

Tutanota should know better than that.

If they did, they can track to their hearts' content - and it's horribly misleading that the news and news titles don't make this obvious. It'll put people into false sense of security.

You will get private canavas trackers. All your private data will be sold for advertisement.

To test try amiunique.org on a PC. Hint: You are not unique you are tracked.

This teacking is probably not legal according to GDPR.

It would be wonderful.

so when you say a crazy way of making laws, you mean the way that laws basically get made?

>No regulator has had the idea of just going to Facebook,

pretty sure there was all sorts of conversations with Facebook and others over at least 5 years where it was quite clear people wanted to fix privacy issues and it was also clear that it was in Facebook's financial interest that it not get fixed.

>tried to draft a forward-looking law that will make the whole system better?

Facebook doesn't want the system better, Facebook wants the system to benefit them. At some point these things are incompatible. No body has gone to a bank robber and tried to discuss with them how to best draft the laws on how to stop the robbing of banks, because of an intuitive understanding that it is not the bank robber's intention to help stop the robbing of banks.

So when the law gets made to stop the robbing of banks, the bank robber than goes ahead and breaks it.

Or in the case of Facebook they say we are obeying the law! But still try to do what the law wants them not to do.

But I think this is the core of our disagreement here >according to their fair reading of that law

I would say according to their desire to get around that law.

This would never work because Facebook is uninterested in making "the whole system better". Their entire goal is to make money off of user data, and they have zero incentive to work with governments that threaten that goal.

So often in the last 20 years I’ve seen companies (and particularly US tech companies, but it’s not exclusive to them) deliberately read more charitable interpretation of the law, knowing they'll make millions over and above any fines they might receive.

It’s so common place that there is even a saying for it:

“ask for forgiveness not permission”

So I have a hard time believing that Facebook, with their army of lawyers and millions earned from data collection, are the victims here.

I do not care at all what FB claims. They repeatedly lied, cheated (see 2 factor phone numbers) and deliberately misinterpreted law in insane ways.

One of their attempts was putting serving interesting ads as service given to users and claiming that it means that they are obligated to track them.

and here I was thinking that breaking things and disruption is what Facebook in particular was super into. Sucks if it happens to you I guess. Laws and regulations aren't made by meeting Facebook representatives and then asking them what's convenient. Okay Facebook has invested billions of dollars, luckily they've also made billions of dollars. How much do you think traditional journalism, including all the positive externalities it entails has suffered from Facebook? They didn't seem to care, it's a legacy industry if I remember correctly.

Car manufacturers all over the world have invested probably a hundred times as much in the combustion engine and the traditional car, it's going away as well. Like are we going to reimburse and invite everyone who has made anything we've decided we don't want any more?

I think the crux is that they instead implemented a system according to their most favourable reading of that law.

They took a calculated risk, it backfired a little bit (albeit after 5 years of using it to their advantage), and now they need to approach things differently.

Business as usual.

> Then, some random guy says he doesn't think Facebook's interpretation is right, a court agrees, and [the law changes].

You've just described how US legal system works (case law - https://legaldictionary.net/case-law/)

> just going to Facebook, having a real conversation about what they're doing, then talked about it with ethics professionals and researchers and tried to draft a forward-looking law that will make the whole system better

You've just described how US lobbying works.

In terms of society, regulatory uncertainty better than no regulation, hands down, and is a spectrum whether the risk is too high to engage in the market profitably.

'Gone to waste' is the best possible outcome of money spent on advertising infrastructure.

This is utter bullshit. They have tried to twist and bend the rules and tried to use an exception that doesn't apply to them at all. Everybody knew that Facebook went against the spirit of the law.

Somehow they got the Irish authority to go along with their idiotic interpretation of the law, but that doesn't mean they were working "according to a fair reading of the law", it just means that the Irish authority failed to do their job.

If Facebook had gone with a conservative reading of the law, like many other companies have, they would have added consent prompts 5 years ago, and they wouldn't have a problem today.

I would suggest you spend some time reading the GDPR. It's surprisingly approachable. The parts about consent really aren't that hard to understand at all, and it's clear what the intention of the exceptions were (eg. a pizza delivery service obviously does not need to ask for consent to share the customer address with a delivery driver for the purpose of delivering the pizza, but they do need to ask for consent if they want to add the address to a direct mailing directory).

It's unfortunate that it took the EU 5 years to do something about this obvious violation, but the problem is not the law itself.

"Having a real conversation" is clearly not how Facebook intends to operate. It has never been particularly open or forthcoming about how it handles data.

The "vague and general language":

Article 7, paragraph 4:

> When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

https://gdpr-info.eu/art-7-gdpr/

Recital 42:

> Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. 2In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given. 3In accordance with Council Directive 93/13/EEC¹ a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. 4For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended. 5Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.

https://gdpr-info.eu/recitals/no-42/

Facebook didn't like the business impact of complying so has spent years grasping at loopholes that don't exist in a law which is remarkably clear for legalese (especially EU legalese). The fault for that lies with Facebook, not the law making process.

This is not "some random guy". It's noyb and they're doing an important job. They not just "saying this and that" but do try to get the actual laws enforced which is what they did here. You can learn more about them here: https://noyb.eu/en/our-detailed-concept

The "random guy" you've probably actually meant is Max Schrems and his history is also quite noteworthy: https://en.wikipedia.org/wiki/Max_Schrems

What?

Article 7 par 4. GDPR [1], "Conditions for consent": When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. (emphasis mine)

Personalizing ads is not necessary for providing the service, hence the forced consent is not given freely.

To anyone involved with the GDPR back then, this was as clear as the day.

Also, Article 7 par 3. clearly states that even if consent were given freely, the "data subject shall have the right to withdraw his or her consent at any time", and "[p]rior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.", which was clearly not on the table with Facebook.

[1] https://gdpr.eu/article-7-how-to-get-consent-to-collect-pers...

Many would argue that that's what happened, Facebook choose to bet a few billions on trying to get around it by trying to argue loopholes into the interpretation and is now getting told to knock that off a bit more forcefully.

I mean, if they do not actually know for sure how a specific law is to be interpreted then better err on the side of caution, instead of becoming a criminal, violating the rights of many millions of people. Better take precautions in case ones convenient interpretation turns out to be BS. I am sure they made their business viable without all those violations of the law. They can just flip a switch now, and stop doing the bad thing, that they now know for sure is illegal :)

But hey, that is just what I personally would consider an ethical approach, ha! Maybe not caring about the law and just continuing to ignore people's rights, being as invasive as possible to people's privacy, for as long as it is financially viable is the more ethical choice ...

The article makes it seem pretty straightforward:

> Meta explained that its updated terms rely on the GDPR concept of "contractual necessity". The GDPR mostly prohibits companies from forcing users to turn over personal information to use their services. The only exception is when that information is necessary to execute a contract: For instance, a car sharing app needs to know your location so that it can show cars near you.

For a car sharing app, it is necessary for them to get your location for the service to work. In Facebook's case, personalized ads are not necessary for Facebook to work. Since it isn't necessary, Facebook needs to get express permission to use personal information for ads.

Facebook took an overly optimistic view of the law expecting regulatory capture to allow them to skirt the rules. It didn't work, so their investment was a poor one. Regulators didn't force Facebook to make a poor investment.

Also, Facebook can decide to pay the users it tracks in Europe. Maybe the investment has poor returns, but the money hasn't entirely gone to waste yet.

The article suggests you need actice consent, which is what a basic reading of gdpr rules would mean. I don't know why hiding it in the terms and conditions would possible be conpatible.

I should be able to choose complete privacy.

Anything less, regardless of what corporations or government agencies say or agree, is illegitimate. And it shows that the governance agencies are illegitimate too.

It shouldn't be that it is assumed I am a criminal and that as crimes occur online, my data should be collected. Not should it be assumed that my data should be monetisable by intermediaries.

I get the feeling that you can bypass laws in the US based on technicalities and loopholes. In the EU, it’s the intent of the laws that matters, not how the words are written first degree. And the intent is pretty fucking clear: don’t mess with EU citizens private data. I can’t wait for Facebook to die and will never care that they spent billions trying to bypass EU laws for nothing.

[1]source: a list of the largest tech companies sorted by market cap.

https://gdpr.eu/gdpr-consent-requirements/

I'm doubtful that Facebook have been using a fair interpretation of the laws as that doesn't seem to be the way they operate. I'm also doubtful that users can easily revoke consent which is another requirement under GDPR.

If their "fair reading" of that law is about as accurate as the characterization in your post, it's no wonder they lose court case after court case about it.

History shows us the regulator always comes after the original culprits exploited what they could, never before.

It's really not up to Facebook nor you to decide what is the "fair interpretation of the law".

All they have to do is stop collecting people's personal information, all their problems would go away. People don't want their surveillance capitalism abuse anymore. No one is interested in watching Facebook "discuss" the matter with regulators in order to massage it into a "compliant" form. We want Facebook's unconditional surrender on the matter, cease and desist all surveillance activities. We don't care how much money it will cost them, what they are doing is simply not acceptable and it has to stop.

To me it means one of two possibilities:

1. Facebook is incompetent, not only did it spend billions developing lackluster practices that don't fit the spirit of the GDPR but that money also instantly disappears because they are apparently incapable of adding a prompt for tracking consent and evolving with the regulatory landscape like every other company on earth.

or

2. Facebook relies on its relationship with its users being non-consensual.

The language Art. 7 (https://gdpr-info.eu/art-7-gdpr/) may not be clear enough, but check out the recitals.

Unless you're actively trying to skirt the edge (in which case you shouldn't act surprised if you find yourself on the wrong side of it), it's pretty clear.

However, I think this article is slightly missing the point, as is your conclusion. (https://noyb.eu/en/noyb-win-personalized-ads-facebook-instag... explains this a bit better.)

Facebook wasn't trying to get consent through the fine print (that would be very obviously illegal). https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dis... says that the decision "settles ... the question of whether or not the processing of personal data for the performance of a contract is a suitable legal basis for behavioural advertising".

Under GDPR, you need to have a valid legal basis for any data processing. This can be a) consent (which Facebook was not getting, nor claiming to get), b) doing only what's necessary for the performance of a contract, (some other things), and f) legitimate interests.

Consent is the easiest: When you get it (properly), as you said, you can basically use data in any way. But getting consent properly means actually getting consent, not tricking, annoying or forcing the user into saying yes when they don't want to. Ad platforms tend to either try to claim consent without actually getting it in a valid way (because, surprise, most people don't want this), or they reach for the other justifications.

While the advertising industry is trying to push to justify legitimate interest, anyone who has read the official EU interpretations (e.g. https://edpb.europa.eu/sites/default/files/consultation/edpb... - page 16 point 50, referencing Page 47 in https://web.archive.org/web/20220305192156/https://ec.europa...) would plainly see that you cannot use that to justify the kind of tracking that these ad networks do.

I suspect Facebook has realized this because otherwise they would have claimed Legitimate Interest. Instead, they claimed that processing the personal data is "necessary for the performance of a contract". That is obvious bullshit, and the EDPB has now explicitly confirmed this.

So I would recap it differently:

- A law was put in place 5 years ago to protect people from exactly the kind of behavior Facebook wanted to engage in (intrusive tracking, wholesale collection of personal data).

- Facebook has made a massive profit by violating the law, claiming to be merely skirting it, relying on creative interpretations that they must have known were "creative".

- They have now been told that their creative interpretations are wrong and that they need to actually follow the law. (They will likely also have to pay a fine that is a fraction of the profit they made from violating the law.)

- They can still do the thing they want, they'll just need to actually get voluntary user consent. Which they probably will not get in many ways, in particular because they're known for abusing the users and illegally misusing their data (see above).

I agree that it's inefficient that they were allowed to do this for 5 years before being told to stop, but I don't think that's unfair to Facebook, to Facebook's detriment, or because Facebook couldn't have known. It's because Facebook correctly concluded that they will get away with, and profit from, violating the law until caught and stopped.

This is a fight for the money Facebook is generating. The court, the law, the administrations, the bureaucrats, the media, the lawyers, the judges are all complicit. Using the law to say, take over someone house without reason will be outrageous (though it does happen in "lesser" countries than the EU).

But in the EU, you can still get people to look the other side if you explain it by Facebook is evil, Facebook is tracking you, Facebook is addicting you, Facebook is generating lots of money, etc... Of course, you have to realize, this is the same government that will sell your blood if they think they can make profit out of it.

Welcome to the Jungle.

Funny. Facebook's addictive "engagement engineering" was proven to worsen people's mental health in significant and measurable ways. When is that going to stop being fine? When are all the ad tech attention brokers gonna be held accountable?

If advertising-driven social media is wiped off the face of this earth, our lives are going to improve, not the other way around. We don't need advertising, nor do we need social media.

That's just my personal observation. Make of that what you will.

Have two pennies if you can answer that without a presumptive bias.

https://www.ctrl.blog/entry/flattr2.html

https://github.com/flattr/flattr-extension/

(Yes, this does potentially give a lot of power to Flattr. But not that much, barely more than Patreon, as long as most of the processing stays local, and they only get the aggregate usage once per month ? And the open source aspect should keep them honest...)

https://www.moneysavingexpert.com/news/2019/01/martin-lewis-...

That being said, this unequivocally lowers demand for software engineers and puts downward pressure on our compensation.

Governments can get away with punishing companies up to the point they become unprofitable. I feel like internet ad companies have flown too close to the sun and privacy regulations are proving more productive for governments than anti-trust or tax law. Privacy is an acceptable excuse, but the real motivator is Europe is tired of sending so many ad dollars to US software engineers.

The money advertisers can pay Facebook is, essentially, a percentage of all consumer spending. A percentage of the money you pay for toilet paper, dish soap, groceries, car insurance, credit cards, etc is funding the advertising budgets of those companies.

The money consumers can pay Facebook is, at most, some portion of their discretionary spending budget. What's left over after buying all that stuff, and paying the rest of their bills (housing, fuel, taxes, etc).

The first number is a much bigger number than the second.

If Facebook is no longer able to capture Charmin's ad spend because they can no longer provide adequate targeting, then Facebook will no longer get that money. The Charmin customers don't have it to send to Facebook directly, they gave it to Charmin to buy their toilet paper.

And the reason they do it so well is because they are so invasive to peoples integrity that if people find out - they’d also quit the service in droves, and it’s also so invasive that regulators are objecting.

I don’t see Facebook returning to growth any time soon.

Excuse me, 'growth story'? For Facebook ??

Time proves the shareholders vs. rest of society stereotype to be true, I guess

[1] unless the data is needed for the website to work

For example, my total spending on video games in the last 5 years is between 0 and $100, so game publishers should probably save their ad spend (and not annoy me with noise). My TV is seldom out of the closet and plugged in, and I spend maybe $1-200/month on books. I'm pretty interested in buying a tennis stringing machine and more sheet music to play, but it's too much effort for me to seek those things out, so I don't. These are just a few of an infinite array of identifiers that could provide worthwhile targeted ads to me.

As another example, most charities have a group of people who would be happy to give them money if they knew about the organizations, while most of the population is indifferent or, in some cases, opposed to their work.

I don't like advertising much, either, and it doesn't reach me that often, but it's ridiculous to suggest that personalized ads have no value.

With that setup, if they're confident that they'll come out on top, they can keep tracking while appealing. If they're less confident, they'll pause tracking to prevent the buildup of fines.

Actually, they may yet receive a hefty fine. The court ruled on the principle: now, each lower jurisdictions may take action based on that principle.

For variation it gives me some crap ads from some online stores that are just a frontend for some Aliexpress drop shipping. The line is always the same "Unfortunately we're discontinuing $PRODUCT. Buy now to take advantage of the discount!"

I don't see what niche they're targeting with that.

This isn't possible anymore as you need to burn thousands to get enough learning to get scale with Facebook, especially if you're in the US with an audience that uses iPhones.

Google Search ads still work, because they own the whole stack and they aren't impacted by attribution, but the prices have been going up significantly as people move spend towards channels with better attribution.

All of this legislation and privacy advocacy is just a gift to Amazon/Google/Apple - everything is first party data for these "portal" businesses. Their ads will still work, and they'll have no real competition in direct-response marketing.

Enjoy watching Nissan ads on loop.

If targeted advertising benefits the user, they will opt-in (GDPR doesn’t outright outlaw it, it just requires informed consent). If you are having an existential crisis about people having this choice then maybe it’s time to recognise that you’ve always been a parasite that didn’t actually provide any value to users?

As comparison, look at Amazon's smart speakers. $10 billion spent, lots of hype, part of the zeitgeist enough that SNL is doing jokes about it [1]. End of the day it's a "colossal failure": https://arstechnica.com/gadgets/2022/11/amazon-alexa-is-a-co...

[1] https://www.youtube.com/watch?v=YvT_gqs5ETk