https://news.ycombinator.com/item?id=37403583
https://news.ycombinator.com/item?id=37173344
https://news.ycombinator.com/item?id=37045185
Sadly, there is no personal data protection. EU has recently agreed to allow data transfer to US [1]
[1] https://arstechnica.com/tech-policy/2023/07/big-tech-can-tra...
My collegue made an experiment with his wife. Put their phones down, talk about different kinds of CRMs and DID NOT SEARCH for that stuff. Lo and behold, ads about different kinds of CRMs start popping up.
I'm skeptical to these things and initially didn't believe. Then people I ask confirm - hey, yeah, I was only talking about it, now I get those ads! He said he was talking non-English, however CRM software names are english.
Coincidance?
I would love to hear some experiment results in this direction.
*If It's Smart, It's Vulnerable", Mikko Hyppönen
It would be obvious if they were exfiltrating audio data. They are not.
But. I also think this shows how spookily good the surveillance ad tech really is, and to what extent the major players (Alphabet, Meta etc) keep track of people. Non-techy people attribute it to microphones and dictation, while in reality it is just enormous amount of old school digital behaviour tracking.
(And a dash or two of frequency illusion bias of course, people tend to ignore the "hot single moms in your area" or super general ads with less impressive targeting)
An average user with an adblock gets hundreds, maybe even thousands of ads every day, for new cars, clutch replacements, diapers, washing detergent, shadow raid vpn, local political party, mcdowells, kentucky fried pizza, sex toys, 1:9 baluns, cisco console cables... and they don't even notice most of them.
And then something happens, your washing machine fails, you talk about it, open google, get ads for tampax, ignore them, find service, fix it and forget about everything. Then you watch stranger things, google the reviews, get an ad for yard fences, ignore that and forget about that too. Then you talk with your wife how you're out of detergent, turn on youtube and get a detergent ad... "wait, we were just talking about that? how did they know?! microphones, spying, conspiracy!".
It's the equivelent of being less than one parking ticket per year - and that's for someone on an SV income.
As I understand it, it's legal to offer recommender systems for personalized content suggestions, but you cannot do the same for personalized ads.
In EU and areas that conform with the EU laws: EEA (which Norway is part of), Switzerland etc.
What you should compare it to is the net income derived from Norway.
Do big-tech companies actually pay these fines? In cash? By daily bank transfer? Direct debit?
And to whom? Margrethe, the Queen of Denmark? Or to some bank? Or are bank notes scattered to wind in Copenhagen square so the people can stuff them into their pockets?
Or do the governments of countries whose laws are broken have a nod-and-wink tacit agreement that "fines" are just numbers for the press to print and assuage our sense of outrage. Aren't we just starting to use numbers like this as abstract tokens of justice?
I'd like to see Zuck made to personally lug an enormous pirate's chest of treasure up to the gates of Copenhagen, or face blood-eagling at dawn.
You can't go idly throwing away $30 million a year, even if you're Facebook. Yes, they can get away with it once or twice, but if that is your approach to unnecessary $30 million costs, you're not going to last very long.
Still, agreed would be better if it was a more punitive fine!
It is better for them to do something big enough to hurt, but not big enough to get all of Meta's guns blazing. This will accepted, and we can start from there with the next step (applying this same ruling to a hundred other users, or in a hundred other courts)
A million here, a million there, and before you know it you are talking about real money - Everett Dirksen
To frame it differently: if all GDPR countries were to fine similarly it'd scale up to $3-4 billion annually and that would start to hurt a little.
Someone should sum all those fines, maybe then it will have a dent?
Moreover revenue is useless in this context, we should compare with profit anyways. And maybe profit against Norway particulary or any other country in question.
Can't help but think the correct protocol here is to respond to them "Oh you're American? Nice, I've been to Mexico!"
> I'm not sure where the confusion comes from?
There is no confusion, there's a lack of concrete factual knowledge. That's different.
Who exactly takes that money? When and how? And how does that translate into a win for the victims?
Echoing other comments about how Norway and Denmark are separate countries.
The next question is - if we're hoping to seriously talk about the effectiveness of fines against hostile and uncooperative foreign companies, how does the Norwegian DPA use that money to further remedy the harms inflicted on the people?
That's not a lot of money in the scheme of things. but handing it out amongst everyone doesn't seem useful.
The obvious danger is that the DPA becomes a self-fulfilling entity, in perpetual growth of power and reach, and quite happy if Meta continue to transgress.
Shouldn't Europe use this money to invest in its own social networking infrastructure, thus providing a double-whammy against Meta's misdeeds?
What to do with that money?
Some of the listed companies clearly got fined because their software engineering is rubbish and they made genuine mistakes. Maybe use the money to pay for (and force) those companies to have their programmers trained in better privacy related SE skills?
a big viking party would be cool
It's a computer program, it's not magic, you can take it apart down to individual system calls, and with popular apps, people actually do that.
Looks like Instagram at least does do TLS cert pinning, but it looks like there are patched binaries that disable it.
I'd guess a good chunk of us are worth £0 (or even negative) and then there is a long tail of increasing valuable users who interact with adverts and services.
Amazing how valuable some of the users must be!
If it's possible to stop breaking the law in a way that the revenue drop is smaller than $30M a year, they'll possibly do it at some point. However, it's possible that the drop would be bigger, in which case the $30M/y fine is just cost of doing business.
There's a staggering amount of inefficiencies in large corporations. Just because a corpo is doing something a certain way right now, doesn't mean it's necessarily the result of a higly optimized process or rational risk/benefit analysis.
(is this a situation of coming from a US background and being confused about how a unitary state works?)
Have to think that's pretty widespread behaviour.
https://www.datatilsynet.no/en/news/2021/fined-for-accessing...
"Oh, yeah! I've been to Africa!"
got that (and variations of it) more than once..
(though I suppose you could be an Estadounidense from the Estados Unidos Mexicanos - it's really not the best continent for disambiguation!!)