10 ms·

A small French privacy ruling could remake adtech

250 points by gbugniot 8y ago

gnud 8y ago
> In plainer English, this is being interpreted by data experts as the regulator stating that consent to processing personal data cannot be gained through a framework arrangement which bundles a number of uses behind a single “I agree” button that, when clicked, passes consent to partners via a contractual relationship. Now, I guess it's obvious to complain about the idiotic, user-hostile and down-right evil Oath consent pop-over that I got when I visited TC. I'm gonna do it anyway. Here's hoping this ruling stands.
- peteri 8y ago
  I haven't read techcrunch or any site with that oauth pop-over since GDPR came in. It's super obnoxious.
  - gnud 8y ago
    Pretty sure it's not OAuth, but Oath. Also pretty sure they named the company Oath so that people would think "oh this is another OAuth permission box, OK".
    - peteri 8y ago
      You are so right, it is Oath
    - scrollaway 8y ago
      > Also pretty sure they named the company Oath so that people would think "oh this is another OAuth permission box, OK". I think that's just developer bias. "OAuth" is not a thing non-developers know, even by name.
    - jefftk 8y ago
      It looks like the "Oath" brand is going away, and they're going to use "Verizon Media Group": https://www.theverge.com/2018/11/5/18064172/verizon-oath-media-group-rebrand https://www.theverge.com/2018/11/5/18064172/verizon-oath-med...
      - gpvos 8y ago
        Good. It was a truly horrible name.
  - karrotwaltz 8y ago
    When GDPR popups started appearing, I modified my Kill Sticky bookmark-script to also re-enable scrolling. Works most of the time for any kind of popup. Here's the script: https://pastebin.com/NfCyDLw8 https://pastebin.com/NfCyDLw8
    - CamperBob2 8y ago
      Thanks for this script, by the way -- it's come in handy many times.
- shakna 8y ago
  It's even more ironic in French [0], here we have a single click "I agree" button, in French, covering up a reading about a French ruling that suggests it's worthless. [0] https://shakna.keybase.pub/oath_techcrunch.png https://shakna.keybase.pub/oath_techcrunch.png
  - ElBarto 8y ago
    That is really horrible. It says "Select 'OK' to authorise 'Oath' and our partners to use your data." Is there a more general, less specific, way to phrase this? It's basically "please let anyone use your data for anything".
- Nursie 8y ago
  Of the dark patterns I've found in this space, theirs is the worst so far. They hide away what they plan to do, and if you start digging in to try to find controls... well good luck, I haven't found any. You can get to all sorts of policies, various login pages and lots of spurious info, but as yet no controls. Other dark patterns I've seen are - A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them (though they of course have a handy 'enable all' button). A page gives you a big green "Accept All" button, and a 'reject all' option which looks greyed out and is smaller. When pressed it takes you to another dialog with a big green "Go Back" button and another, smaller, dimmer link for "Leave". The "Leave" link is the one that gets you back to the page, rejection preference intact. These seem contrary to the spirit of the GDPR, I guess we'll see in time if they are deemed to contravene the law. The TC/Oath one definitely seems to be over the line. --edit-- Missed one - A page allows you to set various controls and sliders to reject its data sharing, but then sits for several minutes "processing" your lack of consent. When it eventually completes you get a message saying that they don't have a version of the page they can show you without the data sharing cookies, so sorry, please check again in a few months.
  - cr1895 8y ago
    >A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them (though they of course have a handy 'enable all' button). I see this often too. Doesn't this directly contravene the text of the GDPR, much less the spirit of it?
    - robin_reala 8y ago
      Yes. Opt in is a requirement, not opt out.
  - dspillett 8y ago
    > A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them Some of which are marked as "opt-out through partner", with no link or other details about how one would do that. While the trackers are making it a faf to opt out (rather than as the legislation actually required: making it an opt-in situation) I'll just keep on with my side of the arms war that is ad-blocking. Their loss, not mine. I can't say I feel I've missed out on anything by sites failing/refusing to display with ads blocked, links that redirect through trackers not working at all, or just plain backing out of sites that are obnoxious (and in breach) with "by continuing or closing this banner..." and other such.
- scoot_718 8y ago
  Yup. No more contracts to provide services. France is idiotic.
  - icebraining 8y ago
    Contracts are fine. You just can't pay with your first-born, your freedom or your private data.
fraserharris 8y ago
The stronger GDPR is interpreted by the courts, the stronger Google & Facebook's oligopoly is. To compete as an ad network you will first need to have consented first-party data at scale - in other words, a (or network of) website/application that a majority of European's visit daily.
- kryptiskt 8y ago
  Google and Facebook relies on other collecting consent on their behalf, lots of Google business takes place on other sites than their own, this is trouble for them too.
- shakna 8y ago
  That doesn't seem to be the case here. In fact, Google asking other's to collect consent, and then performing auditing, may well not be considered compliant after this ruling.' > The requirement based on the article 7 above-mentioned isn’t fulfilled with a contractual clause that guarantees validly collected initial consent. The company VECTAURY should be able to show, for all data that it is processing, the validity of the expressed consent. Google hasn't first-party consented through each of the publishing contracts. They may be able to turn it around. However, the industry would now favour someone who had no need to collect consent, if we're just talking about the base ability. The ad-world's dependency on personalised data is a problem, and may continue having issues with the GDPR.
  - candybar 8y ago
    I think you're confusing Google's ad-tech platform (DFP and such) with Google's actual primary business as a publisher. Google's ad-tech business competes with other ad-tech platforms and provides services for other publishers to monetize their inventory. This is a relatively small part of their overall business that they could live without and Google the publisher doesn't need any of that to stay massively profitable. Google's own inventory would certainly be more valuable in a world where Google's ad-tech platform could not effectively help monetize other publishers' inventory.
- simias 8y ago
fyfy18 8y ago
Good. I always saw the intention of the GDPR as legislation to fundamentally change the way personal data is processed, to prevent the freely spreading of it, with blatant disregard to the consequences, by basically any company that handles personal data. Instead most companies have just opted for clickwrap consent, and continued as they always have. The more rulings we have like this, the better. Yes it may cause some business models to disappear, but I feel it's worth it to take back control of our privacy.
- isostatic 8y ago
  > Yes it may cause some business models to disappear, but I feel it's worth it to take back control of our privacy. Good, hopefully we'll see some real innovation, with wide spread micropayments, rather than brainwashing which costs the viewer of the site far more than the recipient of the site gets.
  - fabricexpert 8y ago
    > wide spread micropayments I see this on HN a LOT, but I am really not sure it's a great model. The thing about ad-supported revenue is that you can still consume the content if you can't afford it. I'm simplifying a little, but the people who convert on ads are basically subsidizing the content for the rest of us. In our society the people that fall into the conversion group are generally wealthy and the people who fall into the latter group may or not be. But the point is that with micropayments only the rich have access, and with ad-supported revenue everyone has access. I think most people prefer the latter.
    - ForHackernews 8y ago
      With proper browser design, you could support both models. load_ads_unless(payment >= $0.0001) Whether or not sites would suffer the added complexity probably depends on how much money is on the table.
    - Nursie 8y ago
      > the people who convert on ads are basically subsidizing the content for the rest of us. Do they? Or is it the people who buy the products, regardless of ad conversion?
Nursie 8y ago
Perhaps ironically, I can't access this article because I'm unwilling to just click "OK" and allow TechCrunch to pass my data to all and sundry, and their 'controls' links lead to a warren of pages at their parent company's site, and eventually to some sort of login page, with no controls in sight. In apparent contravention of the GDPR, various parts of the page say that I must agree to their use of my data for third party advertising or I cannot access the site.
- Semaphor 8y ago
  FWIW, TC works perfectly well with the default uMatrix config (as in block everything third party) and only sets a single, empty session cookie.
  - exergy 8y ago
    uMatrix is a life changer. No one can understand the sheer scope of how much one gets tracked until you log into a random article on the internet where bloody Pinterest or LinkedIn scripts and cookies are present. It's maddening, and uMatrix is amazing.
- laurent123456 8y ago
  I'm wondering actually, is there any browser extension that would get rid of these popups (as well as all these "we use cookies" useless banners)?
  - nephrite 8y ago
    Switch off JS or use uBlock - it can block arbitrary elements in any page, and works in two clicks.
    - olex 8y ago
      The Oath consent is not just an overlay, it's a separate page that TC redirects to. Not as easy to block as on-page elements.
emiliobumachar 8y ago
> consent [...] cannot be gained through a framework arrangement which bundles a number of uses behind a single “I agree” button [...] I'm a bit worried that the interface of old Windows installers might make a comeback in the internet, but with "I agree" instead of "Next" written on that button that you have to click a dozen times.
Reason077 8y ago
The interminable pile of pop-ups on the EU web has become extremely annoying, and I don't blame ad firms and publishers for seeking to minimise the disruption to the user experience. At the same time, the protections that the GDPR seeks to provide are very important and it's absolutely right to protect them in law. But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? It devalues the whole point of the GDPR because no sane person would actually read the policies for every single website to see if their data is being used reasonably or not. I personally think that there should be a limited, well-defined set of data that can be transmitted to ad exchanges under an assumed consent. Fully anonymised and broad demographic data (eg: age range, sex, city, etc) for example. Anything beyond that should require an explicit consent. This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good.
- Krasnol 8y ago
  You only have to read the policies if you are interested in sharing the data and this can be linked properly. I don't see a problem there (besides the fact that many pages are not even able to link to the proper pages of course). The design of the wall of buttons is another topic. There is a design opportunity for a good solution there. Unfortunately what I see is the opposite. Pages that try to trick you into consent, pages who seem to link to other pages "checking something", "loading", "I'm sorry, try later", plainly not working buttons or no way to check all to "do not allow" but one button to "allow all". I really hope people who install those will pay and disappear when someone has finally enough of this crap.
  - brain5ide 8y ago
    One could also argue that by avoiding the symmetric controls in these the websites are already aware of their malicious practices of the data they collect. This is cleverness, not stupidity.
- Nursie 8y ago
  > But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? There is none, however it seems to me that a lot of these are going to be considered illegal after a while, particularly the ones that default-enable a ton of stuff under the cover of a single OK button. What would be really, really nice to see would be the web industry engaging with this properly, and changing their attitudes to private data, instead of effectively trying to hide behind multiple levels of disclaimer and implementing dark patterns to try to work around it. > This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good. This is already the case, as far as a lot of privacy campaigners are concerned. If you're not planning on using my data in nefarious ways (sharing it with commercial interests for money), but only use it in ways that support providing me the service (technically, not financially) we're golden, and you don't need any consent.
hyperman1 8y ago
I'm wondering if we can't start micropayments today: Create an ad provider which bids together with all the others, but in your name (and you give them some money). If you pay enough via that ad provider, it will claim the ad space on that page for you and leave it empty or puts some todolist or whatever you want there. Ask a monthly fee of a euro for computer costs. As this is the raison d'aitre of this pseudo ad company, all its GDPR troubles are resolved at once. If it gains traction, publishers can use it as a preferred ad provider and resolve their GDPR troubles too. Only question: Who would want to pay for this. It might prove people prefer ads to micropayments.
- hartator 8y ago
  Or use an Adblock.
  - wild_preference 8y ago
    Unless we want the internet to continue centralizing into the websites that don't need a business model (like VC funding), or to the few that people are willing to take out their wallet for (like Netflix), we need a new solution if we're going to unanimously block ads.
- denisvlr 8y ago
  To my knowledge that's basically what Google Contributor does: https://contributor.google.com/v/beta https://contributor.google.com/v/beta I don't think it ever caught on.
  - deleted 8y ago
    [deleted]
- icebraining 8y ago
  Privacy protections undermine that, since it would required individual targeting of ads (unless you could afford to pay for any ads shown to everyone in your demographics). You could try to form a coalition to do group purchases, but it's a hard thing to start, since the individual benefits would be small until you got a large number of members, whereas an adblocker is free and more effective. Plus, the ad network could still track you, which is one of the problems people have with ads.
hyperman1 8y ago
I like the way they are punished: no fine, but CNIL ordered the firm to delete all data it had not already deleted (having judged collection illegal given consent was not valid); and to stop processing data without consent. So this is a warning shot to them and the ad industry: If they change the way they do business, they were almost not hurt (There is probably the court costs to pay, plus their defence, plus opportunity costs). For now, the maximum fines seem to be just that, at least in France: Maxima, only for those who really do not want to mend their ways
- remify 8y ago
  There's no need for punishment but pedagogy. Since there is still a lot of moving part regarding RGPD, the CNIL is just laying the foundation for futur cases.
  - hyperman1 8y ago
    Exactly. And the fact that CNIL takes this approach, deserves some applause. They could take out bigger guns if they wanted.
pmontra 8y ago
This is not only about advertising, it's about any service that trasfers consent to another one. There is a full thread about micro payments here, but they could solve only some cases. There are plenty of legitimate third-party services added to web sites (example: customer service) that according to this ruling (if I understood it well) should verify consent on their own. This could be possible or not, it depends on the nature of the service.
Tsubasachan 8y ago
Anything that makes it more difficult for the advertising industry is good in my book. Reminds me of how our ancestors built cathedrals instead of hospitals.
throw2016 8y ago
There seems to be a significant ethical problem of dehumanization and predation in the tech community that must be analyzed and understood. Here are people living in a civilized world with rules and regulations and posture as civilized human beings who function in an ethical society. But at work they seem to be operating in neolitic wild lands engaging in increasingly invasive predatory behavior that systematically reduces the entirety of the human population going about their daily lives into objects of profit lacking agency, merely tools to be stalked and analyzed for revenue, to be prodded for value in any way possible. There is a dehumanization here with no respect of personal space, privacy and basic human dignity. This would not be as bad if there was explicit consent and self declared transparency of the all processes in play, and commitments to ethical frameworks of operation. It's the surreptitious, misleading and often deceptive communication and behavior that betrays their willful complicity that is troubling.
Fiahil 8y ago
Maybe, at some point, ad companies would prefer asking a visitor which topic he is interested in, instead of trying to collect some giant amount of shitty data to feed their profiling engine and then being GDPRed for failure to register consent. Sometimes the best solution is also the simplest.
- deleted 8y ago
  [deleted]
deleted 8y ago
[deleted]
buboard 8y ago
The solution is to replace the cookie consents with an explicit form where users select their interests, so that the publisher can request ads tailored to the user. It's a lot more transparent and it can save a lot of publishers in the EU which are now at a dead end. (People who think that donations/subscriptions will save websites are deluded. Tracking is bad , but targeted advertising is not. Advertising is a perfectly valid model but context-based advertising is horrible - i know because i ve been seeing and serving those "russian bride" and "click here to get iphone" ads since May).
- reitanqild 8y ago
  > context-based advertising is horrible - i know because i ve been seeing and serving those "russian bride" and "click here to get iphone" ads since May). Doesn't exactly seem like you got context-based ads but rather completely pointless ads?
  - buboard 8y ago
    thats what you will get if you have anything other than a blog, though. I bet news websites have the same problem. Reporting about a death doesnt mean you want to advertise coffins.
    - reitanqild 8y ago
      And there is the problem: It seems Russian bride distributors and few others pay best. And media houses seems to don't care that this is intellectually and emotionally insulting to their readers. Had they put slightly more effort into this they might have had a nice income from non-spammy ads like they have in print.
cm2012 8y ago
This decision would be super good for Facebook and Google by the way. If you can't share/pool cookie data, then the smaller ad players will die out even faster than they are now.
rhacker 8y ago
I've always felt that one way to change the way internet companies do business with a loose-style relationship with our data is to pass laws in small towns or even just one large city. Imagine if Portland OR made severe legal consequences for specific kinds of privacy breeches for people in its own town. The giants would have to decide to block people in that city or change general data processing rules internally. But I think it acts more of a starting point of an avalanche as more and more places see the good that comes from that. It's also NOT just the big corps. Companies that use public records (and public records in and of themselves needs a LOT of additional laws in the digital age) so you can find your ex-girlfriends, etc... Can you imagine these ASSHAT websites being sued for 100k by people in Portland? Then New York, etc.. I would love to see that happen.

250 points by gbugniot 8y ago

gnud 8y ago

> In plainer English, this is being interpreted by data experts as the regulator stating that consent to processing personal data cannot be gained through a framework arrangement which bundles a number of uses behind a single “I agree” button that, when clicked, passes consent to partners via a contractual relationship. Now, I guess it's obvious to complain about the idiotic, user-hostile and down-right evil Oath consent pop-over that I got when I visited TC. I'm gonna do it anyway. Here's hoping this ruling stands.

peteri 8y ago
I haven't read techcrunch or any site with that oauth pop-over since GDPR came in. It's super obnoxious.
- gnud 8y ago
  Pretty sure it's not OAuth, but Oath. Also pretty sure they named the company Oath so that people would think "oh this is another OAuth permission box, OK".
  - peteri 8y ago
    You are so right, it is Oath
  - scrollaway 8y ago
    > Also pretty sure they named the company Oath so that people would think "oh this is another OAuth permission box, OK". I think that's just developer bias. "OAuth" is not a thing non-developers know, even by name.
  - jefftk 8y ago
    It looks like the "Oath" brand is going away, and they're going to use "Verizon Media Group": https://www.theverge.com/2018/11/5/18064172/verizon-oath-media-group-rebrand https://www.theverge.com/2018/11/5/18064172/verizon-oath-med...
    - gpvos 8y ago
      Good. It was a truly horrible name.
- karrotwaltz 8y ago
  When GDPR popups started appearing, I modified my Kill Sticky bookmark-script to also re-enable scrolling. Works most of the time for any kind of popup. Here's the script: https://pastebin.com/NfCyDLw8 https://pastebin.com/NfCyDLw8
  - CamperBob2 8y ago
    Thanks for this script, by the way -- it's come in handy many times.
shakna 8y ago
It's even more ironic in French [0], here we have a single click "I agree" button, in French, covering up a reading about a French ruling that suggests it's worthless. [0] https://shakna.keybase.pub/oath_techcrunch.png https://shakna.keybase.pub/oath_techcrunch.png
- ElBarto 8y ago
  That is really horrible. It says "Select 'OK' to authorise 'Oath' and our partners to use your data." Is there a more general, less specific, way to phrase this? It's basically "please let anyone use your data for anything".
Nursie 8y ago
Of the dark patterns I've found in this space, theirs is the worst so far. They hide away what they plan to do, and if you start digging in to try to find controls... well good luck, I haven't found any. You can get to all sorts of policies, various login pages and lots of spurious info, but as yet no controls. Other dark patterns I've seen are - A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them (though they of course have a handy 'enable all' button). A page gives you a big green "Accept All" button, and a 'reject all' option which looks greyed out and is smaller. When pressed it takes you to another dialog with a big green "Go Back" button and another, smaller, dimmer link for "Leave". The "Leave" link is the one that gets you back to the page, rejection preference intact. These seem contrary to the spirit of the GDPR, I guess we'll see in time if they are deemed to contravene the law. The TC/Oath one definitely seems to be over the line. --edit-- Missed one - A page allows you to set various controls and sliders to reject its data sharing, but then sits for several minutes "processing" your lack of consent. When it eventually completes you get a message saying that they don't have a version of the page they can show you without the data sharing cookies, so sorry, please check again in a few months.
- cr1895 8y ago
  >A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them (though they of course have a handy 'enable all' button). I see this often too. Doesn't this directly contravene the text of the GDPR, much less the spirit of it?
  - robin_reala 8y ago
    Yes. Opt in is a requirement, not opt out.
- dspillett 8y ago
  > A page attempts to put you off by making you manually deactivate hundreds of different services if you object to them Some of which are marked as "opt-out through partner", with no link or other details about how one would do that. While the trackers are making it a faf to opt out (rather than as the legislation actually required: making it an opt-in situation) I'll just keep on with my side of the arms war that is ad-blocking. Their loss, not mine. I can't say I feel I've missed out on anything by sites failing/refusing to display with ads blocked, links that redirect through trackers not working at all, or just plain backing out of sites that are obnoxious (and in breach) with "by continuing or closing this banner..." and other such.
scoot_718 8y ago
Yup. No more contracts to provide services. France is idiotic.
- icebraining 8y ago
  Contracts are fine. You just can't pay with your first-born, your freedom or your private data.

fraserharris 8y ago

The stronger GDPR is interpreted by the courts, the stronger Google & Facebook's oligopoly is. To compete as an ad network you will first need to have consented first-party data at scale - in other words, a (or network of) website/application that a majority of European's visit daily.

kryptiskt 8y ago
Google and Facebook relies on other collecting consent on their behalf, lots of Google business takes place on other sites than their own, this is trouble for them too.
shakna 8y ago
That doesn't seem to be the case here. In fact, Google asking other's to collect consent, and then performing auditing, may well not be considered compliant after this ruling.' > The requirement based on the article 7 above-mentioned isn’t fulfilled with a contractual clause that guarantees validly collected initial consent. The company VECTAURY should be able to show, for all data that it is processing, the validity of the expressed consent. Google hasn't first-party consented through each of the publishing contracts. They may be able to turn it around. However, the industry would now favour someone who had no need to collect consent, if we're just talking about the base ability. The ad-world's dependency on personalised data is a problem, and may continue having issues with the GDPR.
- candybar 8y ago
  I think you're confusing Google's ad-tech platform (DFP and such) with Google's actual primary business as a publisher. Google's ad-tech business competes with other ad-tech platforms and provides services for other publishers to monetize their inventory. This is a relatively small part of their overall business that they could live without and Google the publisher doesn't need any of that to stay massively profitable. Google's own inventory would certainly be more valuable in a world where Google's ad-tech platform could not effectively help monetize other publishers' inventory.
simias 8y ago

fyfy18 8y ago

Good. I always saw the intention of the GDPR as legislation to fundamentally change the way personal data is processed, to prevent the freely spreading of it, with blatant disregard to the consequences, by basically any company that handles personal data. Instead most companies have just opted for clickwrap consent, and continued as they always have. The more rulings we have like this, the better. Yes it may cause some business models to disappear, but I feel it's worth it to take back control of our privacy.

isostatic 8y ago
> Yes it may cause some business models to disappear, but I feel it's worth it to take back control of our privacy. Good, hopefully we'll see some real innovation, with wide spread micropayments, rather than brainwashing which costs the viewer of the site far more than the recipient of the site gets.
- fabricexpert 8y ago
  > wide spread micropayments I see this on HN a LOT, but I am really not sure it's a great model. The thing about ad-supported revenue is that you can still consume the content if you can't afford it. I'm simplifying a little, but the people who convert on ads are basically subsidizing the content for the rest of us. In our society the people that fall into the conversion group are generally wealthy and the people who fall into the latter group may or not be. But the point is that with micropayments only the rich have access, and with ad-supported revenue everyone has access. I think most people prefer the latter.
  - ForHackernews 8y ago
    With proper browser design, you could support both models. load_ads_unless(payment >= $0.0001) Whether or not sites would suffer the added complexity probably depends on how much money is on the table.
  - Nursie 8y ago
    > the people who convert on ads are basically subsidizing the content for the rest of us. Do they? Or is it the people who buy the products, regardless of ad conversion?

Nursie 8y ago

Perhaps ironically, I can't access this article because I'm unwilling to just click "OK" and allow TechCrunch to pass my data to all and sundry, and their 'controls' links lead to a warren of pages at their parent company's site, and eventually to some sort of login page, with no controls in sight. In apparent contravention of the GDPR, various parts of the page say that I must agree to their use of my data for third party advertising or I cannot access the site.

Semaphor 8y ago
FWIW, TC works perfectly well with the default uMatrix config (as in block everything third party) and only sets a single, empty session cookie.
- exergy 8y ago
  uMatrix is a life changer. No one can understand the sheer scope of how much one gets tracked until you log into a random article on the internet where bloody Pinterest or LinkedIn scripts and cookies are present. It's maddening, and uMatrix is amazing.
laurent123456 8y ago
I'm wondering actually, is there any browser extension that would get rid of these popups (as well as all these "we use cookies" useless banners)?
- nephrite 8y ago
  Switch off JS or use uBlock - it can block arbitrary elements in any page, and works in two clicks.
  - olex 8y ago
    The Oath consent is not just an overlay, it's a separate page that TC redirects to. Not as easy to block as on-page elements.

emiliobumachar 8y ago

> consent [...] cannot be gained through a framework arrangement which bundles a number of uses behind a single “I agree” button [...] I'm a bit worried that the interface of old Windows installers might make a comeback in the internet, but with "I agree" instead of "Next" written on that button that you have to click a dozen times.

Reason077 8y ago

The interminable pile of pop-ups on the EU web has become extremely annoying, and I don't blame ad firms and publishers for seeking to minimise the disruption to the user experience. At the same time, the protections that the GDPR seeks to provide are very important and it's absolutely right to protect them in law. But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? It devalues the whole point of the GDPR because no sane person would actually read the policies for every single website to see if their data is being used reasonably or not. I personally think that there should be a limited, well-defined set of data that can be transmitted to ad exchanges under an assumed consent. Fully anonymised and broad demographic data (eg: age range, sex, city, etc) for example. Anything beyond that should require an explicit consent. This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good.

Krasnol 8y ago
You only have to read the policies if you are interested in sharing the data and this can be linked properly. I don't see a problem there (besides the fact that many pages are not even able to link to the proper pages of course). The design of the wall of buttons is another topic. There is a design opportunity for a good solution there. Unfortunately what I see is the opposite. Pages that try to trick you into consent, pages who seem to link to other pages "checking something", "loading", "I'm sorry, try later", plainly not working buttons or no way to check all to "do not allow" but one button to "allow all". I really hope people who install those will pay and disappear when someone has finally enough of this crap.
- brain5ide 8y ago
  One could also argue that by avoiding the symmetric controls in these the websites are already aware of their malicious practices of the data they collect. This is cleverness, not stupidity.
Nursie 8y ago
> But what value is there in constant boxes that users become accustomed to clicking through like trained monkeys? There is none, however it seems to me that a lot of these are going to be considered illegal after a while, particularly the ones that default-enable a ton of stuff under the cover of a single OK button. What would be really, really nice to see would be the web industry engaging with this properly, and changing their attitudes to private data, instead of effectively trying to hide behind multiple levels of disclaimer and implementing dark patterns to try to work around it. > This should encourage most publishers to do the right thing, because if you're doing something that requires a consent pop-up, it probably means you're up to no good. This is already the case, as far as a lot of privacy campaigners are concerned. If you're not planning on using my data in nefarious ways (sharing it with commercial interests for money), but only use it in ways that support providing me the service (technically, not financially) we're golden, and you don't need any consent.

hyperman1 8y ago

I'm wondering if we can't start micropayments today: Create an ad provider which bids together with all the others, but in your name (and you give them some money). If you pay enough via that ad provider, it will claim the ad space on that page for you and leave it empty or puts some todolist or whatever you want there. Ask a monthly fee of a euro for computer costs. As this is the raison d'aitre of this pseudo ad company, all its GDPR troubles are resolved at once. If it gains traction, publishers can use it as a preferred ad provider and resolve their GDPR troubles too. Only question: Who would want to pay for this. It might prove people prefer ads to micropayments.

hartator 8y ago
Or use an Adblock.
- wild_preference 8y ago
  Unless we want the internet to continue centralizing into the websites that don't need a business model (like VC funding), or to the few that people are willing to take out their wallet for (like Netflix), we need a new solution if we're going to unanimously block ads.
denisvlr 8y ago
To my knowledge that's basically what Google Contributor does: https://contributor.google.com/v/beta https://contributor.google.com/v/beta I don't think it ever caught on.
- deleted 8y ago
  [deleted]
icebraining 8y ago
Privacy protections undermine that, since it would required individual targeting of ads (unless you could afford to pay for any ads shown to everyone in your demographics). You could try to form a coalition to do group purchases, but it's a hard thing to start, since the individual benefits would be small until you got a large number of members, whereas an adblocker is free and more effective. Plus, the ad network could still track you, which is one of the problems people have with ads.

hyperman1 8y ago

I like the way they are punished: no fine, but CNIL ordered the firm to delete all data it had not already deleted (having judged collection illegal given consent was not valid); and to stop processing data without consent. So this is a warning shot to them and the ad industry: If they change the way they do business, they were almost not hurt (There is probably the court costs to pay, plus their defence, plus opportunity costs). For now, the maximum fines seem to be just that, at least in France: Maxima, only for those who really do not want to mend their ways

remify 8y ago
There's no need for punishment but pedagogy. Since there is still a lot of moving part regarding RGPD, the CNIL is just laying the foundation for futur cases.
- hyperman1 8y ago
  Exactly. And the fact that CNIL takes this approach, deserves some applause. They could take out bigger guns if they wanted.

pmontra 8y ago

This is not only about advertising, it's about any service that trasfers consent to another one. There is a full thread about micro payments here, but they could solve only some cases. There are plenty of legitimate third-party services added to web sites (example: customer service) that according to this ruling (if I understood it well) should verify consent on their own. This could be possible or not, it depends on the nature of the service.

Tsubasachan 8y ago

Anything that makes it more difficult for the advertising industry is good in my book. Reminds me of how our ancestors built cathedrals instead of hospitals.

throw2016 8y ago

There seems to be a significant ethical problem of dehumanization and predation in the tech community that must be analyzed and understood. Here are people living in a civilized world with rules and regulations and posture as civilized human beings who function in an ethical society. But at work they seem to be operating in neolitic wild lands engaging in increasingly invasive predatory behavior that systematically reduces the entirety of the human population going about their daily lives into objects of profit lacking agency, merely tools to be stalked and analyzed for revenue, to be prodded for value in any way possible. There is a dehumanization here with no respect of personal space, privacy and basic human dignity. This would not be as bad if there was explicit consent and self declared transparency of the all processes in play, and commitments to ethical frameworks of operation. It's the surreptitious, misleading and often deceptive communication and behavior that betrays their willful complicity that is troubling.

Fiahil 8y ago

Maybe, at some point, ad companies would prefer asking a visitor which topic he is interested in, instead of trying to collect some giant amount of shitty data to feed their profiling engine and then being GDPRed for failure to register consent. Sometimes the best solution is also the simplest.

deleted 8y ago
[deleted]

deleted 8y ago

[deleted]

buboard 8y ago

The solution is to replace the cookie consents with an explicit form where users select their interests, so that the publisher can request ads tailored to the user. It's a lot more transparent and it can save a lot of publishers in the EU which are now at a dead end. (People who think that donations/subscriptions will save websites are deluded. Tracking is bad , but targeted advertising is not. Advertising is a perfectly valid model but context-based advertising is horrible - i know because i ve been seeing and serving those "russian bride" and "click here to get iphone" ads since May).

reitanqild 8y ago
> context-based advertising is horrible - i know because i ve been seeing and serving those "russian bride" and "click here to get iphone" ads since May). Doesn't exactly seem like you got context-based ads but rather completely pointless ads?
- buboard 8y ago
  thats what you will get if you have anything other than a blog, though. I bet news websites have the same problem. Reporting about a death doesnt mean you want to advertise coffins.
  - reitanqild 8y ago
    And there is the problem: It seems Russian bride distributors and few others pay best. And media houses seems to don't care that this is intellectually and emotionally insulting to their readers. Had they put slightly more effort into this they might have had a nice income from non-spammy ads like they have in print.

cm2012 8y ago

This decision would be super good for Facebook and Google by the way. If you can't share/pool cookie data, then the smaller ad players will die out even faster than they are now.

rhacker 8y ago

I've always felt that one way to change the way internet companies do business with a loose-style relationship with our data is to pass laws in small towns or even just one large city. Imagine if Portland OR made severe legal consequences for specific kinds of privacy breeches for people in its own town. The giants would have to decide to block people in that city or change general data processing rules internally. But I think it acts more of a starting point of an avalanche as more and more places see the good that comes from that. It's also NOT just the big corps. Companies that use public records (and public records in and of themselves needs a LOT of additional laws in the digital age) so you can find your ex-girlfriends, etc... Can you imagine these ASSHAT websites being sued for 100k by people in Portland? Then New York, etc.. I would love to see that happen.