6 ms·

One thing that strikes me reading this, is that the only thing that's changed is that Google won't disallow it. But I think it would make more sense if the ICO

One thing that strikes me reading this, is that the only thing that's changed is that Google won't disallow it. But I think it would make more sense if the ICO actually just went after the companies doing fingerprinting directly, instead of being angry at Google for not enforcing things for them. There is a subtle but important difference here. If governments enforce policy by bullying HSBC/Google/E.ON to enforce policies for them, there is no legal opportunity for companies and individuals to argue for their sake. You'll just be shut out of your bank/advertising/electricity for doing something "wrong". If instead UK ICO would bring a legal case against an individual or company applying fingerprinting (and I'm no advocate of fingerprinting, but that's besides the point) then they can defend themselves in court.

g-b-r 2y ago
There's a gazillion of companies outside UK legislation; if they only went against companies doing fingerprinting, only those subject to their legislation would refrain from doing it Having Google forbid it makes a lot of sense
- ben_w 2y ago
  That argument works better against having Google be the enforcer than in favour: Google's rules are (as I understand it in this case) global, why should the UK's rules be made to apply to, say, a Japanese-language-only app sold only in the Japan? (For all I know Japan has similar rules, the point isn't the specific country, but that this would be the UK projecting power internationally that it shouldn't be).
  - swores 2y ago
    Google can choose to only have it against the rules for adverts served to UK (or UK and EU and any other country with strong privacy laws), and still have better ability to target the bad actors (as they can choose to either fully ban, or just ban from advertising to those countries, any company that breaks the rule regardless of whether they're in or outside ICO's jurisdiction).
    - anticensor 2y ago
      About 160 countries in the world have EU-style privacy law. USA is an outlier.
buran77 2y ago
> if the ICO actually just went after the companies doing fingerprinting directly, instead of being angry at Google for not enforcing things for them Google isn't just a hapless bystander here, they are enabling and profiting from the practice. Big tech companies all build these billion people villages and heavily tax every person inside but when "outside law" is broken then "outside authorities" should fix it for free. The rules could be simple: you have a problem in your village, either you enforce the laws there, or national authorities will do it and charge you (the company) for the service. When Amazon allows any of the millions of ephemeral clone-storefronts to sell shady or illegal stuff, would you rather have the authorities spend years chasing ghosts or have Amazon change their rules to make sure such illegality and abuse aren't possible in their marketplace?
- sandstrom 2y ago
  > When Amazon allows any of the millions of ephemeral clone-storefronts to sell shady or illegal stuff, would you rather have the authorities spend years chasing ghosts or have Amazon change their rules to make sure such illegality and abuse aren't possible in their marketplace? I'm fine with a law saying Amazon is liable for fake storefronts etc. Sounds reasonable. I'd also favor requiring e.g. Uber or Airbnb to provide authorities with data to prevent tax fraud from operators in such marketplaces. But to me saying Google's advertising product should enforce how the individual websites work [fingerprinting], is to me more in the direction of "an electricity provider should enforce how people live their lives in any home provided by such electricity…"
  - swores 2y ago
    I completely disagree, and I'm someone whose interests would be best served by agreeing with you (my marketing agency spends a lot on advertising, and if the ad platforms don't have to enforce this sort of bad behaviour from other advertisers then prices could potentially fall as their expenses would) Google's ad network isn't just dumb pipes for information like an ISP or an electricity provider, they're actively charging companies money in order to send whatever information to be displayed and code to be executed those companies want them to onto the screens of people that they're actively targeting. It should absolutely be Google's (or whatever ad network's) responsibility to not allow bad actors to use their services to spread viruses/malware, nor to allow even worse privacy evasion that they're already doing themselves such as allowing fingerprinting.
usr1106 2y ago
That's the problem with allowing a company the reach and keep dominating market position. You need to involve them in regulation enforcement. In a fair market Google could rightfully say that's none of our business.
underdeserver 2y ago
Two separate issues. There needs to be regulation to stop Google from doing or allowing fingerprinting, and there also needs to be regulation to help people against one-sided decisions like that. You don't get to be that big and make your own rules.
IanCal 2y ago
I really don't understand this comment. They're not expecting google to enforce anything, and they are talking about going after individual companies. > If governments enforce policy by bullying HSBC/Google/E.ON to enforce policies for them, there is no legal opportunity for companies and individuals to argue for their sake Companies are in no way stopped from fingerprinting just because of google. > When the new policy comes into force on 16 February 2025, organisations using Google’s advertising technology will be able to deploy fingerprinting without being in breach of Google’s own policies. Given Google’s position and scale in the online advertising ecosystem, this is significant. This seems like a very reasonable statement, no?
- sandstrom 2y ago
  I guess it depends on what you read into it. But when I read this it seems like they are unhappy with Google no longer enforcing their view of fingerprinting: We think this change is irresponsible. [...] We are continuing to engage with Google on this U-turn in its position and the departure it represents from our expectation of a privacy-friendly internet.
  - IanCal 2y ago
    Yes, they call it out as a bad change and are making a statement that it will be hard for companies who use this to justify it.
    - swores 2y ago
      They (ICO) are saying two things, they're saying that regardless of Google's policy they will go after companies they find to be using fingerprinting to bypass a user's right to privacy (this is the part you've focussed on), and they're also saying that Google should cancel this change and return to having it banned as their policy, with the implication that Google actively policies their own policy and would therefore prevent people from doing fingerprinting without ICO having to get involved (which is what the person you originally replied to was focussing on). Their comment that you said you didn't understand made complete sense in the context of that aspect of the ICO's post, but you seemed to not see a link between the ICO wanting Google to reinstate the ban and seeing that as Google policing that subject on their network.
maffyoo 2y ago
This just doesn't make sense. Google wont disallow fingerprinting on companies using ITS advertising technology. I think accountability gets exhausted pretty quickly on this just by thinking about the implications. If UK gov (or any other) enforces a blanket ban on google ads to prevent this problem, where exactly does the issue lie ? This is not like someone selling syringes being accountable for someone putting toxins into the syringe, this is someone who already has a line into a main blood vessel saying they wont prevent someone from putting toxins in. Big, Big difference, they have the privilege of access and wont prevent other people abusing it. This is on google, pure and simple
rixed 2y ago
I have no opinion about this particular case at hand, but decades of observations of how governments, esp. in Europe, "regulate" IT by targetting a few big players, and Google always first in line despite that company has been _historically_ the most careful with users data, have convinced me that this has little to do with protection of citizens privacy and much more to do with forcing those whole encompassing corporations to cooperate with governments own surveillance agendas.
- seanhunter 2y ago
  Firstly regulators go after the big players because they have finite resources and that’s the easiest way for them to have a lot of leverage versus trying to play whack a mole with thousands of tiny companies who can easily shut down and change name in the event of a regulatory action. Secondly the idea that google are particularly singled out flies in the face of the significant actions by european data regulators against meta and all the other big tech companies. Thirdly the idea that google are particularly careful with users data is pretty laughable.
  - rixed 2y ago
    > the idea that google are particularly careful with users data is pretty laughable Either you don't know what you are talking about, or we attach very different meanings behind some of these words. Let me rephrase : of all companies, institutions or associations that I've been able to glance from the inside in my already quite long carrier, Google was by far the one where user data was the most secured, from unlegitimate access from the outside world or from the employees alike. Also, of all the big internet corporations, I've read many stories about facebook or microsoft (amongst others) cooperating with the most repressive regimes. On rare occasion where I could read about some big corp prefering to loose a market rather than user trust, each time it was either Apple or Google. Granted, it was many years ago; But already after Google was regularly presented by EU "opinion makers" like the most evil of corporations. Witnessing this and the ensuing downward trajectory of morale in big IT corporations, I half-jokingly developped the theory that maybe corporations are like little children: they behave just as well as they are expected to. If you constantly tell them that they are immoral and stupid, then they become just that.
seanhunter 2y ago
What makes you think the UK ICO won’t bring legal cases against individuals or companies applying fingerprinting? They literally say in this guidance that they consider it against the regulations for companies to do this even though google now allows it. Having dealt with regulators a fair bit that’s pretty much as clear cut a warning as you can get that they will go after people who do this. Now, will they be fast? No. Will they go after the worst offenders? Maybe, maybe not. Will they only do it if someone makes a complaint? Perhaps. But this note is literally them saying to companies “don’t think you can do this just because google now says it’s ok”.
- Winblows11 2y ago
  > What makes you think the UK ICO won’t bring legal cases against individuals or companies applying fingerprinting? Not enough staff in ICO to bring these cases. All the capable people earn much more in private sector (banking/finance) in London.
- noprocrasted 2y ago
  > What makes you think the UK ICO won’t bring legal cases against individuals or companies applying fingerprinting? The vast majority of consent flows ("cookie banners") out there are not compliant and they do absolutely nothing about it. It's very unlikely this would be any different. The ICO is all bark and no bite.
threeseed 2y ago
> But I think it would make more sense if the ICO actually just went after the companies The majority of online advertisers are small-medium ecommerce brands. There is no chance ICO would go that route.
isodev 2y ago
> it would make more sense if the ICO actually just went after the companies doing fingerprinting directly, instead of being angry at Google I think it’s quite the opposite - Google enabling illegal use of their services should make their offering unfit for market. Being a monopolist in the space, it’s Google’s responsibility to ensure users are safe when exposed to their services.
stefan_ 2y ago
I suppose this is why we need to break up Google, so even the most unaware person on the world can realize that they are the biggest advertising network on the planet. THEIR PRODUCT IS ADVERTISING. TARGETED ADVERTISING. This is what they do. That is where their money is made. What business do you think Google is in?!

g-b-r 2y ago

There's a gazillion of companies outside UK legislation; if they only went against companies doing fingerprinting, only those subject to their legislation would refrain from doing it Having Google forbid it makes a lot of sense

ben_w 2y ago
That argument works better against having Google be the enforcer than in favour: Google's rules are (as I understand it in this case) global, why should the UK's rules be made to apply to, say, a Japanese-language-only app sold only in the Japan? (For all I know Japan has similar rules, the point isn't the specific country, but that this would be the UK projecting power internationally that it shouldn't be).
- swores 2y ago
  Google can choose to only have it against the rules for adverts served to UK (or UK and EU and any other country with strong privacy laws), and still have better ability to target the bad actors (as they can choose to either fully ban, or just ban from advertising to those countries, any company that breaks the rule regardless of whether they're in or outside ICO's jurisdiction).
  - anticensor 2y ago
    About 160 countries in the world have EU-style privacy law. USA is an outlier.

buran77 2y ago

> if the ICO actually just went after the companies doing fingerprinting directly, instead of being angry at Google for not enforcing things for them Google isn't just a hapless bystander here, they are enabling and profiting from the practice. Big tech companies all build these billion people villages and heavily tax every person inside but when "outside law" is broken then "outside authorities" should fix it for free. The rules could be simple: you have a problem in your village, either you enforce the laws there, or national authorities will do it and charge you (the company) for the service. When Amazon allows any of the millions of ephemeral clone-storefronts to sell shady or illegal stuff, would you rather have the authorities spend years chasing ghosts or have Amazon change their rules to make sure such illegality and abuse aren't possible in their marketplace?

sandstrom 2y ago
> When Amazon allows any of the millions of ephemeral clone-storefronts to sell shady or illegal stuff, would you rather have the authorities spend years chasing ghosts or have Amazon change their rules to make sure such illegality and abuse aren't possible in their marketplace? I'm fine with a law saying Amazon is liable for fake storefronts etc. Sounds reasonable. I'd also favor requiring e.g. Uber or Airbnb to provide authorities with data to prevent tax fraud from operators in such marketplaces. But to me saying Google's advertising product should enforce how the individual websites work [fingerprinting], is to me more in the direction of "an electricity provider should enforce how people live their lives in any home provided by such electricity…"
- swores 2y ago
  I completely disagree, and I'm someone whose interests would be best served by agreeing with you (my marketing agency spends a lot on advertising, and if the ad platforms don't have to enforce this sort of bad behaviour from other advertisers then prices could potentially fall as their expenses would) Google's ad network isn't just dumb pipes for information like an ISP or an electricity provider, they're actively charging companies money in order to send whatever information to be displayed and code to be executed those companies want them to onto the screens of people that they're actively targeting. It should absolutely be Google's (or whatever ad network's) responsibility to not allow bad actors to use their services to spread viruses/malware, nor to allow even worse privacy evasion that they're already doing themselves such as allowing fingerprinting.

usr1106 2y ago

That's the problem with allowing a company the reach and keep dominating market position. You need to involve them in regulation enforcement. In a fair market Google could rightfully say that's none of our business.

underdeserver 2y ago

Two separate issues. There needs to be regulation to stop Google from doing or allowing fingerprinting, and there also needs to be regulation to help people against one-sided decisions like that. You don't get to be that big and make your own rules.

IanCal 2y ago

I really don't understand this comment. They're not expecting google to enforce anything, and they are talking about going after individual companies. > If governments enforce policy by bullying HSBC/Google/E.ON to enforce policies for them, there is no legal opportunity for companies and individuals to argue for their sake Companies are in no way stopped from fingerprinting just because of google. > When the new policy comes into force on 16 February 2025, organisations using Google’s advertising technology will be able to deploy fingerprinting without being in breach of Google’s own policies. Given Google’s position and scale in the online advertising ecosystem, this is significant. This seems like a very reasonable statement, no?

sandstrom 2y ago
I guess it depends on what you read into it. But when I read this it seems like they are unhappy with Google no longer enforcing their view of fingerprinting: We think this change is irresponsible. [...] We are continuing to engage with Google on this U-turn in its position and the departure it represents from our expectation of a privacy-friendly internet.
- IanCal 2y ago
  Yes, they call it out as a bad change and are making a statement that it will be hard for companies who use this to justify it.
  - swores 2y ago
    They (ICO) are saying two things, they're saying that regardless of Google's policy they will go after companies they find to be using fingerprinting to bypass a user's right to privacy (this is the part you've focussed on), and they're also saying that Google should cancel this change and return to having it banned as their policy, with the implication that Google actively policies their own policy and would therefore prevent people from doing fingerprinting without ICO having to get involved (which is what the person you originally replied to was focussing on). Their comment that you said you didn't understand made complete sense in the context of that aspect of the ICO's post, but you seemed to not see a link between the ICO wanting Google to reinstate the ban and seeing that as Google policing that subject on their network.

maffyoo 2y ago

This just doesn't make sense. Google wont disallow fingerprinting on companies using ITS advertising technology. I think accountability gets exhausted pretty quickly on this just by thinking about the implications. If UK gov (or any other) enforces a blanket ban on google ads to prevent this problem, where exactly does the issue lie ? This is not like someone selling syringes being accountable for someone putting toxins into the syringe, this is someone who already has a line into a main blood vessel saying they wont prevent someone from putting toxins in. Big, Big difference, they have the privilege of access and wont prevent other people abusing it. This is on google, pure and simple

rixed 2y ago

I have no opinion about this particular case at hand, but decades of observations of how governments, esp. in Europe, "regulate" IT by targetting a few big players, and Google always first in line despite that company has been _historically_ the most careful with users data, have convinced me that this has little to do with protection of citizens privacy and much more to do with forcing those whole encompassing corporations to cooperate with governments own surveillance agendas.

seanhunter 2y ago
Firstly regulators go after the big players because they have finite resources and that’s the easiest way for them to have a lot of leverage versus trying to play whack a mole with thousands of tiny companies who can easily shut down and change name in the event of a regulatory action. Secondly the idea that google are particularly singled out flies in the face of the significant actions by european data regulators against meta and all the other big tech companies. Thirdly the idea that google are particularly careful with users data is pretty laughable.
- rixed 2y ago
  > the idea that google are particularly careful with users data is pretty laughable Either you don't know what you are talking about, or we attach very different meanings behind some of these words. Let me rephrase : of all companies, institutions or associations that I've been able to glance from the inside in my already quite long carrier, Google was by far the one where user data was the most secured, from unlegitimate access from the outside world or from the employees alike. Also, of all the big internet corporations, I've read many stories about facebook or microsoft (amongst others) cooperating with the most repressive regimes. On rare occasion where I could read about some big corp prefering to loose a market rather than user trust, each time it was either Apple or Google. Granted, it was many years ago; But already after Google was regularly presented by EU "opinion makers" like the most evil of corporations. Witnessing this and the ensuing downward trajectory of morale in big IT corporations, I half-jokingly developped the theory that maybe corporations are like little children: they behave just as well as they are expected to. If you constantly tell them that they are immoral and stupid, then they become just that.

seanhunter 2y ago

What makes you think the UK ICO won’t bring legal cases against individuals or companies applying fingerprinting? They literally say in this guidance that they consider it against the regulations for companies to do this even though google now allows it. Having dealt with regulators a fair bit that’s pretty much as clear cut a warning as you can get that they will go after people who do this. Now, will they be fast? No. Will they go after the worst offenders? Maybe, maybe not. Will they only do it if someone makes a complaint? Perhaps. But this note is literally them saying to companies “don’t think you can do this just because google now says it’s ok”.

Winblows11 2y ago
> What makes you think the UK ICO won’t bring legal cases against individuals or companies applying fingerprinting? Not enough staff in ICO to bring these cases. All the capable people earn much more in private sector (banking/finance) in London.
noprocrasted 2y ago
> What makes you think the UK ICO won’t bring legal cases against individuals or companies applying fingerprinting? The vast majority of consent flows ("cookie banners") out there are not compliant and they do absolutely nothing about it. It's very unlikely this would be any different. The ICO is all bark and no bite.

threeseed 2y ago

> But I think it would make more sense if the ICO actually just went after the companies The majority of online advertisers are small-medium ecommerce brands. There is no chance ICO would go that route.

isodev 2y ago

> it would make more sense if the ICO actually just went after the companies doing fingerprinting directly, instead of being angry at Google I think it’s quite the opposite - Google enabling illegal use of their services should make their offering unfit for market. Being a monopolist in the space, it’s Google’s responsibility to ensure users are safe when exposed to their services.

stefan_ 2y ago

I suppose this is why we need to break up Google, so even the most unaware person on the world can realize that they are the biggest advertising network on the planet. THEIR PRODUCT IS ADVERTISING. TARGETED ADVERTISING. This is what they do. That is where their money is made. What business do you think Google is in?!