Facebook will argue that the data is necessary.

I can't see that argument going well: Since they let users opt-out of targeted advertising, which is probably the only thing "tracking" is useful for, they tacitly admit that "tracking" is not necessary for them to providing their service.

"We require tracking to pay for the costs of providing this free service".

No such thing as a free lunch.

Just because they chose a specific business model doesn't mean it's necessary. Nobody says the lunch must be free, just that not every avenue of funding is allowed.

Please read the GDPR text and then tell me where it says anything like this.

I'd have to quote too much. Essentially you only have six allowed reasons for processing personal data (article 6). The only ones that could apply are (a) consent or (b) necessary for performance of contract.

(b) isn't applicable because it only applies when it's directly necessary to provide for that particular user (like processing a CC number when paying for a product). That you business model generally needs it is not enough (see the ICO FAQ on the issue[1]).

(a) Consent is valid, but it must be freely given, that is, the provision on the service can't be conditional on the consent (article 7 (4)).

[1] https://ico.org.uk/for-organisations/guide-to-the-general-da...

The GDPR talks about "executing a contract, which includes the provision of services" (not the exact wording, but something like that). So if you define "using the social network in return for having targeted ads displayed" as the contract, it is necessary.

> just that not every avenue of funding is allowed

Funding by targeted ads isn't illegal last time I checked.

Performance of the contract does not mean whatever they want it to mean. Here's the ICO FAQ on the GDPR (emphasis mine):

"The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

> Funding by targeted ads isn't illegal last time I checked.

It is if you don't get consent. And you can't make that consent required to provide a service, since then it won't be "freely given", as per Article 7.

I'm not a GDPR expert. My work around it has been very narrow.

If this is correct, this is a major blow for US industries.

I hope the US follows suit with Europe rather than attempting to start another trade war.

What does "freely given" mean in this context? Is GDPR forcing me to give access to my service for free if my business model is targeted ads?

Yes, I that's the way I read it (from Recital 43), and the ICO seems to agree:

"Avoid making consent to processing a precondition of a service (...) If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."

https://ico.org.uk/for-organisations/guide-to-the-general-da...

That would be interesting! That would probably mean they'd need to ban me, since I use an ad-blocker, right?

What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...

> That would probably mean they'd need to ban me, since I use an ad-blocker, right?

Are you saying they should be forced by law to block you?

> What about someone who uploads a lot of pictures but doesn't have many friends? That person might be using more resources than the ad revenue they generated...

That is a flat-fee/pricing issue, just like someone binge watching Netflix might be using more resources than they generate in revenue. It isn't relevant to the discussion.

“We sell your credit card number on the black market to pay the costs of this free service”.

Also illegal.

Selling the credit card is illegal, serving targeted ads isn't.

Without user consent, it will be in soon in the EU.

> "We require tracking to pay for the costs of providing this free service".

> No such thing as a free lunch.

Please square that with the fact (which I already pointed out) that they already provide their free service without targeting, based on user settings.

They can't using tracking to "pay the costs of providing this free service" without ad targeting (unless they're selling the tracking data, which they publicly deny).

I'm making an educated guess that mere declarations of necessity tracking are not sufficient legal justification for it in the EU.

What if your service requires the tracking?

Consent isn't required for data collection that is necessary for the service to work. However, you have to be prepared to defend in court that it IS necessary.

As such, trackers in 3rd-party advertising network code probably won't count as necessary; it's necessary for the ad network, but it is not necessary for the website displaying the advertisements, as proven by ad-blockers.

Likewise, the facebook like button and other "plugin" components aren't "necessary", they merely add value to the existing content / features, and must therefor be entirely opt-in.

At least, that's my understanding, which is entirely too facile to be taken as legal advice.

EDIT: As petercooper pointed out below, in addition to proving necessity, you must still also prove in court that you have balanced the necessity against users' rights and interests. As such, I no longer feel confident to say I even have a clue as to what is legal and what is not, for FB or for anyone else, until there's a big enough court case to set precedent.

> but it is not necessary for the website displaying the advertisements, as proven by ad-blockers.

when I was a child I stole a toy from Wal-Mart. Wal-Mart is still around. Therefore, Wal-Mart's entire existence as a store does not depend on any kind of anti-theft measures, and it should be illegal for them to film my entrance and exit.

This is an interesting choice of counter-argument. Firstly three things:

1) Laws don't exist in isolation

2) Long standing law says theft is illegal and stores can take steps to limit it.

3) This new law (GDPR) says you can't take users details and use them unless necessary to provide your service.

With this new GDPR law it's the little guy, the user, that get protection from something of value being taken from them and exploited - their personal details.

So, extending the above counter-argument it is also true to say that like Walmart, the singular 'theft' of personal details might not be terminal for the user. But just like the law recognises the theft of material goods and it's potential harm (even in the case of a singal instance), it now recognises the 'taking' of personal data as harmful (also even a single instance).

Extending the argument further, the GDPR takes the stance that one entity has been taking something of value from another without true compensation for the value of that something.

When we realise that what has been taken from users has value and that users haven't been fairly compensated for that value, it becomes obvious that a set of entities have based a business model on profiting off another set without fair compensation.

The GDPR now limits that behaviour and business model to return balance to the 'contract' between the two parties. Users get to use a service by providing the minimum needed for that service to be provided.

Actually, filming entrance and exits is probably necessary for them to have insurance against theft, which probably is necessary for them to continue operating.

Further, some stores put locks on items and displays that others do not. These are also required for the store to continue offering such services.

You, as an individual, may not have undermined the store. However, you, as an individual among many, may be the reason why certain stores are not able to function as other stores do.

EDIT: to clarify my point, I don't think the GDPR takes how revenue is obtained into account. The revenue model itself must still conform to user consent. The analogy of Walmart to ad-blockers is interesting, though slightly off when one behavior is illegal and the other is not.

But thats not what facebook is doing. Facebook is tracking your every move between stores, public and private spaces, using that information to infer vast knowledge about your likes, dislikes, sexual orientation, income level, political belief, religion, friends and friends of friends. Seeing who you talk to, how long and about what, and then selling that information to anyone, along with access your newsfeed.

Do you mean to say that Facebook's existence isn't entirely dependent on selling personal information to advertisers?

My understanding is that Facebook doesn’t actually sell data to advertisers. By this I mean you can’t go to Facebook and say, “I would like to buy data for 10,000 18-24 year old males in New York City, how much?” Instead you say, “I have an ad I want to show to 10,000 18-24 year old males in NYC, how much?” Facebook then handles serving the ad for you and sends you data about how succufull your campaigne was, when people click on the ad and visit your website you obviously can collect data from them there. This is subtle difference and one I think few people have been articulating, probally in part because it makes you sound like a shill for Facebook.

This actually makes more sense finically for Facebook, if they did the first thing people would only have to buy data once, and worse they could resell the data to third parties decreasing Facebook’s control of the market. Instead by retaining control of the data Facebook can charge an advertiser for every ad they show, making more money. Ironically this also better protects peoples privacy because Facebook isn’t actually giving the data away.

Unfortunately, if I run an ad targeting 18-24 year old males in New York City, and my ad manages to collect IP addresses, I have effectively purchased information about anyone who sees my ad.

It's certainly not a complete profile, and may have ranges of categorizations (i.e. 18-24 years old) BUT as an advertiser, I probably wouldn't need or want data more specific than that anyway.

Unfortunately you can’t collect IP addrssses from people who saw your ad though, because FB doesn’t let you :)

You can of course though collect them if people actually click on them and come to your website! This is also the case for non targeted ads mind you as it’s simply how the web works

I don't think the GDPR's "necessary to work" clause considers profit models. I believe, (again, IANAL) that "necessary to work" is really "necessary for a feature to function"; how a company derives revenue from the service doesn't come into account.

It would be interesting to see revenue as a necessity be tested in court, since there are open-source social networks that don't rely on user tracking or data sales to the extent that Facebook does it.

On the contrary, commercial interests, including things like direct marketing, are considered acceptable "legitimate interests" under the GDPR, assuming the practice follows industry standards, ethics, and are legal.

However, they need to pass two other tests, a "necessity" test that determines that the processing of information is necessary to serve the interest, and, most crucially, a "balancing" test which balances the commercial interest against the user's interests, rights, and freedoms. It's this latter part where more onerous advertising practices will falter.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Interesting... the "necessity" test was what I was referring to for "necessary to work". However, I wasn't aware of the "balancing" test.

Also, does Facebook's ad network really constitute "direct marketing"? I had imagined that to be more of an email blast about a new FB feature, rather than collect-your-usage-data-and-sell-marketing-slots-to-you.

Now that I type that out, I guess it does make more sense. However, I really am not a big fan of the common-law approach to the "balancing" test. Basically, whoever has the most money and faces the most lenient judge wins. Everyone else is left guessing what the hell is legal and what isn't, when a clear set of rules would be much easier to fairly apply to everyone.

Erroneous guesses about GDPR, upvoted. Legal fact citing the law itself, downvoted.

Vote me down all you like, but it doesn't affect what is actual legal fact :-)

> However, you have to be prepared to defend in court that it IS necessary.

I'm pretty sure Facebook has the resources to have hired competent lawyers to advise them on that, and the money to afford preparation and execution of a strong court presentation of their viewpoint.

And Facebook probably had more information on what is necessary for the system Facebook provides to work than people trying to guess that from the outside.

It is, of course, possible, and, perhaps even likely, that a court will disagree with what they argue, and force a change—but it may be, from a PR perspective, worth the cost of non-compliance sanctions to have any decrease in utility resulting from changes they will be compelled to make to be very visibly forced on them by orders that they vigorously fought rather than self-initiated, so that European authorities and the GDPR get the blame for any reduced quality.

> I'm pretty sure Facebook has the resources to have hired competent lawyers to advise them on that

You could say that about any of the resource-rich people and companies that have subsequently had their arse handed to them in court.

Yes, you could, and the rest of my post addresses why it might be in FBs interest to push this even if they are likely to lose.

Then you’d be permitted to do so. Facebook Messenger’s chat with your friends service does not depend on tracking, for example, so this argument doesn’t apply to Facebook.

What do you mean by "does not depend on tracking"? Do you mean that you can conceive of a way to implement the service as it appears to the user, without tracking? Because Facebook can certainly inject tracking into their chat app. Given Facebook, I assume it's already the case that if I type "let's get married" and then erase those words and never send them, that Facebook's going to start showing me advertisements for how to pop the question.

You assume that, I assume that, these thoughts are a few digits shy of the decimal point of the percentage of people in the world who understand this. It's not commonly known that Facebook track your every conscious and unconscious interactions with their sites, apps, and every other site that has one of their tracking pixels/logins. It's even less commonly known that they gather data from numerous data brokers to enhance the data they have on you.

Tracking is not required to deliver a text message between two contacts who approved each other.

Facebook might declare otherwise, but since SMS and IRC both stand as counterexamples of successful text chat services that do not inherently depend on tracking, they would likely lose their case.

Define "doesn't depend on" because I could easily make the argument that Messenger's chat does require tracking location for example to increase security and to fight spam. By not opting in to tracking of location, you degrading the quality of the service and affecting other people.

i.e. Without this tracking, the quality of Messenger is affected, and therefore, by definition, the service cannot be provided without it.

That's fine, but then FB can only use that location for increasing security and fighting spam. Slurping information based on an excuse and then using it for something else is explicitly prohibited by the GDPR.

Required means for example that you need a shipping address to ship a product. Not that you need location data in order to build a profile used for various undeclared, vague purposes - or for an unrelated purpose. I don't use fb in order to watch ads. Fb shows ads on order to finance the service. They can offer a paid option to cover the cost of serving pictures of adorable kittens.