My understanding is that Facebook doesn’t actually sell data to advertisers. By this I mean you can’t go to Facebook and say, “I would like to buy data for 10,000 18-24 year old males in New York City, how much?” Instead you say, “I have an ad I want to show to 10,000 18-24 year old males in NYC, how much?” Facebook then handles serving the ad for you and sends you data about how succufull your campaigne was, when people click on the ad and visit your website you obviously can collect data from them there. This is subtle difference and one I think few people have been articulating, probally in part because it makes you sound like a shill for Facebook.

This actually makes more sense finically for Facebook, if they did the first thing people would only have to buy data once, and worse they could resell the data to third parties decreasing Facebook’s control of the market. Instead by retaining control of the data Facebook can charge an advertiser for every ad they show, making more money. Ironically this also better protects peoples privacy because Facebook isn’t actually giving the data away.

Unfortunately, if I run an ad targeting 18-24 year old males in New York City, and my ad manages to collect IP addresses, I have effectively purchased information about anyone who sees my ad.

It's certainly not a complete profile, and may have ranges of categorizations (i.e. 18-24 years old) BUT as an advertiser, I probably wouldn't need or want data more specific than that anyway.

Unfortunately you can’t collect IP addrssses from people who saw your ad though, because FB doesn’t let you :)

You can of course though collect them if people actually click on them and come to your website! This is also the case for non targeted ads mind you as it’s simply how the web works

I don't think the GDPR's "necessary to work" clause considers profit models. I believe, (again, IANAL) that "necessary to work" is really "necessary for a feature to function"; how a company derives revenue from the service doesn't come into account.

It would be interesting to see revenue as a necessity be tested in court, since there are open-source social networks that don't rely on user tracking or data sales to the extent that Facebook does it.

On the contrary, commercial interests, including things like direct marketing, are considered acceptable "legitimate interests" under the GDPR, assuming the practice follows industry standards, ethics, and are legal.

However, they need to pass two other tests, a "necessity" test that determines that the processing of information is necessary to serve the interest, and, most crucially, a "balancing" test which balances the commercial interest against the user's interests, rights, and freedoms. It's this latter part where more onerous advertising practices will falter.

https://ico.org.uk/for-organisations/guide-to-the-general-da...

Interesting... the "necessity" test was what I was referring to for "necessary to work". However, I wasn't aware of the "balancing" test.

Also, does Facebook's ad network really constitute "direct marketing"? I had imagined that to be more of an email blast about a new FB feature, rather than collect-your-usage-data-and-sell-marketing-slots-to-you.

Now that I type that out, I guess it does make more sense. However, I really am not a big fan of the common-law approach to the "balancing" test. Basically, whoever has the most money and faces the most lenient judge wins. Everyone else is left guessing what the hell is legal and what isn't, when a clear set of rules would be much easier to fairly apply to everyone.

Erroneous guesses about GDPR, upvoted. Legal fact citing the law itself, downvoted.

Vote me down all you like, but it doesn't affect what is actual legal fact :-)