> 4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
So they have to sit in contemplation for a few hours before going right ahead with collecting data that is not functionally required? Utmost care was taken...
It seems like the interesting question here would be what happens if the thing conditional on consent isn't the provision of service but rather something like waiving payment of a fee.
The reason this hasn't been offered historically is economic. There aren't enough people willing to pay to justify the effort, and the people who are willing to pay are also the best advertising targets, which means the fee would have to be high enough that hardly anyone would choose it.
But what happens now if they put a box on the site that says "pay $75 for this article or consent to be tracked and get it for free"?
EDIT: Am I really being downvoted for requesting a citation to a claim that seems to have no apparent/straight-forward basis in the law? What has this site became?
A newspaper might argue that their business is tracking users so they can show ads and afford journalists, but it won’t hold up.
Of course sites will rather try to pull a stunt like this if the option is shutting down your business directly - but I sure hope regulators force sites to turn to paid content or shut down.
I think it will hold up. Newspapers are a big factor in European the courts would not risk anything against them. Especially not if they might loose a big chunk of revenue.
Q is what will actually happen if the law is interpreted the way I want/think? Newspapers are doing quite poorly already.
Not at all: on the surface, it's the difference between "give me a dollar for a bar of candy" and "here, have a free bar of candy (and I'll help myself to a dollar (or two))".
Beneath the surface, it means that the ad-financed newspaper will have to aggregate their PII in-house (or with the help of carefully vetted partners) into targeting decisions instead of blindly throwing it over a wall to random third parties.
Oh totally! That’s why ads have never been a thing until the internet, and why there have never been print ads, television ads, and ads on the radio. No individual data, no ads, it all adds up.
(/s)
You're free to have ad tracking as long as it is optional and by explicit consent only.
Would that be allowed by the GDPR?
"Intelligence" in snark-validating environments like this means "successful oneupsmanship", and quotient means "upvotes".
But "pay and agree to get tracked, or else your payment will get you nothing", that would be a surefire way to get in trouble.
Also unconsentable would be a carte blanche for passing on the data to undisclosed third parties for unrestricted use and redistribution. This is where many existing revenue models will still have to adapt and where a lot of bad actors will dwindle or shift from grey to deep, actionable black.
I could play and encounter the ocasional cheatet. great f... deal. to this day I still play wii mario kart with some friends and there is still some loser spamming bombs all over the maps because nintendo screwed up (I wouldn't mind games havin root access to a console). we simply couldn't care less. yeah everyone will lose to the loser and switch servers asap, but we still had a good time.
while on the PC every crap you install from steam (which already have root access, expose network ports for who knows what, etc) will also install with root access for what? so people can't cheat on solitaire2000 mmo? I gladly would like all that crap software to run securely in a sandbox and find the ocasional cheater that I will lose to and then proceed to ignore.
heck a blocking list would be better than every single anti cheat code.
I don't even know where I am going with this rant. giving up your entire computer to every crap game is dumb. period.
It would just plain suck. Nobody would have fun, not even the cheaters, when they are going to play against eachother.
The commenter's case was about removing or not allowing it at all, but de facto it's required.
I'm pretty sure non-matchmaked games don't have anticheat features -- it would be dumb, as it is an additional cost.
The commenter specifically complained about giving root access to games, which is a pretty insane idea, security-wise. If anticheating techniques really require root access, then people that care about competitive gaming should have an option to consider this trade-off and turn the anticheating pieces on if they think this has a better reward/risk ratio than not giving root access to a game. It definitely shouldn't be on by default and unconfigurable, though.
In CounterStrike (Global Offensive) this is already the case. The official Valve anticheat is not as intrusive as the anticheat provided by external services like Esea or Faceit. If you choose to use such service they basicly take your system apart. It turns out that in order to get good results this is needed.
I think you underestimate the impact massive cheating can have on a game. Even casual players will leave games that have cheaters in every other lobby.
Tho back then I missed their spin how they are supposedly only targeting "that one specific cracker", they must have come up with that a bit later because on their Reddit they mostly tried to argue "it's only affecting pirates".
recaptcha was fine without even having a server side confirmation, until google improved it.
I don't know about Tuesday, but you should have been shorting any company that derives a significant percentage of their revenue from the EU ad market for the last several months. Online ad revenue from the EU will fall and never rise again, it's just a matter of exactly how much. The only thing that might change this is if there is such a public outcry about the negative effects of GDPR that it gets dialed back. But that seems like a longshot.
Seriously? Comparing privacy regulations with blithely following a cult leader into mass suicide? Aside from a few emails asking for permission to keep sending newsletters and announcing new privacy policies being mildly annoying, most EU citizens just gained a few basic rights without any significant downsides.
For me it's very clear that while GDPR has many good things, it ís disasterous to some companies, which I really don't like and question myself whether it's worth it.
Think it has anything to do with the HN crowd consisting disproportionately of the tiny minority of the workforce who make a living out of exactly the kind of behavior the GDPR wants to restrain?
And the best jokes where made by those who still have personal memories of the y2k scare. Did you remember to stockpile cash and food?
I never had the feeling in the past that HN visitors were especially pro-privacy. There were a few notable exceptions, but many more were the entrepreneur/hustler, "I don't care" or the "let the market sort it out" types.
In the past 1-2 years I guess there were several data leaks and privacy-related scandals and more and more people have had enough of these Monday to Friday advertisers on this Monday to Friday plane (of existance). Hate would not be a wrong word to describe the feelings those people have towards the advertising industry.
Maybe the pendulum has swung back :)
Showing bullshit ads isn’t.
It's actually quite liberating, yesterday I made Twitter delete a whole bunch of contacts they got off my phone.
GDPR is a piece of human rights legislation. For entirely sensible historical reasons, Europeans are acutely sensitive to issues of privacy. Many of them were born and raised in totalitarian regimes and learned painful lessons about the dangers of mass surveillance.
By passing the GDPR, the European Parliament said in no uncertain terms "if you can't run a business without infringing the rights of our citizens, we don't want you to do business in our Union". The citizens of that union are supportive of the decision taken by their democratically elected representatives.
Not only that, to a certain degree it also influences IT security: Companies with a data breach have 72 hours to report it.
No more sitting out breaches until users can find their own data on some obscure Russian forum, 2 years later.
GDPR doesn't stop you from creating a service that's a massive invasion of privacy, but you've got to ask permission first in plain language and allow people to change their minds later. If it turns out that users aren't willing to give that permission and revoke permissions that they have previously granted, it vindicates one of the basic arguments for GDPR - users wanted privacy, but they weren't being offered the opportunity to make a free and informed decision.
A small number of huge American tech companies have most to lose on this. These are the ones who play fast and loose with people's privacy.
If these new laws change the focus of business investment in Europe to those who respect privacy, that's a big win for all European citizens.
Now it's time for Margrethe Vestager to start cutting those huge American tech monopolies down to size!
And I suspect the main driver for GDPR cheering is that nothing else has been done about so many other privacy incidents. We can look back on HN and find such things as the massive Equifax leak (the next one of those is going to be interesting!) and the smart TVs that exfiltrate a list of all files on any media inserted.
This is some high-strung rhetoric. And claiming GDPR outlaws machine learning is just FUD. ML performed on personal data collected without the user's consent is illegal - but so is doing anything with illegally obtained data. ML is not the issue here, and ML has many other applications besides stealth user profiling.
"So why is interpreting the GDPR as placing a ban on ML so misleading?
Because there are significant exceptions to the prohibition on the autonomous use of ML—meaning that “prohibition” is way too strong of a word. Once the GDPR goes into effect, data scientists should expect most applications of ML to be achievable—just with a compliance burden they won’t be able to ignore.
Now, a bit more detail on the exceptions to the prohibition.
The regulation identifies three areas where the use of autonomous decisions is legal: where the processing is necessary for contractual reasons, where it’s separately authorized by another law, or when the data subject has explicitly consented.
In practice, it’s that last basis—when a data subject has explicitly allowed their data to be used by a model—that’s likely to be a common way around this prohibition. Managing user consent is not easy. Users can consent to many different types of data processing, and they can also withdraw that consent at anytime, meaning that consent management needs to be granular (allowing many different forms of consent), dynamic (allowing consent to be withdrawn), and user friendly enough that data subjects are actually empowered to understand how their data is being used and to assert control over that use.
So, does the GDPR really prohibit the use of ML models? Not completely - but it will, in many of ML’s most powerful use cases, make the deployment and management of these models and their input data increasingly difficult."
Want to use machine learning to analyze stock price movements? For self-driving cars? You're fine.
For an example, looking at kaggle's page of open competitions, only 2 of 19 use datasets that I suspect would run into consent issues (predicting home credit default risk, and predicting demand for classified ads).
There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives.
>The GDPR also outlaws most machine learning applications,
Can you point to the specific bit of GDPR that outlaws machine learning?
Here's a whole article on the subject [1] and HN discussion thread [2] . Any machine learning application that utilizes automated decision making - which is the entire point of machine learning - is forbidden under the GDPR. This can be overcome with explicit consent for that specific application of ML, but getting that in most circumstances will be a low percentage shot.
There are no additional risks imposed by GDPR; all of those risks already exist in other privacy directives.
Fines of up to 20 million EUR are a significant and new risk.
[1] https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...
Not true. Article 22 allows automated decision making if it is contractually necessary, is authorised by law or is based on explicit consent.
Many use-cases for machine learning do not constitute automated decision making within the meaning of Article 22, because they do not produce "legal effects concerning him or her or similarly significantly affects him or her". Using ML to recommend a product or enhance a photo is perfectly permissible without any special safeguards. Most ML models based on personal data are effectively anonymous in line with Recital 26, so are not considered to be personal data.
If you're using ML in a way that respects the rights of users, GDPR is not a significant obstacle.
From https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machi...
Ah, yes, if what your ML application does is suck user data on one end and produce "useful" information on the other end, then you will have a hard time explaining users why you need to collect all that data and why you need to hold it in storage for as long as you do. Because, indeed, you don't really know how that data is processed, nor how long do you really need to keep it. (This is very much an oversimplification though; many ML-based things don't necessarily fall under the rule about automated decision-based making)
Both are pieces of information that should be essential to making an informed decision about whether or not to allow private data to be collected. If you can't provide it, you need a better business plan. I'm really sorry that your founder won't be able to buy that new yacht this summer but it's hardly my problem -- and it does nothing to stiffle ML progress.
In fact, if anything, it'll be beneficial to society if some smart people give up doing ML to show ads and go someplace where they can apply ML to something useful.
I'm going to point out some counter-examples:
- One of the first machine learning stories around was movie recommendation. Under GDPR, when you click the "Recommended for me" link in your typical movie recommender, they now have to show you a page that says something on the lines of:
> UberRecommender needs to automatically process your previous ratings/view history/whatever data to make you good recommendations. We will find users with similar taste to yours, recommend movies they have liked to you and vice-versa. Click on "I agree" to continue, or "I don't agree" to disable this functionality for your account (you may change this preference later on in your settings page).
It doesn't seem too difficult to get people to click that "I agree" button, does it?
- Machine learning applied to medical diagnosis/early detection/etc. This usage was already heavily regulated (at least in the EU). So much that I'm pretty sure the GDPR does not change anything in that space.
A company really has to do terrible things to data to come anywhere near the €20m maximum fine.
"The GDPR isn't vastly different to the old Data Protection Directive, which has been in force since 1997. The panic over GDPR suggests that a lot of companies had simply been ignoring the DPD. If a bit of bullying is required to get businesses to obey the law, then so be it." (https://news.ycombinator.com/item?id=17149581)
This rings true to me. I do have a strong suspicion, as an American who's worked for an American multi-national at a low level, that people have been ignoring the existing requirements for dealing with EU data properly. For years.
The flip side of all the wailing about heavy handed regulation is that business people will not obey something that isn't enforced. And then feel it is some sort of natural right to go on that way.
That's why the EU made these laws a big EU thing, so they are in a better position to actually enforce this stuff on multi-nationals.
Business people aren't special - this is true of all people. Consider the wailing that would occur if police actually enforced speed limits.
On the contrary, since we’ll be wasting so much less time than countries still addicted to the attention economy, we’ll run rings around them in terms of productivity
It may not do that in the long term. Total spend for online advertising is probably a relatively stable figure.
In the short term it will likely have, at least from where I stand, a net positive effect. Now that industrial-grade stalking is finally illegal, companies whose sole business model was based on it will suffer. Possibly collapse. Well boohoo, cry me a river.
If and when large enough portion of the target market may no longer be stalked, the advertisers will have to come up with new (or rediscover old), non-intrusive ways to target their audience. The value of intent- and context-based audience segmentation might just go up again.
But how do you know which ads, and on which sites, ended up working the best? How about generating per-impression [bonus] codes? You don't need to stalk your potential customers if they willingly submit opaque and non-trackable information that allows you to trace the ad campaigns. GDPR does allow incentivisation, after all.
It’ll work itself out in the end, some think it will increase overall quality by forcing lower quality news publishers out of the market.
I can't find the link where I read this, but targeted ads tend to be detrimental for high-quality publications. Targeted ad peddlers are mercenary. If they want to target a high-quality site's audience, they'll run just enough ads to profile them, then target that audience on cheaper, lower-quality sites which that they also frequent.
tl;dr: Targeted ads and tracking mean advertisers have the technology to shaft high-quality sites in favor of cheaper, lower quality ones.
This is by far the most likely result. Why run an ecommerce store when you can rely on Amazon or eBay to shoulder the costs and risk?
GDPR will cause further consolidation, and ironically the companies people are forced to use will have everyone opt-out of the GDPR law by spamming them constantly with "opt-in" links until they click the "stop spamming me" button and the situation is exactly the same as it was yesterday, but with less competition.
Unintended consequences indeed.
Hm? I don't see this happening. Under GDPR you have to offer the same service 'without detriment' if the user does not want personalized ads. Most people would pick this option as long as it is clear to do so. I don't think reputation makes much of a difference. As far as I can tell, they could become paid subscriptions more likely.
The high quality news will be gladly paid for, while there will be far less clickbait sites as the ads revenues will drop. We will have less garbage on the internet and this is actually great, on the other side, the real journalism (not news like how to enlarge your penis) will hopefully come back into spotlite.
Quality small to medium publishers are the ones who will get squeezed hard.
It would be pretty shocking if suddenly EU users started happily paying for journalism. It’s going to be an exciting petri dish.
Ironically, the most effective micro-payment or subscription-based system will probably come from Google or Facebook in the end.
It's simple math. The ad industry has gotten so large because complex ad targeting tools made it possible to deploy ad campaigns profitably. With those tools extremely watered down due to GDPR, most ads that were profitable on May 24th are not profitable today. Most companies will not sustain these losses for long, and will simply shift their ad spend to other markets where they can still make a profit.
Some brand advertisers might stick around in the EU market - Coke, Pepsi, maybe Apple, etc. But with most everyone else out of the picture, the market will shrink. It will likely never again be the size that it was on May 24th.
That's totally fine, and nothing of tangible value will be lost to society.
Some valuable innovations have happened thanks to $$ being fueled into the tech sector via adtech and privacy invasion, and those will suffer, but that's a trade me and many others are happy to make. The "value add" of privacy invasion is purely an arms race.
I don't think anyone really knows this for sure. Of course, Ad Tech companies will come up with some type of "metrics" to show how profitable their particular targeted ads are compared to everyone else. But I think much of the recent technical advances in ad tech are driven more from an arms race mentality - i.e. as an advertiser I feel pressured into using the latest ad targeting tech, not because it is more effective, but because my competitors are using it and I don't want to be left behind (kind of like the VC FOMO herd mentality).
Edit: Perhaps you meant profitable for the Ad Tech companies themselves and not the actual product companies purchasing the ads. In this case, I believe your statement is valid (again, not because of the effectiveness of the tech but because of FOMO).
But let's look at one of the examples on the wikidiff:
> "hardware is to software as a television set is to the shows that appear on it"
Would you say that in this analogy the author compares "hardware" to "a television" and "software" to "shows that appear on a television"?
It allowed millions of web sites to fund themselves and publish content for free, which enabled millions of other people, many of whom don't have a lot of money to pay for content, to access it. Many of those people would never respond to the ads, so in effect, they were subsidized by those who would respond to the ads.
I grew up poor myself in Baltimore city, I could never had afforded to pay for any online content. My parents couldn't even afford cable. We watched broadcast television only. I got all my books from public libraries or used book stores. If most of the services that exist today were behind paywalls and I were still poor, that content would be off limits to me.
On the flip side, advertising used to be incredibly wasteful for small businesses. If you're a local dress shop, bakery, or piano teacher, it was much harder for you to "target" people who were highly likely to use your services. Instead, you had to place much more generic ads in many different channels like signage, local newspaper classifieds, the yellow book, circulars, direct mail, and so on.
The more precise web based advertising is a revolution for smaller businesses to limit their costs, track campaigns, iterate and test what works, and reach customers cheaper and faster. Is your local bakery saving money and bringing in more local business, evil?
Way too much of the rhetoric on HN lately IS literally drinking the cool aid. It's people taking theoretical damage scenarios and way over-inflating them into actual harm. It's worse than the anti-vaxxers who inflate minute risks, or the anti-GMO crowd, who bridge a sledgehammer when a scalpel is needed.
The downside of making ad spending less efficient, or erecting pay walls, is going to be greater centralization of the web. Because if you need to do untargeted advertising, than the greatest efficiency comes from reaching the most number of eyeballs. If you need to get paywall subscribers, most small brands won't be able to convince people to pay $10/mo for subscribers, so this will force small publishers into the arms of large consolidators who sell subscriptions, and then dole out pennies, just like the record industry did to musicians.
So those wishing for the destruction of the ad supported web as it exists today are really, in effect, creating the unintended consequence of even bigger publishing oligarchies tomorrow, while the little guy is squeezed out by lower margins and higher costs. These regulations aren't really going to punish Google, Facebook, or the other large players very much. They'll survive. It's the mid-sized and smaller companies who will face the greater challenges.
I don't have a precise answer for that question. I would love to read a good analysis.
>It allowed millions of web sites to fund themselves
Not sure about that number.
> which enabled millions of other people, many of whom don't have a lot of money to pay for content, to access it. Many of those people would never respond to the ads, so in effect, they were subsidized by those who would respond to the ads.
Yes, and it also allowed centralized ad agencies (google, fb, twitter...) to gather and mine their data, to behave irresponsibly and give us the Age of Anger fueled by social and video sites extracting value from human interaction while disregarding the huge social costs of all this.
All the heat comes from those who want to push instead of provide. It is so obviously wrong.
Your comment accuses people who are opposed to surveillance capitalism of being "hyperbolic" "anti-vaxxers" talking about "theoretical damage" but the only scenarios you provide to argue your case come from your imagination.
"Think of the small businesses!" is not an argument for surveillance capitalism. I have worked in adtech on and off for about a decade. The first adtech company I worked for specialized in software for agencies/directories advertising on behalf of small business.
In fact most small business owners do not have the knowledge and time to effectively market using online advertising. It is very easy to spend all of a small online advertising budget without getting any results. The bigger players have much greater advantages and leverage over small businesses in Internet advertising than they did pre-Internet. In fact this enables the very centralization you hypothesize: the small business discovery space is captured by Yelp, Google's business listings, Facebook pages, etc., in a way that the Yellow Pages never matched. There is no way for a small business today to effectively compete in digital marketing with franchises and national chains.
The statistics support my experience: there are now less small businesses around than at any time since the 1970s: http://money.cnn.com/2016/09/08/news/economy/us-startups-nea...
Of the small businesses I see having success with Internet advertising today, they are also organized differently. Instead of being a traditional small business than happens to do X, they are run like Internet marketing firms that happen to market X. This is more like the TV infomercial business model.
A client of mine leases offices from WeWork. All the offices have glass walls, so you can really see everything about a business. Just from walking around the halls, I see a number of small apparel startups (no production equipment for making samples, no patterns hanging around, no supplies - just some computers for doing marketing), a home improvement gadget than 15 years ago would have been "As Seen on TV" (no actual tools around though - again, only computers for doing marketing), and a couple of fad diet meal substitute companies (I don't see them preparing their gloop in the communal kitchen...).
Literally the exact opposite of what you describe is the reality. Surveillance capitalism is driving a decline of small businesses and centralization into oligopolies.
> I got all my books from public libraries or used book stores. If most of the services that exist today were behind paywalls and I were still poor, that content would be off limits to me.
It really does not surprise me that you missed the point here too. Your first sentence contradicts your second. In fact, books from independent publishers and periodicals are available from public libraries. Public libraries also have subscriptions to digital journals and information databases. Publishing worked fine (in fact, in many ways better) before the surveillance capitalism oligopoly, and it will survive and thrive once the surveillance capitalism oligopoly is dismantled.
And in what concrete scenarios in Europe, has someone's data at say, Google, Facebook, or Amazon actually harmed them? Is it more or less than the people who had a bad reaction to a vaccination? (~1 in 1 million)
> In fact most small business owners do not have the knowledge and time to effectively market using online advertising.
True, the holy grail would be pay for customer acquisition, only pay for ads that work and convert. Which would allow businesses on the margin to precisely estimate their CA costs, and whether the LV justifies it. That is only possible with some kind of end-to-end information, from click to purchase.
>A client of mine leases offices from WeWork. All the offices have glass walls, so you can really see everything about a business.
(Small irony that you're opposite to surveillance capitalism, but as a capitalist, you used access to your client's workspace to gather intel on others :) )
When I say small business, I'm not talking about people trying to ship products, like your WeWork example, I'm talking brick-and-mortar, your local Italian eatery, or French bakery.
> Publishing worked fine (in fact, in many ways better) before the surveillance capitalism oligopoly, and it will survive and thrive once the surveillance capitalism oligopoly is dismantled.
Demonstrably false. The amount of free information I have access to at the touch of a button is exponentially greater than it was when I was growing up in the 70s and 80s. A library in the 80s didn't have "digital subscriptions", they had "subscriptions" to actual paper magazines. And libraries in poor neighborhoods don't exactly operate like a library in Manhattan or Palo Alto.
It's easy to sweep away things as working "fine" if you don't have the experience of only having a public library that stocks few books, doesn't have "digital databases", and to access more information, you have to take a bus far away.
Billions of people now have access to almost the sum total of human knowledge in an instant, except the truly evil people who keep publicly funded scientific papers behind expensive paywalls. This didn't work "fine" 30 years ago, raising the barrier to information to a level that only the truly dedicated would put in the effort to get it.
People who were born after the creation of the internet and of less modest economic means I think have a different perspective of just how hard it used to be to obtain information, especially on demand. I taught myself programming from a ripped up book on 6502 assembly programming, and a VIC-20 register map. That was all I could obtain, and even finding where to find a library that had other books I might want was an epic quest for a child, something thanksfully, today's kids don't have to worry about.
But you have to ask yourself how we got from zero in the 1980s, to trillions of web pages today. Someone directly paid for that out of pocket, and it wasn't me, and it wasn't publicly funded.
_That_ is the positive social externality I was talking about in my original post. It's easy to lose sight of the bonanza of riches you have today that was invisibly funded and not understand how it was funded, nor what model can replace it. It's all too easy for people to bring out the pitchforks and torches over theoretical harm and completely ignoring the concrete benefits since they aren't paying for it.
What fraction of your investable wealth have you (downandabout) committed to the short?
2) I have not made a single "doomsday" post about GDPR. I am realistic about its consequences, which happen to be negative for the most part.
3) There are many, many people on HN that invest in various things, and I have not once seen a financial disclosure about anything, even from incredibly high profile individuals on here that are known to be investors in or associated with the things they are talking about.
It's good to have multiple viewpoints of course, but I was a bit surprised by your commitment to anti-GDPR commenting. It's as if the previous discussions accounted for nothing, and it all has to be hashed out again.
I would for sure classify your viewpoint as "doomsday" (or FUD), but I have to admit I'm probably biased by my opinion: I legitimately feel GDPR is the best thing to happen to not only privacy, but Internet in general in the last decade.
Everyone should have a chance to learn accurate facts about this nightmarish regulation, especially here on HN where we have many tech entrepreneurs. Most people don’t see every post on GDPR. For the record, I just searched for GDPR stories on here and it turns out I have commented on only a small percentage of the GDPR threads that have been submitted.
""When we do need to apply a sanction, fines will not always be the most appropriate or effective choice," Denham said. "Compulsory data protection audits, warnings, reprimands, and enforcement notices are all important enforcement tools. The ICO can even stop an organisation processing data."
"None of these will require an organisation to write a cheque to the Treasury, but they will have a significant impact on their reputation and, ultimately, their bottom line," she said."
https://www.out-law.com/en/articles/2018/april/gdpr-uk-watch...
This is stuff the ICO has been doing for decades anyway, because they've always had the power.
Remember when they got a warrant to search the London Office of Cambridge Analytica? That was pre-GDPR.
If you think you know more than the UK Information Commissioner's Office about GDPR compliance, you're delusional.
How so? GDPR doesn't make personalized, targeted advertising illegal, rather it gives you (the targeted individual) the right to know how your data is being collected and sed, and to opt out of that collection if you want.
If you want to continue paying for content with your identity, fair enough, but not everyone does.
So under this system a user who doesn't mind personalized ads doesn't have the option to 'pay'. They have the ability to 'donate' their personal information but there would be no reason to do this.
Now if GDPR had allowed companies to either choose personalized ads or pay for the content, that would have been different.
The inexorable rise of ad blocking, the increasing pace of adoption recently, and not solely amongst citizens of the EU makes me think most people's trust has been burnt out.
I suspect many people in the US would be in favour of more consideration of their privacy and data security if given a choice.
If a web business can still remain profitable with personalized ads being optional, then the targeting behind those ads was never paying for that content to begin with, it was always a 'donation.'
Sorry, I've edited for clarity.
>If a business is unable to make enough of a profit from its new business model, it simply shuts down. It was certainly not always a 'donation'.
What's debatable is whether targeted advertising is necessary for a business to maintain that profit. The GDPR suggests it isn't.
Google and FB (with their small army of lawyers) can afford to jump through all the hoops to make the regulators happy while "a small Belgian newspaper" will probably just get steamrolled.
You're right to a degree. You're right, because ad revenue from the EU is a lot lower than the US. Even if targeted ads in the EU aren't a thing, then a service that mostly gets US ad clicks and ad views will be able to handle it just fine. However, this means that EU viewers/readers will be treated as second class citizens.
Doesn't the fact that the rest of the world is scrambling to come to grips with an EU regulation and European privacy standards suggest the opposite?
Most of my savings are currently in a fund based on an FTSE small cap ex-US index.[1] Average market cap is $1.8B and about 37% is in Europe.
So the website has to block users that don't explicitly agree, a simple statement won't do.
There are exceptions, GDPR having the notion of "legitimate interest", which many services will try to abuse, however it has a precise definition and user tracking, ads targeting, marketing, or other interests like that that don't cut it, even if by not doing so results in less revenue for the service.
The GDPR has teeth, which is why companies that have been violating user privacy are freaking out ;-)
We don't know how GDPR works. Its structure grants immense discretion to political bodies. Given the EU is undergoing another cycle of political weakness, it would not be safe to assume anything about interpretation or enforcement.
This is a good principle for Constitutional law. It's a bad principle for general law, as it introduces political uncertainty and authoritarian risks into everything.
For example, the legitimate interest. Who determines that? The authoritaa. But then the authoritaa might approve Google and disapproves small-naughty-trackor. Both are doing the same privacy invasion. So why one gets a free pass and another is reprimanded.
Even if the current regulator (persons) are honest, they are not irreplaceable. Maybe the guy after them will be corrupt. And since there is a lot of money here, money corrupts.
IANAL but implied consent, by visiting the site, is not enough anymore. Consent must be explicit and informed, afaik there are a few exceptions there for stuff that's "vital to the sites function".
* If your company is EU-based, you must comply with GDPR, whatever the location of your users/clients
* If your users/clients are EU-based, idem
* If your users/clients are EU citizens located abroad, it applies *only* if you target EU as a market. If you operate a website dedicated to sell t-shirts to Californian people, and an EU citizen living in California buys from your website, you aren’t expected to comply with GDPR.For example, when you are a EU citizen using a US social network that operates world wide (and thus also targets EU markets), you are still covered when in the US.
"""
1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. [i.e. EU companies, or EU subsidiaries of foreign companies, have to obey GDPR with all data they deal with]
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: [foreign companies dealing with the data of people physically inside the territory of the EU have to follow the GDPR if...]
(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union [they're offering services to those people]; or
(b) the monitoring of their behaviour as far as their behaviour takes place within the Union. [they're tracking what those people do in the EU - but tracking what they do abroad doesn't trigger GDPR!]
3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law. [it applies to businesses in places with weird legal status, like some overseas possessions, or maybe the Channel Islands]
"""
Also, I find it interesting and confusing that the site puts up a panel on the privacy policy, which says "By using our site, you agree to these terms". But then it has an "Accept" button, as well as an "X". So (not that this site is unique) what does it mean if I don't click Accept (as is my wont)?