It looks like it was designed to be useless, since neither Google nor Facebook sell info under the definition of selling you posted.

There are many business that “sell” data under the second clause TO both Facebook and Google which could be impacted.

The Facebook Pixel is definitely disclosing data to Facebook, even if they aren’t being paid for it. And they probably use data from the Facebook Pixel across many advertisers for Facebook’s own business purposes.

I guess the question is whether selling targeted ads counts as selling personal information under this law. My impression is that it doesn't, which makes me wonder what the author was thinking. In fact, this will be worst for the smaller companies that don't harvest, target and serve all in-house, while the behemoths will be untouched.

It's not about Facebook Pixel, but the fact that ad companies usually don't "sell the data". They share the data with third-parties, and they can also give access to their advertising platforms (where the third-parties don't have direct access to the data).

Sharing the data is explicitly in the definition of selling I listed so long as the entity receiving the data uses it additionally for their own purposes. If Facebook uses it to provide more accurate targeting to a different advertiser, that sounds like using it for their own purposes to me.

Edit: to be clear, the Facebook Pixel is basically fine under this law so long as Facebook only uses the data for facilitating ads for the company the data was collected from in the first place.

n/a to facebook and google != useless.

sounds like it would hurt equifax. that’s worth way more than google, which only gives access to demographic data and doesn’t directly share it.

And yet they still lobbied against it.

They might just be over the 50 million gross revenue threshold though.

Is the law only effective at protecting privacy in your mind if it kills Facebook's and Google's business model?

Because I suspect that is what GDPR advocates truly want.

I became an advocate for GDPR after I started implementing it for the company I work for. I am an advocate for it because it requires companies to think hard about what they need the data for and whether or not it is going to adversely affect their customers.

Before GDPR there was virtually no downside for gathering private information. There was no downside for using that information to profile customers for any purpose you want. Now there is a downside: you have to tell the customer what you are doing with the data and you have to get permission to do so if the use is not related to the service that you are providing to the customer.

IMHO this strikes a good balance. You can still use the data, but there is a cost. Even within the organisation where I work, it has completely changed the way they look at this data. Previously the attitude was, "Let's collect the data and use it, because why not?" Now we're being told, "These are the only things we want to collect data on because we don't want to piss off our customers".

This is exactly what I want. I have in the past used Facebook's services. I currently use Google's services. I don't mind if their business model is destroyed because IMHO, on balance this way is better. I don't mind if people will have to pay for services like theirs. I'm old enough to remember a time where it was already like that -- it's really not so bad. Having thought about it (by way of being required to implement GDPR), I'm going to move to move away from the Google's et al. Having seen the transition in the company I work for, it's clear to me how much better it is.

If their business model is violating privacy, then sure.

Letting smaller businesses off the hook here is not a good idea, since the larger businesses could just buy data off of the smaller ones, or both could belong to the same umbrella corporation and the data could be shared for nothing.

What incentive would such a small business have for operating. They would have to deliberately cap their revenue in order to maintain the business size and not run afoul of the regulation. The moment their revenue tips over, the profit maximizing behavior would be for facebook and google to use home-grown compliant solutions. Once they have a home-grown solution that complies with the law, they'd have no reason to ever again contract out the collection work.

Not only would this not affect Google and Facebook, who "sell your data" to their own internal marketing products (let's not pretend they aren't actually selling your data, they just have the marketing company in-house), but that minimum revenue bar also likely exempts your Unroll.mes who do literally sell your data, because they probably don't bring in enough revenue to cross the line. Companies burning investment money and not bringing in actual revenue would also be exempt.

Unroll.me would probably fall under either of the other two categories that are not revenue-based.

Ah, good point.

>let's not pretend they aren't actually selling your data, they just have the marketing company in-house

They aren't actually selling your data... Maybe if you decide to change the definition of the word "selling" they are selling your data.

Or, as pointed out in this very discussion, use the definition that is right there in front of you.

No, I'll use the actual definition of the word thank you very much.

To many details in laws give judges less roam to do their job. There's a reason why European Countries aren't as specific.

I should know what's forbidden without having to go consult every judge.