There are many business that “sell” data under the second clause TO both Facebook and Google which could be impacted.

The Facebook Pixel is definitely disclosing data to Facebook, even if they aren’t being paid for it. And they probably use data from the Facebook Pixel across many advertisers for Facebook’s own business purposes.

I guess the question is whether selling targeted ads counts as selling personal information under this law. My impression is that it doesn't, which makes me wonder what the author was thinking. In fact, this will be worst for the smaller companies that don't harvest, target and serve all in-house, while the behemoths will be untouched.

It's not about Facebook Pixel, but the fact that ad companies usually don't "sell the data". They share the data with third-parties, and they can also give access to their advertising platforms (where the third-parties don't have direct access to the data).

Sharing the data is explicitly in the definition of selling I listed so long as the entity receiving the data uses it additionally for their own purposes. If Facebook uses it to provide more accurate targeting to a different advertiser, that sounds like using it for their own purposes to me.

Edit: to be clear, the Facebook Pixel is basically fine under this law so long as Facebook only uses the data for facilitating ads for the company the data was collected from in the first place.

n/a to facebook and google != useless.

sounds like it would hurt equifax. that’s worth way more than google, which only gives access to demographic data and doesn’t directly share it.

And yet they still lobbied against it.

They might just be over the 50 million gross revenue threshold though.

Is the law only effective at protecting privacy in your mind if it kills Facebook's and Google's business model?

Because I suspect that is what GDPR advocates truly want.

I became an advocate for GDPR after I started implementing it for the company I work for. I am an advocate for it because it requires companies to think hard about what they need the data for and whether or not it is going to adversely affect their customers.

Before GDPR there was virtually no downside for gathering private information. There was no downside for using that information to profile customers for any purpose you want. Now there is a downside: you have to tell the customer what you are doing with the data and you have to get permission to do so if the use is not related to the service that you are providing to the customer.

IMHO this strikes a good balance. You can still use the data, but there is a cost. Even within the organisation where I work, it has completely changed the way they look at this data. Previously the attitude was, "Let's collect the data and use it, because why not?" Now we're being told, "These are the only things we want to collect data on because we don't want to piss off our customers".

This is exactly what I want. I have in the past used Facebook's services. I currently use Google's services. I don't mind if their business model is destroyed because IMHO, on balance this way is better. I don't mind if people will have to pay for services like theirs. I'm old enough to remember a time where it was already like that -- it's really not so bad. Having thought about it (by way of being required to implement GDPR), I'm going to move to move away from the Google's et al. Having seen the transition in the company I work for, it's clear to me how much better it is.

If their business model is violating privacy, then sure.