Looking back, when they announced they were going to become an AI-first company these sort of drastic data-grabs and privacy issues should have been apparent. But hindsight is 20/20...
You know what they meant. Google is milking users for all data they can derive from their activity and creating value from that. It's not so much the use of the data that's the problem as the lengths they go to to create that data.
I recall someone from one of the major tech companies talking about how their users "emit data", implying the data just happens and their role is purely passive with the users practically handing them that data. That's a perverse way of looking at it when you contrast it with e.g. the GDPR's premise that data belongs to the user and companies need (withdrawable) consent to collect and process it.
In the US tech companies don't collect user data, users "emit" it -- even if the only reason the data is "emitted" is because the tech is actively spying on its users' every move.
They provide a lot of value, but in the end, I think a lot of their products will eventually use market and mindshare.
As a user you expect a reasonable level of privacy unless the software explicitly requests your consent for providing certain information or explicitly asks you to provide that information manually. If the software then hands that information off to a third party you expect that only to happen with explicit consent.
The problem in this case is that Google isn't interested in consent. It tries to get as much information as it can without needing to ask for consent and when it does ask for consent it's through coercion by tying that consent request to actions that are not reflective of the scope of the request ("You want to save your home location? Okay but in order to do that we need to be able to track your every move forever").
That's arguably far more malicious than explicitly saying "please let us share this info with company XYZ so we can continue offering this service for free". That most companies selling data to third parties aren't so explicit about it is irrelevant -- this is just about the claim that "selling data" is inherently more malicious than what Google is doing.
That said, no, selling does not mean "surrendering any and every control over it". GDPR and friends specifically address that by stating that the human being the data is about continues to own that data and can withdraw consent at any time (at any depth of sharing).
If you can only explain why selling is worse by creating a scenario where the selling is done without consent or in an equally malicious/shady way, that doesn't demonstrate that selling is inherently worse.
Selling isn't worse. Selling without regard for a user's rights is bad. But Google is already engaging in abusive behavior as far as users' rights are concerned.
Also, I know this is hard to understand if you're not used to real privacy laws, but if a company sells your data and you invoke your rights against the company, it's the company's responsibility to go after whoever they sold the data to, not yours.
> if a company sells your data and you invoke your rights against the company, it's the company's responsibility to go after whoever they sold the data to, not yours.
Can you point me to more details on this? I have my doubts about it.
The GDPR treats personal information as property of the user. Even if access to and processing of that data is permitted by the user, it remains the property of the user. If the company is permitted to also pass that data on, they're still responsible for ensuring the data is handled appropriately.
I'm not sure what you are doubting. The GDPR is (in)famous for this.
This is why GDPR compliance makes it nearly impossible to hand over information to third parties who aren't GDPR compliant and why EU companies are nervous about working with Google and other US companies (because the Privacy Shield is not any more trustworthy than Safe Harbor which died an extremely swift death).
As far as the user concerned there's no difference between you "selling" their data and you handing it over to a third party as a data processor. You can't "sell" it because it's not yours, you can just take money for handing it over -- but that's between you and the third party, the user isn't part of that transaction.
Think of it this way: users can't sell you their data (they literally can't) so the data isn't your property. You can't sell what isn't yours, so the data you hand over to a third party is still owned by the user who gave it to you with the (GDPR-backed) expectation that you're retaining the control necessary to comply with their requests.
FWIW I'm not sure how this works for third-party tracking (e.g. Facebook widgets). Google Analytics avoids this by requiring compliant websites to enable IP anonymization (which supposedly should be sufficient) but liability still resides with the website owner (and the Data Protection Agreement makes this perfectly clear).
As you want sources, here's what a quick Google yields:
https://iapp.org/news/a/threes-a-crowd-third-party-risk-unde...
https://martechtoday.com/gdpr-mean-third-party-data-processo...
https://www.out-law.com/en/articles/2017/november/stricter-c...
And especially this:
http://www.infocore.com/insights/data-privacy-a-marketers-lo...
> Under the GDPR, EU citizens must be given the easy ability to withdraw their consent, often called "the right to be forgotten". If consent is withdrawn, those data subjects have the right to have their personal data erased and no longer used for processing by the data collector, and by any other entity who has ever used or purchased that data.
So in other words: "selling" user data is no different from handing the data to a data processor.
The point of the GDPR is that personal information is something that taints your product's data and therefore something you want to avoid. Selling it to dodgy companies that abuse the heck out of it is exactly what the GDPR is meant to combat.
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
So there's an obligation to inform. Which makes sense: Assume you (with consent of the user) sell data to some company, you have to forward them the request of said user to be forgotten. But you have no authority over that company. You can report them to any and every authority if they ignore or actively refuse your request, but you as a company have no authority over them. Particularly if they don't operate within the reach of the European authorities, there's little you can do. And that's what I mean with "You surrender control of the data once you sell it".
I'm appalled every time I'm asked to train Google's object detection networks in the guise of solving a captcha.
But now when I'm asked to select all the squares containing road signs or storefronts or whatever it feels like I'm being forced to work for Google for free just so I can go about my day.
It's such a simple concept, and yet I see people on Hacker News constantly making this mistake. It's as if people are too addicted to outrage culture to even consider the arguments anymore.
Then can tell you to try to sell cycle headlamp to me because I have been looking for it in last fews days. I'd say that's selling my data.
They never were the good guy, but I guess they decided to finally stop pretending.