We're fighting the ad and tracking industry here, the internet equivalent of a gang member with a shiv and a length of pipe. I'm not going to fight nicely. I'll deny you any chance and any method I get.
-- Banksy
Which is entirely different. Ads are still manipulative (by design), but at least purely contextual ads don't track you.
It's quite surprising to see how many JS plugins are in operation on a typical consumer site, and satisfying to know they were all blocked unless expressly permitted :)
Note that it is a hack/poc and does not always work, especially the x-frame-detection is iffy so if you try it and just see a blank page try the "enable proxy" checkbox. I use it every now and then on iOS to get around some especially obnoxious JS, but if there were more users I would be more motivated to improve it (hint hint:-)
For example, one particular maroon-headwear-related Linux distro's bug tracker has a particularly egregious blinking bright red banner, asking you to enable JS for the website to "function correctly", even though reading bugs on said tracker works fine without it.
It ruined print when every other newspaper and magazine page had an ad mixed in with the content. Sure you could get the paper for free, but how much content are you actually reading?
It ruined television when an hour-long show is interrupted several times to show 15 minutes of ads.
And now it's ruining the web with the advent of ad tech and the brilliant minds that get paid millions to think of new ways of squeezing more value out of people's attention. Web sites are riddled with ads now even worse than in the popup days. I have to navigate a legal minefield of dark patterns to ask them to please not track me or sell my data.
These are just the ways it ruins content and user experience. What about the misinformation? The lies from the tobacco industry, the political ads that overturn democracies, astroturfing and embedded marketing...? The list of shady and downright evil practices is too long to mention.
Advertising is a scourge on humanity. It needs to be strongly regulated and companies as influential as Google and Facebook need to switch to user respecting business models, for the sake of all of us.
The problems are the tracking and the ad networks that kinda treat both the viewer and their site-hosts as consumable resources, but that sites can't realistically avoid if they want/need ad support, because that's where all the money is. Break the ad networks, break tracking (and I mean legally, in both cases—tech means for blocking are doomed, IMO) and ad money won't go away, it'll be redirected to less-awful ways of delivering ads.
However I don't want any content which could be distracting or plain unsafe for mental wellbeing. One example are the ads for violent games on BlueStacks when I was using the emulator for Android education software for my children.
No thank you. Any content I can't control will be kicked.
Either by using adblockers or by just not using the service.
I dated a woman who experienced trauma in the past and she would routinely get horror movie trailers in YouTube. Even I found them disturbing. Neither of us had any interest in getting intrusive thoughts from watching assault and body horror. Putting in uBlock Origin did wonders for her well being.
I think there's actually a great opportunity for someone to create an ad server that only serves first-party ads with no tracking.
I'm talking about something even simpler than that. I have my own website and I have my own advertisers who want to put ads on it. I need a way to serve them and do contextual targeting (e.g. stories about a certain topic) and frequency capping and forecasting and the other sort of basic stuff I expect from Google Ad Manager.
Not just that, but I’ve never seen a cookie banner that does anything. Cookies get sent down with the page on the initial load. Whenever I’ve opened an inspector to see if cookies get unset by JavaScript in response to my “opting out,” I’ve never seen an effect. The same cookies get sent after I opt out: no change. Has anyone seen a cookie preference banner that actually does something?
https://www.gov.uk/, https://www.nhs.uk/, https://europa.eu/, https://home.cern/, https://www.bundesregierung.de/ (maybe), https://www.dr.dk/ (maybe).
They all started with a single "agree" button, then went to "agree/disagree" with no effect and are finally starting to come around to a functioning disagree button.
GDPR also helps here, as it defined what identifies an individual and that made most of the tracking PII even when it's all merged by a random ID that stays with the user. The effect is slow, but it's starting to work.
Hopefully the next step will be abandoning cookie banners and only using technically required cookies(don't need conset) and/or non-identifying tracking for aggregate results. This is a massive improvment on UX and actually gives the company more quality data that doesn't identify any single individual.
I'm personally pushing for aggregated tracking in my current company. It's an uphill battle, but one that can be won I think.
That sounds similar to FLoC, which is still very much identifying[1].
The solution to user tracking isn't less identifying tracking. It's no user tracking.
[1]: https://blog.mozilla.org/en/mozilla/privacy-analysis-of-floc...
Once in a while I read/learn something new at HN that changes my perspective on things. This sentence is such an example.
Not following this too closely, I thought that's possible now, or at least as soon as the last few holdout apps get updated?
Until the law that defined informed consent actually get enforced, a new law can not really fix it unless the regulators start to add the threat of jail time to repeat offenders.
This is not the case. The fines are up to 2% of annual global turnover. This scares companies.
Moreover, some of the worst offending cookie banners are slowly being replaced by better ones as more and more organizations (such as noyb) file official complaints and companies get fined.
You are wrong. The initial fine is much, much lower and companies have so long to dabble in wilful ignorance that it is at the moment not something that has teeth. Companies are like bullies, they don't respect threats - only harm.
Another diluent: the maximum fine is practically the lesser of 2% and the NPV of business in that European country, or, expansively, in Europe. If you have little business in Europe, it’s cheaper in some cases to simply close shop.
Companies are not doing much because enforcement is lacking, and in case you get caught, most fines are in the neighborhood of reasonable rather than instant liquidation.
[0] https://noyb.eu/en/irish-dpc-handles-9993-gdpr-complaints-wi...
> Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher (emphasis mine).
As for the absolute sum, there is no limit.
If they change their ways then good, if not Noyb has a much more solid case when making a complaint to the SAs and/or the courts.
[0] https://noyb.eu/en/noyb-aims-end-cookie-banner-terror-and-is...
No need to add the threat of jail time, _especially_ if it isn't enforced.
This is somewhat different from most tracking done on the web, which is done for the exclusive benefit of those doing the tracking.
Believe me, I would have opted out of this had I been prompted to do so during setup.
[1] https://eu.community.samsung.com/t5/galaxy-s9-series/default...
What is different this time around compared to P3P, DNT, and other earlier mechanisms is that the times have changed. Privacy is a much bigger topic. There is much more reporting now about privacy. Users understand a bit better better (though, we are still far off from real transparency). Lawmakers and regulators are catching up. Many companies embrace privacy. There is a burgeoning privacy tech industry with quite a bit of venture funding.
Also, lessons were learned from earlier efforts. CalOPPA required recipients of DNT signals to only say whether they respect those. The CCPA regulations now require actual compliance. If the CCPA is applicable to your company, you have no choice but to respect it. And that is also true for automated browser signals. There is much stronger enforcement now behind more recent privacy laws. Virginia and Colorado recently enacted privacy laws, and it is likely that other states will do to.
Disclosure: I am an academic researcher working with collaborators of all stripes on Global Privacy Control (GPC) [1, 2]. We are in touch with the good folks at ADPC and support their work. They are doing a fantastic job over there!
[1] https://globalprivacycontrol.org/ [2] https://github.com/privacycg/proposals/issues/10
Capital and technology need not respect sovereign borders and laws as long as they can keep one step ahead of enforcement and still get enough revenue. The laws and lawmakers are fundamentally slower and weaker and poorer; by the time CCPA et al have an actual deterrent effect (beyond just mandated privacy notices), the industry will have moved on to some more sinister loophole.
It's an arms race that 1700s-style government simply cannot keep up with. It takes months to come up with new algorithmic loopholes, decades to change the law, one industry-friendly administration to undo all the progress.
Offloading privacy to government only works when you have strong states (China, the E.U. maybe). In the US, what's left of the federal government is too crippled to effectively tackle this (and arguably any technological problem) at scale. State-specific laws are subject to the same constraints, and additionally face the problem of enforcement across borders and Commerce Clause issues. If anything this will be an arms race between adtech and adblocking; Congress is the kid in the corner crying, "But I wanna play too!" and pretty much shrugged off by everyone else.
None of that is far fetched. Facebook, Google, Apple etc. all track and use first party data. If anything this just consolidates advertising power into the hands of an oligarchy that's already largely above antitrust law.
The law is never simple, exhaustive, or agile when it comes to regulating technologies.
GDPR has been the most successful of the bunch and all it really did was force a bunch of cookie notices and deletion processes. That still largely depends on people being lazily accepting advertising.
Any proposed law that singlehandedly destroys ad tech is unlikely to either pass or stay relevant for more than a few months.
This is a sentiment expressed surprisingly often even here on HN.
And as the Sinclair adage goes, it is difficult to get a man to understand something when his salary depends on his not understanding it.
1. targeted ad buys are mostly a scam. Research shows that they are barely more effective than old-fashioned contextual ads.
2. Contextual ads, aka "dumb" ads, the kind that show ads based on the content they are displayed with, are fine.
3. adtech companies depend on advertisers not understanding (1) and publishers chasing dollars by signing up with ad targeting networks.
The ones that are actually making money are the ad networks, and it is in their interest to spread FUD about (1) and not offer (2), as they make their money as a percentage of every ad sale (auction) transaction, and the CPM is higher on targeted ads because of ignorance of (1)
Actually, the view that they have to either do unethical things like tracking or perish is one of the greatest fallacies and a sign of lazy thinking.
There are plenty of people online playing devil's advocate because one day they too could be rich and they don't want the harsh yoke of government regulation holding them back.
On HN, part of the audience is in closer proximity to that kind of wealth, and their arguments in favour of that status quo reflect this.
As a general best practice, if you are convinced something is true, ask yourself "what evidence would someone have to show me to convince me this is not true" - if you can't think of something, there's a problem.
Almost everyone wants privacy limits, they just don't agree on the current measures (or their previous ones, or the ones before that, or doubling down on continued failed policy approaches in the future).
I remember spending a silly amount of time trying to come up with a P3P policy that was both accurate and also didn't break sign-on for a single app that used multiple domains.
Granted though that enforcement of the existing rules seems to be the biggest problem today.
Reminder that Internet advertising has a lot of actors with competing interests, and it is not usually the "adtech companies" who don't want users to have an easy-opt out, but publishers and to a lesser extent the advertisers. Many "adtech companies" would love to have clearer legal signals and simpler, industry-wide justification to collect less data.
Publishers have been very good at foisting all user frustration off on vague "adtech" (or alternately, adtech companies have been effective at reputation laundering for publishers/advertisers) but they're the ones that want to collect, share, and sell the data to be able to raise their rates.
advertises will pay higher CPM for precise targeting and attribution
publishers want the best CPM they can get
adtech uses as many tricks as possible to get as much information as possible about a user so they can maximize the CPM the advertiser will pay
Publishers just end up doing what ever their adtech partners tell them will give them the best CPM.
Publishers (and retailers, and anyone with a dataset) seek out adtech partner companies, to justify high CPMs and to sell their audience data. Adtech companies are market-makers, it's been years since the data they can get independently of supply-side partners was worth shit.
The publisher is the one with the cookie warning and consent forms! The publisher is the one who wants you to log in with a stable ID! The publisher is the one with a model of you regardless of your ad or tracker blocker settings! The adtech companies will sell you downstream for sure, but the publishers are the ones deploying as many tricks as possible to gather data.
And yeah, adtech companies will advise them about how to effectively gather data. That's a lot less about "tricks" and more about how to build salable taxonomies instead of data lakes full of garbage. To the extent it's about tricks, it's more often the adtech companies having to patiently but firmly explain, no, you can't just hardcode a single consent state for all visitors and send that to us in lieu of a real CMP. (A purely theoretical example, of course...)
Adtech is very much instrumental in the race to extract as much value from attention as possible.
Adtech built a market for advertisers to target users based on interest (which may or may not be a scam[1]). Advertisers exploit this and other tools at their disposal (astroturfing, embedded marketing, etc.), but they're certainly not as vicious or out of control as what adtech can produce.
The publisher has my information if I give it to them or if they buy it somewhere. Adtech has it regardless of what I do. Why would a publisher even want a model of me when what they want is for their product to reach me on as many sites as possible, not just their own? An adtech company having as much information on everyone can serve many publishers, so it's no wonder the system is so centralized.
You're correct, for large publishers ... I guess we could almost say they are adtech companies now.
The ones that seem out of place on your list are because their main business is something other than surveillance. Saying that Walgreens "patronizes the surveillance industry" does make more sense than labeling the whole company as doing that one thing. Although labeling the marketing group requesting all the trackers be added to their website as the "surveillance department" makes sense.
I think "surveillance" is a much better term than "ad" because the latter seems like just some harmless annoyance in line with American business values, whereas the former more accurately captures that the systems these companies are building are offenses against freedom and humanity.
That won't stop them from additionally using cookie banners, out of spite. But I suspect many websites that currently have cookie banners only have them because they believe it to be necessary, and it's hard to push back on it. If such a spec came to be recognized as a way to obtain consent by regulation, it'd make it easy to point its way, and at least end the madness of cookie banners on websites that don't need it.
I agree. But I don't think it's because adtech want you to think privacy is shit; I think it's because by compelling you to click, they can run Javascript in the context of a user gesture.
I want a plugin that automatically says "OK" to cookie banners. My browser already blocks 3rd-party cookies. It only allows session cookies. Cookie banners are like fire-hydrant CAPTCHAs - they masssively increase the friction that web users have to deal with.
They also legitimise other kinds of popup window that websites present. I've noticed more and more popups appearing on first visit to a site, inviting me to subscribe to a newsletter or whatever. You often see a cookie banner, followed by a newsletter popup, followed by a Google login popup. Who knows, maybe there's a traffic-lights CAPTCHA.
Then finally you're into the site, and it turns out to be Washpo or NYT, and you can't read the article anyway, because it's paywalled.
Can we have our open web back please, mister?
Why would you want that? Even if you delete 3rd-party cookies that would still allow tracking companies to log your IP and track you through some other shady means which you've now consented to.
Cookie approval has to be under the control of the user, not the website. So it has to be done by the browser or an extension. So if I have user-controlled cookie-approval, I might as well click "OK" on the form - the site might treat me better if I do.
Try “I don’t care about cookies” :)
The emperor is naked. The GDPR law is broken.
All this noise about cookie privacy, fingerprinting, FLoC, tracking, etc. --- what are the actual harms that make these things bad? Has anyone in the real world ever experienced a concrete harm arising from interest targeting? Doubtful.
The EU privacy regime imposes a heavy regulatory burden in exchange for nothing. Information is a non-rivalrous good. Further limiting its dissemination will increase friction all over the internet, impose new transaction costs on previously free interactions, and make the whole network less useful for everyone. And for what? Assuaging the paranoia of a tiny fragile and vocal minority of privacy activists? Sorry, but that's not worth breaking the internet.
And this ability is currently asymmetric. While Big Tech and Big Govt knows nearly everything about everybody, ordinary citizens are denied data and transparency. And even if the data may be hypothetically available, its scale precludes analysis by anyone except highly funded groups.
Lack of privacy does translate to enormous soft power. It doesn't have to result in death, although the potential is there for that too. Democracy and individual liberty become meaningless except on paper.
I'm not sure that's what we want, in exchange for a few conveniences in the palm of our hands.
Is there any evidence that Big Tech and Big Government are actually controlling people by tagging them in some database (which no human actually inspects) as being interested in hiking gear and cookie recipes? Give me a break.
What you've described isn't a concrete harm, but an emotion --- specifically, fear. Lots of fears are baseless. So is this one. We shouldn't organize society around the baseless fears of tiny vocal minorities.
It should be, flatly, illegal to collect that sort of data about people without a business need to do so, and illegal to use it for any other purpose, transfer it to any other entity without the same restrictions on its use, et c., when it's needed (like: credit card companies and banks obviously need to know where & when you spend money, but they shouldn't be able to use those data for anything else at all—no aggregating and re-selling to others, no mining spending trends for investment intelligence, no targeting ads at you based on it, none of that).
No, companies do not mind control people on an individual level, but what they do has all the traditional effects of monopolies/oligopolies that are not democratically controlled by the people affected but a handful of rich executives.
I'm not even going to go to the "advertising controls people" dialog tree. If it's not obvious why having the power of putting anything you want in front of billions of people is powerful, then I don't think there's a discussion worth having.
There it is. It's not about tracking per se. It's really about control over advertising and information dissemination more broadly.
Motte: preserving user privacy by blocking cookies
Bailey: let's tightly control who can put messages in front of the general public
You are framing this as if I am somehow advocating censorship towards people, yet I am advocating the opposite position. Executives shouldn't be given a such huge powers of data mining and information distribution and ability shut powerless opposition and competition out. This is about preserving equal voice to all people, and preventing juggernauts from squashing it.
"No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks."
https://en.wikipedia.org/wiki/Universal_Declaration_of_Human...
Why isn't this Article at the forefront of any and all conversation re: privacy?
Now some nations may have decide to take some of the principles in this declaration and turn them into laws. But you will find that there is great variance in the human rights laws today even between, say, Canada and the U.S., or Mexico and Japan.
The fact of the matter is human rights are a social construct and they very much differ on what society your are in and what that society has decided are the rights it will observe. Looking around, we find very different definitions and intepretations of rights all around the world.
>Everyone has the right to respect for his private and family life, his home and his correspondence.
>There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others."
and Articles 7 and 8 of the Charter of Fundamental Rights of the European Union[1]
>Everyone has the right to respect for his or her private and family life, home and communications.
and
>1. Everyone has the right to the protection of personal data concerning him or her.
>2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
>3. Compliance with these rules shall be subject to control by an independent authority.
Both of these documents are legally binding (the former on all member states of the Council of Europe,[2] and the latter on the EU and its member states)
[0] https://en.wikisource.org/wiki/European_Convention_for_the_P...
There are a lot of angry people in this thread stating what they want, but none have offered an argument for why we should structure society around their whims. Sorry, but "you shouldn't be able to collect information" isn't an argument. It's a wish. Nobody is under any obligation to indulge the wishes of random strangers.
> Sorry, but "you shouldn't be able to collect information" isn't an argument.
How about "private entities shouldn't be able to collect my information without my explicit consent".
> It's a wish. Nobody is under any obligation to indulge the wishes of random strangers.
Yours included.
If the information is public, no consent is needed.
Privacy is about trusting someone with private information and expecting they will not do anything with it that you would not approve of.
Keeping a diary or a phone contact list would be forbidden under a strict reading of that rule. Even remembering the name of a person you met at a party would be forbidden unless you ask for explicit consent first. "Hey, Joe. Great to meet you. Mind if I make a mental note connecting your face to your name?" Real people don't think like this.
We all have a natural freedom to record facts we perceive in the world around them. Taken to its logical conclusion, privacy advocacy is about mandatory forgetting. No, thanks.
PII is very valuable to advertisers (or to adtech as I recently learned[2]) as it allows them to target individuals based on interest. Beyond the fact that I don't enjoy being forced into complicitness to being manipulated into purchasing a product, I strongly object to having a profile in some mega-corp's database that has my personal information I didn't agree to share with them, for them to disect, analyze and sell in perpetuity, and to wonder how future advancements in adtech might use this data in less benign ways than today.
At the very least, I would like a share of the profits they're making from me. Facebook and Google should be paying users to use their products, or everyone on the internet rather, but I don't think their shareholders would like that very much.
[1]: https://www.businessinsider.com/facebook-uploaded-1-5-millio...
The kind of question can only be asked by someone who has never been abused by a domestic partner, never been on the wrong end of debt collectors, the law, disgruntled employees, doxxers, or other real and persistent threats that are enabled by the data collection and aggregation that is the foundation of interest targeting.
Adtech companies don't want users to have an easy opt-out. They didn't want P3P. They didn't want DNT. They will not want this new spec, unless the spec is so bad that most users will agree by accident.
The annoying and confusing cookie banners are a feature. Besides making people agree through confusion or attrition, the banners are malicious compliance. Adtech companies putting them up want you to be pissed off at the banners. They want you to associate them with privacy, and conclude that privacy laws are pointless and should be repealed.