You're betting this definition wouldn't have any serious unintended consequences?

A hypothetical example: suppose it becomes a legal nightmare to have even heavily censored webserver request logs retained for any period of time if your company does any advertising at all. That is, even if you have no intent or even ability to use those logs for advertising purposes, it might be a lot of work to prove that to the law, unless you take the hopefully-easier route of literally never advertising. "Boo hoo, companies have to prove they're not breaking the law", you might say; as is usually the case with these kinds of regulations, demonstrable compliance might be totally practical for bigger companies but a massive barrier for smaller companies, which on the margin means the difference between success and failure for quite a few businesses that would've otherwise created a lot of value.

That specific scenario probably wouldn't happen, I hope, but that's far from the only plausible failure mode! I would like to believe that we can figure out a good definition with relatively little value destroyed in the fallout if a law like this comes into effect, but it's almost certainly not going to be a single sentence.

Let's say a streaming music service collects information on what you have listened to and how long. Is that surveillance? What if they use it to back a page where you can see what you've been listening to recently? If they start recommending new artists based on your listening history?

this is by definition surveillance -- a "...monitoring of behavior, activities, or information for the purpose of information gathering, managing, or directing." [0]

to possibly downplay it or imply otherwise because the collected information may (or may not) benefit the user is just spin.

[0]: https://en.m.wikipedia.org/wiki/Surveillance

Nothing inherently wrong with those features. The problem is some corporation owns this data, not us. It would be fine if it was some local software instead.

That is nearly impossible to avoid. Go to your local store enough times and they might remember you, even when no data is retained at all.

do you mean the people at the store remember you? kinda different than collecting data and deploying it across the whole internet wouldn't you say?

The person running the store remembering you and treating you differently based on your history is within what they're covering here, yes. In the report that Vivaldi is recommending (https://www.forbrukerradet.no/wp-content/uploads/2021/06/202...) they consider both first-party and third-party tracking to be part of "surveillance-based advertising". For example, a site showing ads for users based on what topics they tend to view weighted by how much they interact with each one. There's nothing about having to "deploy it across the whole internet" before it counts; activity on a single site is still (described as) surveillance.

still, this seems more like in the physical store you getting tracked with cameras, reward cards and so on and things getting rearranged on the shelves etc. just for you. I consider this surveillance.

I consider it less surveillance-y if a single employee is remembering me. Although I do sometime wish I could delete some embarrassing moments at the store, but I guess, as long as they don't gossip about it between employees... :)

> If it collects any data at all, it's surveillance

Great, we just banned TCP.

Exposing is not the same as collecting though...

I'd definitely consider a system which collects all information that are exposed in a TCP stream a surveillance tool

That's why we have TOR. Which allows you to use TCP without revealing the two TCP endpoints to anyone else.