It's also extremely important that companies can't insulate themselves from consequences by outsourcing compliance functions to a "designated villain".

It seems like that's what's happening here though. The IAB appears to take all the blame while everyone else gets away.

They lose all the data though. They may have avoided some name smearing but it's the data that they really want.

I'd argue that the data has already been integrated into ML models or mixed in such a way that there's no way to even tell where the data originated from. While the logical conclusion would be to just delete any data they can't prove a legitimate origin for, I very much doubt this is going to happen.

Most importantly, tens of billions have already been made using this ill-gotten data.

Or just force all models to be deleted that had any input of that data in the first place. If they don't do that in practice let the whistleblowers do their job in exposing the companies.

Good luck identifying these models. By now what caused what is so muddled, it could get a small army of lawyers to even start detangling

According to the GDPR the burden of proving compliance is on the controller by keeping paper trails and documentation. So technically they would already need to be able to prove were all data has come from, or else they can't have it. So either they start untangling or they delete it. :)

The models aren't the data and aren't regulated under GDPR. It would be crazy to try to do so tbh.

The models aren't subject to GDPR, but which data went to which model is: every data treatment must be documented.

The GDPR doesn't apply to data that can't be related to a natural person. Those models would therefore no longer be under the scope.

Another example: You get consent from me, count your distinct visitors for January and I revoke my consent tomorrow. You do not have to change your visitor count retroactively.

> The GDPR doesn't apply to data that can't be related to a natural person. Those models would therefore no longer be under the scope.

Give me the models and a week, and I'll dox some people with them.

I don't think that's a fair example, because the issue is not about inaccurate data (the view count), but illegally gathered data.

An analog example would be stealing paint and painting your car with it. Should the paint be stripped off the car and given back? I don't know, but the victims are entitled to compensation, which isn't happening in the Google/Amazon case.

With your paint analogy, it feels like a "you wouldn't download car paint" situation.

I wonder if these models would become inaccurate over time without the data inflow.

I'm not sure to what extent this should be classified as a data breach, since the data was in effect illegally harvested and processed.

In case of a data breach, the controllers (i.e. the 1000+ companies) would be required to provide notification to the respective supervisory authorities of the affected users [33] -- although due to the one-stop-shop mechanism, that notification will be considered already done. But on top of that they would also be obligated to inform the affected users themselves [34].

Article 34 also includes this stipulation: The communication to the data subject [..] shall not be required if [..] it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

Note that these requirements are on the controllers, not the processor. IAB in this case is the processor. So if the data authority were to consider this a data breach, the controllers would not get away scot-free.

[33] https://gdpr-info.eu/art-33-gdpr/

[34] https://gdpr-info.eu/art-34-gdpr/

> All data collected through the TCF must now be deleted

At best the companies will have to delete months of data, the rest being stale or already fed through some ML loop that extracted any useful value from it.

Would they need to delete derived ML data as well?

My understanding is that as long as there is no PII is in the ML model (there’s not) then any existing models do not need to be deleted.

How do you prove there is no PII in the ML model?

It has been proven countless times that it's possible to extract learning data from models. I can't see how you can prove the opposite, except, maybe, with federated learning (but even then, you need to good "ratio" of noise)

I suppose the models might theoretically at risk if the learning data can be extracted, but I don’t think this will practically happen because it’s so far different from current GDPR practices. Someone would have to prove their protected information is inside of a model before they might have a chance. After that, I am not a lawyer.

Of course you can’t prove that some data cannot be de-anonymized unless there are duplicate entries. However, GDPR explicitly encourages anonymization, or “pseudonymization”, which therefore suggests that reasonable attempts to keep data generic are considered legal by this particular law. People have already pointed out that GDPR’s language here is too vague and makes bad assumptions about how identifying multiple quasi-identifiers can be.

GDPR encourages pseudonymization as a best practice, but also draws a sharp distinction between anonymous and pseudonymous data. Pseudonymous data is still personal data and subject to all other obligations under GDPR. Any data that's pseudonymous would still be subject to the deletion order.

I shouldn’t have mentioned pseudonymization, that wasn’t my point. It doesn’t change the fact that the law is vague and to some degree contradicts itself, suggesting that data can be anonymous. There is a real and actual overlap between anonymized data and personally identifiable data. The way the GDPR is written, it would be extremely difficult to prosecute someone for breach of data they had taken best practice steps to anonymize. The law wasn’t written to handle ML based de-anonymization. It also doesn’t help here that if you Google PII, the hundreds and hundreds of examples are things like name and address, nothing remotely close to anonymous yet identifiable.

> How do you prove there is no PII in the ML model?

Is "innocent until proven guilty" not a maxim in European justice?

They have just been found guilty, that's what the ruling is, and the outcome of the ruling is they should delete data derived from the related data. The ML models took the data as input, I think it's fair to say that if they want to argue the ML models do not derive from it despite that, they should maintain the burden of proof.

It's not possible to discuss legality of something, until a judge said we are allowed to discuss it? What?

So I can murder someone, and say "Innocent until proven guilty", and forbid anyone from discussing whether I'm a murderer, until I'm actually judged guilty?

But ok, sounds like you're nitpicking on my words, so let me rephrase the comment you're replying to.

"Considering that we have dozens of research papers showing that public models contain PII, how can we trust that FAANG's private models doesn't without auditing? It sounds safe to assume it does contain PII"

> So I can murder someone, and say "Innocent until proven guilty", and forbid anyone from discussing whether I'm a murderer, until I'm actually judged guilty?

In many European countries it's in fact against the law to publish the name of a suspect until a court has found them guilty. And is some it's even illegal to publish the name at all.

That's not what I said. I said that it would presumably require a trial to prove that the ML models contain PII, as opposed to the government being able to assume they do and demanding the company prove they don't to some arbitrary standard.

Generally not in administrative law. Executive authorities (e.g. tax office) make some decision and you can appeal to administrative court, but you have to prove why the decision was bad.

OK, that's interesting. Thank you.

If you choose to handle PII you have to keep track of where it ends up. Feeding PII into a black box and pretending it isn't there anymore without taking reasonable precautions, especially on something like ML that is known to leak its input, doesn't seem like it should be an option. If you don't know the safe assumption should be that the ML model can leak PII and should be destroyed along with the training data.

It is, however in this case innocence means having a complete paper trail of your data processing as defined under GDPR. Not having such a paper trail is one of the things the IAB was found guilty of in this ruling.

Not in money laundering.

I don't think it's much of a deterrent, because there's no clawback of the ill gotten gains from the use of that data. That's something done routinely in, say, fraud cases.

Precisely. Until all the profits + substantial deterrent fines occur, nothing will change. This will have been worth it to the violators.

In effect this just encourages them to keep this practise going. This has to be treated like fraud.

Why isn’t anyone going to prison for this? Happens regularly with fraud.

They did get a 250,000 eur fine, however that is based just on IAB membership fees.

This ruling should make it a lot harder for advertisers to hide behind the IAB though. One would hope that opens members up to more substantial fines in the future.

> Which will probably be a nice deterrent against them pulling the same shit again.

Unfortunately, there are reasons they want these cookies on there so badly that justify the cost to figure out how to comply with the policy and try again.

I wonder if it's that or if it's also a case of marketing departments going wild with GTM and Segment and the like, literally throwing the kitchen sink in front of the user's experience in a desperate attempt to measure and drive 'engagement'.

I mean, if you take a news website like The Independent, there's not a chance in hell that a competent design and engineering team would sign off on all the bullshit that is dumped on top of the page. It's always added on at runtime.

Are they marketing departments not being driven the by the same industry wide focus on OKRs and measurement as the engineers? They just are even less likely to get a default assumption of being valuable.

> that justify the cost to figure out how to comply with the policy and try again

I wonder if this judgment opens them up to civil suits.

My understanding is that they did not comply to begin with. However, enforcement is still lacking as I don't see a monetary fine, so effectively they got away with it.

I’m not sure how true this is, many types of data have diminishing returns after a few months. I’d be surprised if they lost money compared to not using these methods —- they’ve just lost the tail of incremental value.

Millions of Google Analytics customers with suddenly blank histories going back (years?) will notice quite a bit, whole classes of employees basically just make charts about historical performance.

Attribution in advertising is something which can last months for some products, and it's doubtful that a large proportion of companies import from GA and will lose their ability to gauge current performance compared to the past.

I agree with your position that people will notice and that some attributions will be affected.

It seems like we’ve still given cake to the glutton, though, just without a cherry on top.

Cynically, I expect this will go the way of tthe cookie popups themselves: the law will be blamed, not the transgressor.

In the end it should be mandated that all user data is stored locally and cannot be processed outside of its local jurisdiction.

The U.S. is never going to accede that its intelligence agencies cannot access data gathered by its Tech Giants. All claims and soothing words to the contrary are a false belief.

That's a very likely outcome. Saudi Arabia passed its own GDPR (the PDPL) which does not permit the transfer of Saudi PII outside the Kingdom except in "extreme" circumstances.

I think you meant to use the word lose not loose. I suspect you mean lose the data as in delete it, not loose as in releasing the data to others.

There is a popular anti-drunk-driving campaign in the US with the slogan "Booze it and Lose It!" ("it" being your license)

My town messed up on one of the billboards, though, and for a while commuters got to see "Booze it and Loose It!", which conveys a somewhat more carefree message.

Pics! or it didn't happen. j/k

These are the kind of classic "Spell checking. It's impotent!" type of situations. For long bits of text, I can see how somethings might slip through. When it's only 4 friggin words, and it's a campaign being slapped up on multiple billboards for everyone to see, one might think letting someone else review/approve would be a good idea. Thinking it might have actually done that and still nobody caught it is even more funny/sad.

thanks

> All data collected through the TCF

there is no data collected via TCF:

https://github.com/InteractiveAdvertisingBureau/GDPR-Transpa...

CMPs are the popups that save the preferences and thus enable the collection of the data.

IAB only provides a spec.

This kind of "but technically" is not going to go well for them if that's what they try. Technically the CMPs don't collect the data either, the ads do and the website controls how the CMP relates to ad loading.

The TCF is a spec, the industry agreed on this spec, built implementations and used it as justification of tracking. I think it's fair to call data collected by ads loaded under the idea that a valid implementation of the spec was proof of GDPR consent as "data collected through the TCF".

Anyway, this is the press release, not the ruling. See C.2 of the ruling if you want to nitpick the way this is actually being ordered.

https://www.gegevensbeschermingsautoriteit.be/publications/b...

> but technically

well, the difference is quite important.

So now they've destroyed user security in an attempt to destroy user privacy? That's actually genius.

How are they screwing users? By showing them relevant ads?

I gave them two decades and they never figured out how to show ads that are relevant. They never figured it out and I don't believe they ever will, I'm done sharing data with them and I'm done watching ads.

Countless articles and media pieces over the years on the plethora of unethical ways our data gets sold, resold and abused and still you ask what's wrong...

Yet No alternative have arrived to ads, people are used to free software how do you circumvent these things ?

Ads aren't the problem, the surveillance is. That you can't have the former without the latter is a myth FB and Google peddle to justify their existence. They don't even need your data all that much - the duopoly the myth perpetuates is what matters. There's no conclusive proof that personalized ads are more efficient than old banner networks, much less that FB's or Google's services are worth the huge share of profits they take as intermediaries.

Who said this ruling forbids ads? It only forbids user tracking (actually not even that - it just requires meaningful consent to be obtained before tracking users).

It amazes me how people--even technical people--have been tricked into believing that ads require pervasive tracking.

Ads have been around for as long as there has been trade. So, thousands of years. Pervasive tracking has been around for less than thirty years. But yeah, "how in the world will we ever be able to show ads to people and pay for software?"

>How are they screwing users? By showing them relevant ads?

If the true purpose of ads is just an innocent venture in creating beneficial user experiences with helpful suggestions, then we can improve that system by orders of magnitude by getting rid of distortions associated with paid placement.

Then we can reap all of the benefits without having to worry about the experience being compromised by the distorting effects of self-interest, associated with privileged placement in exchange for payment.

Breaching privacy, having a detailed dossier of my online behavior, is itself a harm done onto me.

> By showing them relevant ads?

If only. Generally they just manage to show me ads to buy more of the stuff I just bought. Or something I looked at and decided not to buy.

I think the elephant in the room are political ads, and in some regions personal civil rights.

So the screwing is not done by the advertisers but by the kind of ads and the third party access to data.

Also companies like Google seem to have a very clear stance wrt to both, while companies like FB in the past have been pivotal in political landslides, screwed-over level personalized political influencing...

Under GDPR, users are perfectly free to want relevant ads.

Users are getting screwed by IAB, because IAB does their best to remove users that freedom.

By not complying with users' lawful rights under the GDPR.