Google search was likely profitable with keyword ads long before any tracking was involved.
Where has that been ruled legal, and do you have a link to the ruling? I've only seen German newspapers do this, so my assumption has been that it's just the German authorities turning a blind eye to it. If it's really a legit option, it seems like a miracle that nobody else is using this.
This was communicated to me by a law firm specializing this area. This was with regards to the newspaper "derstandard.at".
Here's a source in German which includes the ruling as a PDF [1].
I see that in the meantime, this "pay or okay" model has been questioned again, but in any case, a ruling exists. And, as I was told, the national DPAs don't just rule as they see fit, but rather coordinate with other DPAs, in order to harmonize the enforcement across the EU.
[1] https://www.dataprotect.at/2018/12/07/payortrack-die-entsche...
> If it's really a legit option, it seems like a miracle that nobody else is using this.
None of the big sites are using it because it's frequently far more profitable to track people. Just look at various revenue-per-user stats.
And the users most willing to spend money for no-tracking tend to be the users who also spend money on other things, so their the users you'd want to advertise to the most.
> None of the big sites are using it because it's frequently far more profitable to track people.
That doesn't explain it. If the only options on accessing one of the "big sites" were to see ads and be tracked, or to pay €200 / year and not be, it is pretty obvious that fewer users would opt out of the tracking than now (when it is free).
If a consent dialogue that required one more click for refusing than accepting is not legal, how can this be?
If your site makes its money selling ads that is most likely only of interest only to the tax authorities where your company is located. It doesn't matter where your site users are located. You advertising income will just be another entry on normal business income taxes.
If your site makes its money selling subscriptions, that money is business income on your normal business income taxes but also likely will be subject to sales taxes in the places where your subscribers are located.
If you have customers in the EU, you'll need to collect and file quarterly VAT there (the EU has its act together so you only have to register in one country, and file a quarterly report breaking down sales by country, and that one you registered in will deal with distributing the money to the rest).
If you have customers in the UK you will have register separately with them, because the morons implementing Brexit failed to arrange to stay in the unified online VAT system of the EU. (Not that you can currently actually register in the UK. We applied for our VAT registration number something like two years ago and they keep saying that HMRC is very busy and will eventually get to it. In the meantime we are suppose to collect and hold UK VAT, but not supposed to call it VAT).
If you have customers in the US you might have to deal with sales tax in 45 states. Unlike the EU VAT the rates are not uniform within a given state. You have to deal with different rates in each county, possibly each city, and possibly even in different areas within a city--and tax boundaries do not always line up with zip code boundaries so to do it right you have to collect exact address information for your subscribers.
In the derstandard.at model, the site is inaccessible (and also does not set any cookies, or perform any other tracking options) until you choose either A or B, so the amount of clicks are the same.
> That doesn't explain it. If the only options on accessing one of the "big sites" were to see ads and be tracked, or to pay €200 / year and not be, it is pretty obvious that fewer users would opt out of the tracking than now (when it is free).
It's too soon to say as the option only appeared recently, but taken to the extreme, if every single user of Google services opted out of tracking, Google would probably end up with a revenue problem and re-assess the situation.
The amount of clicks is definitely not the same; choosing to subscribe will certainly require filling in a dozen fields of personal information, provide credit card details, etc. The friction difference between 1 vs. 2 clicks is trivial compared to the friction added by a full subscription flow.
Of course entering a contract, requiring some form of online payment, will take more steps than not entering one.
The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions):
> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
Interestingly, the decision that you linked prefers to rely on the case law of the data protection authority when interpreting the question of consent, in particular referring to rulings that predate the GDPR, despite its refinement of the concept of consent. It also focuses upon 'wesentlicher Nachteil' (significant detriment) where the original text of the GDPR prohibits just 'Nachteil' detriment. I find these choices rather suspicious, and wouldn't be comfortable with relying on them holding if challenged in other EU states.
[0]: https://www.theregister.com/2018/11/19/ico_washington_post/
> The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions):
>> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.*
I don't see why they should be at odds with the decision? Quoting:
"Gibt eine betroffene Person keine Einwilligung ab, so besteht die erste Konsequenz darin, dass diese ein O*-Abo abschließen kann. Dieses O*-Abo ist – wie festgestellt – frei von Werbung, frei von Daten-Tracking und frei von der Setzung von Fremdcookies. Das O*-Abo ist mit einem Preis von 6 Euro monatlich ab dem zweiten Monat auch keine unverhältnismäßig teure Alternative."
It's obviously without question that one can charge something for a service rendered -- the newspaper does not have to offer this for free.
And in the above text, the authority then opined that charging 6 Euro for a monthly subscription to read a newspaper is not unreasonable, hence the decision to opt into tracking is a free one, because the alternative is simply to pay 6 Euro for a month's access.
The GDPR reads as if its authors had a different understanding. For example, the 'data minimisation' principle indicates that you should not be collecting personal data unless doing so would prevent the desired activity; serving an article, or even serving an article with adverts, can both be achieved without this data. There's also a question over whether the services are the same: a subscription appears to be materially different to one-shot access to an article, a question which is entirely overlooked in their analysis.
Beyond the weakening of 'detriment' to 'significant detriment' by reference to their pre-GDPR decisions, I also find the result unusual. The practical interpretation is that, if a user wishes to read 100 articles from 100 service providers all using this scheme, the cost of privacy is a significant detriment at €600. I am not confident that other data protection authorities will be as eager to jump to this same weakened interpretation.
There is probably a safer middle ground: giving the user the option to pay for either the article or the subscription, and allowing for either direct payment or payment by proxy through an advertising broker. In the latter context, the user's relationship and data-flow is controlled by the advertising broker, and the service provider needs no data relationship with the user. Of course, this shifts the controller liability into the advertisers -- something that they would probably prefer to avoid -- and I'm not aware of any services offering this or concrete decision on it yet.
Indeed. It could reasonably be assumed that this is the main reason why the paid version does not use any tracking.
> There's also a question over whether the services are the same: a subscription appears to be materially different to one-shot access to an article, a question which is entirely overlooked in their analysis.
Well, the service is being offered on a monthly basis alone. The customer may only desire a one-shot access, but that offer is simply not on the table.
I may only be interested one-shot access to [some-Netflix-movie], but the smallest access unit Netflix is willing to sell me is a month. Same goes for certain gym memberships. etc.
> The practical interpretation is that, if a user wishes to read 100 articles from 100 service providers all using this scheme, the cost of privacy is a significant detriment at €600.
Accessing a 100 difference service providers is on the customer, though?
Same example as above. Say the customer wants to watch just one movie on Netflix, Disney+, and 98 other providers, all charging $10/month. $1000 per month sounds a lot but that's entirely on the customer; they could also just spend only $10 and watch 100 movies on Netflix.
Don't use the service.
> they no longer can be forced to be "the product" without their consent.
Don't use the service.
> when B is unnecessary for performing A.
Technically unnecessary, the same way that the existence of goods in a shop is not dependent on whether or not I pay for them. But it sure has hell is necessary for the shop to keep functioning.
The overwhelming majority of people are happy to sell their data for free services. How many Facebook movies need to be made before people are convinced that 1) the average person knows they are being tracked and 2) they would still rather be tracked than pay.
I mean ffs, Netflix is about to roll out an ad supported plan. The average person does not value their privacy nearly as much as the outraged HN'er would believe.
Bring on the downvotes.
That basically means the business model “give people a service in exchange for personal info they think they don’t mind sharing” isn’t ok.
It also, by extension, means that you are telling consenting people that some agreements aren’t ok for them to enter into. Which is also fine.
> The average person does not value their privacy nearly as much as the outraged HN'er would believe.
I think you have it backwards. Regulation is needed because people don’t care. Not the other way around.
Seat belt laws are there because people don’t care about personal safety enough.
This is not how Democracy works. If, as you admit, billions of people don’t really care…who are you to force your will upon them? You know what’s better for them than they do?
It boggles my mind how people can think this way.
One might argue (perhaps especially in the case of the EU) that the legislative body doesn’t have public support some times. But that somehow laws are undemocratic because some fraction of the population doesn’t want them or doesn’t care? What’s the reasoning there? It’s even very common in a democracy to see lawmakers introduce laws that have a majority oppose them, because e.g it’s needed for society to function (tax increase would be the typical example that is rarely popular with 50%).
I don’t care about half the laws in the book most likely. But I elect representatives I trust to make things I might not like too. Democracy.
Also “billions”? These laws are m ass for half a billion Europeans and similar laws exist e.g in California. What’s going on with the rest of the billions it’s not really the concern of EU or California voters because … Democracy.
This is fine if:
1) The true extent of the tracking was disclosed. Before the GDPR that wasn't the case.
2) In practice, this only works for small services with lots of competition. For services which have a monopoly and/or oligopoly (and all of them are equally bad), this isn't a solution.
Maybe the GDPR can be relaxed in a few years/decades after other regulations against monopolies take effect or the monopoly/oligopoly problem self-resolves, but in the meantime I think the current state of the GDPR is valuable.
This isn't about just the button. Until a few years, "you're not the customer; you're the product" was the norm for a typical user's interaction with the internet, and they were powerless to change that.
Then the GDPR came along, declaring that users have fundamental right to their data, and as such, they no longer can be forced to be "the product" without their consent. One of its most empowering rules, however, is in Article 7 (4):
"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."
So consent must be (1) freely given, and (2) it's not free if you're blocking access to service A by requiring consent for service B, when B is unnecessary for performing A.
Hence, a search engine cannot force you to consent to tracking for advertising purposes, because technically, the search engine doesn't need it.
So how can the search engine make money? One popular way that has already been ruled as legal is to offer two plans: a paid plan with no ads and tracking, or a free plan with ads and tracking (in essence, it's a paid plan and you're paying for it with tracking).