News for hackers. Stuff that matters.
Re:Can Ads Be GDPR Compliant? by tobr on Sunday January 08, 2023 @09:29AM (#34299365)
I wonder if you read the part about fraud detection?
Re:Can Ads Be GDPR Compliant? by diffeomorphism on Sunday January 08, 2023 @09:41AM (#34299456)
That argument is somewhat flimsy though. It is only a problem if you want to pay per view. If you just pay for "show it for one week" as in print then there is no issue.
Re:Can Ads Be GDPR Compliant? by emodendroket on Sunday January 08, 2023 @09:46AM (#34299493)
But in print it is knowable how many copies are going out, isn't it?
Re:Can Ads Be GDPR Compliant? by ceejayoz on Sunday January 08, 2023 @09:50AM (#34299528)
Even that can be fiddled.

USAToday used to do it via deals with hotels to put one outside your room. Boom, extra copies!

Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @10:07AM (#34299683)
Yeah although ad buyers of any sophistication knew going in that a lot of certain newspapers were hotel copies (though arguably a lot of people read those), trade rags vs. consumer subscriptions, general vs. niche, etc. and took that into account.

They still didn't have a great idea of how effective they were a lot of the time of course.

Re:Can Ads Be GDPR Compliant? by emodendroket on Sunday January 08, 2023 @09:52AM (#34299551)
Printing a newspaper at least costs a bit more money and there's a decent chance someone will read the copy of the paper in their hotel room. Fake Web traffic could easily dwarf real traffic.
Re:Can Ads Be GDPR Compliant? by googlryas on Sunday January 08, 2023 @09:50AM (#34299537)
Advertisers would want to know something akin to circulation numbers before paying for placement though. And they would want to be reasonably confident those numbers aren't pumped by fraud.

Maybe the web needs something like Nielsen ratings, where Verified real users voluntarily submit their browsing to help advertisers determine watch time.

Re:Can Ads Be GDPR Compliant? by jefftk on Sunday January 08, 2023 @10:04AM (#34299663)
I talk about this at the end of the post as well. I think a ratings panel approach doesn't apply well to the web because the web is so fragmented. (In a good way! I like that there are lots of independent sites!)

Unless you had something like 10% of real users or a super representative 1% I think you'd have a big problem with getting realistic numbers outside huge sites.

Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @10:03AM (#34299655)
Yes. But even if you pay for a month placement on a given site, the ad buyer is still going to want an estimate of how many legitimate viewers see/saw your ad.

It probably works better on things like podcasts but the bottom line is that you can't really trust me to tell you how many viewers my site had without some fraud detection mechanisms in place. (And even then fraud is apparently pretty rampant.)

Re:Can Ads Be GDPR Compliant? by Saris on Sunday January 08, 2023 @10:35AM (#34299926)
I may be missing something, but why? Wouldn't the buyer just look at how many people arrived at their website from the ad?
Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @10:43AM (#34299990)
How do you know those clicks are people? (You can measure just conversions but that's a much higher bar for measuring an ad and a direct conversion may not even be your objective.)
Re:Can Ads Be GDPR Compliant? by jefftk on Sunday January 08, 2023 @10:43AM (#34299996)
Bots can click through like any other visitors. They won't buy stuff, though, so if you're placing ads for people to directly take an expensive action ("performance advertising") you're mostly ok. Brand advertising, though, is very dependent on fraud detection because it doesn't have this clear connection.

There's more about this near the end of the post.

Re:Can Ads Be GDPR Compliant? by tobr on Sunday January 08, 2023 @11:26AM (#34300412)
Do you think it’s possible to measure how many people are coming from an ad on a specific site and buying something, without also resorting to illegal tracking?
Re:Can Ads Be GDPR Compliant? by jefftk on Sunday January 08, 2023 @05:12PM (#34303767)
That's a good point. I think a shopping site might be able to succeed in arguing that they had a legitimate interest in tracking how people arrived on their site, but possibly not. On the other hand, if half of your visitors consent to tracking that's enough to have a pretty good sense of the value you're getting from each source.
Re:Can Ads Be GDPR Compliant? by Xelbair on Sunday January 08, 2023 @10:46AM (#34300026)
>But even if you pay for a month placement on a given site, the ad buyer is still going to want an estimate of how many legitimate viewers see/saw your ad.

yes, you might WANT that. but you do not NEED that. Remember that ad's isn't only effective when clicking on it, but also by spreading visibility of your offer/product.

you could easily use sites visitor count as a estimate for monthly pricing. And frankly without all tracking there would be no incentives to fake click on ads at all, so you could get your own tracking on your own side.

Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @11:16AM (#34300304)
If I can't tell with some degree of assurance whether you have 1K viewers per month or 1M viewers per month (never mind uniques), I'm probably not going to pay for ad on your site.
Re:Can Ads Be GDPR Compliant? by orangeoxidation on Sunday January 08, 2023 @09:48AM (#34299511)
Print can charge for ad placement, not impressions. But that's only possible because the number of subscribers, size and number of print runs, circulation are well known and hard to fake stats.

The web cannot do that without tracking...

Re:Can Ads Be GDPR Compliant? by contravariant on Sunday January 08, 2023 @10:04AM (#34299659)
Depends what you call tracking. Just like a newspaper company knows how many copies they distribute a website would know how many copies they've sent over the line.

You might not trust them but I don't see why you'd think a newspaper would have a harder time claiming they've made more copies than they have.

Re:Can Ads Be GDPR Compliant? by jefftk on Sunday January 08, 2023 @10:09AM (#34299695)
Sending out a newspaper is much more expensive than sending out a pageview. If a million bots visit my site everyday I can point at server logs showing very high numbers of pageviews, but you wouldn't want to use that to pay me!

Now, you could say don't do business with people who are trying to defraud you, but one of the more impressive things about the ad ecosystem is that it works without advertisers and publishers trusting each other. I can sell the space on my site and advertisers don't need to figure out how much to trust me in particular.

It's easy to have ad fraud that's plausibly deniable and maybe even not on purpose. Let's say you're a publisher and you want more people to come to your site. You look around and you find someone who says they run a newsletter and would be willing to include links to your stories for a small fee. When you multiply out the cost per visitor this looks like a pretty good deal; you say yes. This traffic turns out to be entirely bots, but you can't tell because we got rid of ad fraud detection.

Re:Can Ads Be GDPR Compliant? by dmitriid on Sunday January 08, 2023 @10:49AM (#34300061)
> but one of the more impressive things about the ad ecosystem is that it works without advertisers and publishers trusting each other. I can sell the space on my site and advertisers don't need to figure out how much to trust me in particular.

For a person who worked in ads you are surprisingly oblivious to how both Facebook and Google defrauded advertisers and publishers.

- Facebook Lied About Video Metrics and It Killed Profitable Businesses https://www.ccn.com/facebook-lied-about-video-metrics/

- Google Hit With $268 Million Fine Over Unfair Ad Practices https://gizmodo.com/google-hit-with-268-million-fine-over-un...

Ad industry should burn in the fires of hell.

Re:Can Ads Be GDPR Compliant? by klvino on Sunday January 08, 2023 @11:52AM (#34300675)
There was a second flaw in the premise between print publishers and websites. Some print publishers inflate circulation numbers when attempting to sell ad space in an attempt to make the ad space appear more valuable.

Similar double-selling of television ads take place as well. A network ad may run in the network feed and will appear in the network affidavit logs as having run. Local affiliates supercede network feeds all the time and in some of those cases they do so during a network ad pod and run station-sold ads. Consumer sees only one of the TV ads but both get reported as run.

Fraud in advertising isn't something new or isolated to the online medium.

Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @10:20AM (#34299781)
Ignore the headline which is completely unsupported by anything in the story but circulation numbers are audited, e.g. by an organization called BPA. https://www.photonics.com/Articles/The_Magazine_Industrys_Di...

Doesn't mean there isn't fraud but someone can't really make up circulation numbers out of whole cloth.

Re:Can Ads Be GDPR Compliant? by contravariant on Sunday January 08, 2023 @10:41AM (#34299974)
Sure, but if anything that shows that newspaper companies can't be trusted to report accurate numbers if there is no oversight whatsoever.

All I'm saying is that the same logic holds for websites and that tracking people is a needlessly paranoid and harmful solution to the problem when it can be solved with trust, contracts and auditing.

Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @10:51AM (#34300073)
>it can be solved with trust, contracts and auditing

I actually agree with you. And large businesses in particular are both audited and do internal audits all the time. It's not that they and their employees are all untrustworthy but audits can both catch mistakes and send a signal that people are watching.

There are probably other mechanisms to do fraud detection. But, as your comment suggests, they may be more heavyweight and therefore might exclude most smaller sites.

Re:Can Ads Be GDPR Compliant? by jefftk on Sunday January 08, 2023 @05:15PM (#34303814)
I don't see how audits work well in this situation. I wrote more about what ad fraud can look like in this comment [1] and I don't see how an audit would catch "as a publisher, one of our traffic sources is sending us bots instead of real visitors".

[1] https://www.lesswrong.com/posts/dFgfQTo4DRZG5t8Ap/can-ads-be...

Re:Can Ads Be GDPR Compliant? by kzrdude on Sunday January 08, 2023 @09:59AM (#34299612)
Big sites (newspapers) could do it the same way - maybe independent reach surveys could be the data that they use to back up their web ad pricing.
Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @10:36AM (#34299940)
I think that's one of the points though. Big sites can back up their digital reach claims such as by using third parties. But if vetting yourself for advertisers was to become a requirement, advertisers just might not bother with small sites. Though admittedly Google makes money off small sites--but I bet most of those small sites don't make enough to make note of.
Re:Can Ads Be GDPR Compliant? by jefftk on Sunday January 08, 2023 @10:45AM (#34300011)
Google's vetting of small sites is pretty minimal. Instead they use fraud detection: vetting the traffic itself.
Re:Can Ads Be GDPR Compliant? by ghaff on Sunday January 08, 2023 @10:59AM (#34300145)
Right. Which is the point both of us are making I think. If you can't do some minimum floor of fraud detection more or less transparently and cheaply, you fall back on more heavyweight mechanisms and probably screen out any site that isn't "big."