Google’s GDPR Workaround
brave.com
brave.com
Below is the google_gid for different publishers, there is no proof of overlap, they have different google_gid for same person. Which is exactly what google describes. [1]
I don't understand what Brave claims.
d.agkn.com CAESEP-S3Zs5f0_kq11XTCZP_mE
id.rlcdn.com CAESEPpf2T4-2AsAR_4rer3RfNs
image6.pubmatic.com CAESEB9H3qdV26kxEiz-BJ_TY-M
pippio.com CAESEJyqG1Pg1j-_scqW8kDzTkg
token.rubiconproject.com CAESEE1DyZ245WggYaQZEWpQWI8
us-u.openx.net CAESEPIJ9jHcY2j4jK3-DPmfar4
[0] https://brave.com/wp-content/uploads/files_2019-9-2/sample_p...
BidRequest Data [0] and Request Time is already enough to fingerprint the user.
"Google prohibits multiple buyers from joining their match tables." part is not technical, it is contract based.
[0] Sample Data from Bid Request
ip: "F\303\006"
user_agent: "Mozilla/5.0 (Linux; Android 7.1.1; Pixel XL Build/NOF26V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Mobile Safari/537.36"
url: "http://www.myfitnesspal.com/food/calories/popeyes-buttermilk-biscuit-29980768"
cookie_version: 1
google_user_id: "CAESEIMlaNwMN-rtiDFzjwNIX6Y"
timezone_offset: -360
detected_content_label: 39
mobile { is_app: false 3: "android" 8: 1 12: "google" 13: "pixel xl" 14 { 1: 7 2: 1 3: 1 } 15: 412 16: 732 18: 70092 19: 3500 }
cookie_age_seconds: 12960000
geo_criteria_id: 9023221
device { device_type: HIGHEND_PHONE platform: "android" brand: "google" model: "pixel xl" os_version { major: 7 minor: 1 micro: 1 } carrier_id: 70092 screen_width: 412 screen_height: 732 screen_pixel_ratio_millis: 3500 }It being technical impossible or infeasible does not give them license to not follow the law.
Either they comply with the law or they don't. I'm not a lawyer, but it certainly doesn't look like they're following the law here.
Well there's absolutely a way: single-source JS and no CORS.
:/
“there is no way for google to operate under the GDPR and provide targeted advertising” ?
i’m inclined to agree :/
Couldn't each buyer get their own "auction ID" as well as their own "user ID"? Am I completely misunderstanding things?
now those are used to match a 3rd party id. you just need a gdpr_workaround schema in your data base with two columns user-id, google-random-id with N-1 records indexed both ways.
gdpr has restrictions on pin pointing a single person. this is effectively doing that, but claim it is not, because random ids. apple is just a little better with how device-advertiser-id works.
I don’t think we can have it both ways, or at least it is very difficult and we don’t have a great compromise solution.
AFAICT Brave's plan is to send a block of potential ads to the client and use a client-side machine learning algorithm to choose specific ads. So the claim is that none of client events, inferences from the algo, nor ad choices travel from the client to the ad networks. (But ad networks retain their crazy microtargetting which I guess is the selling point.)
Even if Brave were to choose the blocks of ads based on geolocation and other install-time/runtime data which they then sell to third parties, it's still significantly less data leaking from the client's browser compared to, say, a default Chrome install. But them storing/selling that would be a clear GDPR violation as well as going directly against all their explicit public claims so far.
What is your understanding of Brave's upcoming ad network that leads you to believe it requires a surreptitious GDPR violation?
Here's my understanding: Google runs real-time bidding ad auctions by sending anonymized profiles to marketers, who bid on those impressions. The anonymous id used in each auction was the same for each bidder, which is in violation of GDPR. If Google were to send different ids for each bidder, it would be ok? Is this correct?
Why would it matter that the bidders are able to match up the IDs with each other, aren't they all receiving the same profile anyway? Wouldn't privacy advocates consider the sending of the profiles at all an issue?
There are companies that specialise in sharing user information. Some of them work by only sharing data with companies that first share data with them (an exchange).
If you got this Google ID, and you had a few other pieces of information about the user, you could share that data with an exchange, indicating that the Google ID is a unique identifier. Then, the exchange would check if it has a matching profile, add the information you provided to that profile, and then return all of the information they have for that profile to you.
So, let's say you're an online retailer, and you have Google IDs for your customers. You probably have some useful and sensitive customer information, like names, emails, addresses, and purchase histories. In order to better target your ads, you could participate in one of these exchanges, so that you can use the information you receive to suggest products that are as relevant as possible to each customer.
To participate, you send all this sensitive information, along with a Google ID, and receive similar information from other retailers, online services, video games, banks, credit card providers, insurers, mortgage brokers, service providers, and more! And now you know what sort of vehicles your customers drive, how much they make, whether they're married, how many kids they have, which websites they browse, etc. So useful! And not only do you get all these juicy private details, but you've also shared your customers sensitive purchase history with anyone else who is connected to the exchange.
I get the impression that this structure would require an exchange: retailers would not trust each other otherwise.
Wouldn’t commercial pamphlets, interviews with salespeople, etc., from the exchange be obvious proof of illegal behaviour there? Google’s implementation is imperfect but, for the loophole to work, it would need coordination between several competitors and third party with a business model explicitly and almost exclusively about going around against GDPR.
If I can risk a comparison, that would be Google is like a chemical company selling fertilizer, and the exchange is selling bombs made from raw material bought by other people.
Am I missing the point? Shouldn’t this article be about those exchange and their clients, not Google?
Isn't that also a GDPR violation?
I would guess that yes, they're all receiving – _from Google_ – the "same profile" but they also are collecting additional info that they can then share with each other and, because they can match profiles exactly, they can access each other's info about specific people.
> Wouldn't privacy advocates consider the sending of the profiles at all an issue?
I'd imagine that the profile Google has and shares is by itself fairly anodyne, but I could be (very) wrong about that. The problem seems to be more (if not entirely) that different advertisers can share info using a common profile ID.
I'd imagine that even a single advertiser would be able to perform a similar 'attack' by, e.g. running multiple different campaigns, but I may be misunderstanding exactly what info is being shared. It's possible advertisers are able to match the Google profiles to specific unique identities and thus are sharing much more than just the info they're collecting directly from their ads.
The headline was enough to pique my curiosity to explore Brave's product offering. Unfortunately, actually reading the article had the exact opposite affect.
I didn't make it to the end, closed the tab and went over to HN comments for a summary.
The only thing Google did in regards to GPRR was limit the number of parties in RTB they're including by default for syncing to a "trusted set" of parties.
he diagrams in your link show a single hop for the 302, in my experience that can be many hops going between different advertisers. The same thing happens on non-google platforms, like TradeDesk and others.
The sync scenario can make it next to impossible to delete cookies when those cookies can be rebuilt using data from others.
I say this because I am in this position now. I have to figure out how to advertise my company's products and am torn on how to go about it.
It's definitely possible, but you're just doing everything manually that ad networks do for you. Whether that is worth your time (or worth it to hire someone to do this kind of thing for you...) is up to you.
It's definitely possible for small websites to do ads directly, but it's a lot of work. Often more than is justified for a few thousand dollars a year in ads.
You've just explained how contexual ads used to work, which doesn't need all the invasive surveillance modern internet users have to put up with.
You can still target adverts at content on a site, and have an aggregate system to make that easy and granular.
There could even be services which collected lists of websites and categorised them, and the rough demographics of their audience, and retailed slots.
Individual tracking is unnecessary financially, you can make as much revenue without. See example of the New York Time dropping tacking for EU readers for GDPR reasons, and continuing to grow ad revenue: https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut...
The whole targeted advertising is to allow adtech companies to identify users of the "widget fans" site, and then advertise to the same people, but on another, cheaper site.
I'd love seeing this turned around though.
Imagine if you went back to say the 1920s, and you told a marketing director that you could install a one-way mirror room and back door into every household in the country, and staff them all with analysts who will secretly observe people in their homes 24 hours a day, 365 days a year. People would think you were crazy. In fact, I bet most people today would be completely against that idea, yet wouldn't realize that what companies like Google and Amazon are doing today is effectively the same thing, except _much more_ invasive.
However, it's all a whole lot more expensive and effortful than running some Google ads.
This is exactly how marketing worked before and how people can go about it now, as you describe, through traditional advertising markets.
I'd personally prefer it that way in general, but legislation is necessary for them to optimize on those restrictions.
I've never needed to turn to Google or other ad-slingers. Instead, I've done things the old-fashioned way, by going to where my potential customers tend to congregate and engaging with them (this kickstarts word-of-mouth, which is still the best advertising you can get), hosting my own online forums for customers, going to trade shows as appropriate, and supplementing everything with a few direct-placement ads in carefully selected media.
Yes, it's more work -- what Google et. al. are actually selling you is convenience, after all. But the rewards in terms of of ROI as well as fostering a real community, complete with evangelists, are more than worth it to me.
Of course, ymmv.
Trade "print" media with an online presence. Online media that doesn't sell all their pixels to Google? Radio, depending on your audience and required reach? Forums specific to your audience that don't sell all their pixels to Google. Podcasts. Submarine articles in the trades? Open source ad networks that don't embed insanity or real-time bidding?
Mostly, I would try to target your initial audience as precisely as possible where they live, rather than with a wide net. Perhaps a Google search returns results for top websites dealing with your product - if they are not vendors, then perhaps you advertise on that site?
Disclaimer: I'm not a growth hacker, but I've thought about these things and run a couple of poor Facebook campaigns for a brick and mortar business.
I've personally never heard of a success story for what you describe that involves paying google. But maybe they exist and they're just keeping it quiet?
> The evidence further reveals that Google allowed [...]
> Google has no control over what happens to these data once broadcast [...]
Is it possible that Google does have "control" over the data after broadcast, albeit legal control via contracts with advertisers (as opposed to technical control)?
Perhaps Google's GDPR compliance strategy relies on the participating advertisers to comply with their contract with Google. If that assumption is accurate, perhaps Google's advertisers are in breach of their contract with Google which makes it appear as though Google itself is in breach?
I could be off-base, the details in the article aren't incredibly clear to me.
(For the record, I don't like Google's business model and I don't like Google's pervasive tracking -- I'm playing devil's advocate to better understand the issue)
Aka - you land on a site, it send your IP and whatever identifiers it has to 10,000+ companies who all then figure out if they want to bid on showing you an ad.
That distinction is important. I’m happy that privacy advocates are realising that platforms having access to enforceable contracts is key–too many are quick to paint platforms as the source of the problem and not an agent who, with the right tools, could organise a market.
Facebook has suggested having an independent court what is acceptable content in their platform. Google could think about delegating the control of how its IDs are used to an independent entity with the power to audit its partners’ data practice properly.
The GDPR has separate rules that effectively deal with whether you are the business with which the customer works or one of their contractors. I could imagine a world where google is the second party and needs a secure feature like this so the first party can perform (consented) tracking across multiple domains they own. This is just a devils advocate argument since I can’t guess intent.
I don't actually put much faith in such "control".
Now there's a claim only a court would buy!
A court probably would buy it, though.
Sigh.
Is it enough that a RTB ID is pseudo-anonymous? (it always identifies the same person, but cannot be used to find that person's real information) - OR - is a RTB ID not even pseudo-anonymous?
A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII.
the ID would be pseudo-anonymous if one would need some extra data, to which they don't have access to, for linking the ID to one specific user in the whole dataset[2].
So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them.
[1] It's also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. https://www.lexico.com/en/definition/identifiable
[2] Definition of pseudonymisation, 5'th bullet-point: https://gdpr-info.eu/art-4-gdpr/ sheds some light on this.
(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
If they could, they would've already done so.
One of the things "the cleverest engineers to walk the planet" would probably need to do is to increase consumers willingness to pay for good content by a factor of ~10 for e.g. online newspapers with quality journalism to be profitable, which frankly sounds near-impossible.
After more than two decades newspapers still haven't figured out that even though I want to pay for good journalism I cannot subscribe to every newspaper there is, and I am a user who actively wants to pay.
I already voluntarily pay for two newspapers and involuntarily pay for the national news-and-a-little-propaganda service. Oh, and I donate to the Guardian half the time I visit them.
If more papers allowed me to pay per view I would likely spend more money on journalism.
But I'm not going to have another subscription right now, thanks.
Technical issues are mostly used as an excuse.
In the same vein, there may be engineers that enjoy working on this type of problem - how to identify someone that is actively avoiding you. The current iteration of Do Not Track mentality only makes the problem more interesting by putting up restrictions.
Until there is some sort of agreement among the relevant jurisdictions to greatly reduce the pain of this, direct micro-transactions with your site's visitors are likely to be a bureaucratic nightmare.
New ways of building things is the province of engineering.
New ways of making money is the province of MBAs.
Not that really matters; I doubt you will succeed in replacing ads with something "better".
See their release note (15 April 2013); https://developers.google.com/authorized-buyers/rtb/relnotes
“Starting in mid-April, we will begin assigning a URL-safe string value to the google_push parameter in our pixel match requests and we will expect that same URL-safe string to be returned in the google_push parameter you set. This change will help us with our latency troubleshooting efforts and improve our pixel match efficiency.”
====
Page View #1:
- Acorp: google_gid=qwerty, google_push=foo
- Bcorp: google_gid=asdfgh, google_push=foo
- Ccorp: google_gid=zxcvbn, google_push=foo
By exchanging their `google_gid` values corresponding to the page load with shared `google_push` value foo, Acorp, Bcorp, and Ccorp can identify you as user qwerty-asdfgh-zxcvbn.
====
Page View #2:
- Acorp: google_gid=qwerty, google_push=bar
- Bcorp: google_gid=asdfgh, google_push=bar
- Ccorp: google_gid=zxcvbn, google_push=bar
By exchanging their `google_gid` values corresponding to the page load with shared `google_push` value bar, Acorp, Bcorp, and Ccorp can still identify you as user qwerty-asdfgh-zxcvbn, even though the `google_push` value has changed.
Having worked in adtech, I can tell you the adtech providers probably don’t do that, for those reasons: 1) those adtech providers are usually competitors 2) if they work together, they can already sync their user ids directly together (so using google id is not necessary).
So I don’t think Google intentions were malign here on this particular point (contrary to Brave communication and all the press coverage). But yes, Google shouldn’t add entropy by sending the same “page view id” to different adtech providers. Note that Google is “better” than the others here: every other adtech providers send the same user id to each partner (persistant identifier, not session or page view like google). And those providers are sometimes quite big: for example, AppNexus or Criteo trackers are also everywhere on the web. Overall, it’s the RTB system with all those cookie syncs that shouldn’t exist, and except for the “google_push” argument, Brave study is quite good (they are just explaining how the adtech world works).
> Google claims to prevent the many companies ... from combining their profiles about those visitors
> Brave’s new evidence reveals that Google allowed not only one additional party, but many, to match with Google identifiers. The evidence further reveals that Google allowed multiple parties to match their identifiers for the data subject with each other.
BTW, many comments in here seem quick to agree w/this headline given how buried the details are. If someone has better detail, please share it.
Essentially, Google assigns an anonymized identifier to a user and sends that to prospective ad buyers. The idea is that the ad buyer can use this to target ads to people who have visited their site as they browse other areas of the internet participating in Google's auction. This is called remarketing.
An example. You go to footlocker.com and put a pair of sneakers in your shopping cart but decide not to buy. When you go read an article on the New York Times site, a potential advertiser recognizes your anonymized id and bids to serve you an ad for the sneakers.
The issue Brave is raising is that the same anonymized id is served to each potential ad buyer. This isn't an issue with data Google collects or exposes, but Brave states that buyers could theoretically collude to build profiles by sharing the data collected on their own sites with each other joining by Google's identifier. There is no evidence of this actually happening and Google's contract with ad buyers specifically prohibits this activity.
If it's anonymized then how could they send targeted ads to you? I think you're using a slightly different version of the word anonymous.
How I use the word anonymous it means, roughly speaking, that it can't be traced back to you. Or in this context, google wouldn't be selling anonymized data to third parties who in turn could contact you.
If they were selling data like X persons like product Y more then Z, there would be less of an uproar about this.
Also there was an interesting story a while back about a clash between advertising and the Fuchsia engineering team https://9to5google.com/2018/07/20/fuchsia-friday-respecting-...
There is de-Googled Chromium OS project, but Brave takes a few steps sideways by making further changes such as proxying location services, safe browsing API, etc. I doubt a 12 y/o could compile it though, let alone in 2 hours.
This sort of resolution was inevitable.
I said it before and I'll say it again: GDPR is an annoying measure for developers, small businesses and startups. It doesn't do much other than put in place so many steps that growth tools for startups become risky to use. For big businesses that (ab)use big data, it's not much of a hassle because they can afford the legal steps as well as the change in infrastructure. They can even work around it and keep abusing data without consequences.
If they're able to beat Google's lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that'll be more than covered by their daily revs.
Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be.
GDPR penalties are a flat fee or a percentage of revenue, whichever is higher.
If Google is truly willfully violating the GDPR, the maximum penalty by law could be up to 4% of their global turnover. I would not call that pocket change. But more importantly, it is a relative increase in fine based on the law breaking company.
(Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!)
The EU already fined Google a total of $9 billion over the last two years.
4% the first time might be something you can shrug off, especially for a company the size of Google. But if you continue breaking the law and give the regulators an easy second or third bite at the apple...
I’d expect Google makes no changes and fights the regulators the first few times.
E: I used to have a comment here about Google continuing their current practices against non-EU people but it appears from my reading of the GDPR that may not be so simple
> The maximum fine under the GDPR is up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements.
From here: https://www.itgovernance.co.uk/dpa-and-gdpr-penalties
A straight 4% would be absolutely bigger, but relatively the same (once beyond $500M).
My problem is with fines that they don't really force the PEOPLE in the businesses to play fair.
What about required & [RESPONSIBLE] roles and jail?
I am asking that in general because I am fed up with our business-entities made world where committing a crime is basically RECOMMENDED if the numbers and percentages say so.
If GDPR wants to be effective they need a ridiculous company-breaking fine for big abusers like COPPA and the like. Something like a per-user fine for violations that means they either can't do business in the EU or they have to become compliant otherwise risk being basically destroyed (for reference, violating child protection laws in the US can break and have broken companies before).
EDIT: also as for the tracking growth comment -- I agree on this, but the effects of GDPR on growth tools reach far beyond this. Even basic metrics are hard to get without a bunch of hoops. Even if you store no data you have to have a bunch of checkboxes and banners everywhere. Just for using Google Analytics that just relies on what they know about your computer (fingerprinting), and uses no PII at all, you need a banner and privacy policy. The laws are making it hard to use even basic analytics without fearing a misstep.
Although I feel that Google has won its position in search, etc by offering a legitimately better product, we need to punish companies that continue to break the law. Success does not put you above the law. If you use your massive profits to absorb fines for breaking the law repeatedly, you should lose your ability to operate as a corporation and be dissolved. We need to reform antitrust laws. It's not just being able to control an entire market anymore, it's about being able to ignore international law because you have so much money.
IMO, punishing data abusers can't be solved with data privacy laws. It's a regulation with very little ability to be enforced.
In the first place to abuse data you need a lot of it, so really we're looking mostly at big companies with big pockets. The easiest way to attack here is to punish unfair markets and to have stronger antitrust laws.
Let's look at the textbook case for privacy with Facebook. Facebook would be the prime candidate for antitrust no matter how you look at it: there are basically no competitors to it in the US social media market. They own everything except Snapchat, which is dying off and failing to turn a profit. Facebook accounts for so much presence in the US that they have login buttons you can integrate on different sites (Google does too because of how crazy cemented they are). Yet somehow besides being so obviously monopolistic and out of control they're hit with no antitrust. Bell was split up for doing much less.
Antitrust is just a joke right now. We have to get better enforcement first before looking to create regulations to be enforced.
This is why the 4% of global annual revenue fine option exists. A few of those add up quick.
I'm very happy that the GDPR exist, if only because it forced all these websites from explicitly giving me a list of the literally hundreds of partners they want to share my data with, along with a way to say "hell no". Of course Google and friends will try to work around it but hopefully that won't come to pass and they'll have to actually bother changing their crappy business model. I think the spirit of the law is fairly clear, I wonder why Google thinks this scheme can work. Maybe they're just trying to buy some time.
As for startups that sink because they can't be bothered to sanely handle my personal data: good riddance.
- It doesn't explicitly force them to do that. And most sites aren't explicitly sharing the data either; i.e. almost every site uses Google analytics which doesn't really comply with do not track all too well, and Google will then share their data with everybody else (which is part of their violations in this article). Also saying "no" doesn't do much either as most of these big sites either already stored the cookie or won't do much to delete it. And it's not that they'll try to work around it, they either don't put forth the effort because GDPR is like a pebble for them, or they already worked around it in a way that changes nothing. Their business model is still the exact same.
I think the spirit of this law is fine, but the actual law does nothing and is just privacy theater. Google isn't buying time, almost 4 years later nothing has changed -- they just know they can't be touched.
- They're not going to sink, they'll just grow much slower and thus won't be an alternative to the big data abusers you hate so much. And they're not failing to handle your data, most of the time startups aren't selling you out they're just trying to figure out who their customer is internally. To do this they collect some data that is usually optional and very much with your consent; GDPR just puts a bunch of hoops in front of this so that it's an enormous pain to do so. I run a startup that collects basically no data (literally, we do not have a database for 2 of our products). It was a pain for us to become GDPR compliant because that disables our metrics entirely and requires a bunch of banners and checkboxes everywhere even though we literally store nothing.
I'm all for the spirit of the law. I just think the execution sucks and they definitely didn't think it through enough. I think the evidence for this is clear based on the sheer number of privacy violations we've had since GDPR was enacted alone, and how little enforcement and regulation has actually gone on.
We're not four years into the GDPR becoming enforceable (it was just last year), and certainly not enough time to see real action for complex cases - regulators and courts move slowly.
Startups barely ever asked for consent, and collect way more data than you imply - including, as you mention, by using Google Analytics.
The GDPR requires zero banners and checkboxes if you are not processing data.
How do you know? The fact that there's still crime doesn't mean that law enforcement doesn't do anything. Somebody reports an alleged violation, an investigation is started, and maybe the investigation will produce that Google is in violation (in which case a fine will "regulate" Google's behavior) or they are not (in which case it may be fair to criticize GDPR for allowing that behavior, or it may not be because the info wasn't correct).
> almost every site uses Google analytics which doesn't really comply with do not track all too well, and Google will then share their data with everybody else
Unless you have specific info, I believe you're mistaken here. GA is generally seen to be compliant if anonymizeIp is active and you're not pushing PII into it via customization. Google is, if I understand it correctly, not "sharing" GA raw data with anyone, but analyzing the data for their own research and providing the website owners with aggregate data (i.e. demographic information) without sharing data on individuals. I'm not a fan of GA, but I haven't seen any info that they're that obviously in violation.
> It was a pain for us to become GDPR compliant because that disables our metrics entirely and requires a bunch of banners and checkboxes everywhere even though we literally store nothing.
What was the specific pain? I get that having to add a privacy info sucks (and might cost money if you get a customized version), but I never found it to be that big a deal. If you don't store any PII, it's pretty straight forward, and so will the procedures be if anybody asks about the data you stored: just inform them that your systems do not store any data in general and also didn't store any data on them in particular.
That's why, IMO, GDPR sucks for small businesses that can be outed to the ICO for a minor oversight and not so much for big data abusers that can take on GDPR and come out unscathed.
We've stopped cookie matching in EU28 countries so I can't verify if they do pass the buyer_uid.
If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me.
Also, if a malicious actor targets an ad to a group of people, and some of these people buy the advertised items, then the actor can infer things about those people not necessarily related to the items sold.
Seemed like a major HIPAA violation to me.
You have to take some personal responsibility, though. If they saw your Youtube recommendations or your Spotify playlist, they'd probably make inferences as well. That porn link in your history you forgot to clear? Be aware of who's watching and browse anonymously if you're concerned.
It's not hard to imagine a person's career being affected by something like that.
They're not choosing to have targeted ads that share their info around the web and cause someone over their shoulder to infer things about them.
That's the point -- we should have that choice. And the default should be "no".
Because what Google are doing is not dissimilar to how any other RTB participant is acting, saying this is a Google workaround seems disingenuous.
Unfortunately I fear this will only embolden Google to further monopolize digital advertising.
I mean, if the allegations are correct, Google didn't find any loophole, they're just hiding the fact that they're selling person identifiers.
Edit: Why downvote? Do you really think that the US government will stay silent if the European Union threatens with such fines? Political tensions are something you take heavily into account.
Also the 4% global revenue fine wasn't exercised yet because it's the maximum fine, and there needs to be room for escalation: hard to serve a bigger punch if you're already at the maximum.
In fact Contextual Targeting predates the current approaches, but it became less important once advertises/adtech companies started preaching the thinly veiled idea of using behaviourism to trigger conversions/less products.
Changes like this are slow to introduce due to technical and (mainly) structural/cultural issues in the Advertising Industry, but that’s a topic for an entire essay/series of blog posts.
Source: I work in AdTech and deal with privacy/the ethical impact of programmatic, content monetisation models. Opinions obv. mine.
On the PG/PMP side, the usage is obvious, but I'm also curious what it will take for publisher-provided data to be trusted in the open exchange environment where historically advertisers and DSPs have tended to not trust the publisher-supplied categorization.
I think of it like the UID I get on a UNIX machine: it identifies me, and anyone with /etc/passed can get my name, and things that don’t have access to it can still see “oh uid 1099 is logging in again to play nethack”.
I realise I am in a minority, but I have never clicked on a digital ad and went through to buy something, and I never will.
The minute I see ads on a webpage, I automatically associate that site with trash. (Please take note HN :))
It is as if humanity cannot be trusted with technology. This creates a certain "ceiling" for us in terms of development as a species. Such a shame.
It's the same thing as a full-page advert in a magazine that you flip through. For some readers, they will stop an read it, raising awareness to that brand/product/company etc.
A company spamming my eyeballs with visual ads to "raise awareness" does not get my money. I take particular offence to that, as it is my screen. Not a Billboard for example.
My point is proven in the HN website, where it enjoys a large readership, largely influenced by the sites clean, ad-free design.
Slashdot used to be like that until they started displaying ads, and that is what brought me to HN. Thank you HN for not doing this.
You might want to reconsider
At first glance, I would have thought this isn't a workaround at all. GDPR allows for pseudonymisation as a method of data protection. But, Recital 26 of the GDPR disallows this:
> The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. [...]
That said, I don't think this is cut and dried, because Google themselves isn't providing the linkage to an identifiable natural person. The person that can make that linkage necessarily already has the identifying information. Get ready for a major legal battle.
>"The primary targets of this campaign are Google and the IAB, which control the RTB system."
Can someone say who makes up the IAB exactly? Is this just an industry trade group?
It's a mix of the major players in the digital advertising industry. Historically the IAB has taken actions that are good for the industry overall. It focuses on standardization/interoperability in the ad-tech space. It generally isn't a watchdog and doesn't regulate the industry except when the industry as a whole would benefit (e.g. self-regulatory programs that have no real effect but stave off state regulation).
You can fight back by providing fake and bogus data. For example, there are browser extensions that do this for you.
I think there are some folks at Google who have just read too deep into both 1984 and The Google Book to go on to think that privacy violations like this is a normal thing. But what do I know? I'm just another 'privacy lunatic' on the net that wears a metal helmet (tinfoil hats are just not good enough) trying to protect my privacy.
Enabled by default can and should be the default for security-related features.
I tend to agree about the rest of the creepiness, especially anything personally behavioral.
If you want to know which Go modules I use, go check out my github. They're listed right there in import statements. If I'm hacking on a project that I want to keep private, I'll disable this feature with a command line flag - easy.
My issue with the paranoid folks in that thread is not that they made no sense (they can't help that), it was they were attacking the person who implemented the feature viciously. He had implemented a feature that a majority of Go developers had been requesting for 5+ years, had done it in a way that improved clean build time, improved security and could easily be disabled or replaced with a private DB. Literally what else could that man have done?
Even though all his work could be verified trivially (Go is open source!), they still chose to attack him.
Not since Google uses the argument of increased security to justify data collection for quite some time in the interest of itself.
How do you figure?
You are assuming you were branded by a large swath while similarly branding an entire company that is clearly represented by many diverse opinions on diverse products. The debate needs more nuance lest everyone pulls out their broad brushes while also taking offense to receiving a fleck of paint. Conflating the Go proxy w/ Google's ad business is a perfect way to ignore nuance in the debate downplaying the real, tangible effects.
"Come on that's just paranoia"
Snowden leaks secret program that implements everything details in the patriot act.
"WHO COULD HAVE SUSPECTED?"
https://sum.golang.org/privacy
This links to the Google Privacy Policy which is an additional 27 pages.
"I think there are some folks at Google who have just read too deep into both 1984 and The Google Book..."
Is this The Google Book?
What are the privacy issues in Android 10? Anything new compared to previous versions?
Other than that, it seems that privacy controls have been generally improved in Android 10.
You were doing baseless accusation on something you don't know anything about. Your comment was basically "they market it as being better to handle privacy thus they clearly are worst with your privacy!".
You didn't raise anything substantial at all in that comment.
https://cryptome.org/2012/07/gent-forum-spies.htm
It's just as valid a technique for large organizations as it is for governments.
Active Perception Management is most definitely a thing. Of course it only works because most people aren't aware it is a thing.
Only the Paranoid Survive. A book by The President and CEO of Intel.
The main difference between the two is just which paranoid thoughts you give credence to.
McDonalds already had complaints (and some lawsuits) over the (significantly higher than industry standard) temperature of their coffee, so this wasn't exactly out of the blue.
She ended up with 3rd degree burns on her legs and crotch. She asked only for her medical bills to be paid. McDonald's refused, so she eventually took them to court. Even then, she only asked for medical bills (and now legal expenses).
The jury decided that McDonalds was not only liable for those costs, but had treated the woman so poorly that they should pay punitive damages. The massive amount you heard about in the news was based on the amount of money McDonalds makes selling coffee in one day.
But that's not the story that was spread by the shills...
In popular circles, the story is framed in a way that does make the lawsuit look frivolous. But this is also a case that has made it into the legal textbooks as an example of corporate negligence that's clear-cut enough to use for demonstrating the concept in introductory textbooks.
Of course, in the legal textbooks, the version of the story that's told includes a lot of details that, as you point out, get excluded from the popular version.
1. A woman willingly purchased hot coffee from McDonald's.
2. She spilled it on herself.
3. She sued McDonald's because of her injuries.
Those three things are true no matter which circle you ask.
A lot of people I talk to, even when given all of the facts of the case still consider it a frivolous lawsuit because they place almost all of the blame on the woman.
The Internet extreme position machine. Everything has to be clear cut.
How McDonalds no longer engages in "corporate negligence": they put pronounced warnings on the cup that it's a dangerously hot substance. That's it. They did not lower the temperature (as is frequently claimed, nor is the temperature at all outside of normal industry standards, yet this is being repeatedly stated throughout this thread -- coffee, brewing with boiling water, is hot). You can get a searingly hot cup of coffee from most quick-serve restaurants today depending upon how freshly it was brewed. This is a case where the solution is more warnings on things.
This case was, however, an example of bad brand management, and perhaps throwing good money after bad for something they could have privately settled early on.
This is certainly not a hill I want to die on, and generally arguing against the prevalent opinion (which is overwhelming the one that you and the GP have expressed, albeit almost always positioning it like it's contrarian) is self-defeating, however this whole case is fascinating in how public perception shifts.
It actually all relates to trucking/truckers who use their own special cups, but demand the coffee be scalding so it stays hot longer on the road. McDonald's catered to these truckers to grow their coffee business, they knew the risks and gave no warnings to customers. I think the employee was also negligent in securing the lid leading to the spill itself.
As you say the coffee was so hot it scalded this woman so badly through her jeans she needed skin grafts. And sure enough there was massive money spent to spin this in the media as "woman burned by coffee sues for millions, everything wrong with our litigious society." Where this should have read: giant corporation disregards safety standards to boost their bottom line to the detriment of its customers leading to boiling coffee that scalded a woman's privates requiring skin grafts, then in bad faith the insurer denies the woman's claim to pay her medical bills, drags her through court which they lose, then they drag her through the appeals process which she didn't want any part of either.
From a UK perspective I'd always thought of it as a case of crazy pay-out. Why does this one women get several million dollars (although googling reveals this number went down a bit on appeal)? Especially if others had a similar experience. Either there should be a limit on the temperature of hot drinks, or there shouldn't.
The fact a warning is deemed adequate seems weird too, people will actively try and avoid spilling a stone cold cup of coffee on their lap!
It feels to me like the internet moved from shilling for big burger to shilling for big law firm.
I'm not sure that was the case at the time... specifically there being "paid shills" on the internet.
Concern / outrage over the legal system seems to be a bit of the human condition, I'm not convinced there was a conspiracy required to have folks retell an inaccurate story about that incident.
Sometimes it feels like anything that is perceived to be corporate friendly is called a "shill" as if individuals (mistaken or not) couldn't organically have X opinion.
Unfortunately, you often don't need to try particularly hard to get the media to repeat false claims.
Well, all of these changes (perhaps with the exception of industry standards) are IMHO irrelevant to responsibility of McDonald for the incident.
That lawsuit was frivolous. Coffee is hot. If you spill it, it might burn you.
As far as just asking for medical bills — that might have been true until her lawyers smelled a multi-million payday.
Lawyers like that are the reason we have warnings on hair dryers to not use while showering and warnings on coffee cups that warn of the hot beverage inside. Coffee is traditionally made using boiling or near boiling water — unless McDonalds super-heated the water, the temperature at which it was served was consistent with how coffee is normally served.
That it was an elderly lady makes no difference. That’s just emotional distraction and has no relevance. The McDonalds lawsuit ushered in the “nanny” era where people have to be warned against such hazards as “boating carries a risk of serious injury or drowning.” And product costs (including medical care) is dramatically more expensive than it should be because the trial lawyers had to all get paid. Punishment under statute is one thing, but unlimited punitive damages is absurd. We talk about CEOs getting paid to much — not even close to the payday trial lawyers get.
That corporate entity had decided it was cheaper to not fix it than to fix it, until a human being who they contributed to significantly harming brought the problem before a jury. And she was found partially responsible for her own injuries, a fact which you elide (while speaking so authoritatively that I must assume you know this to be true, otherwise you wouldn't, yes?), while the jury also found that McDonalds' had been reckless in their operation--that most of the money awarded was a punitive penalty assessed because that corporate entity was cavalier in their treatment of actual, real-not-fictive people.
While we're at it, the punitive award granted was $480,000, not "multi-million"--though the jury asked for it, as two days of McDonalds' coffee revenue, and was reduced by the judge.
You've either been had, or you're trying to do the having. I shall not speculate on which.
https://segarlaw.com/blog/myths-and-facts-of-the-mcdonalds-h...
Have a read and then come back here and lets hear you argue that the lawsuit wasn't warranted.
Companies do actually employ shills to go on forums and try to sway public opinion. They call them something like public advocates, doesn't change the idea though.
If you see these kind of behavior online, it's almost always people paid to explicitly monitor forums and "protect" a company image.
Either its employees, hired guns and or something...
--Upton Sinclair
So it’s not surprising that some BigTech employees are going to actively defend their employer’s values on forums.
The best way to understand modern tech company culture is to consider them all very successful cults.
Or maybe people have widely differing views on all kinds of subjects?
I've been called all kinds of things, which I definitely am not, so I'm inclined to think that people put far to much weight on the conspiracies.
I'm inclined to believe you, but sources please. Especially interested if you (or anyone) have anything on Google in this respect.
Full thread in a nicely readable format at https://www.thepoke.co.uk/2019/08/15/amazon-ambassadors-take...
[0] https://twitter.com/rulesObeyer/status/1161758672973811712
The book Merchants of Doubt highlights the practice across decades and industries.
Ralph Nader was subject to corporate smear tactics and surveillance in the 1970s.
The idea that companies would suddenly stop using these tactics the moment they become divinely powerful defies all reason.
Reddit's /r/shills and /r/HailCorporate highlight some modern instances.
It's not going to be entirely legitimate but there's going to be some eye opening items in there for you I suspect.
Dictatorships use Whataboutism to help cover stuff like this... https://www.reddit.com/r/pics/comments/cz75gj/hong_kong_poli...
When you're wrong, you shutting down discourse by effectively saying the other person isn't even a person. This gets us to far more extreme us-vs-them dynamics than otherwise possible.
This is the lazy and ignorant method of dismissing other people's arguments. Shill or not, what does it matter if what they state are facts?
First, please observe the principle of charity when posting.
> Shill or not, what does it matter if what they state are facts?
Because it is entirely possible to tell large lies using small facts.
Because propaganda and disinformation are actual, real things and are very difficult to combat once unleashed in the commons.
Because the "let the marketplace of ideas figure it out" excuse to not police propaganda and disinformation attacks is hopelessly naive at best, and deliberately ineffective at worst.
I'm John and I have views on privacy that are completely genuine and happen to align with what benefits the corporation(s) that my company, TotallyLegitimateComments LLC, contracts for. I believe advertisement is a force for good in the world and can bring together people and products that enrich their lives while creating value for shareholders! While I'd love to share what wonderful businesses my company works with, various privacy agreements prevent us from doing so. However, I can tell you that they all appreciate the fact that you find their views important! We will continue to lobby your congressmen on your behalf to ensure that these views are reflected in the nations laws! Thanks and remember, corporations are people like you and me!
Sincerely, John
That said, I don't think there are nearly as many shills as some people think nor do I think they are very effective.
If a company wants to present its views, they can do so via press releases or clearly mark their posts as such (or via verified accounts like on Twitter).
Paying someone else to share a very sanitized, market researched version of your opinion while pretending that they're organically sharing their own opinion isn't that. It's dishonest, and it's eroding honest conversations for the sake of advertising.
Personally I tend to think of most people on HN as privacy nuts. Honestly of all the problems in the world to get worked up over, online advertising is pretty low on my list. There's nothing I can do about Google/FB/whatever, so why even think about it.
If Google or whoever wants to pay me to keep posting, I'm listening.
Google's 2018 revenue was $136.22 billion. GDPR allows for a maximum fine of 4% of global turnover.
At a maximum 4%, GDPR could impose up to a $5.5 billion fine. I agree, getting something closer to the maximum might help the situation. Although ultimately, my bet is that Google is already baking the 4% revenue risk into their business model. If that's the case, GDPR's maximum penalty should be reconsidered.
The key to getting reasonable ads back is making the bad ads impossible for advertisers to buy.
I am not sure how viable such a company will be in the real world.
I invite any developer / blogger to check out https://CodeFund.io. We are a non-tracking 100% open source ethical ad platform that focuses on funding open source.
But it looks like you've been using HN primarily to do this. That crosses into spamming, so please don't.
These complaints filed by Brave, with their own employees posing as professional “victims” intentionally grasping at straws for evidence of privacy violations, smack of desperation. This is not the first claim they have filed, and sadly, it won’t be the last. Their claims thus far have been disingenuous at best, downright dishonest at worst.
GDPR was not meant as a weapon with which one could hobble their far more successful competitors. It’s sad to see that a company that claims to care so much about privacy is undermining GDPR by bringing the worst fears of those that opposed it to life.
I'm not sure that's true: uBlock Origin has twice as many installations as Brave does. You might say "oh, but that's just blocking ads!" But if you don't block ads, privacy problems are going to spring out of the woodwork like nobody's business. That is, they might not care about privacy by name, but they certainly care about it in effect.