Hacker News Reader

Comment by lacker | Hacker News Reader

This law frequently refers to "selling consumers' personal information". But hardly any company actually sells personal information. Google doesn't sell your personal information, Facebook doesn't sell your personal information. Companies use your personal information to match you to advertising, not to sell the information directly. So laws forbidding the sale of personal information sort of pointless.

At first I thought that this PDF was just describing the proposed law in an inaccurate manner. But no, the CCPA really does talk a lot about "selling your personal information". https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-p...

View on HN

This point is incorrect. There are unfortunately many companies that sell consumers' information directly [1][2]. I understand people have hatred for big companies collecting advertising related information. Nevertheless, it's misguided to pretend the industry of directly collecting and selling private information doesn't exist. Your ISPs can and do collect much worse data about us. The potential damage is much worse. I'm more worry about the lack of oversight on that industry.

[1] https://arstechnica.com/tech-policy/2019/01/t-mobile-sprint-... [2] https://www.forbes.com/sites/metabrown/2015/09/30/when-and-w...

This is a great point that often gets glossed over in these discussions. Facebook and Google primarily get value from your personal information by hoarding it and treating both it and the data they derive from it as proprietary.

The last time I used Google Takeout to download my data I got all my emails, custom maps, YouTube uploads etc., as one might expect, but what I couldn’t find were:

* all the URLs I’ve visited with my Google cookie loaded

* all the searches I’ve ever done

* all the ads I’ve clicked on.

I know ad tech mechanics can be counter intuitive but I’m surprised they don’t have that information for me to download, especially when ads and search are the primary Google functions.

Maybe these logs are pseudonymized in such a way that google can’t tie them to my identity?

They're technically not linked to your Google account I believe, https://policies.google.com/technologies/anonymization?hl=en (although we've seen how anonymized data can still be de-anonymized https://news.ycombinator.com/item?id=20513521 )

Correct google keeps two separate cookies one for ads and one for everything else. This was part of the agreement with the FTC when they bought Double Click. They are prohibited from joining those two cookies by that agreement.

Thanks, that’s useful and interesting. Good on Google for keeping the two activities (and cookies) separate.

[Edit: oof, I found my search history after all so most of this is moot. It’s under “Other Google Activity” ... “Web & App Activity”. I guess it would be nice to see the words “Search Activity” a little more prominently, but still, my bad.]

I can’t help but feeling that both cookies (and their associated histories) count equally as personal data.

Anyone who gets hold of my devices can use the cookies to get my history. I can use the cookies to get some of my history in some form or other (I can’t get my own search history, but I can see it partially in typeaheads on the desktop site.)

It feels half hearted that I can’t pull up the entire dataset, but then I would surely be grateful that no one else can do the same thing if they steal my login.

(I also accept that some of this is just me arrogantly pushing back on being told “no!” by Auntie Google, when I feel entitled to a yes.)

CCPA states that data is valuable and specifically calls out trading for "other valuable consideration" as part of selling.

Therefore (in my read) if your business is "giving away" data, it would inherently be for "other valuable consideration".

Especially since the law calls out 4 cases where sharing data is NOT a sale or valuable consideration: 1) When a consumer is sharing data with your business so that you can help them interact with a 3rd party business 2) Your business is sharing data to tell 3rd parties a consumer now wants to opt-out 3) Your business transfers data to a 3rd party to get a service from a service provider (and the data stops there, it can't be sold on) 4) Your business is acquired

Edit: typo, confusing sentence

IIRC google et al never share your data with third parties. Instead, they use it to target ads from third parties.

This is a critical point, but the definition of “sell” is fairly broad:

“ “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.”

So targeting ads based on personal information that you've collected is still OK, as long as you don't share the data?

It appears so.

There is a possible argument that selling an ad that will use PII to target consumers to a 3rd party advertiser constitutes a “sale” however.

The cynical side in me is now saying “of course! California’s government is not gonna shit where they eat.”

We should not ever expect the government of the place where Google and Facebook are headquartered to do anything meaningful to protect privacy. To do so would destroy the business model of these companies. Why would they ever want to do that?

and what does GDPR say?

IIRC, it refers primarily to collecting and processing consumer information.

Reply on news.ycombinator.com