Hacker News Reader

Comment by ErikAugust | Hacker News Reader

I see six entries. Where's Google, Facebook, etc?

Google and Facebook typically work by allowing advertisers to pick customer traits, and then Google/Facebook shows ads based on their knowledge of who fits those traits. It looks like the definition of sale[1] means companies must actually transfer the consumers info for them to count as a data broker. This means Google and Facebook likely don't have to register.

Their lobbyists did their jobs, I suppose.

[1] https://leginfo.legislature.ca.gov/faces/codes_displaySectio....

Google and Facebook don't sell user data. It's much more profitable to keep it for themselves than to sell it to others.

CCPA's definition of selling data is both expansive, and a little vague.

Google Ads (formerly AdWords) now has an API so that customers can disable possibly-sales-like features on a per-use basis if someone clicks "Do not sell my information." So, while Google doesn't sell users information, they're only willing to go to bat and say "this is definitely not a Sale Of Information under CCPA" for a subset of the services they offer.

https://privacy.google.com/businesses/rdp/

Facebook I dunno. My sense is they have a larger appetite for testing the boundaries of the law.

Yikes, this reminds me of the nebulousness of GDPR. I guess the intent much like GDPR is to write a law too vague to follow and then fine the crap out of companies.

I would say they're technically not data brokers because they collect data directly from an agreed upon relationship with a consumer, and they do not sell the data itself but rather productize it for advertisers.

> they collect data directly from an agreed upon relationship with a consumer

Facebook builds shadow profiles. Those involve no direct relationship with the surveilled.

But there's no evidence that the information they gather on non-users is shared with third parties, even in indirect ways like the ad-targeting information. (I don't necessarily reject the term "shadow profile", but it's important to remember that it's an activist term; there's no reason to expect that they have similar formats or uses to the non-shadow profiles.)

Even if that was true,

> they do not sell the data itself

Selling seems like an important part of brokering

Presumably they get the data for the shadow profiler from tracking scripts and stuff that run in your browser, so technically that’s a relationship you accepted when you ran their script and allowed it to phone home.

> I see six entries. Where's Google, Facebook, etc?

The deadline for registration looks like it's January 31st, hopefully after that date California will start going after those who do not comply.

It will be interesting tko see who registers and who doesn't.

Reply on news.ycombinator.com