Facebook to move UK users to California terms, avoiding EU privacy rules

EU citizen works in the UK for 2 years then goes to Turkey for a vacation but likes the place so much, decides to stay for longer when still remote working for the same London company.Also connects through VPN because the Turks love banning websites.

Where this person residence is? Are the UK, USA, EU or Turkish rules apply? How FB would know about it?

That’s not an extreme scenario BTW, it happens all the time.

Now there's the practical question of how the EU enforces that protection against companies that have no presence in the EU, but those that do, the EU has made it quite clear they'll take enforcement action.

For example, almost anywhere in the world if you want to open a bank account they will explicitly ask you now if you’re an american citizen.

An American tourist in Paris is protected by the GDPR.

Of course the EU will have trouble enforcing that protection against companies that don't operate in the EU. But the protection remains, even if it's practically unenforceable.

That is not correct. Specifically, the counterexample is if you are a EU citizen living in an EU country and the actual bits are stored in a datacenter in Texas. GDPR still applies in this case, as long as the website owner accepts EU users. If the website specifically doesn't do business in the EU, things are different.

Also one that didn't just talk about cookies. What if I enable tracking code in my mobile app? That's not cookie-driven.

Some companies want to use the web to try to change users behaviour, and many users want those companies to change their behaviour. That’s not a solvable problem, it’s a circular reference bug.

So maybe better tools might actually make it worse, in a race to the bottom sort of situation.

My main concern is that the consent forms, however well meaning they might be, are creating a horrible environment. There are lots of perverse incentives for people to ruin the web experience. Some players stand to gain a lot from a horrible web environment. For example ones that have competing information products.

I’m increasingly thinking it would be better to just not have consent forms, and with better browser tools, people would hopefully go to websites that treated them well.

That would not have been used.

The whole reason why all the consent forms are constantly violating the GDPR is because companies want to make it as hard as possible to say no.

They'd only accept the browser API if the "No to all" button (which by law has to be default, has to be the option chosen if you click anything except yes, and has to be easier to use than "Yes to all") was hidden behind 3 layers of "are you sure", each of which having a 30 second timer before you could continue.

That's the whole reason this consent form disaster exists: because companies are trying to do everything they can go get around the laws.

Just look at the Do Not Track header: it's a legally meaningful statement that companies should follow. They don't.

The EU basically looked at that situation with a competitive browser market, extensions, the existence of the same feature in the past and said, "screw all that, the Commission knows best". Which is exactly the attitude that drove people to vote leave in the first place.

EU rules look great, until one of the nations decide to sh*t on it, see Hungary (I'm a Hungarian citizen, but not really proud of it any more) vs EU recently on budgeting, or Ireland being unwilling to actually enforce any EU regulations.

This could be more of a strategic move from Facebook, anticipating the UK government wanting a quick post-Brexit trade deal with the US and having limited practical room to manoeuvre in negotiating one. In particular, the UK government presumably doesn't want to commit political suicide, so it's very unlikely to compromise on issues like the NHS or food standards. That means it needs something else, and probably something big, that it can bring to the table. And that could well be favours for US tech firms that are already here, such as agreeing not to go after them for extra taxes and brushing anything resembling privacy protections under the carpet.

Whether that is a good bet for Facebook to make is a different question. If the Johnson administration doesn't manage to seal a deal very quickly -- and it does have a few other things on its plate right now, not to mention a known-hostile incoming Biden administration across the pond -- then there is a decent chance that any future US-UK trade deal will actually be concluded a few years later. By that time, our respective governments might well be led by Kamala Harris and Keir Starmer, for example, in which case Big Tech might have much bigger worries anyway.

But since no-one has a crystal ball, presumably those tech firms are going to try to insulate themselves from unnecessary risk in the fallout from Brexit, and this move by Facebook probably achieves that at a reasonable cost right now, regardless of what might happen some years later.

Case in point: Uber suggesting minimum wage for their workers, some time ago. Think about this, the company refuses to recognize them as their work force but are fine to suggest a minimum wage. As it happens, the minimum wage would put their competition out of business at that time so it must have been seen as favorable for Uber. The competition was not so well funded and so this would be an attrition war at a point in time when Uber was potentially able to win it and wipe all competition out.

This shows that you don't even need corrupt bureaucrats to have regulation steered this or that way by private business.

Regulatory capture is utterly rampant right now and a huge threat to democracy. This is true regardless of one's personal politics or beliefs about big vs small government or political party of preference. It's a cancer and more dangerous than people think.

Without laws, the people/groups you mention would just use the law of the jungle - might makes right - to get what they want. At least with laws they have to somewhat accommodate this process to get what they want, frequently compromising along the way.

I'm not saying that all laws are perfect, but let's not get overwhelming cynicism get the best of us.

It's our work, as a society, to be watchful and try that the game is one that everybody have a chance to enjoy.

You can't do that without rules, in fact you can't have a game without rules. Even private property is just a rule.

2. Of course they further political aims. Anything that has to do with law is political, by definition. This statement makes regulations sound scary and sinister, but actually imparts no information to the discussion.

A world without regulations won't be some libertarian paradise. It'll be an authoritarian dystopia, where the powerful can do what they please, and you will have zero proactive recourse against them, and very limited reactive recourse.

PS. Consider that a rule, or even aversion against regulation is itself a regulation. Which absolutely has side effects[1] that protect powerful businesses, and is pursued for personal and political aims.

[1] Very obvious ones, actually.

(Not that any of this matters much these days - companies like Uber demonstrate that you can absolutely run an illegal operation in western countries, and end up with a double-digit billion dollars IPO.)

In the UK we do have very well established "Consumer Law" which is there explicitly to protect the consumer and recognises that they are often not otherwise in a powerful position.

The most relevant stuff for Facebook is the data protection stuff, but another example, relevant to other online transactions, is the Distance Selling Regulations ( https://www.gov.uk/online-and-distance-selling-for-businesse... ). This gives the customer the right to cancel, without a reason, for up to 14 days after the goods are delivered. If the business doesn't explicitly tell you this then your right to cancel is extended to 12 months.

So, when regulations do not work for your advantage as a normal citizen, maybe the problem is not the existence of regulation but the lack of democratic representation and integrity in your government and the bodies it creates and controls.

The entire US constitution only applied to the US Federal Government, until the 14th amendment expanded it to state governments and all publicly chartered entities and all entities that accept direct material support from publicly chartered entities which is only noticeable when they interact with the people.

So that would have been over 100 years ago so you might think the point is moot. The reality is that the point is not resolved, never will be completely resolved, and has had less time to be resolved than people may notice.

Protecting those rights for the entire world is a bit out-of-scope.

Not sure I would go this far, but I do agree with this

> The ICO can fine, but almost certainly won't

But only because one the U.K. leaves the EU, the ICO will struggle to actually enforce its fines when all of the companies involved are notional operating in the EU with little direct presence in the U.K.

GDPR is fully incorporated into British law so can you clarify what you mean by this? Do you mean that the EU regulator has more teeth than its UK equivalent? Both seem to be equally useless in fact.

Something I've seen in lots of UK law derived from EU directives is that it applies limits to behaviour specifically happening in the EU. So UK privacy law might provide a whole load of protections to EU citizens, but not specifically to UK citizens, because EU citizens would be a superset including UK citizen. Except, as of 1st Jan 2021, that won't be true any more.

The UK's position is strange because of Brexit, but it seems the practical position of all recent governments has been that existing EU laws should be transposed into UK national laws where necessary and with the required changes to make sense, until such time as our national authorities might decide to deviate from them. Primary legislation has already been made to that effect. The big question is what "that effect" actually is, given the huge volume of legislation affected and the potential ambiguity in what changes are required for any given law of EU origin to continue to make sense in a post-Brexit UK.

I suspect this is because the UK has a data sharing agreement with the US, but when Brexit kicks in there is not a legal mechanism in place for easy transfer of data from the EU to the UK (which makes your life hard if you're a company based in Ireland and you need to send data to the UK.)

Are there limitations with using products/doing business outside the UK, from within the UK? As in, is there any authority that they could use to stop people from, willingly(?), using a foreign internet service? It seems that would require some pretty draconian internet policies.

Or maybe even just XOR it with a random key, put the result in the UK and put the key in the US. That way neither US nor UK has "personal data" -- independently each country just got a pile of white noise -- but the two countries together do have it, and they wouldn't be able to say who "really" has it.

That may be true, but few people ask the follow up question “why do people expect things to be free?”

The answer is usually because companies like Google had pulled a bait-and-switch of sorts where they offered a service for free long before they made a commercial business of people’s profiles. They set this expectation of free themselves.

And you can’t really blame a consumer for wanting to bag a bargain.

I take it by saying 'Firefox's Backend' you're talking about Gecko, and with Chromium, Blink (fork of Webkit).

They’re just browser engines. What's the difference in terms of privacy? Nothing. They just render web pages.

No way they’d have two engines switchable, would make it a headache for developers and testers.

I do not see this is the case in general. People do not expect that.

Every social network that has gained any significant popularity (>100M users) is built on a closed system. Email is the only open protocol system that is relevant to bring up, and its flaws and shortcomings are well documented. Most enterprises use a closed system on top of email (Office 365 or G suite primarily) and communication is migrating to entirely closed systems (Slack or Teams).

Closed systems offer huge advantages for innovation, providing excellent user experience and strong privacy controls. As such, closed systems will continue to be the dominant paradigm.

I spoke about the technical considerations several years ago at the W3C annual conference: https://www.slideshare.net/StuC/ill-see-you-on-the-write-sid...

Globalization has some problems. The benefits so far have massively outweighed them, especially if you take the long view. How about we try to fix those faults, instead of retreating and isolating?

Here's something I've always wondered: I don't really get this obsession with maximizing the number of people who go to one's web page. If you're just a regular person who's not profiting from ads or something, it shouldn't matter.

If I post something to the internet, I maybe send it to a few people who might want to see it and that's it. I don't care about collecting pageviews, or likes, or follows, or upvotes, or any of these vanity metrics. It doesn't really matter to me if something I wrote was viewed by 10 people, 1000 people, or 100,000 people. Who cares? What difference does it make? My life is not richer because thousands of random people read some blog post or forum comment.

The only reason I can see to promote some creative work is if you're making a profit off of it. In that case, it's an investment. Spend $X on discovery and make $Y in revenue from ads or conversions or whatever. But just to put up some web site about your stamp collection? Who cares how many people visit?

Comments.

Comments are the final frontier. Why do you think I never bother getting a personal blog website off the ground? Because the traffic it gets pales in comparison to the audience I get from writing comments. This comment for instance might be seen by several hundred people, all within my target demographic. How many people might see my longform blog content? Maybe dozens if I'm lucky. I've never really written a meaningful blog post, but I've probably written a novel's worth of comments.

And because comments aren't really written for monetary gains, they are one of purest forms of writing left on the internet today. People still write comments liberally and openly, speaking their mind and even voicing unpopular opinions, because they don't give a shit about what Google thinks. Google doesn't read comments. Say the quiet parts loudly.

Maybe someday there will be an age where you can be certain almost every comment you read is already bought and paid for by some corporate interest or a guerrilla advertiser, but fortunately we are still not there yet.

And if you stop paying Facebook will severely limit any organic traffic to your page. That should be illegal, unfortunately it is not being viewed as something serious, meanwhile Facebook gets showered with billions extracted out of small businesses.

Has nothing to do with technical limitations and everything with engagement metrics. Facebook does not want to show you what you want to see, they want to show you what will hook you and keep you in the platform. If anything, it takes more resources to show their view than just a time posted order.

I don’t believe that is what the platform is doing. It is displaying content the user will most likely interact with, resulting in the user staying on the platform longer. It seems quite dangerous to me, as it could cause users to assign some sort of weight to the content, particularly if the content is well liked by others it could lead to the belief that ‘this is the correct information’.

On the other hand it can be too easy for too many people to be seen: spam.

Which makes you wish for more curated and controlled platforms.

And that’s why we have moderators and upvotes and downvotes.

Do you think it was easier in the age before the internet to be gain an audience?

I would quite like my data to stay in the UK, where national governments I don't elect or pay taxes to, can't touch it.

I believe strongly that the social media and internet ad business models are at best amoral but responsible for the second order effects, much as coal plants are responsible for pollution. At worst they are making money off of making people crazy by giving every crazy person a megaphone and making sure you have to hear from them.

I think in the future there will definitely be regional internets so to speak. You will still be able to talk to people via the boring protocols, like email for instance. But a lot of people are seeing the enormous value in controlling higher level access. News, social media, etc etc.

Have you been watching the last four years?

Now that the UK is leaving Europe, they can either choose to stay there (which they are not doing), or move somewhere else (to California).