Hacker News Reader

Doesn't this bear the risk for the businesses to violate the GDPR because they actively transmit data to a third party?

There are different responsibilities for the "controller" and the "processor" under GDPR.

Facebook and Google are recognized as processors in this situation. The websites that send them the data are the controllers and are subject to the vast majority of the regulation, while the processors can assume that the controller has obtained user consent until informed otherwise.

It's legally important to recognize that Facebook and Google are not blindly sucking up data from around the internet. Websites/apps are actively transmitting this data to them and other adtech platforms for their own benefits.

That's what I meant. Before the companies that used Facebook und Googles tracking have denied any responsibility because they just embeded the tracking scripts. So in their view any violation was Facebook's or Google's fault. But now they are the active part collecting the data and transmitting it intentionally to a third party.

Reply on news.ycombinator.com