GDPR will pop the adtech bubble(blogs.harvard.edu)
blogs.harvard.edu
GDPR will pop the adtech bubble
http://blogs.harvard.edu/doc/2018/05/12/gdpr/
453 comments
> By and large, it doesn't, very well.
I know Twitter isn't known for being the best at advertising, but it was made exceptionally clear to me that online advertising is a massive bunch of lies when I did my GDPR Twitter data export and it included me in a bunch of incorrect, non-sensical and contradictory ad targeting groups.
Twitter claims I:
I know Twitter isn't known for being the best at advertising, but it was made exceptionally clear to me that online advertising is a massive bunch of lies when I did my GDPR Twitter data export and it included me in a bunch of incorrect, non-sensical and contradictory ad targeting groups.
Twitter claims I:
* Own a cat, dog and other animal (I don't)
* Have between $100k- $999k liquid investible assets (I don't)
* Have a net worth between $1 and $1m (cool - I own *something*)
* Am highly affluent (/shrug)
* Am a high spender (okay...)
* Am a frugal spender (...but how can I be both a high spender AND frugal)
* Own a house (I don't)
* Have multiple families (I don't)
> GDPR Twitter data export and it included me in a bunch of incorrect, non-sensical and contradictory ad targeting groups.
This is expected. It's not desirable, but it is expected.
The problem is your comparing it to an absolute. I.e. to perfect.
If advertisers had that choice, they would love it. They generally don't. Remarketing is kinda close, but limits the scale.
Rather, the only other scalable options are far worse. Think about it. What are the marketers other choices?
The one that should come to mind, and the one they spend most of their money: TV.
With TV you pick up a huge amount of waste. Say you buy a spot on Big Bang because you want people thinking of buying a new iPhone. Not a big stretch, right? At the same time thinking of all the other people they have to buy, who watch the ad, and aren't buying an iPhone. It's waste.
And that waste is huge relative to what you're talking about above.
So you're asking the wrong question here. It's not how good is the targeting in terms of precision/recall. The question is what's better?
The waste here is generally known & its priced accordingly.
> I was very disappointed that the Google and Facebook data exports don't contain this data.
It's in my Facebook export. Under "Information About You" did you uncheck "Ads"?
That's where the information is contained & it's checked by default.
You can also view it here for both FB & Google, as well as opt of both:
https://adssettings.google.com/authenticated?hl=en
https://www.facebook.com/about/basics/advertising
This is expected. It's not desirable, but it is expected.
The problem is your comparing it to an absolute. I.e. to perfect.
If advertisers had that choice, they would love it. They generally don't. Remarketing is kinda close, but limits the scale.
Rather, the only other scalable options are far worse. Think about it. What are the marketers other choices?
The one that should come to mind, and the one they spend most of their money: TV.
With TV you pick up a huge amount of waste. Say you buy a spot on Big Bang because you want people thinking of buying a new iPhone. Not a big stretch, right? At the same time thinking of all the other people they have to buy, who watch the ad, and aren't buying an iPhone. It's waste.
And that waste is huge relative to what you're talking about above.
So you're asking the wrong question here. It's not how good is the targeting in terms of precision/recall. The question is what's better?
The waste here is generally known & its priced accordingly.
> I was very disappointed that the Google and Facebook data exports don't contain this data.
It's in my Facebook export. Under "Information About You" did you uncheck "Ads"?
That's where the information is contained & it's checked by default.
You can also view it here for both FB & Google, as well as opt of both:
https://adssettings.google.com/authenticated?hl=en
https://www.facebook.com/about/basics/advertising
> Rather, the only other scalable options are far worse.
Is it really worse than "this article is about X, Y is related, let's show some ads for Y"?
I bet from the point of view of the advertisement middlemen it is not. Because they capitalize mostly on showing ads of products that people already decided to buy or are very near deciding. But that is yet another racquet that only decreases the value of the industry. My question is, from the point of view of the real advertisers (the ones selling something), is it really worse?
Is it really worse than "this article is about X, Y is related, let's show some ads for Y"?
I bet from the point of view of the advertisement middlemen it is not. Because they capitalize mostly on showing ads of products that people already decided to buy or are very near deciding. But that is yet another racquet that only decreases the value of the industry. My question is, from the point of view of the real advertisers (the ones selling something), is it really worse?
Right but the advertising budgets for things actually related to articles or other media content are vastly dwarfed by the advertising budgets for unrelated things that actually make more revenue/profit.
So you'll end up having to try to monetize something that has little no no related things that are profitable to advertise.
So you'll end up having to try to monetize something that has little no no related things that are profitable to advertise.
> What are the marketers other choices?
Advertise on a tech site, 80+% will be interested in tech.
Advertise on a dog community site is probably pretty spot on if you want to target dog owners...
Far better than what, 5% ? This isn't rocket science, we sold everyones integrity for pennies.
> who watch the ad, and aren't buying an iPhone. It's waste.
No, advertisements like that are more about selling the brand than selling iphones. Something TV is probably pretty good for.
Advertise on a tech site, 80+% will be interested in tech.
Advertise on a dog community site is probably pretty spot on if you want to target dog owners...
Far better than what, 5% ? This isn't rocket science, we sold everyones integrity for pennies.
> who watch the ad, and aren't buying an iPhone. It's waste.
No, advertisements like that are more about selling the brand than selling iphones. Something TV is probably pretty good for.
> Advertise on a dog community site is probably pretty spot on if you want to target dog owners...
That would probably target dog enthusiasts or dog hobbyists or dog fanatics, which are all subsets of dog owners.
I think that one of the things that makes social media ad targeting so attractive to advertisers is that they can target the dog owners, instead of just the enthusiasts/hobbyists/fanatics.
That would probably target dog enthusiasts or dog hobbyists or dog fanatics, which are all subsets of dog owners.
I think that one of the things that makes social media ad targeting so attractive to advertisers is that they can target the dog owners, instead of just the enthusiasts/hobbyists/fanatics.
> Advertise on a dog community site is probably pretty spot on if you want to target dog owners...
Big brands struggle with UGC. Witness the events of YouTube & brand safety.
But even without that, what you're saying just isn't scalable. What community site can reach even 50% of dog owners -- let alone what a primtetime sitcom or YouTube can reach?
> No, advertisements like that are more about selling the brand than selling iphones. Something TV is probably pretty good for.
What? Sure, they have campaigns running for awareness, recall, perception.
But you're really saying Apple doesn't dramatically increase its spend when a new phone is released? That's poppycock.
Big brands struggle with UGC. Witness the events of YouTube & brand safety.
But even without that, what you're saying just isn't scalable. What community site can reach even 50% of dog owners -- let alone what a primtetime sitcom or YouTube can reach?
> No, advertisements like that are more about selling the brand than selling iphones. Something TV is probably pretty good for.
What? Sure, they have campaigns running for awareness, recall, perception.
But you're really saying Apple doesn't dramatically increase its spend when a new phone is released? That's poppycock.
Only google et al cares about scalability, everyone else cares about results. Only google needs to sell ads without any knowledge about the product or audience, this scales extremely well but leads to poor results.
> But you're really saying Apple doesn't dramatically increase its spend when a new phone is released? That's poppycock.
When is the best time to sell the brand? When your flagship is a year old and still costs as much as on launch day and when the competition has surpassed you? Hardly.
> But you're really saying Apple doesn't dramatically increase its spend when a new phone is released? That's poppycock.
When is the best time to sell the brand? When your flagship is a year old and still costs as much as on launch day and when the competition has surpassed you? Hardly.
People that has enough interest to use a dog-forum has too much knowledge of quality to buy things that a company advertises. They will know already what works for their dog and does not listen to advertising in the normal sense. They might however listen to bloggers that has been payed to talk about brands.
If you buy ads, you want them displayed to the non-fanatics that is not influenced by experience and vulnerable to brand exposure.
If you buy ads, you want them displayed to the non-fanatics that is not influenced by experience and vulnerable to brand exposure.
As long as the algorithms are close to or better than this model why would they bother? One is all automated and the other is a lot of work dealing with individual websites (even if it is just a matter of manual targeting settings)
I'd say they are much much worse, but they are scalable and cheaper so that kind of makes up for it.
But the only one who cares is the middleman. They are the only ones that benefit from the scale.
But the only one who cares is the middleman. They are the only ones that benefit from the scale.
> Advertise on a dog community site is probably pretty spot on if you want to target dog owners...
Give me a list of dog community site to target 1 millions dog owners.
Now tell me how expensive it would be to show ads on theses websites.
Plenty of dog owners are on Facebook, much easier to target 1 millions dog owner there instead.
Did I forget to mentions that it's for a dog shop in Montreal? Good luck!
Give me a list of dog community site to target 1 millions dog owners.
Now tell me how expensive it would be to show ads on theses websites.
Plenty of dog owners are on Facebook, much easier to target 1 millions dog owner there instead.
Did I forget to mentions that it's for a dog shop in Montreal? Good luck!
Looking at the hundreds of mostly incorrect or irrelevant demographics that Twitter has be in, I would still say there’s a huge amount of waste going on. At least with offline advertising (like TV or print) the “fuzziness” is very explicit. Here, Twitter sells you that you can target “dog owners”, but nowhere through the Twitter ad buy process does it tell you how BS that targeting is.
And that's why Twitter is not doing as well as Facebook. Facebook doesn't need algorithms to know what you are interested in, where you like to eat, etc. You explicitly tell them in your info and by what types of articles you like and share, and what you post.
Well I’ve told Twitter that I hate Blockchain and think it’s all BS, yet I still get ads for ICOs and “Uber for the blockchain” - whatever the fuck that is.
Again, I guess this is because Twitter sucks at advertising.
Again, I guess this is because Twitter sucks at advertising.
Twitter is the same, except even more-so. People tweet 10+ times a day, update FB status infrequently.
All the things FB has done to extract things like resturant data etc are product development they undertook. Twitter spent 10 years moving form 140 characters to 280 instead.
All the things FB has done to extract things like resturant data etc are product development they undertook. Twitter spent 10 years moving form 140 characters to 280 instead.
Even if that is true, when people sign up for Facebook, they fill out a bio telling FB their work history, their school affiliations, who their family members are, their hometowns and current cities, they check in where they are at, tell FB their favorite books, music, tv shows, thier gender, relationship status, thier sexual preference, and thier political party affiliation. Everyone doesn't fill out everything, but a lot of people do.
That's exactly my point.
There is no reason why Twitter couldn't have done the same 5 years ago. And no reason that they can't do it now.
(Also people are just as likely to follow and talk about things like tv shows and music and politics on Twitter as FB)
There is no reason why Twitter couldn't have done the same 5 years ago. And no reason that they can't do it now.
(Also people are just as likely to follow and talk about things like tv shows and music and politics on Twitter as FB)
Plus the fact that they can also average your interests from information volunteered by your friends and family because "birds of a feather, flock together".
IOW, Twitter followers may be total strangers to many IRL, unlike Facebook followers.
IOW, Twitter followers may be total strangers to many IRL, unlike Facebook followers.
Traditionally, it wasn't necessarily considered a waste to give people a positive feeling about your brand even if they weren't the specific ones who wanted to buy, because everybody talks to everyone else.
I think advertisers have been chasing a chimera via targeting, because not only doesn't it work well, but there is a trade-off to maintaining a brand.
I think advertisers have been chasing a chimera via targeting, because not only doesn't it work well, but there is a trade-off to maintaining a brand.
I’ll tell you one thing that’d be better: prices and wages that make sense. I shouldn’t be faced with dozens of subscriptions just to lead basically the same life I did over a decade ago with half those subscriptions (or fewer). And being paid 5x what I made then shouldn’t feel like I’m making it work but not saving much. And I shouldn’t be getting sales calls over 4 months after having used TrueCar.
For the frugal/high spender conflict, I can kind of see how that might happen.
I try to buy quality goods because cheap stuff doesn't last. That means spending more up front to spend less in the long run. So frugal, but also maybe high spender?
My mom always says: if you're poor, you can't afford to buy cheap.
I try to buy quality goods because cheap stuff doesn't last. That means spending more up front to spend less in the long run. So frugal, but also maybe high spender?
My mom always says: if you're poor, you can't afford to buy cheap.
All things equal (features that I need from the product) I like to buy high quality things because they make me feel good (they look well built, they give me this warm feeling inside that I got my money's worth). But I realize this is all emotional and rationally I shouldn't, in most cases.
I don't think they pay off long term, at least it seems heavily dependent on the product type. That's because we are playing a lottery game, even if this product breaks in 0.1% cases vs 5% cases for a much cheaper product, we're not buying large numbers of them, we're buying just one and while the probability to break on me is smaller it can still happen and the monetary loss would be much larger than if I were to buy the cheaper product. That is, the warranty doesn't scale with the price (the expensive top quality TV is $2000 and the cheaper one is $500 and both have 1 year of warranty), for the same money I can buy 4 of those $500 TVs and would last at least 4 years (but very likely to find at least one that will work much longer, since I'm buying up to 4 of them).
I don't think they pay off long term, at least it seems heavily dependent on the product type. That's because we are playing a lottery game, even if this product breaks in 0.1% cases vs 5% cases for a much cheaper product, we're not buying large numbers of them, we're buying just one and while the probability to break on me is smaller it can still happen and the monetary loss would be much larger than if I were to buy the cheaper product. That is, the warranty doesn't scale with the price (the expensive top quality TV is $2000 and the cheaper one is $500 and both have 1 year of warranty), for the same money I can buy 4 of those $500 TVs and would last at least 4 years (but very likely to find at least one that will work much longer, since I'm buying up to 4 of them).
That almost never works for the reason you describe. For any quality item that lasts M times as long as the cheap item, you can almost always find N > M such that you can buy N copies of the cheap item for the price of one quality item. You do not spend less in the long run, though you can convince yourself of that. The primary effect of buying cheap is not financial, it's that you're dealing with less quality over the entire usage lifetime (hence getting less utility out of it) and the replacement effort has cost (but which for poor people is very little by definition).
It is probably because they have to show you the categories/tags but they are not required to show you the exact percentage/probability. So in their db they have it like 80% frugal spender, 15% high spender but when exported you see it as a yes/no which is confusing.
I guess the 'spoiler' is that I'm fortunate enough to certainly not be a frugal spender. Yet another data point they have about me that they sell, but is completely incorrect.
I think this might be it eg spending $250 instead of $50 on shoes or boots for longer life and improved comfort.
$250 shoes do not last 5 times as long as $50 shoes. Improved comfort is the main benefit.
The math can work out in some cases. I've had my 400$ Allen Edmunds for 8 years, some wear, but generally still in fantastic shape and very comfortable. Prior to getting them I bought 1-3 pairs of ~70$ department store shoes per year.
Usually it's very anecdotal and hard to tell ahead of time. My current shoes cost 40€ and that was about 4 years ago. So they have lasted atleast half as long as your expensive shows for 1/10th the price.
I have some inexpensive Chinese-made boots that are over a decade old, I think. It can't be the norm that shoes last 4 months, unless you are talking about wearing down the soles of running shoes.
easier to repair also
Have they got the following mostly right:
* Your age bracket;
* The fact that your net worth is positive (not deep in debt);
* Whether you live in a city / suburb / countryside;
* Which part of country is that;
* Your gender;
* Your race / ethnicity, broadly?
I don't know about the person in question, but in order:
* Yes, but the age bracket for me is _very_ wide (it says "alive and not in need of new knees yet probably", but not much more)
* They didn't have this info
* This was wrong
* No, they didn't have this (although the country itself was correct)
* Wrong
* They did not have this
* Yes, but the age bracket for me is _very_ wide (it says "alive and not in need of new knees yet probably", but not much more)
* They didn't have this info
* This was wrong
* No, they didn't have this (although the country itself was correct)
* Wrong
* They did not have this
He just doesn't want to admit on HN that he has a cat.
Yep agreed. As a salesperson, knowing someone went to college is often more helpful than knowing what exact college someone went to - too personalized is just creepy. I think the trick is somewhere around the space being able to accurately engage someone with of "hey you look like the sort of person who might be interested in xyz".
Yeah, my impression is that this whole "smart, targeted ads" thing is actually just a lie, and that it's really more of a "spray and pray" kind of thing.
It's a bubble!
It's a bubble!
But everyone using this spray and pray knows it is far from perfect. You just use the best you can get and knows about the imperfections. Spray and pray also works in a broad sense.
I had very similar experience with Facebook when tried to check my profile.
Out of 20 interests only 4 were correct
I think it is an intentional stretching the interests way to far to look better for advertisers.
In more details: https://levashov.biz/can-trust-facebook-audience-interests/
I think it is an intentional stretching the interests way to far to look better for advertisers.
In more details: https://levashov.biz/can-trust-facebook-audience-interests/
The idea of advertising is also to create interest where there is none. If you all of a sudden see an ad about those other topics your aren't super interested yet, maybe you will become. That's the idea of manipulation and marketing.
That's the kind of advertisement TV is selling, not what social media are claiming to sell.
For Google, something similar can be found under My account -> Personal info & privacy -> Ads settings.
Most of the topics Google thinks I'm interested in are close enough. But American football and Parenting? I don't know where they got those. I have to consciously think to come up with the name of the local team ("Mariners? No, that's baseball."), and we don't have kids nor any plans to do so.
Maybe it was all the clicking on CafeMom.com (mommy blog with tons of trackers and ads) while I was testing the Pi-Hole set up. :-)
Maybe it was all the clicking on CafeMom.com (mommy blog with tons of trackers and ads) while I was testing the Pi-Hole set up. :-)
Would like to see my own. How do you do that?
> I was very disappointed that the Google and Facebook data exports don't contain this data.
Facebook has it available, if not in their Download Your Information tool. Go to Settings -> Ads -> Your Information -> Categories.
Facebook has it available, if not in their Download Your Information tool. Go to Settings -> Ads -> Your Information -> Categories.
Mine says "You do not have any behaviors in your ad" preferences. https://i.imgur.com/giAxfiF.png
But interesting page. Looking at the "advertisers who have added your details to their targeting list" it again shows how bullshit this industry is:
But interesting page. Looking at the "advertisers who have added your details to their targeting list" it again shows how bullshit this industry is:
* Playstation in 19 countries
* Musicians which I definitely don't listen to, like Keith Urban, Post Malone, Jack White, YBN Nahmir, and Ziggy Marley, whoever these people are.
* Pages like "Top Kickstarter Watches" and "Top Kickstarter Inventions"
* A bunch of restaurants that I've never been to, but are in the same complex that I used to live in (thanks whoever sold/'shared' my email, literally probably my former real estate agent)Last time I checked mine, it was pretty accurate, but I have a lot of the "PlayStation in <random country>" too!
I also see a lot of PlayStation related ads on my news feed... I haven't used a PlayStation since I got an Xbox one!
I also see a lot of PlayStation related ads on my news feed... I haven't used a PlayStation since I got an Xbox one!
[deleted]
One can see it a bit like search where it can be more important to do fast exclude than to have correct include. Those 8 ad targeting groups are potential matches, but what the data do not say is the hundreds of targeting groups which twitter claim that you are not. This kind of fast classification is good as a performance/cost saving technique when the error cost is also low.
Also, one can be high spender and frugal. A person who buy one pair of very expensive shoes and wear them for 10 years rather than buying 10 pairs of inexpensive ones would be such person.
Also, one can be high spender and frugal. A person who buy one pair of very expensive shoes and wear them for 10 years rather than buying 10 pairs of inexpensive ones would be such person.
> Facebook data exports don't contain this data
Facebook does have demographics and targeting data. Go to Setting -> Ads -> Your Information -> Your Categories. I haven't found a way to export it.
On the categorization side, Facebook does a half decent job considering I don't upload anything on FB or any other sister sites.
Twitter on the other hand might be running algorithm which tries to extrapolate too much from the available data.
Facebook does have demographics and targeting data. Go to Setting -> Ads -> Your Information -> Your Categories. I haven't found a way to export it.
On the categorization side, Facebook does a half decent job considering I don't upload anything on FB or any other sister sites.
Twitter on the other hand might be running algorithm which tries to extrapolate too much from the available data.
I've never looked at the Google export, but you can see what topics they think you are interested in here: https://adssettings.google.com/authenticated?hl=en
Twitter is just entirely incompetent at everything, so no surprise they get their advertising product wrong too.
Twitter is just entirely incompetent at everything, so no surprise they get their advertising product wrong too.
Those are just arbitrary names given to clusters of users. If your behavior and responsiveness is similar to others in the group, why should the advertiser care if the label isn't literally true?
That's not a failure of advertising. That's a failure of technology.
The fact that you choose to purchase certain items over other equally suitable items is largely because of advertising.
The fact that you choose to purchase certain items over other equally suitable items is largely because of advertising.
How much do you use twitter?
By and large, it doesn't, very well.
If that's true, it's not because ad tech doesn't work, it's that most advertisers don't use it properly. A large percentage of my company's revenue comes from performance marketing (running paid traffic to affiliate offers) and it works very well for us. You just have to know what you're doing, make sure you're not getting too much bot/junk traffic, and bid the appropriate amounts. We've written software that handles all of this automatically, and our paid traffic campaigns do amazingly well. Show me another investment in which you can reliably and consistently achieve 30%+ ROI weekly with a fair amount of scalability.
Ironically, native ad networks like Taboola and Revcontent will flourish in the new GDPR world. Since they target ads based mostly on nothing more than the topic of the content that the user is viewing, these ads are effective enough for smart performance marketers to make money with, and GDPR doesn't fundamentally change anything about their model. EU advertisers will flock to native and abandon other forms of advertising that were based on more invasive targeting.
If that's true, it's not because ad tech doesn't work, it's that most advertisers don't use it properly. A large percentage of my company's revenue comes from performance marketing (running paid traffic to affiliate offers) and it works very well for us. You just have to know what you're doing, make sure you're not getting too much bot/junk traffic, and bid the appropriate amounts. We've written software that handles all of this automatically, and our paid traffic campaigns do amazingly well. Show me another investment in which you can reliably and consistently achieve 30%+ ROI weekly with a fair amount of scalability.
Ironically, native ad networks like Taboola and Revcontent will flourish in the new GDPR world. Since they target ads based mostly on nothing more than the topic of the content that the user is viewing, these ads are effective enough for smart performance marketers to make money with, and GDPR doesn't fundamentally change anything about their model. EU advertisers will flock to native and abandon other forms of advertising that were based on more invasive targeting.
Is that 30% confirmed by a hold out group? The cynic in me suspects most measures, nowadays.
I can't believe nobody is making a profit. I just suspect most of the trick is in generating demand, not finding it. That or diversifying offerings.
I can't believe nobody is making a profit. I just suspect most of the trick is in generating demand, not finding it. That or diversifying offerings.
Is that 30% confirmed by a hold out group?
I’m not sure what you mean by that. But generally we get about a 30-50% ROI on our native ad campaigns once they are optimized, and most affiliate networks pay weekly if you produce significant revenue. We do better than most because I wrote some clever stuff to identify sites that were sending us mostly bots/bad traffic and automatically blacklist them from showing our ads. There are a ton of these in the native ad space.
I just suspect most of the trick is in generating demand, not finding it.
There are evergreen affiliate niches such as weight loss, hair loss, erectile dysfunction, etc. Aging, bad genetics, and poor lifestyle choices generate the demand for us. Making money in these niches is generally as simple as placing ads on sites where people that belong to certain known demographic groups visit, and reducing fraudulent traffic by as much as possible.
I’m not sure what you mean by that. But generally we get about a 30-50% ROI on our native ad campaigns once they are optimized, and most affiliate networks pay weekly if you produce significant revenue. We do better than most because I wrote some clever stuff to identify sites that were sending us mostly bots/bad traffic and automatically blacklist them from showing our ads. There are a ton of these in the native ad space.
I just suspect most of the trick is in generating demand, not finding it.
There are evergreen affiliate niches such as weight loss, hair loss, erectile dysfunction, etc. Aging, bad genetics, and poor lifestyle choices generate the demand for us. Making money in these niches is generally as simple as placing ads on sites where people that belong to certain known demographic groups visit, and reducing fraudulent traffic by as much as possible.
How do you measure the 30%? Compared to previous revenue or compared to a cohort you purposely don't advertise to, but is randomly selected from those you do?
That said, the niches you describe sounds like snake oil markets. :(
That said, the niches you describe sounds like snake oil markets. :(
If true, it makes a very amusing reversal from the usual story. Rather than peddling their wares to suckers, the placers of the ads have themselves been suckered into buying a product that doesn't work as advertised!
The more you think of it, the more it seems to be totally expected. It's the advertising industry we're talking about. They're not exactly a paragon of honesty. On the contrary, I suspect everyone tries to bullshit everyone else. The few observations I made from working next to people in marketing & advertising supports that viewpoint.
EDIT: reminds me of that one story about A/B testing, which pretty much directly told us how adtech companies are bullshitting their own customers.
https://news.ycombinator.com/item?id=10872359
I highlighted the more interesting parts back then: https://news.ycombinator.com/item?id=10873226.
EDIT: reminds me of that one story about A/B testing, which pretty much directly told us how adtech companies are bullshitting their own customers.
https://news.ycombinator.com/item?id=10872359
I highlighted the more interesting parts back then: https://news.ycombinator.com/item?id=10873226.
The rumor is that both the Cruz campaign and the Trump campaign found Cambridge Analytics' products to not work as advertised.
The SNP had an introduction to them, and the delegate reported back exactly that: not trustworthy and not a good idea to work with.
Read The Waste in Advertising is the Part That Works: https://www.researchgate.net/publication/4733724_The_Waste_i....
In it E. Ann Hollier and Tim Ambler make a strong case for what has been known from the start about branding: that mass media do it best, without performing at the personal levewl. One corollary for their case might be, "Not everything you value can be measured, and not everything you can measure has value."
Because digital advertising can be both targeted and measured, the whole advertising business decided that ads perform only when they are targeted and measured. But that's not advertising, really. That's direct marketing, which -- as I say in that post -- is descended from junk mail and a cousin of spam.
It's no accident that the $trillion or more spent on adtech hasn't produced a single brand known to the world.
The unanswered question is the one raised in The Problem With Targeting (https://www.dotcoma.it/2015/06/22/the-problem-with-targeting...), and pretty much everything Don Marti and Bof Hoffman (look them up) have been writing as well: is it possible for online advertising to brand products the way offline print and broadcast media could, and still do?
I suspect the answer is no. But my mind is open on the matter.
In it E. Ann Hollier and Tim Ambler make a strong case for what has been known from the start about branding: that mass media do it best, without performing at the personal levewl. One corollary for their case might be, "Not everything you value can be measured, and not everything you can measure has value."
Because digital advertising can be both targeted and measured, the whole advertising business decided that ads perform only when they are targeted and measured. But that's not advertising, really. That's direct marketing, which -- as I say in that post -- is descended from junk mail and a cousin of spam.
It's no accident that the $trillion or more spent on adtech hasn't produced a single brand known to the world.
The unanswered question is the one raised in The Problem With Targeting (https://www.dotcoma.it/2015/06/22/the-problem-with-targeting...), and pretty much everything Don Marti and Bof Hoffman (look them up) have been writing as well: is it possible for online advertising to brand products the way offline print and broadcast media could, and still do?
I suspect the answer is no. But my mind is open on the matter.
> By and large, it doesn't, very well.
Compared to what?
It may be easy to provide evidence for:
* Time and resource intensive prebiased word of mouth has a higher conversion rate.
* Conversion rates for mass advertising are very low numbers.
It is also easy to provide numbers for:
* Conversion rates for targeted advertising are significantly higher than non-targeted advertising.
* Having a non-existent marketing strategy for scale markets has a high probability of failure.
What is your position exactly?
Consider also some of what is implied throughout the article, that changes implied may price smaller companies out of the market. This doesn't bode well for competition, particularly for less funded competition. Small p&l organizations typically need to market to drive revenue, they're rarely in a position to push brand marketing strategies alone. Indeed this is a common huge difference between fine and coarse targeted platforms - when did you last see a small p&l trying to advertise on cable? What about on fine target platforms such as Facebook? Do you want such companies to become competitors to brand giants?
Compared to what?
It may be easy to provide evidence for:
* Time and resource intensive prebiased word of mouth has a higher conversion rate.
* Conversion rates for mass advertising are very low numbers.
It is also easy to provide numbers for:
* Conversion rates for targeted advertising are significantly higher than non-targeted advertising.
* Having a non-existent marketing strategy for scale markets has a high probability of failure.
What is your position exactly?
Consider also some of what is implied throughout the article, that changes implied may price smaller companies out of the market. This doesn't bode well for competition, particularly for less funded competition. Small p&l organizations typically need to market to drive revenue, they're rarely in a position to push brand marketing strategies alone. Indeed this is a common huge difference between fine and coarse targeted platforms - when did you last see a small p&l trying to advertise on cable? What about on fine target platforms such as Facebook? Do you want such companies to become competitors to brand giants?
There are three main kinds of ads I see: (1) products I just bought, (2) products I would never ever buy, and (3) creepily manipulative clickbait. None of these should be worth the money to the advertiser.
I test drove a car and after I got almost a dozen follow up calls while I was busy with other stuff, I blocked the dealership number. They kept calling me from other numbers, which I also blocked (with the new Android spam filter on my phone). But the amusing thing was that I started seeing ads for the dealership online promoting their "low pressure" sales team!
I made fun of a company called Salsify for naming their business after oyster plant, a root vegetable I can't stand, and now I see ads for them all the time.
I test drove a car and after I got almost a dozen follow up calls while I was busy with other stuff, I blocked the dealership number. They kept calling me from other numbers, which I also blocked (with the new Android spam filter on my phone). But the amusing thing was that I started seeing ads for the dealership online promoting their "low pressure" sales team!
I made fun of a company called Salsify for naming their business after oyster plant, a root vegetable I can't stand, and now I see ads for them all the time.
> I'm pretty sure that, the more we learn about how well advertising works, the less money people will be willing to pay for it.
That sounds like a statement from someone not very familiar with advertising.
Minimally it's contrary to the agency model & its incentives. A lot spend (the majority?) goes through that model, and it's not likely to change any time soon. And if anything GDPR, will increase it.
That said, even as measurement & attribution improves, the reality is that the effect will be shift to spend around. The better an advertiser can identify waste, they better they can redeploy that spend. Because that improves the ROI, the less it hurts the margin, and the more it makes sense for them to spend.
That sounds like a statement from someone not very familiar with advertising.
Minimally it's contrary to the agency model & its incentives. A lot spend (the majority?) goes through that model, and it's not likely to change any time soon. And if anything GDPR, will increase it.
That said, even as measurement & attribution improves, the reality is that the effect will be shift to spend around. The better an advertiser can identify waste, they better they can redeploy that spend. Because that improves the ROI, the less it hurts the margin, and the more it makes sense for them to spend.
>I think one side affect of the surge of IT into advertising, is that it has become easier to measure exactly how well advertising works. By and large, it doesn't, very well.
If that was true, Coca-Cola and McDonald's wouldn't exist.
If that was true, Coca-Cola and McDonald's wouldn't exist.
Coke's most successful marketing trick was a giant fluke. Even then, most of their success is probably in cornering the market, not just marketing. In large, many (most?) places sell it because they have an exclusive license that provides cups and supplies.
McDonald's is a funny one. They really don't seem any worse than most other fast food to me. I suspect they saw more expansion from their franchise methods than anything else, though.
Which is not to say the marketing isn't important. I just don't think it deserves the full victory.
McDonald's is a funny one. They really don't seem any worse than most other fast food to me. I suspect they saw more expansion from their franchise methods than anything else, though.
Which is not to say the marketing isn't important. I just don't think it deserves the full victory.
I think you're doing a disservice to marketing - both of the elements you've mentioned actually fall under the marketing banner:
- Coke: their branding, market research, and consumer strategy got them where they are today. All are marketing functions.
- McDonald's: franchise go-to-market strategy, branding, consistency of product. All are marketing functions.
Whether or not paid advertising helped them is a whole different argument (and one I'd argue, as when 'tis the season, it's always the real thing...)
- Coke: their branding, market research, and consumer strategy got them where they are today. All are marketing functions.
- McDonald's: franchise go-to-market strategy, branding, consistency of product. All are marketing functions.
Whether or not paid advertising helped them is a whole different argument (and one I'd argue, as when 'tis the season, it's always the real thing...)
Then I contend that marketing is expanded to too large a term. And at that point, yes, it is responsible from everything including product strategy, but also worthless as a term. :(
Might as well debate that "business" is responsible.
Especially if the success is not repeatable. Which, most early practices of large companies today are not repeatable by smaller companies.
Might as well debate that "business" is responsible.
Especially if the success is not repeatable. Which, most early practices of large companies today are not repeatable by smaller companies.
Marketing has always been defined by the 4P's: Product, Price, Place, and Promotion.
The "business" defines the problem-space and strategic direction (in these cases, food/drink), marketing defines how you address the space (specifics of the products from research and evaluation, market positioning, promotion to audiences), operations executes on the above (supply chain, training, maintenance), and then customer support feeds into all three of the above.
This GCSE Bitesize piece (revision material for UK exams students take at 16) outlines why marketing is more than simply advertising and promotion: http://www.bbc.co.uk/schools/gcsebitesize/business/marketing...
Advertising is a subset of marketing, but marketing is a broad term, and is often mistakenly limited in how it's used in arguments (usually to belittle the role of it).
The "business" defines the problem-space and strategic direction (in these cases, food/drink), marketing defines how you address the space (specifics of the products from research and evaluation, market positioning, promotion to audiences), operations executes on the above (supply chain, training, maintenance), and then customer support feeds into all three of the above.
This GCSE Bitesize piece (revision material for UK exams students take at 16) outlines why marketing is more than simply advertising and promotion: http://www.bbc.co.uk/schools/gcsebitesize/business/marketing...
Advertising is a subset of marketing, but marketing is a broad term, and is often mistakenly limited in how it's used in arguments (usually to belittle the role of it).
That still seems to broad of a definition. I get that it is taught to be concerned with the 4Ps, but those can clearly exist independent of a marketing department. Or any discernible marketing strategy.
Consider, as well, that the engineering department is also responsible for the Product. In large, they are also influential in the Price. Yet, I think it would also be unfair to give engineering full credit for a successful product. Even if it was well engineered or poorly marketed.
Which is to further my point that I was not trying to dismiss marketing as a valid area that a company should invest in. I just don't think it should deserve full credit for Coke and McDonald's existing. :)
Consider, as well, that the engineering department is also responsible for the Product. In large, they are also influential in the Price. Yet, I think it would also be unfair to give engineering full credit for a successful product. Even if it was well engineered or poorly marketed.
Which is to further my point that I was not trying to dismiss marketing as a valid area that a company should invest in. I just don't think it should deserve full credit for Coke and McDonald's existing. :)
underestimates or overestimates? There is advertising that doesn't require tracking. Simple brand-awareness-building and content-based advertising is pretty profitable without requiring tracking. For a website, the lack of personally-targeted ads may be offset by increasing the number of ad slots. I wonder if there is an estimate on how much value tracking adds.
There is no reason to expect that ad spending will drop in total, because ads never worked very well in any medium, but they worked well enough that it's worth investing in them. The portion of ad spending in TV has not changed significantly the past decades, what has happened is spending has shifted from newspapers to online. but the overall the volume keeps increasing in all media
[1] https://cdn.static-economist.com/sites/default/files/images/...
There is no reason to expect that ad spending will drop in total, because ads never worked very well in any medium, but they worked well enough that it's worth investing in them. The portion of ad spending in TV has not changed significantly the past decades, what has happened is spending has shifted from newspapers to online. but the overall the volume keeps increasing in all media
[1] https://cdn.static-economist.com/sites/default/files/images/...
Oddly, I think YOU are underestimating the size of the change coming, too. An upended industry won't go quietly, and I think we're about to see a lot of technology innovation to circumvent the new wave of privacy restrictions.
I think you're missing the point that's being made in the parent post. It's not that enhanced privacy will cause advertising to implode, it's that as the industry has gained more knowledge and understanding of advertising it's becoming apparent that advertising isn't worth what they thought it was.
I saw a similar up-ending of an ad-dependent industry 15 years ago with newspapers. Advertisers for years assumed a certain value based on the circulation numbers as reported by ABC. There was no real way to directly measure that value other than inferred activity within a geographic region that could arguably be tied to newspaper advertising. With the internet advertisers began to be able to track specific value for ad campaigns based on click-thrus, cost-per-action, etc. Those values were lower than the assumed value of newspaper advertising, which began a shift in where money was spent. Combine that with the fact that ABC numbers started to show that they were far less accurate than originally assumed, due in part to gaming by the papers themselves, and revenue started seriously shrinking. The last firewall that newspaper had was classified, which quickly folded in the face of job and real estate sites and of course craigslist.
Internet advertising has been suffering the same game-playing by sites that newspapers pulled with ABC circ numbers, and as advertisers gather more and better performance data about the value of ads and campaigns they're realizing that value is less than they thought and seems to be trending down.
Regardless of whether there's more or less privacy for users/consumers, the indications are that advertising is becoming less and less valuable.
I saw a similar up-ending of an ad-dependent industry 15 years ago with newspapers. Advertisers for years assumed a certain value based on the circulation numbers as reported by ABC. There was no real way to directly measure that value other than inferred activity within a geographic region that could arguably be tied to newspaper advertising. With the internet advertisers began to be able to track specific value for ad campaigns based on click-thrus, cost-per-action, etc. Those values were lower than the assumed value of newspaper advertising, which began a shift in where money was spent. Combine that with the fact that ABC numbers started to show that they were far less accurate than originally assumed, due in part to gaming by the papers themselves, and revenue started seriously shrinking. The last firewall that newspaper had was classified, which quickly folded in the face of job and real estate sites and of course craigslist.
Internet advertising has been suffering the same game-playing by sites that newspapers pulled with ABC circ numbers, and as advertisers gather more and better performance data about the value of ads and campaigns they're realizing that value is less than they thought and seems to be trending down.
Regardless of whether there's more or less privacy for users/consumers, the indications are that advertising is becoming less and less valuable.
advertising has never worked, but the delusion that it could work is strong - it seems like there’s probably a neverending supply of businesses who are going to throw some money down the drain, just in case they get lucky. It’s like buying lottery tickets - you don’t do it because of your great ROI, you do it because you’re having a fantasy about results
> I'm pretty sure that, the more we learn about how well advertising works, the less money people will be willing to pay for it. What's happening to billboards and newspapers right now is probably coming to several other industries soon.
I don't see any evidence to support that. Total spending on advertising is increasing every year. Newspaper spending is down, Google & Facebook is way up. Overall it's up.
I don't see any evidence to support that. Total spending on advertising is increasing every year. Newspaper spending is down, Google & Facebook is way up. Overall it's up.
Yeah, it pretty much doesn't work well. The unit economics is something like "pay 50 cents a click and hope your funnel can monetize that effectively". More if you have more specific/desirable targeting, less if it's broader, but anything you save on the targeting end you lose in funnel effectiveness. If you've got solid data all the way through to conversions and lifetime value, that can either justify dialing ad spend up or down, and it's usually going to be down.
I agree that as an aggregate we're probably massively overpaying for ads for little average effect, but there may be a game-theoretic reason why it does not go away. What if out of 100 competitors the top one gains a lot from ads but the 99 others lose? All 100 have to pay to play to try to be that one. If they cooperated as a cartel they could all pay less for ads and consumers could pay less for products but that is unlikely to happen.
There's a well-worn advertising quote "I waste 50% of my advertising budget. The problem is I don't know what half."
Most ad rates have dropped pretty dramatically since the early dot-com days, though. Are they still overvalued?
Advertising doesn't work that well if you look at the raw numbers. Assume you have a great campaign and awesome conversion funnel, so that you get 1% clicks and 1% conversion.
The math is 100 x 100, or one sale for every 10,000 eyes who sees your ad.
In a vacuum, those numbers are awful. If your entire marketing strategy is buying ads to convert to sales, then of course, advertising doesn't work, and really, you probably shouldn't be advertising in the first place.
The math is 100 x 100, or one sale for every 10,000 eyes who sees your ad.
In a vacuum, those numbers are awful. If your entire marketing strategy is buying ads to convert to sales, then of course, advertising doesn't work, and really, you probably shouldn't be advertising in the first place.
The only thing that matters is ROAS. If you spend $1 and get back > $1 in return, it works.
Also about half the market is branding, which is all about exposure rather than direct clicks or conversions.
Also about half the market is branding, which is all about exposure rather than direct clicks or conversions.
While reading your comment. I imagined 10,000 one-eyed people. :-)
but what percentage of ad spend on the internet is actually ROI justified? I'd guess it's pretty low, right? I got the impression it's dominated by big brand advertisers that can't calculate ad spend ROI anyway.
The only way to eliminate all waste in advertising is to use an affiliate marketing model and that's the biggest cesspool of them all.
Affiliate marketing does not magically get rid of waste. It just transfers the risk involved to another downstream party, while buying a shield of deniability of the unethical and scam tactics commonly used by affiliates.
We are considering an affiliate model for a new side-product. Can you point out the worst issues we should watch out for ?
(Its a virtual-goods product. Not subscription, but usually multiple-return customers. Around 70% gross margin since we have some high upfront provisioning cost.)
(Its a virtual-goods product. Not subscription, but usually multiple-return customers. Around 70% gross margin since we have some high upfront provisioning cost.)
Pressure sales tactics, spamming and hijacking the last click are the things that really work in affiliate marketing
> I think one side affect of the surge of IT into advertising, is that it has become easier to measure exactly how well advertising works. By and large, it doesn't, very well.
I just don't understand the anti-social media agenda. The same people who for 2 years have been saying that social media advertising is so effective that it got trump elected are now saying it is ineffective. They demand that political advertising on social media be monitored because it is so effective that it gets presidents elected. Now, it's social media ad spending is so ineffective that these companies won't be around.
> What's happening to billboards and newspapers right now is probably coming to several other industries soon.
What's happening to billboards and newspapers is that ad money is flooding into digital space ( where the young kids are ).
https://www.iab.com/news/digital-ad-spend-increases-23-year-...
https://www.recode.net/2017/9/14/16294450/mobile-ad-spending...
Why speak so authoritatively about something you obviously know nothing about?
I just don't understand the anti-social media agenda. The same people who for 2 years have been saying that social media advertising is so effective that it got trump elected are now saying it is ineffective. They demand that political advertising on social media be monitored because it is so effective that it gets presidents elected. Now, it's social media ad spending is so ineffective that these companies won't be around.
> What's happening to billboards and newspapers right now is probably coming to several other industries soon.
What's happening to billboards and newspapers is that ad money is flooding into digital space ( where the young kids are ).
https://www.iab.com/news/digital-ad-spend-increases-23-year-...
https://www.recode.net/2017/9/14/16294450/mobile-ad-spending...
Why speak so authoritatively about something you obviously know nothing about?
Desperate politicians making absurd rules when:
1) US election went “wrong”.
2) The same is happening to them
3) They’re mostly not hitting their own companies
Obviously it’s a lie. The “right” is gaining in Europe like crazy, not because of Facebook, but because the existing governments have seriously underperformed.
But politicians faced with the choice of admitting mistakes that they don’t even know how to fix, or to wildly and randomly strike at whoever got blamed ...
1) US election went “wrong”.
2) The same is happening to them
3) They’re mostly not hitting their own companies
Obviously it’s a lie. The “right” is gaining in Europe like crazy, not because of Facebook, but because the existing governments have seriously underperformed.
But politicians faced with the choice of admitting mistakes that they don’t even know how to fix, or to wildly and randomly strike at whoever got blamed ...
> The same people who
Is it really the same people? Do you have any examples of this?
Is it really the same people? Do you have any examples of this?
"The same people who for 2 years have been saying that social media advertising is so effective that it got trump elected are now saying it is ineffective."
So does that mean you think that social media advertising is effective as people claim and Russian use of it got Trump elected?
Regardless of whether your "same people" is a straw man, the opposite of a set of inconsistent claims tends to also be inconsistent, so I'm not sure what you are trying to say here.
So does that mean you think that social media advertising is effective as people claim and Russian use of it got Trump elected?
Regardless of whether your "same people" is a straw man, the opposite of a set of inconsistent claims tends to also be inconsistent, so I'm not sure what you are trying to say here.
It won't do much. It'll definitely get rid of some low-value companies but that's about it.
People think that adtech has some incredible insights but 99% of data is terrible. If you check your profile at any major site, you'll quickly find that you're probably in several conflicting segments that have nothing to do with you. Context is still king for any marketer who knows what they're doing, but unfortunately the industry is overwhelmed with subpar talent and politics through layers of agencies that buy buzzwords like "AI" and "data". Barely any adtech companies have a direct link to a person, and any links that did exist are even harder now with adblocking, 3rd party cookie deletion, ephemeral mobile device ids, IP renewals, and other noisy and loose signals.
Interestingly, big companies like Facebook and Google that have user logins and 1st party data connections will actually benefit from the higher industry regulation and are not going to lose any of the data that users willingly give to them. ISPs are another major source of data, along with credit agencies and banks, and now giant ecommerce companies like Walmart and Amazon, all of which have very accurate and exhaustive histories and will see little change from GDPR. Overall it's well-intentioned, and good progress, but what it will do is vastly overstated.
People think that adtech has some incredible insights but 99% of data is terrible. If you check your profile at any major site, you'll quickly find that you're probably in several conflicting segments that have nothing to do with you. Context is still king for any marketer who knows what they're doing, but unfortunately the industry is overwhelmed with subpar talent and politics through layers of agencies that buy buzzwords like "AI" and "data". Barely any adtech companies have a direct link to a person, and any links that did exist are even harder now with adblocking, 3rd party cookie deletion, ephemeral mobile device ids, IP renewals, and other noisy and loose signals.
Interestingly, big companies like Facebook and Google that have user logins and 1st party data connections will actually benefit from the higher industry regulation and are not going to lose any of the data that users willingly give to them. ISPs are another major source of data, along with credit agencies and banks, and now giant ecommerce companies like Walmart and Amazon, all of which have very accurate and exhaustive histories and will see little change from GDPR. Overall it's well-intentioned, and good progress, but what it will do is vastly overstated.
What you're describing sounds very much like a bubble that is going to pop...
I said that GDPR will not affect much, other than a few companies that add up to a microscopic market share. Where's the bubble?
i am hopeful for the idea that shifting from ads to paid services will reduce clickbait. right now may be seen as the yellow journalism moment of the internet.
One surprising side effect of this might be that the hordes of machine learners and data scientists who used to work for adtech might go to healthcare/bioinformatics where we might get new breakthroughs.
A lot will just move to finance...
However, financial firms are usually pretty against open academic research that would allow publication of papers. Many researchers truly value the ability to contribute to this field openly. Perhaps you are right and they will move to health.
However, financial firms are usually pretty against open academic research that would allow publication of papers. Many researchers truly value the ability to contribute to this field openly. Perhaps you are right and they will move to health.
Dodd-Frank isn't repealed and AFAIU, it made taking investor money much harder than it used to be.
We can see the next most lucrative fields where ML can be applied to by Alphabet's portfolio: * Calico, Verily - healthcare * Waymo - self driving cars
Another fields which comes to mind is robotics but Google liquidated their holdings related to this (Boston Dynamics) for some reasons.
We can see the next most lucrative fields where ML can be applied to by Alphabet's portfolio: * Calico, Verily - healthcare * Waymo - self driving cars
Another fields which comes to mind is robotics but Google liquidated their holdings related to this (Boston Dynamics) for some reasons.
Hopefully some find their way into rocketry research to help further commoditise space travel.
I'm trying to. It's not simple, if you're not in the US or Germany :<.
Germany, eh? Interesting. What kind of companies in that field are in Germany?
I wish I knew more about this subject.
I wish I knew more about this subject.
Too many to list. DLR - Germany's NASA - is a key player in Europe's space industry, so it draws all kinds of space companies to its neighbourhood.
EDIT: those two links might give you a quick overview:
- https://spaceindividuals.com/space-companies
- https://spaceindividuals.com/space-jobs?country=Germany (over 50% of all listed, but not surprising, since the site's owner is in Germany as well)
Right now, I'm trying to map the industry myself.
EDIT: those two links might give you a quick overview:
- https://spaceindividuals.com/space-companies
- https://spaceindividuals.com/space-jobs?country=Germany (over 50% of all listed, but not surprising, since the site's owner is in Germany as well)
Right now, I'm trying to map the industry myself.
[deleted]
There are not that many actual hard data science experts in adtech. Much of it is smoke and mirrors with every vendor claiming "AI" even if it's just some excel tweaking. The industry can't even agree on standard metrics or run a campaign without 20% discrepancies.
Also you can definitely apply ML techniques to data without PII, it's just harder, which actually makes the job more in-demand for high-quality talent.
Also you can definitely apply ML techniques to data without PII, it's just harder, which actually makes the job more in-demand for high-quality talent.
As someone who has just left the advertising industry, and was doing data stuff, the real issue is that a lot of companies have a lot of data but almost none of it has any actual useful information content in it. It’s a bit of a hard concept to explain to explain to people because they go “but there’s a hundred something columns, and hundreds of millions of rows!”, you can have all the data you want, but if it’s all non-indicative trash you’re not going to be able to usefully predict anything, but hey, you’ve hired a data scientist now and added the cost of a big spark cluster to your AWS bill now, so you may as well continue telling the market you’ve got some real hot stuff.
Yes, agreed. Lots of useless data out there that doesn't really have significant signals. Also a lot of it is duplicated with everyone getting the same logs, so I find it hard to believe that any single company magically derived a big advantage over another.
Not to mention, no amount of AI powered results can beat a slick sales team. $1M spent on quality salesperson is much higher ROI than $1M on fancy AI engineering when it comes to relationship-powered media spend.
Not to mention, no amount of AI powered results can beat a slick sales team. $1M spent on quality salesperson is much higher ROI than $1M on fancy AI engineering when it comes to relationship-powered media spend.
In statistics, there's a classic quote by John Tukey "The combination of some data and an aching desire for an answer does not ensure that a reasonable answer can be extracted from a given body of data."
This should be printed in large letters on the wall of anybody claiming to do data science.
This should be printed in large letters on the wall of anybody claiming to do data science.
They can still use sufficiently anonymized data under GDPR. They also will have data from people who have consented to have their data used. They will also have data from visitors who are not in the Union.
I would not at all be surprised if this is enough for the machine learning and data science people to be effective, especially at very high traffic sites like Facebook and Twitter.
I would not at all be surprised if this is enough for the machine learning and data science people to be effective, especially at very high traffic sites like Facebook and Twitter.
I don't believe for a second that they can make the data "sufficiently anonymized". That is extremely hard and pretty much every time "sufficiently anonymized" data gets leaked it turns out it weasn't sufficiently anonymized after all.
Anonymization won't really help because you can't store unique identifiers. IPs, emails device identifiers, etc and anything derived from them (no hashes of that data either) are all prohibited. So you can't really build a profile of someone if you've got no key to look it up when you need to target someone.
But that still prevents the entire targeted ad industry. If you can't hold any identifying information on a user that didn't opt-in to tracking, you can't show targeted ads to that user.
There's a lot more stuff to do with ML and make money than ad targeting
Adtech is the highest paid application of ML.
Based on what exactly? ML is not that common in adtech companies, many just lie about some basic regression testing. Some even just put up a facade in front of grunts with excel.
Even the most sophisticated ad modeling pales in comparison to fintech and bioscience/pharma where the real money is.
Even the most sophisticated ad modeling pales in comparison to fintech and bioscience/pharma where the real money is.
Maybe that’s true, but if the ML ad targeting industry disappears, several of those currently employed ML workers have little to no reason to exist.
Yikes! Why the hyperbole? I'm sure if someone is clever enough to learn and be productive with ML, they'll be able to pivot and be productive in another field and/or using other tools.
He's talking about the positions, not the people in them.
What did you have in mind?
To me, the best applications are going to be those by which the human and the ML'd AI will benefit each other by a greater degree than if each were on their own.
At my particular company in logistics, I can see many places where it can be applied- especially in the dispatching of deliveries and helping to set up a call with customer support.
At my particular company in logistics, I can see many places where it can be applied- especially in the dispatching of deliveries and helping to set up a call with customer support.
Predictive maintenance I think will be big as well
Two "might" occurrences means it's unlikely. The chances are these people will be swallowed by whatever the most profitable industry is at the time.
My guess would be similar learning systems that aren't subject to GDPR, such as government, external to EU (US), the ludicrous information of things (smart sensors, cloud, etc) where information doesn't leave the user's control, AI driven products, etc.
Then you'll have quite a few who will just continue regardless, sometimes it's easier to apologize (and pay a small fine) than it is to ask for permission.
Don't get me wrong, I would love for all of these people to end up in the (Scientific) health industry. (It's worth mentioning Scientific, as there is a lot of useless crap that uses some form of learning and offers no real gain - would be disappointing to see them all end up applying deep learning to homeopathy for example.)
My guess would be similar learning systems that aren't subject to GDPR, such as government, external to EU (US), the ludicrous information of things (smart sensors, cloud, etc) where information doesn't leave the user's control, AI driven products, etc.
Then you'll have quite a few who will just continue regardless, sometimes it's easier to apologize (and pay a small fine) than it is to ask for permission.
Don't get me wrong, I would love for all of these people to end up in the (Scientific) health industry. (It's worth mentioning Scientific, as there is a lot of useless crap that uses some form of learning and offers no real gain - would be disappointing to see them all end up applying deep learning to homeopathy for example.)
Not unless they're willing to take a paycut.
Well advertising and marketing firms don't pay there tech talent very well.
You are begging the question.
> tracking people without their knowledge, approval or a court order is just flat-out wrong.
Requiring them to check an "I agree to be tracked" checkbox and signing an agreement (which has just happened to me yesterday in an EU country in accordance to GDPR) before they can use a product/service is hardly much better. This reminds me of the Android app permission system which requires you to allow an app to do everything it wants (including ridiculous requirements like when a game requires access to your contacts list) or just give up the idea of installing it (as for me I just grant the permissions at the installation time and then block everything redundant with XPrivacy). So I doubt it is going to do much good, a way like the cookie law doesn't really do anything but just introduces useless cookie warning banners.
Requiring them to check an "I agree to be tracked" checkbox and signing an agreement (which has just happened to me yesterday in an EU country in accordance to GDPR) before they can use a product/service is hardly much better. This reminds me of the Android app permission system which requires you to allow an app to do everything it wants (including ridiculous requirements like when a game requires access to your contacts list) or just give up the idea of installing it (as for me I just grant the permissions at the installation time and then block everything redundant with XPrivacy). So I doubt it is going to do much good, a way like the cookie law doesn't really do anything but just introduces useless cookie warning banners.
Requiring them to check an "I agree to be tracked" checkbox and signing an agreement (which has just happened to me yesterday in an EU country in accordance to GDPR) before they can use a product/service is hardly much better.
That's specifically not allowed under the GDPR. Either the information is needed to provide the service (and needed means actually needed, not "my business model depends on it"), in which case they don't need to ask, or the use of the service can't depend on that consent.
(By the way, even if the information is needed, they still need consent to use it in other ways, and the same applies)
See the ICO guidelines on the issue: "If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."
https://ico.org.uk/for-organisations/guide-to-the-general-da...
That's specifically not allowed under the GDPR. Either the information is needed to provide the service (and needed means actually needed, not "my business model depends on it"), in which case they don't need to ask, or the use of the service can't depend on that consent.
(By the way, even if the information is needed, they still need consent to use it in other ways, and the same applies)
See the ICO guidelines on the issue: "If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis."
https://ico.org.uk/for-organisations/guide-to-the-general-da...
How is "my business model depends on it" not a bona fide legitimate purpose for information collection? Nobody is forcing anyone to patronize a business that relies on data collection for profitability.
I'm extremely skeptical of regulation that interferes with consensual deals between economic actors. You want transparency? Fine. But you don't get to randomly outlaw certain entire classes of business.
I'm extremely skeptical of regulation that interferes with consensual deals between economic actors. You want transparency? Fine. But you don't get to randomly outlaw certain entire classes of business.
> How is "my business model depends on it" not a bona fide legitimate purpose for information collection?
Business models are arbitrary and orthogonal to services provided.
> But you don't get to randomly outlaw certain entire classes of business.
Why not? Some business models are clearly antisocial and don't deserve to exist. GDPR is only outlawing business models based on large-scale abuse of people's private and identifying information. If you can obtain proper consent from enough percentage of your users, then your business model will be fine. If that's a problem for you, then ask yourself why.
I find it funny to see people complaining that their business model will be in trouble under GDPR. GDPR literally only outlaws being a huge asshole (in context of users' data).
Business models are arbitrary and orthogonal to services provided.
> But you don't get to randomly outlaw certain entire classes of business.
Why not? Some business models are clearly antisocial and don't deserve to exist. GDPR is only outlawing business models based on large-scale abuse of people's private and identifying information. If you can obtain proper consent from enough percentage of your users, then your business model will be fine. If that's a problem for you, then ask yourself why.
I find it funny to see people complaining that their business model will be in trouble under GDPR. GDPR literally only outlaws being a huge asshole (in context of users' data).
> Business models are arbitrary and orthogonal to services provided.
that doesn't change the fact that the business model depends on that orthogonal action. Is it unlawful for gyms to charge by subscription instead of per-use knowing that most people don't use them? Should the NYTimes be forced to go pay-per article instead of subscription? Should nightclubs not be allowed to overcharge the bottle?
> GDPR literally only outlaws being a huge asshole (in context of users' data).
It goes beyond that, by forcing you to serve people that don't agree to your business model.
that doesn't change the fact that the business model depends on that orthogonal action. Is it unlawful for gyms to charge by subscription instead of per-use knowing that most people don't use them? Should the NYTimes be forced to go pay-per article instead of subscription? Should nightclubs not be allowed to overcharge the bottle?
> GDPR literally only outlaws being a huge asshole (in context of users' data).
It goes beyond that, by forcing you to serve people that don't agree to your business model.
> Is it unlawful for gyms to charge by subscription instead of per-use based on the model that most people don't use them? Should the NYTimes be forced to go pay-per article instead of subscription?
It isn't, and it shouldn't. Either can choose whatever works for them best. GDPR only outlaws a few particular antisocial behaviours, which makes a particular class of business models illegal or much less profitable.
The "but business model!" whining sounds a bit like complaining that you can't make money mugging people, because the government disallows theft and assault. Cry me a river.
It isn't, and it shouldn't. Either can choose whatever works for them best. GDPR only outlaws a few particular antisocial behaviours, which makes a particular class of business models illegal or much less profitable.
The "but business model!" whining sounds a bit like complaining that you can't make money mugging people, because the government disallows theft and assault. Cry me a river.
They can charge any subscription or per use fee that they want, but not if the payment is personal data not necessary for the service.
> Business models are arbitrary and orthogonal to services provided.
That's a very interesting claim. So you're saying it'd be possible to organize fighter jet production as a co-op vegan collective?
That's a very interesting claim. So you're saying it'd be possible to organize fighter jet production as a co-op vegan collective?
Sure it is. How effective this business model is is another story.
Either way, you don't have an inherent right to specific business models and the EU is simply not allowing a business model anymore that has been widely abused. Of course it'll hurt some but I think overall the industry will adapt and change for the better.
Either way, you don't have an inherent right to specific business models and the EU is simply not allowing a business model anymore that has been widely abused. Of course it'll hurt some but I think overall the industry will adapt and change for the better.
One example might be the provision of a ‘free attraction’ service in exchange for surveillance capabilities, and the business model being various unrelated ways to exploit those capabilities (targeted ads, selling the raw data, selling products derived from the data, etc).
This has become the default business model of the B2C Internet, as distinct from offering a service in exchange for payment.
This has become the default business model of the B2C Internet, as distinct from offering a service in exchange for payment.
If you can find enough vegan aerospace engineers and have them liquidate their savings for the good of the collective, then sure, why not :).
Maybe "orthogonal" was a bit much. But almost always there's plenty of wiggle room to choose alternative business models.
Maybe "orthogonal" was a bit much. But almost always there's plenty of wiggle room to choose alternative business models.
You wouldn’t think that militant orders of Christianity would have been workable, but they clearly were. I have no doubt that money and power can lead any ideology far from what we’d associate with their base principles. I doubt that vegans are the exception.
There are a lot of companies that are collecting data about you and I that we aren't patronizing. For example, even if you don't have an account at Facebook, they have a profile of you. Even if you don't do business with Equifax, they are collecting your data.
People want more control over how information about them is used.
People want more control over how information about them is used.
Personally, I am extremely skeptical of entities where the only motivation is pure profit, and I personally would like to organize to protect myself against these entities that don't align with my civic concerns.
> consensual deals between economic actors
For web, most people don't understand the scope of tracking and privacy. None of the people I know understand what these web companies are doing, how they are being tracked and what data companies have about them. Nobody reads the privacy notice in those websites. Even after someone tells them facebook is tracking everything, they don't understand and just ignores it. There are no consensual deals on web. So GDPR is for all of them (and for people who understand and wants protection).
Also in America a company is more important than people. That's why there are so much negativity towards GDPR.
For web, most people don't understand the scope of tracking and privacy. None of the people I know understand what these web companies are doing, how they are being tracked and what data companies have about them. Nobody reads the privacy notice in those websites. Even after someone tells them facebook is tracking everything, they don't understand and just ignores it. There are no consensual deals on web. So GDPR is for all of them (and for people who understand and wants protection).
Also in America a company is more important than people. That's why there are so much negativity towards GDPR.
I have visited a drugstore to buy some vitamins yesterday. They have handled me a touch-screen where I had to check a checkbox (saying that I agree to allow my medicines shopping history to be stored and analyzed to track my health (which I obviously don't want them to do actually)) and an electronic signature tablet with a stylus where I had to put my signature. This was a mandatory condition for continuing using a discount card that gives bonuses when you buy meds. I could opt-out but this would mean I won't be given discounts any more.
Although it initially seems kind of scummy, isn't this better than the majority of ad services anyway? In exchange for selling your medical data, you get a discount. It's essentially getting paid for sharing your data.
Of course if it's essential medication which people can't afford without the discount then that's another matter, but otherwise it seems kind of fair to me. And it gets a bit more complicated if you're in America where that data is going to be used by health insurance to adjust your premiums.
Of course if it's essential medication which people can't afford without the discount then that's another matter, but otherwise it seems kind of fair to me. And it gets a bit more complicated if you're in America where that data is going to be used by health insurance to adjust your premiums.
That's a good question, I don't know if it's valid to offer discounts and such in exchange for consent. It goes against the EU principles ("personal information cannot be conceived as a mere economic asset"), but I'm not sure if the law actually prevents it.
One of the criteria for freely given consent is that the customer must be able to revoke it at any time without detriment.
If revoking consent causes a detriment, then it's not freely given, and so that "consent" isn't sufficient to grant the data controller a legal permission to use that data.
Quoting recital 42 from https://gdpr-info.eu/recitals/no-42/ "[...] Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.", so it's quite explicit.
If revoking consent causes a detriment, then it's not freely given, and so that "consent" isn't sufficient to grant the data controller a legal permission to use that data.
Quoting recital 42 from https://gdpr-info.eu/recitals/no-42/ "[...] Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.", so it's quite explicit.
I think a minor discount would probably fly (under 15% or so) or atleast defendable to the regulatory bodies.
Bigger discounts would be a problem since that would be more of a detriment.
Bigger discounts would be a problem since that would be more of a detriment.
Thanks, I missed that recital. It's confusing that the phrase you cited isn't in recital 43.
> personal information cannot be conceived as a mere economic asset
I wonder why not? Personal information is useless for most people, they give it away for free to the state institutions and the police wont even ask your consent. Some websites and services have found a way to make money off it, in exchange for free services etc. Why is this an ethically unacceptable proposition?
I wonder why not? Personal information is useless for most people, they give it away for free to the state institutions and the police wont even ask your consent. Some websites and services have found a way to make money off it, in exchange for free services etc. Why is this an ethically unacceptable proposition?
Because it ends up abused by marketers, and frequently ends up facilitating crime as well. GDPR as a law came out directly from the last decade of mass surveillance economy.
So what? It was part of the agreement when you consented. The same way that when you go to a club, a strip club, or a casino you know you 'll be exploited in a way. Sounds like advocating for overreaching laws that "save you from yourself" and keep you away from harm / drugs etc.
It's a bit ironic that you brought up mass surveillance because GDPR explicitly exempts the police and security services from its reach.
Edit (i can't post a reply): - consent should always be required, but if you don't consent i shouldn't be legally required to service you. GDPR is more than just consent hence the overreach
- The NSA has more data than any single actor on the internet, we can't possibly claim that private surveillance is worse. The NSA may have a better profile of me than any private actor even though (and especially because) i m not american. And their profiling can harm something that businesses generally don't care to harm: my freedom
It's a bit ironic that you brought up mass surveillance because GDPR explicitly exempts the police and security services from its reach.
Edit (i can't post a reply): - consent should always be required, but if you don't consent i shouldn't be legally required to service you. GDPR is more than just consent hence the overreach
- The NSA has more data than any single actor on the internet, we can't possibly claim that private surveillance is worse. The NSA may have a better profile of me than any private actor even though (and especially because) i m not american. And their profiling can harm something that businesses generally don't care to harm: my freedom
> It was part of the agreement when you consented
I didn't consent to shit. GDPR is the response to rampant abuse of personal data without obtaining proper consent. You're still allowed to use my data if I consent, you only have to obtain an actual, informed consent.
> The same way that when you go to a club, a strip club, or a casino you know you 'll be exploited.
What kind of clubs are you visiting? :o. Are you sure they're legal?
> It's a bit ironic that you brought up mass surveillance because GDPR explicitly exempts the police and security services from its reach.
It isn't, because adtech surveillance dwarfs government surveillance. Also, the police and security services are doing something valuable for me, even though they do it imperfectly. Advertising industry exists only to fuck me over. It's a cancer on society.
I didn't consent to shit. GDPR is the response to rampant abuse of personal data without obtaining proper consent. You're still allowed to use my data if I consent, you only have to obtain an actual, informed consent.
> The same way that when you go to a club, a strip club, or a casino you know you 'll be exploited.
What kind of clubs are you visiting? :o. Are you sure they're legal?
> It's a bit ironic that you brought up mass surveillance because GDPR explicitly exempts the police and security services from its reach.
It isn't, because adtech surveillance dwarfs government surveillance. Also, the police and security services are doing something valuable for me, even though they do it imperfectly. Advertising industry exists only to fuck me over. It's a cancer on society.
> It was part of the agreement when you consented.
That's a big point in GDPR, I think -- there never was consent. It's the same as why terms and conditions aren't legally binding: nobody actually considers there to be a valid agreement when they click next. In a sense GDPR is just enforcement of people's expectations, and ending predatory practices that were misusing them.
That's a big point in GDPR, I think -- there never was consent. It's the same as why terms and conditions aren't legally binding: nobody actually considers there to be a valid agreement when they click next. In a sense GDPR is just enforcement of people's expectations, and ending predatory practices that were misusing them.
Replying to your edit:
> consent should always be required, but if you don't consent i shouldn't be legally required to service you. GDPR is more than just consent hence the overreach
Yeah, and in a world where companies were not abusive, it would work that way. As it is, we both know perfectly well what happens - companies have leverage over users, and they'll use it. They'll make you consent to every kind of data abuse and sharing to use the service, exploiting the fact that giving up privacy doesn't feel like it's hurting at the point the data is being taken. GDPR is designed to remove that leverage - to make it unable for companies to extract arbitrary consents on the threat of refusal of service.
This only really affects you if your business model was baiting users with "free" services, spying on them, and selling that data to adtech industry.
> The NSA has more data than any single actor on the internet, we can't possibly claim that private surveillance is worse. The NSA may have a better profile of me than any private actor even though (and especially because) i m not american. And their profiling can harm something that businesses generally don't care to harm: my freedom
Sure, so NSA may have pulled in your e-mail history at some point in time. But it's mostly sitting there. NSA doesn't care about you unless make yourself important to US national security. Adtech surveillance, on the other hand, track you constantly, through pretty much every device you have, every site you visit, and makes use of your data all the time. And all in all, this data might at some point finds its way to NSA too, already nicely packaged. NSA vs. adtech is kind of like choosing high potential loss but very rarely, vs. low loss all the time. I'd say the expected loss is worse with adtech, but I'm still happy GDPR will make the life difficult for both.
> consent should always be required, but if you don't consent i shouldn't be legally required to service you. GDPR is more than just consent hence the overreach
Yeah, and in a world where companies were not abusive, it would work that way. As it is, we both know perfectly well what happens - companies have leverage over users, and they'll use it. They'll make you consent to every kind of data abuse and sharing to use the service, exploiting the fact that giving up privacy doesn't feel like it's hurting at the point the data is being taken. GDPR is designed to remove that leverage - to make it unable for companies to extract arbitrary consents on the threat of refusal of service.
This only really affects you if your business model was baiting users with "free" services, spying on them, and selling that data to adtech industry.
> The NSA has more data than any single actor on the internet, we can't possibly claim that private surveillance is worse. The NSA may have a better profile of me than any private actor even though (and especially because) i m not american. And their profiling can harm something that businesses generally don't care to harm: my freedom
Sure, so NSA may have pulled in your e-mail history at some point in time. But it's mostly sitting there. NSA doesn't care about you unless make yourself important to US national security. Adtech surveillance, on the other hand, track you constantly, through pretty much every device you have, every site you visit, and makes use of your data all the time. And all in all, this data might at some point finds its way to NSA too, already nicely packaged. NSA vs. adtech is kind of like choosing high potential loss but very rarely, vs. low loss all the time. I'd say the expected loss is worse with adtech, but I'm still happy GDPR will make the life difficult for both.
Legitimate question; if you're not American, why do you think the NSA would be impacting your individual freedom, or perhaps the freedom made available by the state(s) of your citizenship(s)? Or were you more referencing that it is violating your privacy?
there is international law which allows the US to affect me and my freedom even in my home country. It would be up to the local courts to decide. And of course when i visit the US, as well as my freedom to do business with US companies. Also, in this case the tracking is both without my consent , and without the protections that american law provides to americans.
> Sounds like advocating for overreaching laws that "save you from yourself" and keep you away from harm / drugs etc.
I understand you probably move in tech/libertarian circles so it doesn't seem like this, but the majority of the world population is in favor of laws protecting people from themselves and keeping them away from harm.
Now what is overreaching or not is a matter of opinion, and hence politics.
I understand you probably move in tech/libertarian circles so it doesn't seem like this, but the majority of the world population is in favor of laws protecting people from themselves and keeping them away from harm.
Now what is overreaching or not is a matter of opinion, and hence politics.
I might be wrong, but I don’t think that this is allowed under GDPR. They have to offer to you the same services with or without the consent to collect your data.
Also, under GDPR, you can always request export and removal of all your profile data from their data stores.
Also, under GDPR, you can always request export and removal of all your profile data from their data stores.
Well, I guess that answers the questions "how much is my privacy worth to me" and also "how much does the society i live in value privacy" quite succinctly.
So they have been storing and analyzing your health already and now they need your signature?
Sounds like something I'd opt-out, request all past data and have it deleted afterwards.
Sounds like something I'd opt-out, request all past data and have it deleted afterwards.
I think a lot of people/companies have been misled into thinking that the GDPR is just another type of cookie law and the same solution will work - get them to ok it by having an obtrusive message at the top of the site. They are in for a rude and costly awakening.
I wonder if there will ever be a suit in which that cookie banner ("Got it!" ugh) is found not to apply because users basically agree to it simply by seeing it. You have their stupid cookie by the time you can read that message. That doesn't seem like an agreement to me, but I'm not even slightly a lawyer.
The whole strategy seems to be in bad faith. I wish more sites would react by minimizing usage of cookies instead of just adopting that dumb overlay.
The whole strategy seems to be in bad faith. I wish more sites would react by minimizing usage of cookies instead of just adopting that dumb overlay.
Completely oblivious and ignorant here:
If a company has no official office in Europe, how does this affect them? All advertisement and business focus is say only in the US, is it business as usual? What if an EU citizen decides to sign up?
Are US companies forced to deny customers not par of say an IP block (half assed method I know, but just speaking in general)?
If a company has no official office in Europe, how does this affect them? All advertisement and business focus is say only in the US, is it business as usual? What if an EU citizen decides to sign up?
Are US companies forced to deny customers not par of say an IP block (half assed method I know, but just speaking in general)?
The guidance we have received is that if your business is not located in the EU, not targeting EU countries, you don't have parts of your site translated to languages spoken in EU countries, and do not have an EU-based domain name extension, your EU traffic is considered incidental and GDPR probably does not apply to you. But, as with everything in the GDPR, that is extremely murky. This law is subject to unique interpretations and degrees of enforcement in the courts and regulatory offices of 28 distinct countries. This is why we simply chose to block EU traffic - there's no need for us to take on the liability of EU traffic, and hope that some country over there doesn't need fines from us badly enough to decide that article 484208408 makes us subject to it.
With regard to enforceability outside the EU, that is anyone's guess. If you're in the US, there are already mechanisms that allow for the domestication of EU judgments in the US. Once domesticated, the judgment would have the same force and effect as if it had been issued by a US judge. However, the treaties that allow this are very complex, and allow for a large number of exceptions. So it would be up to a US judge in each specific case to decide whether or not a judgment for a fine issued under the GDPR can be domesticated. There are currently no treaties specifically relating to GDPR in the US, and I'd imagine there would be (very welcome) strong opposition to such a thing.
With regard to enforceability outside the EU, that is anyone's guess. If you're in the US, there are already mechanisms that allow for the domestication of EU judgments in the US. Once domesticated, the judgment would have the same force and effect as if it had been issued by a US judge. However, the treaties that allow this are very complex, and allow for a large number of exceptions. So it would be up to a US judge in each specific case to decide whether or not a judgment for a fine issued under the GDPR can be domesticated. There are currently no treaties specifically relating to GDPR in the US, and I'd imagine there would be (very welcome) strong opposition to such a thing.
Language is a horrible benchmark.
French in Canada, English and Spanish in the US, German among German expats (of which there are millions.)
Targeting a business for extortion because of the languages offered? Ridiculous. GDPR should only apply to businesses with a physical nexus in Europe, anything else is an attempt to assert extraterritorial jurisdiction.
Europeans don’t have to visit US/Canadian/Chinese websites. If they want to “protect” themselves, they simply stop using services they find objectionable. GDPR is nonsense — individuals should be allowed to do what they feel is right for them.
Why not ban all junk food from Europe? Tobacco? Alcohol? Those harm people far more than targeted advertising. If we actually “cared,” we’d be banning those industries.
GDPR is nothing more than a trade barrier.
French in Canada, English and Spanish in the US, German among German expats (of which there are millions.)
Targeting a business for extortion because of the languages offered? Ridiculous. GDPR should only apply to businesses with a physical nexus in Europe, anything else is an attempt to assert extraterritorial jurisdiction.
Europeans don’t have to visit US/Canadian/Chinese websites. If they want to “protect” themselves, they simply stop using services they find objectionable. GDPR is nonsense — individuals should be allowed to do what they feel is right for them.
Why not ban all junk food from Europe? Tobacco? Alcohol? Those harm people far more than targeted advertising. If we actually “cared,” we’d be banning those industries.
GDPR is nothing more than a trade barrier.
If you have a site in an EU language that is spoken in other countries as well (Spanish etc) but your site doesn't have an EU domain extension and your content and services are generally not targeted at EU residents, then GDPR likely does not apply. Language isn't the only test. If you have a site in German that is reporting German news though, you're likely going to have GDPR apply to you even if you have a .com extension and are not in the EU.
Unfortunately, I must use words such as "likely" here because there is a large amount of ambiguity in these tests, along with a major conflict of interest - it will essentially be up to the would-be beneficiaries of these fines to determine whether or not you are subject to them. The EU HN crowd seems to believe that their various governments will only fine "bad" companies "reasonable" amounts under this law, and that it will not be abused to extract government revenue from foreign companies and/or hobble foreign competitors of companies in their countries. I certainly hope they are correct, but this would be the first time in the history of the world that such a broadly worded statute was not abused. The only safeguard we have is that the world is watching. If/when the EU gets too out of control in their abuse of GDPR, hopefully countries like the US will implement legislation that makes it impossible to enforce GDPR fines within their borders.
Pakistan was once considering issuing an arrest warrant for Mark Zuckerberg because someone created a Facebook contest that offended some Pakistanis [1] [2]. The case would have carried a sentence of death by stoning. Even if charges had been filed, it is doubtful that the US would have extradited him to be stoned to death under the laws of another country. While GDPR fines are civil in nature, this case underscores the importance of not necessarily allowing the enforcement of other countries' laws in your own. If GDPR enforcement becomes abusive, one would hope that similar protections would apply in our home countries.
[1] http://www.adweek.com/digital/could-mark-zuckerberg-face-a-p...
[2] https://tribune.com.pk/story/342031/blasphemy-arrest-mark-zu...
Unfortunately, I must use words such as "likely" here because there is a large amount of ambiguity in these tests, along with a major conflict of interest - it will essentially be up to the would-be beneficiaries of these fines to determine whether or not you are subject to them. The EU HN crowd seems to believe that their various governments will only fine "bad" companies "reasonable" amounts under this law, and that it will not be abused to extract government revenue from foreign companies and/or hobble foreign competitors of companies in their countries. I certainly hope they are correct, but this would be the first time in the history of the world that such a broadly worded statute was not abused. The only safeguard we have is that the world is watching. If/when the EU gets too out of control in their abuse of GDPR, hopefully countries like the US will implement legislation that makes it impossible to enforce GDPR fines within their borders.
Pakistan was once considering issuing an arrest warrant for Mark Zuckerberg because someone created a Facebook contest that offended some Pakistanis [1] [2]. The case would have carried a sentence of death by stoning. Even if charges had been filed, it is doubtful that the US would have extradited him to be stoned to death under the laws of another country. While GDPR fines are civil in nature, this case underscores the importance of not necessarily allowing the enforcement of other countries' laws in your own. If GDPR enforcement becomes abusive, one would hope that similar protections would apply in our home countries.
[1] http://www.adweek.com/digital/could-mark-zuckerberg-face-a-p...
[2] https://tribune.com.pk/story/342031/blasphemy-arrest-mark-zu...
Don't worry, I am sure it wont be abused. The whole fearfull effect was created by adtech companies trying to create public outrage and paranoia to pretect their money source. Be sure that there are going to be some nasty penalties for greatest violaters (like online dating sites) I have noticed a lot of them is packaging GDPR into terms and conditions and privacy policy changes and those will have to get a fine, but I am sure warning will come first. But as one of ICO said (UK?), "We will always try to use carrot instead of stick, but some companies are carnivores, they don't eat carrots."
Also I am sure, half of world will have similar laws in next few years. Private data invasion just went to far, this has to be stopped.
Also I am sure, half of world will have similar laws in next few years. Private data invasion just went to far, this has to be stopped.
Don't worry, I am sure it wont be abused.
It would be the first time in history that such a law has not been abused. The fear is real and fully warranted.
I am sure warning will come first
There is no mandate written into the GDPR requiring warnings before fines, nor is there anything preventing multimillion-dollar fines for first-time, minor violations.
It would be the first time in history that such a law has not been abused. The fear is real and fully warranted.
I am sure warning will come first
There is no mandate written into the GDPR requiring warnings before fines, nor is there anything preventing multimillion-dollar fines for first-time, minor violations.
It's not a law it's a regulation and EU regulation is largely intended to be more of a carrot before the unpack the stick.
See the Smartphone Charger regulation. It requires all smartphones vendors to come up with a standard for charging, everyone picked microUSB (though moving to USB C now). The EU is fine with that and the smartphone vendors know that if they start pulling the "everyone has their own port" shit again that the EU will get out the stick.
Nobody wants the stick. The EU not and the Vendors not. The carrot was the EU Cookie law, which was largely ignored and the consent dialogs poorly implemented (not even asking for consent the majority of the time). So this is them getting out the stick. Now you can pick which one you want.
>There is no mandate written into the GDPR requiring warnings before fines, nor is there anything preventing multimillion-dollar fines for first-time, minor violations.
Art. 83 of the GDPR details this. Art. 78 details what rights you have against them imposing a fine.
See the Smartphone Charger regulation. It requires all smartphones vendors to come up with a standard for charging, everyone picked microUSB (though moving to USB C now). The EU is fine with that and the smartphone vendors know that if they start pulling the "everyone has their own port" shit again that the EU will get out the stick.
Nobody wants the stick. The EU not and the Vendors not. The carrot was the EU Cookie law, which was largely ignored and the consent dialogs poorly implemented (not even asking for consent the majority of the time). So this is them getting out the stick. Now you can pick which one you want.
>There is no mandate written into the GDPR requiring warnings before fines, nor is there anything preventing multimillion-dollar fines for first-time, minor violations.
Art. 83 of the GDPR details this. Art. 78 details what rights you have against them imposing a fine.
Now you can pick which one you want.
I don’t have to pick either. My company is not subject to the GDPR, and we will never put ourselves in a position to be subject to it. I will not be dictated to or threatened by a foreign government.
Art. 83 of the GDPR details this. Art. 78 details what rights you have against them imposing a fine.
People keep saying things like this, and yet neither article a) requires that a warning be issued before they seek a fine or b) limits fines in any way, except for a top cap of $10 million/$20 million (or percentages of revenue, but the caps are more than 100% of the revenue of most companies).
I would love for someone to just say “yes, technically there are no required warnings or limits other than the $10/$20 million”. Because that’s the only true statement that there is about GDPR fines.
I don’t have to pick either. My company is not subject to the GDPR, and we will never put ourselves in a position to be subject to it. I will not be dictated to or threatened by a foreign government.
Art. 83 of the GDPR details this. Art. 78 details what rights you have against them imposing a fine.
People keep saying things like this, and yet neither article a) requires that a warning be issued before they seek a fine or b) limits fines in any way, except for a top cap of $10 million/$20 million (or percentages of revenue, but the caps are more than 100% of the revenue of most companies).
I would love for someone to just say “yes, technically there are no required warnings or limits other than the $10/$20 million”. Because that’s the only true statement that there is about GDPR fines.
>I don’t have to pick either. My company is not subject to the GDPR, and we will never put ourselves in a position to be subject to it.
Canada, Japan and some other countries and even the US have indicated to copy the GDPR if not in letter atleast in spirit, though the US response is a lot weaker.
>I will not be dictated to or threatened by a foreign government.
The US is a foreign government and does it all the time to me, why is it a problem now?
>I would love for someone to just say “yes, technically there are no required warnings or limits other than the $10/$20 million”. Because that’s the only true statement that there is about GDPR fines.
You won't have that. The GDPR has a strict guideline on how to impose fines, it's not a law an won't be enforces as such. The regulatory bodies have bite because large players like Facebook or Equifax that leak large amounts of userdata require more than an angry letter in their mailbox.
As these articles mention, the agency imposing a fine should severely think about the level of fine and ensure it's appropriate. If you get hacked by a 0-day, you followed the advice of your regulatory body, your shit gets leaked and you inform your users immediately, it's very unlikely anything will happen.
If you get hacked because you didn't update your MySQL server in 5 years, you ignored what your regulatory agency said and you don't tell your users, don't expect them to go easy on you.
Easy as that. If you don't like it you can sue back and get the fine reduced or rescinded.
Canada, Japan and some other countries and even the US have indicated to copy the GDPR if not in letter atleast in spirit, though the US response is a lot weaker.
>I will not be dictated to or threatened by a foreign government.
The US is a foreign government and does it all the time to me, why is it a problem now?
>I would love for someone to just say “yes, technically there are no required warnings or limits other than the $10/$20 million”. Because that’s the only true statement that there is about GDPR fines.
You won't have that. The GDPR has a strict guideline on how to impose fines, it's not a law an won't be enforces as such. The regulatory bodies have bite because large players like Facebook or Equifax that leak large amounts of userdata require more than an angry letter in their mailbox.
As these articles mention, the agency imposing a fine should severely think about the level of fine and ensure it's appropriate. If you get hacked by a 0-day, you followed the advice of your regulatory body, your shit gets leaked and you inform your users immediately, it's very unlikely anything will happen.
If you get hacked because you didn't update your MySQL server in 5 years, you ignored what your regulatory agency said and you don't tell your users, don't expect them to go easy on you.
Easy as that. If you don't like it you can sue back and get the fine reduced or rescinded.
People keep saying all of this. Again, there is absolutely nothing enshrined in GDPR limiting fines, other than $10/20 million. It says they should consider some things when determining the fine. But (for example) one of the 28 countries could decide that in their country, the lowest level fines are “only” $5 million, and they go up from there based on the factors they are supposed to consider. That would still be enough to destory most businesses.
You cannot tell me that there is anything limiting the fines (other than the cap) because it isn’t written. You’re saying that you hope and think that each of the 28 governments involved here will be reasonable, but in truth you have no way of knowing, and they have every incentive to not be reasonable.
You cannot tell me that there is anything limiting the fines (other than the cap) because it isn’t written. You’re saying that you hope and think that each of the 28 governments involved here will be reasonable, but in truth you have no way of knowing, and they have every incentive to not be reasonable.
I hope that my government won't do this. As a EU citizen I only have to care about the one in my country.
Again, if you think the fine you got is too heavy you can escalate this to the courts (even EU courts).
There is also no incentive for the regulatory agency to impose such fines if the business cannot pay them. In that case they would get less or even nothing as the business collapses and it has not been the modus operandi in any EU regulatory body I know or experienced.
If they aren't reasonable than the EU courts will make them reasonable or the EU will add additional paragraphs to the GDPR to prevent excessive fines. Simple as that.
Again, if you think the fine you got is too heavy you can escalate this to the courts (even EU courts).
There is also no incentive for the regulatory agency to impose such fines if the business cannot pay them. In that case they would get less or even nothing as the business collapses and it has not been the modus operandi in any EU regulatory body I know or experienced.
If they aren't reasonable than the EU courts will make them reasonable or the EU will add additional paragraphs to the GDPR to prevent excessive fines. Simple as that.
> The fear is real and fully warranted.
Much like the cookie law or CAN-SPAM?
Much like the cookie law or CAN-SPAM?
>GDPR should only apply to businesses with a physical nexus in Europe, anything else is an attempt to assert extraterritorial jurisdiction.
It covers the personal data of EU citizens. Similar laws exist going the other way. Betfair can't (or couldn't) give accounts to US citizens. IIRC, various poker sites had to close US citizens' accounts. The US even arrested a CEO of a UK company who was only changing planes on his way home to Costa Rica: https://en.wikipedia.org/wiki/David_Carruthers#Arrest_during...
>anything else is an attempt to assert extraterritorial jurisdiction.
Good. The EU should grasp the nettle and fulfil it's role as the leading global hegemony.
It covers the personal data of EU citizens. Similar laws exist going the other way. Betfair can't (or couldn't) give accounts to US citizens. IIRC, various poker sites had to close US citizens' accounts. The US even arrested a CEO of a UK company who was only changing planes on his way home to Costa Rica: https://en.wikipedia.org/wiki/David_Carruthers#Arrest_during...
>anything else is an attempt to assert extraterritorial jurisdiction.
Good. The EU should grasp the nettle and fulfil it's role as the leading global hegemony.
It covers the personal data of EU citizens
You're both correct and incorrect. It covers the personal data of EU citizens. However, not all sites are actually subject to the GDPR at all. EU traffic to these sites is considered incidental and no GDPR protections apply, even to EU residents, on those sites that are outside of GDPR jurisdiction. There are legal tests build into the GDPR (which I detailed in my original comment above) that determine this.
You're both correct and incorrect. It covers the personal data of EU citizens. However, not all sites are actually subject to the GDPR at all. EU traffic to these sites is considered incidental and no GDPR protections apply, even to EU residents, on those sites that are outside of GDPR jurisdiction. There are legal tests build into the GDPR (which I detailed in my original comment above) that determine this.
Targeted advertising is not being banned, just regulated. Tobacco and Alcohol are already highly regulated. Junk food is being increasingly regulated https://en.wikipedia.org/wiki/Sugary_drink_tax#Countries
[deleted]
I work in the USA, as a sysad. The company I work for has a social media product.
We've have had European and African citizens who've signed up. And that was more than enough for us to discuss "How do we make our stuff comply with the GDPR?". If we ever considered in starting up in Europe, us ignoring the GDPR is tantamount to writing them off before even thinking of them.
We also do things the right way. Deletion requests aren't treated as "ignore kthxbai", but all data is zeroed out then nightly purged from the DB. And I really think, with how current society is slowly turning against orgs like facebook, the way we're approaching this is one avenue of right ways.
We've have had European and African citizens who've signed up. And that was more than enough for us to discuss "How do we make our stuff comply with the GDPR?". If we ever considered in starting up in Europe, us ignoring the GDPR is tantamount to writing them off before even thinking of them.
We also do things the right way. Deletion requests aren't treated as "ignore kthxbai", but all data is zeroed out then nightly purged from the DB. And I really think, with how current society is slowly turning against orgs like facebook, the way we're approaching this is one avenue of right ways.
If you dont have money, materials, or employees flowing through Europe there is very little they could do to you even if you actively flaunted the law. They could always block access to your site, or even try to sanction your business but unless they are willing to invade your country to physically stop you they don't have very many options.
There is always the chance that your own government will enforce EU rulings against you but at that point either your own government thinks GPDR should be enforced or you're in a very weak country and are going to have to capitulate to the EUs power anyway, much like small Latin American countries were forced to follow US policies
There is always the chance that your own government will enforce EU rulings against you but at that point either your own government thinks GPDR should be enforced or you're in a very weak country and are going to have to capitulate to the EUs power anyway, much like small Latin American countries were forced to follow US policies
If another company with facilities in the EU then buys the noncompliant company, could they enforce a judgement on the parent company?
If a noncompliant company is going through due diligence prior to being acquired, they be legally obligated to disclose that judgement? Even if they didn't, how hard would it be for an associate at a law firm to check public records about the company?
If a noncompliant company is going through due diligence prior to being acquired, they be legally obligated to disclose that judgement? Even if they didn't, how hard would it be for an associate at a law firm to check public records about the company?
Yea they could, but this is basic politics and sovereignty. Nations are allowed to make rules for operating inside themselves. You don't just get to ignore all of those rules when working inside them because you said your home is another nation.
The other side of that is that you can tell foreign governments to fuck off if you aren't dealing with them at all. The only time the foreign governments matter is if they are a superpower able to bend your own country to it's will, and that point you are basically a colony anyway so there's not much you can do
The other side of that is that you can tell foreign governments to fuck off if you aren't dealing with them at all. The only time the foreign governments matter is if they are a superpower able to bend your own country to it's will, and that point you are basically a colony anyway so there's not much you can do
You can totally tell foreign governments to fuck off. I'm just speculating that doing so would affect the value of your company.
The more likely problem will have to do with a US or Chinese company buying an EU company (given the scale imbalances in question). It'd be critical to maintain the existing GDPR compliance and keep the entities separate if the US or Chinese operations are not GDPR compliant per their domestic businesses.
Alibaba for example likely has no plans to concern itself with GDPR compliance in its domestic Chinese operations. They obviously will segment and comply with GDPR as it pertains to the EU operations / EU customers.
Alibaba for example likely has no plans to concern itself with GDPR compliance in its domestic Chinese operations. They obviously will segment and comply with GDPR as it pertains to the EU operations / EU customers.
You're right, if a EU resident decides to visit your website and you're tracking them (Google Analytics etc) you have to comply with GDPR when handling his/her data. The IP block has a logic to it because the law applies to people in the EU rather than EU citizens.
Really? I was under the impression that it applies to EU residents, regardless of where they are accessing the website from.
It's the other way around. The law protects according to point of access (EU soil), not according to nationality. So an American tourist in France would be protected, but not a French tourist in the US.
This is just like most laws, when you're a tourist in a foreign country you have to follow the local laws, not the ones from your passport country.
This is just like most laws, when you're a tourist in a foreign country you have to follow the local laws, not the ones from your passport country.
This is technically true, however if the site is not targeting EU residents, the traffic is supposed to be considered incidental and the GDPR is not supposed to apply.
As long as you don't target EU customers, you're fine.
Do you have any references/citations for this?
Would help me out! I'm trying to put together a one-pager for my team.
Would help me out! I'm trying to put together a one-pager for my team.
When the regulation does not apply
Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
IANAL etc
Your company is service provider based outside the EU. It provides services to customers outside the EU. Its clients can use its services when they travel to other countries, including within the EU. Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.
https://ec.europa.eu/info/law/law-topic/data-protection/refo...
IANAL etc
I recently wrote about this subject (with sources). See these:
https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no...
https://news.ycombinator.com/item?id=17058645
https://www.joyfulbikeshedding.com/blog/2018-04-17-should-no...
https://news.ycombinator.com/item?id=17058645
And “target” is such an arbitrary idea. Just existing could be argued as trying to target.
The standard should be: “do you have a physical nexus in the EU.” That’s it.
The standard should be: “do you have a physical nexus in the EU.” That’s it.
It's either "target", or it apples to all EU customers. "target" is far less of a problem for companies that don't consider their customers data to be important.
> perhaps a $trillion or more has been spent on adtech, and not one brand known to the world has been made by it
Google.
Google.
The author is referring to brands that typically pay for ads, not provide them.
That makes even less sense. Really, ZERO brands have found customers from web marketing? Not even Audible, or Harry's, or all those mattress brands, that weird tongue brush all over YouTube in 2012? No success stories at all?
> Not even Audible, or Harry's, or all those mattress brands
They advertised through sponsoring podcasts or Youtube channels, which is the sort of traditional advertising that's being contrasted to tracking-based adtech.
They advertised through sponsoring podcasts or Youtube channels, which is the sort of traditional advertising that's being contrasted to tracking-based adtech.
You can add Alibaba, Baidu and Toutiao to that list. Nearly all of their revenue comes from adtech. Just three platforms used by a billion people. Yahoo was also made possible by adtech, it was / is a brand known to over a billion people.
Facebook, Twitter, Snapchat - they only exist courtesy of their adtech.
Can you imagine how difficult it would be for Twitter to sustain itself with a paid model? There's such an extreme imbalance between the people that post regularly and are power users, vs people that just occasionally consume. The median user that reads a few tweets per day - at best - is never going to pay $60 or $100 per year for that product. Even if you have five million power users on there paying $100 per year, Twitter instantly goes bankrupt, they could never charge enough.
Facebook, Twitter, Snapchat - they only exist courtesy of their adtech.
Can you imagine how difficult it would be for Twitter to sustain itself with a paid model? There's such an extreme imbalance between the people that post regularly and are power users, vs people that just occasionally consume. The median user that reads a few tweets per day - at best - is never going to pay $60 or $100 per year for that product. Even if you have five million power users on there paying $100 per year, Twitter instantly goes bankrupt, they could never charge enough.
I'm amused by the implication here, that it's obvious $500 million a year isn't enough to run a website where people send short messages to each other.
Out of the three you listed, only one has actually made money. Snapchat and Twitter have lost incredible amounts.
Also, I think what the article is suggesting is that brands don't typically get built on the back of advertising _initially_. All three of those started without it and added it in later once they were highly entrenched to try to monetize.
I still don't think it was a very good point in the article, though.
Also, I think what the article is suggesting is that brands don't typically get built on the back of advertising _initially_. All three of those started without it and added it in later once they were highly entrenched to try to monetize.
I still don't think it was a very good point in the article, though.
Twitter has been net income positive each of the last two quarters.
Maybe then twitter should downsize and accept low profit margin.might have then lead to multiple Twitter like platforms.
>Facebook, Twitter, Snapchat - they only exist courtesy of their adtech.
Where are the ads in snapchat? Or is the money made from selling people's information on to ad tech people?
Where are the ads in snapchat? Or is the money made from selling people's information on to ad tech people?
From one of the references in the article:
The Google consent interface greets site visitors with a request to use data to tailor advertising, with equally prominent “no” and “yes” buttons. If a reader declines to be tracked, he or she sees a notice saying the ads will be less relevant and asking to “agree” or go back to the previous page.
The Google consent interface greets site visitors with a request to use data to tailor advertising, with equally prominent “no” and “yes” buttons. If a reader declines to be tracked, he or she sees a notice saying the ads will be less relevant and asking to “agree” or go back to the previous page.
Adtech is a joke. Even targeted ads are so irrelevant to the point where I don't think most people can tell if they're random or not. Except when the creepiness kicks in, because they show you ads for this one thing you googled a week ago.
Google can't get it right. Their ads suck, and their Youtube suggestions aren't much better. Amazon can't get suggestions right in their own store.
The whole ad industry is a joke. Most people I know do not watch TV anymore, not because of the content, but because of ads. I enjoy reading magazines, but I don't bother anymore because they got full of ads. Now I read books instead. Most Youtubers either have some kind of sponsoring directly in the video, or a Patreon because Youtube ads are clearly awful and ineffective.
I think Patreon and Netflix et al. proves quite nicely that enough people are willing to pay for quality content without ads. For the companies who want to market stuff, I don't have a solution (otherwise I'd be rich), but I do know I'll go to great lengths to avoid seeing your shitty ads.
Google can't get it right. Their ads suck, and their Youtube suggestions aren't much better. Amazon can't get suggestions right in their own store.
The whole ad industry is a joke. Most people I know do not watch TV anymore, not because of the content, but because of ads. I enjoy reading magazines, but I don't bother anymore because they got full of ads. Now I read books instead. Most Youtubers either have some kind of sponsoring directly in the video, or a Patreon because Youtube ads are clearly awful and ineffective.
I think Patreon and Netflix et al. proves quite nicely that enough people are willing to pay for quality content without ads. For the companies who want to market stuff, I don't have a solution (otherwise I'd be rich), but I do know I'll go to great lengths to avoid seeing your shitty ads.
I honestly think this is very, very user dependent. Mainly because if Google's ad tech wasn't working, they wouldn't be making so much money....
You, I, and everyone else on this site don't represent the average user. Personally whenever I Google something out of curiosity as a one-off thing (e.g. "lyrics to Rasputin by Boney M" or "0-60 of a Golf GTI") I switch to in-cognito, just because I've noticed that Google isn't currently tracking stuff like that by IP. This way I don't get recommended Boney M videos in YouTube or adverts for cars I don't actually have an interest in elsewhere. And that's on top of uBlock, Disconnect, Privacy Badger, and a Pi-Hole on my home network. But I work in cyber security and I am in no way a "normal" internet user. Same with TV, I'm a cord-cutter with Plex running on a VPS: meanwhile everybody I know who doesn't work in tech just watches TV normally.
Pretty much everyone on this site saying "advertising doesn't work" is right that it probably isn't as effective for them because they've been taking counter-measures for years, but millions (possibly billions) of normal internet users do click on ads, or have their purchases influenced by ads.
I do agree with Patreon and Netflix, they're fantastic business models. Add Spotify to the mix too: although the renumeration they give to artists is laughable, it's a fantastic platform which has gotten me to actually pay for music for the first time in about a decade.
You, I, and everyone else on this site don't represent the average user. Personally whenever I Google something out of curiosity as a one-off thing (e.g. "lyrics to Rasputin by Boney M" or "0-60 of a Golf GTI") I switch to in-cognito, just because I've noticed that Google isn't currently tracking stuff like that by IP. This way I don't get recommended Boney M videos in YouTube or adverts for cars I don't actually have an interest in elsewhere. And that's on top of uBlock, Disconnect, Privacy Badger, and a Pi-Hole on my home network. But I work in cyber security and I am in no way a "normal" internet user. Same with TV, I'm a cord-cutter with Plex running on a VPS: meanwhile everybody I know who doesn't work in tech just watches TV normally.
Pretty much everyone on this site saying "advertising doesn't work" is right that it probably isn't as effective for them because they've been taking counter-measures for years, but millions (possibly billions) of normal internet users do click on ads, or have their purchases influenced by ads.
I do agree with Patreon and Netflix, they're fantastic business models. Add Spotify to the mix too: although the renumeration they give to artists is laughable, it's a fantastic platform which has gotten me to actually pay for music for the first time in about a decade.
> I switch to in-cognito, just because I've noticed that Google isn't currently tracking stuff like that by IP. This way I don't get recommended Boney M videos in YouTube or adverts for cars I don't actually have an interest in elsewhere.
If you go through all that trouble, why don't you simply turn off personalized ads? https://adssettings.google.com/
If you go through all that trouble, why don't you simply turn off personalized ads? https://adssettings.google.com/
> Mainly because if Google's ad tech wasn't working, they wouldn't be making so much money....
Depends what you mean by "working". Like I said, companies always want to market their stuff. Online ads just need to be better value than print, TV, or radio - a low bar. Also, attention is a zero-sum game, if you don't target online you're missing out on a huge slice. An especially important slice of younger people.
> I honestly think this is very, very user dependent.
Of course. And as engineers, we're painfully aware how important attention/concentration is, and value that higher than most. I think content creators are similarly cognizant of that though. On podcasts, you're much more likely to hear "I don't watch TV".
Sure, in the short term, nothing is going to change. My parents probably won't stop watching TV, although Netflix usability is pretty good, even for them. But in the long term? And it isn't like TV is cheap. In America, cable packages are expensive, although the big media conglomerates are pushing some shitty deals to get people to keep buying them. In Europe, it's often worse. Decent, country-focused TV is usually free. But if you want to watch Game of Thrones, you're basically going to have to pirate it.
And even on shorter timescales, you can see changes. For example, I've followed some creators from Youtube to Twitch and find myself using it more, even if I'm not a fan of the UI or watching streams in particular. So it isn't even the same use-case, but the more time I spend on Twitch, the less time Youtube gets. Or podcasts. Youtube is still useful for discovery, but many people switch away from Youtube for consuming podcasts they follow.
In any case, on average people are more aware of how valuable attention is - a trend I think is increasing.
Depends what you mean by "working". Like I said, companies always want to market their stuff. Online ads just need to be better value than print, TV, or radio - a low bar. Also, attention is a zero-sum game, if you don't target online you're missing out on a huge slice. An especially important slice of younger people.
> I honestly think this is very, very user dependent.
Of course. And as engineers, we're painfully aware how important attention/concentration is, and value that higher than most. I think content creators are similarly cognizant of that though. On podcasts, you're much more likely to hear "I don't watch TV".
Sure, in the short term, nothing is going to change. My parents probably won't stop watching TV, although Netflix usability is pretty good, even for them. But in the long term? And it isn't like TV is cheap. In America, cable packages are expensive, although the big media conglomerates are pushing some shitty deals to get people to keep buying them. In Europe, it's often worse. Decent, country-focused TV is usually free. But if you want to watch Game of Thrones, you're basically going to have to pirate it.
And even on shorter timescales, you can see changes. For example, I've followed some creators from Youtube to Twitch and find myself using it more, even if I'm not a fan of the UI or watching streams in particular. So it isn't even the same use-case, but the more time I spend on Twitch, the less time Youtube gets. Or podcasts. Youtube is still useful for discovery, but many people switch away from Youtube for consuming podcasts they follow.
In any case, on average people are more aware of how valuable attention is - a trend I think is increasing.
I had that "creepy" moment but it was more silly than creepy to me.
I was googling a lot about a certain piece of software (config, how to set this and that up with other things to work together, etc.) and that resulted in me getting ads for it from there on.
I mean yes, the targeting 'worked' - it's a software that interested me at the time, I even own a copy already. Targeted ad money well spent..?
The surgery was successful but the patient died.
I was googling a lot about a certain piece of software (config, how to set this and that up with other things to work together, etc.) and that resulted in me getting ads for it from there on.
I mean yes, the targeting 'worked' - it's a software that interested me at the time, I even own a copy already. Targeted ad money well spent..?
The surgery was successful but the patient died.
What bugs me even more is booking.com
Case in point: I book a hotel for next weekend in Sapporo and they won't stop pestering me with ads for hotels on said weekend in Sapporo.
Hello! I just booked a hotel and don't need another one!
What seems even more seedy is their emails:
Hello CaptainZapp; Prices just went down in Sapporo!
Which, first, is a lie. I know that because I was in Japan during golden week. And prices are very high and certainly don't get any lower for those days.
Secondly it seems fundamentally unfair towards the hotels that (have to) sign up with them.
Case in point: I book a hotel for next weekend in Sapporo and they won't stop pestering me with ads for hotels on said weekend in Sapporo.
Hello! I just booked a hotel and don't need another one!
What seems even more seedy is their emails:
Hello CaptainZapp; Prices just went down in Sapporo!
Which, first, is a lie. I know that because I was in Japan during golden week. And prices are very high and certainly don't get any lower for those days.
Secondly it seems fundamentally unfair towards the hotels that (have to) sign up with them.
Netflix still needs ads to advertise themselves like on YouTube.
Which is certainly fine with me. I'm always amused that the notion that I will regret not having "relevant" ads. Where "relevant" means more likely to get me to buy things I was not intending to buy.
Ads make sense to me in the age of information scarcity. But now if I need a thing, searching always turns up what I want. If I need to figure out what kind of thing to buy, I can read review at places like The Wirecutter. If I want to keep up with what's new in a field, I can follow experts via Twitter, mailing lists, etc. And if I have a problem I don't know how to solve I can talk to friends or use social media.
Please do give me random ads; they're easier for me to entirely ignore.
Ads make sense to me in the age of information scarcity. But now if I need a thing, searching always turns up what I want. If I need to figure out what kind of thing to buy, I can read review at places like The Wirecutter. If I want to keep up with what's new in a field, I can follow experts via Twitter, mailing lists, etc. And if I have a problem I don't know how to solve I can talk to friends or use social media.
Please do give me random ads; they're easier for me to entirely ignore.
Isn't what you're saying in your first paragraph just strawmanning the definition of "relevant"? If you do not want to buy anything no matter what they show you then those ads are by definition not relevant. If they make you want to buy then the ads are by definition relevant. They aren't brainwashing you, at the end of the day the one in control of the credit card is still you.
> They aren't brainwashing you, at the end of the day the one in control of the credit card is still you.
Right, because we're all perfectly rational robots with full control of all of our emotions and impulses, and the advertisers totally don't employ cutting-edge research in psychology to manipulate us.
Right, because we're all perfectly rational robots with full control of all of our emotions and impulses, and the advertisers totally don't employ cutting-edge research in psychology to manipulate us.
Exactly. The actual point of most advertising is to manipulate people into doing what the advertiser wants. Coca Cola doesn't spend billions on advertising because somebody out there isn't aware of Coke.
Even if I never fall for it, the stuff that's most "relevant" from the advertiser perspective is to me the stuff I have to do the most mental work to ignore. The more irrelevant it is, the less I notice it at all.
Even if I never fall for it, the stuff that's most "relevant" from the advertiser perspective is to me the stuff I have to do the most mental work to ignore. The more irrelevant it is, the less I notice it at all.
[deleted]
Actually Google doesn't just say the ads will be less relevant, it also says you won't be able to block or mute some ads. Are you still happy to opt out?
What if Google emotionally bribed people? eg "For every month you have targeted ads enabled, we will donate 10 cents to [INSERT CHARITY]."
They don't have to. The possibility to opt out from tracking have been available for a while, although it was always pretty hidden in the settings.
After I opted out, I started seeing awful ads: mostly semi-naked bodies of people claiming to lose weight or bald heads.
Of course it's easy for Google to just say that this is what their economically optimized algorythm selects for a perfect stranger, because those are the only advertisers that risk spending ad money on someone they know nothing about.
Long story short: it's a sort of bribe already and you cannot prove it is happening.
After I opted out, I started seeing awful ads: mostly semi-naked bodies of people claiming to lose weight or bald heads.
Of course it's easy for Google to just say that this is what their economically optimized algorythm selects for a perfect stranger, because those are the only advertisers that risk spending ad money on someone they know nothing about.
Long story short: it's a sort of bribe already and you cannot prove it is happening.
Turning off the display of personalized ads and turning off data collection are different. Do the setting you are talking about prevent data collection?
I wouldn’t call it bribery - Bing will make a donation if you get enough Bing points. I’ll be generating £3 for the Special Olympics this month (or I could have chosen a £5 voucher in the Microsoft store).
From the article, it looks like the big winners in this will be companies which both run ads and have customer accounts. Google and Facebook, basically. Companies which have no relationship with the customer have no way to ask for permission to use customer data. This is a killer for third-party adtech companies which need that permission.
So the middlemen get cut out, and advertisers deal with Google and Facebook directly.
So the middlemen get cut out, and advertisers deal with Google and Facebook directly.
Tracking cookies gave the ability for small advertisers to understand their customers and their other consumption in ways that only the largest marketers could.
The author thinks big brands are everything and can't see how letting smaller players sell to customers could help the economy. He uses an arbitrary standard of privacy to argue on the behalf of the largest household brands. I think he's missing the forest for the trees.
The author thinks big brands are everything and can't see how letting smaller players sell to customers could help the economy. He uses an arbitrary standard of privacy to argue on the behalf of the largest household brands. I think he's missing the forest for the trees.
Can you flesh that out a bit more? What are those ways?
Customer focus groups. Literally paying customers to spend time with staff to learn their habits and thoughts about the advertising. The big brands have the funds and expertise to directly gather enough data to come up with strong predictors of behavior.
Focus groups are always made with the consent of the participants, though. You can still use tracking cookies if you also get consent.
You use the word "though", but I don't see how your argument doesn't integrate with mine. Can you tell me what I am missing?
Small businesses (especially B2B) used to be able to buy small ads in mainstream publications that catered to the target customers. For example, we used to pay over a grand a month to one magazine, but that magazine drove fully-qualified potential customer traffic directly to our web site that easily paid for the ad. Today, we can't even find a decent place to advertise that doesn't effectively equate to lighting dollar bills on fire.
The GDPR is about a lot more than cookies. I think you're going to have a hard time arguing that current massive internet advertising surveillance and analysis industry is friendly towards small business.
One other fundamental shift that information technology makes to advertising is that digital tools, reviews, and marketplaces somewhat undermine some primary functions of advertising. I no longer care about brand or advertising information when buying commodity products on Amazon; I simply sort by # of reviews * avg score, read a sample of reviews at each star level, and I already have a general picture of the product's quality and consumer satisfaction.
The parts of advertising meant to demonstrate "Hey, we're a quality company that can afford this prestigious advertising slot, therefore the reliability of our products is assured" has been eaten by frictionless digital review platforms. Of course, advertising and branding serve other purposes as well, and will always be some part of the purchasing decision. But social software and AI will likely continue getting better at matching consumers with products over time.
The parts of advertising meant to demonstrate "Hey, we're a quality company that can afford this prestigious advertising slot, therefore the reliability of our products is assured" has been eaten by frictionless digital review platforms. Of course, advertising and branding serve other purposes as well, and will always be some part of the purchasing decision. But social software and AI will likely continue getting better at matching consumers with products over time.
I think that is coming back, however, as the whole fake Amazon review scandal continues to play out and demonstrate that anonymous reviews in an open digital marketplace are no replacement for a trusted brand. Not better and not worse, whether it is reviews or brands, at the end of the day its simply another way to gauge 'potential' product quality. Sometimes good brands screw you over with shitty products, sometimes bad manufacturers hire fake reviewers to shill for them.
I wonder how many "parts" of the Internet are simply going to be inaccessible over the course of the year to individuals residing within the EU as websites take a rudimentary "block all EU traffic" approach as a first swing at preventing their services from being offered to EU residents.
Just be sure to marvel at the speed with which they're all simply replaced.
Another gold rush? Count me in!
I don't quite share the level of optimism the author seems to have, but I hope he's right. If so, good riddance, just a shame it took this long.
Something tells me it will be similar to the fear mongering of cookies policies circa 2014.
Meanwhile as ICO reporting, only on average 50 companies/sites have been investigated and punished, per year.
https://ico.org.uk/action-weve-taken/cookies/
Most likely with GDPR being so damn popular, they will be overloaded on day one. Heck, I personally have 5 different emailers I never provided my email to, that I just wait for the end of May to report! Do I believe each will be prosecuted and extracted out of $25MM in penalties ? Nope.
Meanwhile as ICO reporting, only on average 50 companies/sites have been investigated and punished, per year.
https://ico.org.uk/action-weve-taken/cookies/
Most likely with GDPR being so damn popular, they will be overloaded on day one. Heck, I personally have 5 different emailers I never provided my email to, that I just wait for the end of May to report! Do I believe each will be prosecuted and extracted out of $25MM in penalties ? Nope.
Although I like the GDPR and would support similar legislation in my country, I honestly don't see the gloom and doom story. The EU market is a small part of the global story, and while this change clearly makes that market harder to enter, the article doesn't make the case that the EU represents a sufficient share of the adtech market to pop a bubble.
In general it's easy to believe negative press about hated entities (for example, see liberal credulity about Trump's vulnerability in the US). I don't see the argument passing the bar for evidende, whether or not I want to believe it.
edit: the argument that adtech stinks is not evidence in support of the article's thesis. crappiness is not a predictor of a bubble, and the author makes no attempt to connect the idea that ad tech stinks (which is stated ad nauseum) with the claim that the GDPR will bring about a global sea change for adtech)
In general it's easy to believe negative press about hated entities (for example, see liberal credulity about Trump's vulnerability in the US). I don't see the argument passing the bar for evidende, whether or not I want to believe it.
edit: the argument that adtech stinks is not evidence in support of the article's thesis. crappiness is not a predictor of a bubble, and the author makes no attempt to connect the idea that ad tech stinks (which is stated ad nauseum) with the claim that the GDPR will bring about a global sea change for adtech)
EU market is something like 25% of all the global market revenue, both for total industry and for the main international players individually. 25% of total revenue is large enough to adapt instead of avoiding the market, and it would be expected that every multinational player will be compliant, and thus also require their suppliers to be compliant - i.e. Google won't be buying data from a random adtech company if it might be "contaminated" with EU data obtained without proper procedures, the potential financial risk is just too great.
I felt the point that adtech isn't advertising, but direct marketing, deserves to be called out as important.
I'll play the devil's advocate and say that I'm actually disappointed by this development. A very long time ago when AdSense was young I was thrilled by the idea that instead of being bombarded by stupid ads designed to cater to morons people (including myself) will be getting relevant ads - ideally, ads about stuff that I am actually willing to buy right now. Kinda like legilimency. Too bad that this will be impossible for a long time to come now.
Hmmm...just target it to the content of the site?
Just like targeting search ads to be relevant to the search?
Just like targeting search ads to be relevant to the search?
There are many sites which are topic agnostic, others which have less text and therefore are more difficult to classify by ad crawlers and target based on topic.
It's also difficult to conceive enough advertisers on the demand side for many niches. In this scenario targeted advertisement would fill in for the lack of demand
It's also difficult to conceive enough advertisers on the demand side for many niches. In this scenario targeted advertisement would fill in for the lack of demand
[deleted]
> I just said greatly simplifies what the GDPR actually utters, in bureaucratic legalese
You can read and understand the whole thing in about 30m, as a lay-person.
You can read and understand the whole thing in about 30m, as a lay-person.
Tracking IP address for SAAS companies is important for defending chargeback claims.
For e.g when a customer demands a chargeback through their bank, Stripe notes down the IP address of every transaction. It is important to note this IP address and check if the user created an account using the same IP address. How are SAAS companies to provide sufficient usage proof when it comes to defend chargebacks?
For e.g when a customer demands a chargeback through their bank, Stripe notes down the IP address of every transaction. It is important to note this IP address and check if the user created an account using the same IP address. How are SAAS companies to provide sufficient usage proof when it comes to defend chargebacks?
You would be allowed to track IP addresses to prevent fraud. This is from Recital 47 of the GDPR:
"The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned."
"Legitimate interest" is one of the legal bases for processing personal data under the new regulation.
"The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned."
"Legitimate interest" is one of the legal bases for processing personal data under the new regulation.
For a long time I've been saying that we can do better with online advertising and revenue generation - and that there's a wide open market for the startup providing the solution.
There are a lot of practices that are distasteful that simply don't provide value that overrides their distastefulness.
But quite simply the revenue is there to be had, and nobody is going to venture off in a new direction when you can make easy money doing exactly what everybody else is doing.
The market may shift with GDPR, or it may just shift in europe. Or maybe the market doesn't shift at all, but some company policies change. I think in the end what causes the current incarnation of internet advertising to go away is going to just be a better idea.
There are a lot of practices that are distasteful that simply don't provide value that overrides their distastefulness.
But quite simply the revenue is there to be had, and nobody is going to venture off in a new direction when you can make easy money doing exactly what everybody else is doing.
The market may shift with GDPR, or it may just shift in europe. Or maybe the market doesn't shift at all, but some company policies change. I think in the end what causes the current incarnation of internet advertising to go away is going to just be a better idea.
The real answers here should be in the data, but as an anecdote I experienced something that genuinely impressed me the other day.
I’m in the market for a new mattress, and the other day on a whim I stopped at a mattress store (in real life). After I left the store, within an hour, I looked at a site I commonly look at (a political site), and saw a banner ad for the mattress store company.
In any case, it’s hard for me to believe that targeted advertising doesn’t work, because without it, I see adds in product categories I will never buy in.
I’m in the market for a new mattress, and the other day on a whim I stopped at a mattress store (in real life). After I left the store, within an hour, I looked at a site I commonly look at (a political site), and saw a banner ad for the mattress store company.
In any case, it’s hard for me to believe that targeted advertising doesn’t work, because without it, I see adds in product categories I will never buy in.
On the other hand I'm not in the market for a new mattress but I see advertisement for it everywhere. Might it just be that mattress ads are common this time of the year? A quick check of one of scandinavias more known bed and furniture chains (if ikea does not count...) shows they are having a sale of mattresses right now so if I didn't have ads blocked I would probably have seen some.
I've been anticipating something like an ad-tech bubble pop for years -- most digital ads don't seem to add much by way of tangible value and hijack the decrease to information-acquisition costs that make the Internet a value-add on society.
Oh, I'm not saying no one was ever influenced by digital ads, only that the wholesale adoption appears to be driven less by an understanding of their lift and more by "fear of missing out" by companies.
Oh, I'm not saying no one was ever influenced by digital ads, only that the wholesale adoption appears to be driven less by an understanding of their lift and more by "fear of missing out" by companies.
Aside from generating revenue for what are surely wasted impressions, why does the online ad industry constantly show users web ads for things they've already purchased?
Does this not represent conspicuously wasted spend on the part of these advertisers? It's been going on since the DoubleClick days and never ends. How can this industry bill clients with a straight face when their display decisions are made this crudely?
Does this not represent conspicuously wasted spend on the part of these advertisers? It's been going on since the DoubleClick days and never ends. How can this industry bill clients with a straight face when their display decisions are made this crudely?
This makes me glad I work for a company that makes money selling an actual product, and not just selling people’s data to the highest bidder.
GDPR may cause a drop in tracking-based ads, but websites can then just increase the number of ad slots for display and content-based ads. So what's changing is that the user is forced to choose between "less ads with tracking" and "more ads , no tracking". That 's not against the GDPR.
So, expect more ad-tech, not less.
So, expect more ad-tech, not less.
The second order effects of GDPR could actually be a boon to IT and tech:
* Accounts Payable analytics (should I pay this ad bill?)
* More Pay-per-Action (PPA). Less Pay-Per-View (PPV)
* Standardized pixel tracking managed by Advertisers
* Bot vs human agent detection (who/what actually viewed this ad?)I work for a large adtech company. It's funny how people think they're tracked. Besides websites like Google and Facebook there is no personal information stored. No emails, no names, no way to figure out who that person actual is. Not sure why everyone is freaked out about personalized ads.
I've just published a post about how I prepare my blog and side-project for GDPR:
https://news.ycombinator.com/item?id=17063156
https://news.ycombinator.com/item?id=17063156
Surprised the pop up doesn't say "agree to tracking and you'll be shown fewer and more relevant ads" and when they click decline "you will see 2x as many ads, are you sure?". Hardball!
Finally!
Can anyone from an adtech company shine some light on what work life is right now with the deadline of May 25 approaching? Curious to learn more.
The introduction of the article itself reads as an advertisement for shorting "adtech". What stock would you propose that would be?
Surreal to see people cheering on an attack on memory itself.
https://www.youtube.com/watch?v=gbYXBJOFgeI
https://www.youtube.com/watch?v=gbYXBJOFgeI
That link has nothing to do with this.
Also, GDPR has news, archival, public interest, and free speech exceptions, soooo maybe read the damn thing before posting FUD?
Also, GDPR has news, archival, public interest, and free speech exceptions, soooo maybe read the damn thing before posting FUD?
It really does. This is how incrementalism works so well. The exceptions[0] you cite are for practical purposes pointless; since you would need to defend your use of them, and the regulations can be incrementally tightened.
The EU def of free speech is absurd anyway, the recent pug owner who got a fine for a dog trick is a harbinger.
GDPR is about compliance. It further normalizes the idea that the gov can regulate memory, all the way down to who visited my property (if I was in the shrinking EU).
[0] https://ico.org.uk/for-organisations/guide-to-the-general-da...
The EU def of free speech is absurd anyway, the recent pug owner who got a fine for a dog trick is a harbinger.
GDPR is about compliance. It further normalizes the idea that the gov can regulate memory, all the way down to who visited my property (if I was in the shrinking EU).
[0] https://ico.org.uk/for-organisations/guide-to-the-general-da...
[deleted]
> Advertising isn’t personal, and doesn’t have to be.
Customers are being educated by companies, personal experience and news media why they are seeing the ads they are being shown. Just because advertising doesn't have to be personal, doesn't make that a sufficient argument for not doing it.
> Advertising makes brands.
Certainly brands are useful for trust, but often brand dominance blinds customers from smaller players and solutions. It's a trade-off.
> Advertising carries an economic signal.
Are there no other signals to determine economic strength of a company? Good advertising should project value and tilt perception in their favor.
> Advertising sponsors media, and those paid by media.
Companies study their customers without cookies to learn where better to advertise for them. This isn't new because of cookies. Tracking cookies gave the ability for small advertisers to understand their customers and their other consumption in ways that only the largest marketers could.
> Adtech is built to undermine the brand value of all the media it uses, because it cares about eyeballs more than media, and it causes negative associations with brands.
The author keeps making the assumption that strong brands are better than aligning customers with products that fit them well.
> Adtech wants to be personal. That’s why it’s tracking-based. Though its enthusiasts call it “interest-based,” “relevant” and other harmless-sounding euphemisms, it relies on tracking people.
The author again is throwing the baby out with the bathwater with no imagination for regulatory controls to limit the scope of access for customer data.
> Adtech spies on people and violates their privacy.
Emotional language, privacy is something that isn't monolithic for all people. There is nuance here.
> Adtech is full of fraud and a vector for malware.
So is the internet at large.
> Adtech incentivizes publications to prioritize “content generation” over journalism.
And on the other side of the coin, adtech incentivizes growth of smaller outfits to be competitive because it allows advertisers to find their platform. The author failed to mention all of the new media companies that have sprouted up now that they can compete with larger outfits. Customers have never had more choice. Who is to say the bias of a large firm is more advantageous than a smaller firm?
> Intermediators take most of what’s spent on adtech. Bob Hoffman does a great job showing how as little as 3¢ of a dollar spent on adtech actually makes an “impression. The most generous number I’ve seen is 12¢.
It's not about brand impressions. It's about conversions.
> Adtech gives fake news a business model, because fake news is easier to produce than the real kind, and adtech will pay anybody a bounty for hauling in eyeballs.
This is being worked on right now by the adtech platforms, it has a ton of visibility and public interest.
> Adtech incentivizes hate speech and tribalism by giving both—and the platforms that host them—a business model too.
Tribalism is not inherently a bad thing. Hate speech is a symptom of hate. Adtech is not making people hate each other. Hate speech is widely decried and has tons of visibility and public interest.
> Adtech relies on misdirection.
Again the author implictly is valuing brand presence over customers finding what they want.
> Compared to advertising, adtech is ugly.
Not ugly == expensive. Is that added cost necessary in helping customers find the right products and services? If not, it's superfluous.
> Adtech has caused the largest boycott in human history.
Which shows that the system can be worked around by users when it is too onerous.
Customers are being educated by companies, personal experience and news media why they are seeing the ads they are being shown. Just because advertising doesn't have to be personal, doesn't make that a sufficient argument for not doing it.
> Advertising makes brands.
Certainly brands are useful for trust, but often brand dominance blinds customers from smaller players and solutions. It's a trade-off.
> Advertising carries an economic signal.
Are there no other signals to determine economic strength of a company? Good advertising should project value and tilt perception in their favor.
> Advertising sponsors media, and those paid by media.
Companies study their customers without cookies to learn where better to advertise for them. This isn't new because of cookies. Tracking cookies gave the ability for small advertisers to understand their customers and their other consumption in ways that only the largest marketers could.
> Adtech is built to undermine the brand value of all the media it uses, because it cares about eyeballs more than media, and it causes negative associations with brands.
The author keeps making the assumption that strong brands are better than aligning customers with products that fit them well.
> Adtech wants to be personal. That’s why it’s tracking-based. Though its enthusiasts call it “interest-based,” “relevant” and other harmless-sounding euphemisms, it relies on tracking people.
The author again is throwing the baby out with the bathwater with no imagination for regulatory controls to limit the scope of access for customer data.
> Adtech spies on people and violates their privacy.
Emotional language, privacy is something that isn't monolithic for all people. There is nuance here.
> Adtech is full of fraud and a vector for malware.
So is the internet at large.
> Adtech incentivizes publications to prioritize “content generation” over journalism.
And on the other side of the coin, adtech incentivizes growth of smaller outfits to be competitive because it allows advertisers to find their platform. The author failed to mention all of the new media companies that have sprouted up now that they can compete with larger outfits. Customers have never had more choice. Who is to say the bias of a large firm is more advantageous than a smaller firm?
> Intermediators take most of what’s spent on adtech. Bob Hoffman does a great job showing how as little as 3¢ of a dollar spent on adtech actually makes an “impression. The most generous number I’ve seen is 12¢.
It's not about brand impressions. It's about conversions.
> Adtech gives fake news a business model, because fake news is easier to produce than the real kind, and adtech will pay anybody a bounty for hauling in eyeballs.
This is being worked on right now by the adtech platforms, it has a ton of visibility and public interest.
> Adtech incentivizes hate speech and tribalism by giving both—and the platforms that host them—a business model too.
Tribalism is not inherently a bad thing. Hate speech is a symptom of hate. Adtech is not making people hate each other. Hate speech is widely decried and has tons of visibility and public interest.
> Adtech relies on misdirection.
Again the author implictly is valuing brand presence over customers finding what they want.
> Compared to advertising, adtech is ugly.
Not ugly == expensive. Is that added cost necessary in helping customers find the right products and services? If not, it's superfluous.
> Adtech has caused the largest boycott in human history.
Which shows that the system can be worked around by users when it is too onerous.
And that’s on top of the main problem: tracking people without their knowledge, approval or a court order is just flat-out wrong. The fact that it can be done is no excuse. Nor is the monstrous sum of money made by it.
I use Piwik (https://github.com/matomo-org/matomo) and track visitors without their knowledge or consent, because I need analytics. Piwik is also configured to respect the "Do not track" header, so opting out is as easy as indicating that you don't wish to be tracked.
Is that wrong?
And I use Piwik precisely because it's self-hosted. I know for a fact your data doesn't get sold, because the data never hits any server except mine.
If this seems acceptable, it's also why legislation seems worrisome. There are a lot of corner cases that law tends to overlook. But hopefully the requirements won't be too onerous.
I use Piwik (https://github.com/matomo-org/matomo) and track visitors without their knowledge or consent, because I need analytics. Piwik is also configured to respect the "Do not track" header, so opting out is as easy as indicating that you don't wish to be tracked.
Is that wrong?
And I use Piwik precisely because it's self-hosted. I know for a fact your data doesn't get sold, because the data never hits any server except mine.
If this seems acceptable, it's also why legislation seems worrisome. There are a lot of corner cases that law tends to overlook. But hopefully the requirements won't be too onerous.
I don't see how self-hosting has anything to do with it honestly. This is about tracking people without their consent. It's about preserving rights of individuals. Self hosting is no more or less acceptable than third party hosting. It's not a technical issue.
So is your position that website owners should have no visiblity at all on their visitors, and no way of knowing how many people are using it?
They can know how many people, as long as they don't store personal information. Keeping a counter doesn't require consent.
Keeping a reliable counter of meaningful interactions is hard without personal data to correlate unique users.
> Keeping a reliable counter of meaningful interactions is hard without personal data to correlate unique users.
It's hard if visitor numbers would directly translate into revenue or similar. The trouble you're running in then is discerning organic hits from clickfarming.
If all you care about is when, where what content is popular on your website, there's a pretty simple method: Tally 200 and 304 responses. 200 tells you how many visits you get. 304 tells you, how often people hit refresh, or re-visit your page within the expiration time of the URL that 304s.
Also there's little value in identifying individual visitors. Getting a coarse idea where visitors are located in the world might be nice (for a regional news outlet for example). So just slap some coarse grained. GeoIP on it.
It's hard if visitor numbers would directly translate into revenue or similar. The trouble you're running in then is discerning organic hits from clickfarming.
If all you care about is when, where what content is popular on your website, there's a pretty simple method: Tally 200 and 304 responses. 200 tells you how many visits you get. 304 tells you, how often people hit refresh, or re-visit your page within the expiration time of the URL that 304s.
Also there's little value in identifying individual visitors. Getting a coarse idea where visitors are located in the world might be nice (for a regional news outlet for example). So just slap some coarse grained. GeoIP on it.
Ok, so it’s hard. Nobody is entitled to that being easy in the way that they are to privacy.
What privacy? Knowing that user dhsidhujdjdowhdyyehheis is using my website is not an infringement on your privacy!
Why do you think you can control what I do with data you send to me? Don't send me data I'd you don't want me to have it.
Why do you think you can control what I do with data you send to me? Don't send me data I'd you don't want me to have it.
Why do you think you can control what I do with data you send to me?
Are you really interested in rehashing this conversation? You got plenty of answers last time¹, I doubt you'll get new ones
¹ https://news.ycombinator.com/item?id=16957978
Are you really interested in rehashing this conversation? You got plenty of answers last time¹, I doubt you'll get new ones
¹ https://news.ycombinator.com/item?id=16957978
Obviously no one said anything convining. Sure, it's law under the gdpr and I'll comply. That doesn't mean I think it's a reasonable law.
I'm just saying there's no point starting over, you'll just get the same kind of responses. You should preempt them if you're hoping to get anything new. Though I doubt you'll get it anyway.
Why do you think I can’t photograph your face?
Don’t reflect light in my direction if you don’t want me having pictures of you!
Don’t reflect light in my direction if you don’t want me having pictures of you!
> Why do you think you can control what I do with data you send to me?
Legal protections, like the GDPR.
Legal protections, like the GDPR.
Website owners can have visibility on their visitors if those visitors explicitly consent to it.
Not sure what is so difficult to understand about this.
Not sure what is so difficult to understand about this.
So if I don't think that Walmart should be able to record me with security cameras while I'm in the store I should have the right to demand that they ask me to sign a waiver before entering the store? Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?
GDPR has exemptions for security. Your free to track information for the purposes of blocking vulnerability bots, but only the minimum data required for that purpose... and your visitor's data cannot be used for other applications without their consent.
> Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?
No. Property "rights" are secondary to human rights. Like, Walmart can't knowingly sell poison as food just because it's their property...
In your example, Walmart is free to record you on security cameras for security / theft purposes. However, they can't record what you're looking at and reuse that information for targeted advertising without consent - profling is simply not required to do business, so your right not to be profiled wins.
> Shouldn't it be Walmart's right to do what they want on their property, and my right to decide not to visit Walmart if I don't agree with that. Isn't the converse an infringement of Walmart's rights?
No. Property "rights" are secondary to human rights. Like, Walmart can't knowingly sell poison as food just because it's their property...
In your example, Walmart is free to record you on security cameras for security / theft purposes. However, they can't record what you're looking at and reuse that information for targeted advertising without consent - profling is simply not required to do business, so your right not to be profiled wins.
> “they can't record what you're looking at and reuse that information for targeted advertising without consent”
What law prevents them from doing this?
What law prevents them from doing this?
The actual Walmart? Nothing. The previous poster used Walmart's security cameras as a strawman argument against GDPR, which I expanded on.
Why are people obsessed with companies rights? Do they not have enough already?
There's an asymmetry between what a company can do politically/legally given it's resources and what an individual can do. This is why countries generally have some kind of laws protecting consumers.
Security cameras recording footage and it not being used in 99.999% of the time when no crime occurs is fine. The tapes aren't kept forever. Just as having server logs to identify malicious actors i.e. hackers or scammers is fine. What's not fine is e.g. running facial recognition on the security camera footage, or figuring out who bought what (cough Amazon Go).
There's an asymmetry between what a company can do politically/legally given it's resources and what an individual can do. This is why countries generally have some kind of laws protecting consumers.
Security cameras recording footage and it not being used in 99.999% of the time when no crime occurs is fine. The tapes aren't kept forever. Just as having server logs to identify malicious actors i.e. hackers or scammers is fine. What's not fine is e.g. running facial recognition on the security camera footage, or figuring out who bought what (cough Amazon Go).
Sometimes, guaranteeing freedom for one party requires taking away freedom/rights from another party. For example freedom from slavery means taking away the right to have slaves. Society has to make a choice: which one is more important? In case of GDPR, the EU has chosen: the privacy of citizen is more important than business concerns.
I'm not 100% sure, but I believe the cameras at Walmart are for security only. I don't believe Walmart is using facial-recognition technology to identify visitors, track their behaviors (which aisles they visit, how long they look at specific products, etc.) and then using it to other retailers for them to then target those visitors with ads.
OK, it's the petrol station part of the supermarket, but
"Tesco is set to install hi-tech screens that scan customers' faces in petrol stations so that advertisements can be tailored to suit them, it has been reported.
The retailer will introduce the OptimEyes screen, developed by Lord Sugar's Amscreen, to all 450 of its UK petrol stations, in a five-year deal, according to The Grocer.
The screen, positioned at the till, scans the eyes of customers to determine age and gender, and then runs tailored advertisements."
https://www.theguardian.com/business/2013/nov/03/privacy-tes...
"Tesco is set to install hi-tech screens that scan customers' faces in petrol stations so that advertisements can be tailored to suit them, it has been reported.
The retailer will introduce the OptimEyes screen, developed by Lord Sugar's Amscreen, to all 450 of its UK petrol stations, in a five-year deal, according to The Grocer.
The screen, positioned at the till, scans the eyes of customers to determine age and gender, and then runs tailored advertisements."
https://www.theguardian.com/business/2013/nov/03/privacy-tes...
Consent isn't the only lawful basis for processing personal data.
> It's about preserving rights of individuals.
I'm not sticking up for all the big data perverts, but what about an individuals right to speak freely and disclose information they have observed/recorded? The 'right to be forgotten' seems at odds with everyone else's right to remember and disclose occurances.
I'm not sticking up for all the big data perverts, but what about an individuals right to speak freely and disclose information they have observed/recorded? The 'right to be forgotten' seems at odds with everyone else's right to remember and disclose occurances.
That is not the case. The "right to be forgotten" is not absolute. There are lawful bases for processing under which the right to be forgotten does not apply.
Go read GDPR article 17.3, it's easy to read. A few things for which the right to forgotten does not apply:
- exercising the right of freedom of expression and information
- for compliance with a legal obligation (e.g. keeping records for tax reporting)
- for public interest reasons related to health, science, historical research
Seriously, there is too much FUD about the GDPR.
Go read GDPR article 17.3, it's easy to read. A few things for which the right to forgotten does not apply:
- exercising the right of freedom of expression and information
- for compliance with a legal obligation (e.g. keeping records for tax reporting)
- for public interest reasons related to health, science, historical research
Seriously, there is too much FUD about the GDPR.
Yes! The fud keeps increasing every time another gdpr related post pops up here.
I'm 60% sure it's people who read articles from Adtech Corporations about GDPR and not from people in the EU having to deal with it.
The only bad thing that I've noticed about GDPR is that some niche sites that rely on ad revenue are getting fucked over by Google (if you turn off personalized tracking for your visitors you still need the consent to track, there is no difference) so their income might break down.
That's quite sad but on the other hand they're exploring alternative methods of income and I'm certain adtech will adapt.
The only bad thing that I've noticed about GDPR is that some niche sites that rely on ad revenue are getting fucked over by Google (if you turn off personalized tracking for your visitors you still need the consent to track, there is no difference) so their income might break down.
That's quite sad but on the other hand they're exploring alternative methods of income and I'm certain adtech will adapt.
I doubt it's only that. I think it's also the tendency of people nowadays to only read titles and not to investigate further. I think some people are triggered by the phrase "right to be forgotten" and they jump to conclusions without finding out what it's really about.
The EU cookie law was almost the same issue, barely anyone implemented it and those who did did so poorly or incorrectly.
This time it bites back tho.
This time it bites back tho.
Thanks for the direction. I've read the GDPR a few times but it is (intentionally) non-specific on many implementation details. As I alluded to in comment, 17.3(a) seems like it would work as a global excemption in practice. I'm not familiar with how court rulings that provide legal precedent have impact or are respected across the diversity of legal systems across the EU. By May 25th 2020, after a multitude of GDPR related cases and verdicts, the answer may be more clearly defined. (Or increasingly nuanced with even greater uncertainty ;-)
GDPR also doesn't forbid individuals to do pretty much anything. Article 2c "This Regulation does not apply [...] for a natural person in the course of a purely personal or household activity;" - you can speak freely and disclose information you have observed/recorded, but the business you are running can not.
And with application layer DDoS attacks and intrusions: surrender? Do not ban bad actors? Or outsource to Cloudflare that keeps an army of EU lawyers and is compliant?
Nah, that's a legitimate interest (the example given in Recital 47 is preventing fraud, which is similar). You can process it as long as you only use it for that purpose and delete it as soon as possible.
Are you also against access logs?
Only if you’re not scrubbing IP addresses and other PII within a reasonable window of time.
IP addresses are not pii. (Maybe personal data under the gdpr, but they are not pii.)
Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.
Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.
> Also, what pii is tracked (by default) by piwiki or ga or access logs? I certainly cannot think of anything.
Cookies and other artifacts in the request headers or query parameters that can identify a unique user.
Cookies and other artifacts in the request headers or query parameters that can identify a unique user.
Identify a unique user does not mean that it's pii if I cannot produce the real world identity of the user from the cookie.
True! But some cookies are usually tied to a user account, with an email address, and/or other PII.
How careful are you with tacking cookies to requests? Be mindful, and keep documentation.
How careful are you with tacking cookies to requests? Be mindful, and keep documentation.
Under the GDPR that's PII. IP Addresses too. Personal Data is any data relating to a natural person, if you can uniquely identify them that falls under the monitoring/profiling definition of the regulation.
"A much discussed topic is the IP address. The GDPR states that IP addresses should be considered personal data as it enters the scope of ‘online identifiers’. Of course, in the case of a dynamic IP address – which is changed every time a person connects to a network – there has been some legitimate debate going on as to whether it can truly lead to the identification of a person or not. The conclusion is that the GDPR does consider it as such. The logic behind this decision is relatively simple. The internet service provider (ISP) has a record of the temporary dynamic IP address and knows to whom it has been assigned. A website provider has a record of the web pages accessed by a dynamic IP address (but no other data that would lead to the identification of the person). If the two pieces information would be combined, the website provider could find the identity of the person behind a certain dynamic IP address. However, the chances of this happening are small, as the ISP has to meet certain legal obligations before it can hand the data to a website provider. The conclusion is, all IP addresses should be treated as personal data, in order to be GDPR compliant."
https://eugdprcompliant.com/personal-data/
PII or not PII it is still covered by GDPR.
https://eugdprcompliant.com/personal-data/
PII or not PII it is still covered by GDPR.
Piwik has several blog post about this very topic, for example: https://matomo.org/blog/2017/09/gdpr-potential-consequences-...
You can disable the tracking parts in Piwik, or you can assume a legal stance under one of the 6 exceptions like "Legitimate interests" (https://matomo.org/blog/2018/04/lawful-basis-for-processing-...).
You can disable the tracking parts in Piwik, or you can assume a legal stance under one of the 6 exceptions like "Legitimate interests" (https://matomo.org/blog/2018/04/lawful-basis-for-processing-...).
Thanks, that's very interesting! I wasn't aware that IP address is considered personal data under GDPR... That seems exploitable...
In what way are you thinking IP address as PII is exploitable?
My first thought is that you could impersonate a person by spoofing their IP address. PII identifies a person but I don't think anyone is advocating for (solely) IP-address based bank logins.
My first thought is that you could impersonate a person by spoofing their IP address. PII identifies a person but I don't think anyone is advocating for (solely) IP-address based bank logins.
What site you run and why you need to log my personal data(IP,browser,other identifying data) do you have good reasons to keep it forever or you purge it after you analyze it?
How can a SAAS defend chargeback claims without IP address? Stripe stores IP address and the proof that the user paid for the subscription using the same IP and created an account ties them together.
Have a timeout, that may be a valid reason to store it for the chargeback limitation (120 days IIRC) but definitely not a valid reason to store it forever, as the parent post was talking about.
How is IP and browser personal data ? If you think it is, you should not be on the internet.
The article we're in the comments for is about the GDPR - as defined in article 4 of the GDPR, IP addresses constitute personal data. In many cases, a specific IP address, even a dynamic one, can be used to uniquely identify a natural person.
https://gdpr-info.eu/art-4-gdpr/
Even though in many cases this won't help you identify a specific natural person (ie, you don't know whether whether you're dealing with a specific person or multiple people on a shared connection, and an IP address on its own usually isn't enough for you to de-anonymize a person), they're still a considered a personal identifier, are often coupled to a general physical location, and are now explicitly legally protected.
Couple an IP address with a browser user-agent, and you've got the basis for a strong unique fingerprint for a specific person.
https://gdpr-info.eu/art-4-gdpr/
Even though in many cases this won't help you identify a specific natural person (ie, you don't know whether whether you're dealing with a specific person or multiple people on a shared connection, and an IP address on its own usually isn't enough for you to de-anonymize a person), they're still a considered a personal identifier, are often coupled to a general physical location, and are now explicitly legally protected.
Couple an IP address with a browser user-agent, and you've got the basis for a strong unique fingerprint for a specific person.
Under GDPR guidance, IP addresses are considered personal data because they can be used to identify an individual in a moment in time. Personal data consists of things that identify individuals, but also things that can be used in conjunction with other information to identify individuals.
You might not like that, but the regulators are pretty clear on this point.
You might not like that, but the regulators are pretty clear on this point.
> Under GDPR guidance, IP addresses are considered personal data because they can be used to identify an individual in a moment in time.
That's actually the most frightening thing I've heard in a long time. Does the GDPR actually make that connection? If so, it literally links people to an IP address, rather than simply a connection.
If that line is accurate, I'm surprised it hasn't been mentioned before, associating an IP address to an specific person. I have to believe you are wrong, otherwise the legal implications are scary.
For those that don't understand: my concern is that in the US, for a long time, in copyright claims by the RIAA or MPAA, for example, was to go after someone because of an IP address, a common defense was basically: An IP Address is not a person. The above commenter made the claim that an IP address alone can be associate a specific person. So, I'm wondering if 1) that's accurate and 2) what are the ramifications of an IP address being a person in the world of law enforcement?
That's actually the most frightening thing I've heard in a long time. Does the GDPR actually make that connection? If so, it literally links people to an IP address, rather than simply a connection.
If that line is accurate, I'm surprised it hasn't been mentioned before, associating an IP address to an specific person. I have to believe you are wrong, otherwise the legal implications are scary.
For those that don't understand: my concern is that in the US, for a long time, in copyright claims by the RIAA or MPAA, for example, was to go after someone because of an IP address, a common defense was basically: An IP Address is not a person. The above commenter made the claim that an IP address alone can be associate a specific person. So, I'm wondering if 1) that's accurate and 2) what are the ramifications of an IP address being a person in the world of law enforcement?
No, the GDPR does not actually link people to an IP address. The GDPR never even refers to an IP Address, and where it refers to an Internet address, it is clear it's referring to email addresses.
The ICO (furthermore) has given guidance that they don't think an IP address is uniquely identifying an individual, and have confirmed this to me on the phone.
Where you get into trouble is in transmitting your browser logs/activity to a third party who wants to keep them for their own purposes (e.g. Google). In this circumstance, you have to let people know that you've done this, and to transmit their preferences that you receive onward.
The ICO (furthermore) has given guidance that they don't think an IP address is uniquely identifying an individual, and have confirmed this to me on the phone.
Where you get into trouble is in transmitting your browser logs/activity to a third party who wants to keep them for their own purposes (e.g. Google). In this circumstance, you have to let people know that you've done this, and to transmit their preferences that you receive onward.
Yes, it explicitly mentions it, because it's actually very often true. Of course there are plenty of examples where it would be extremely difficult to link to an individual, but there are tonnes of examples where it's extremely easy. GDPR says that because it's sometimes easy, you have to consider it personal data.
Again, it's not always saying an IP address is a personal identify. It just is often enough.
Again, it's not always saying an IP address is a personal identify. It just is often enough.
> Again, it's not always saying an IP address is a personal identify. It just is often enough.
Well, that's not what you said or implied. I'm just thinking of all the cases in the US were the defense is you can't assume that an IP address ties to a specific person. Anyone could use the computer, or someone could attach to an open wifi.
Basically, if the legal argument is the IP address can be associated with a person, that raises legal concerns.
Well, that's not what you said or implied. I'm just thinking of all the cases in the US were the defense is you can't assume that an IP address ties to a specific person. Anyone could use the computer, or someone could attach to an open wifi.
Basically, if the legal argument is the IP address can be associated with a person, that raises legal concerns.
I said they can be used to identify an individual in a moment in time. That's correct.
Can it always identify an individual? No. Is the standard of identification good enough for a criminal case? Certainly not. But why are you comparing these? The GDPR is a standard about privacy and data protection; a UK postcode (like a zip code in the US) is considered personal data for exactly the same reason.
Can it always identify an individual? No. Is the standard of identification good enough for a criminal case? Certainly not. But why are you comparing these? The GDPR is a standard about privacy and data protection; a UK postcode (like a zip code in the US) is considered personal data for exactly the same reason.
The ICO does not consider IP addresses personal data since more than one person could use a computer in a household.
That's not true; I can only assume you're reading the 2011-era DPA guidance.
Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities:
https://ico.org.uk/for-organisations/guide-to-the-general-da...
As another commenter has mentioned, this is included in the legislation. There isn't much interpretation to apply here.
Under GDPR, an IP address must explicitly be considered as personal data, and any processing of them must be written in the documentation of the data processing activities:
https://ico.org.uk/for-organisations/guide-to-the-general-da...
As another commenter has mentioned, this is included in the legislation. There isn't much interpretation to apply here.
Yes it's absolutely true, insofar as I do not have to obtain someone's consent to have logs of their IP address (which is what we're talking about[1])
[1]: https://news.ycombinator.com/item?id=17060280
The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not under any requirement to actually identify an individual with your IP log.
[1]: https://news.ycombinator.com/item?id=17060280
The GDPR requires informing of use, transmitting preference, and protecting rights, of things that can potentially identify an individual, but this is easy to accommodate by simply not being an asshole. You're not under any requirement to actually identify an individual with your IP log.
Jurisprudence in this area disagrees with you:
"online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user"
http://curia.europa.eu/juris/document/document.jsf?text=&doc...
This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data).
So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig.
I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example).
I understand that's not the outcome you're looking for.
"online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that [..] that data are necessary to facilitate and charge for the specific use of those services by that user"
http://curia.europa.eu/juris/document/document.jsf?text=&doc...
This is related to the DPA; but the GDPR doesn't change anything here, only strengthens it (i.e. making IP addresses explicitly personal data).
So if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig.
I have not read any legal opinion that agrees with yours. I have also been to ICO events where they have stated they expect to treat it as personal data. That's reflected in their site (I gave you a specific example).
I understand that's not the outcome you're looking for.
I'm ignoring German opinions since Art 51-52 suggest only the ICO is going to be involved.
> if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig.
Using IP addresses for audit and security is best practices; I can use the IP address to make sure that a user isn't logging in from two countries at the same time (and then require a call e.g. to whitelist).
Thinking of an IP address in binary, as you're suggesting is extremely dangerous: The GDPR is not supposed to prevent you from thinking about what you're doing.
> That's reflected in their site (I gave you a specific example).
Your example doesn't come out and say IP Addresses are always personal data. Try again.
They've previously said the opposite:
https://ico.org.uk/media/for-organisations/documents/1591/pe...
> if you're arguing collecting IP addresses is absolutely necessary for you to facilitate the service, no, you don't need consent. But I would not want to have to defend that, since disabling collection is as simple as a webserver reconfig.
Using IP addresses for audit and security is best practices; I can use the IP address to make sure that a user isn't logging in from two countries at the same time (and then require a call e.g. to whitelist).
Thinking of an IP address in binary, as you're suggesting is extremely dangerous: The GDPR is not supposed to prevent you from thinking about what you're doing.
> That's reflected in their site (I gave you a specific example).
Your example doesn't come out and say IP Addresses are always personal data. Try again.
They've previously said the opposite:
https://ico.org.uk/media/for-organisations/documents/1591/pe...
So, three things. First, the case reference I gave you. That "German opinion" is from the Court of Justice of the European Union. This is the highest court that applies, and the ICO must obey it (until Brexit - and even after then, it's highly unlikely that the UK will interpret the GDPR in a different manner, at least for some time).
Second, I've said before IP addresses might not always be personal data. But the issue is they sometimes are, and if you record them without discrimination then you're recording personal data. The old guidance says "An IP address is only likely to be personal data if relates to a PC or other device that has a single user" - ok, so are you able to not record IP addresses that do relate to a single-user device? No?
Third, the ICO do think IP addresses count. I've given you a GDPR reference already, even their DPA tool treats them as such:
https://ico.org.uk/for-organisations/making-data-protection-...
It genuinely doesn't matter what the ICO might have said in the past. Right now, they say IP addresses are personal data. The courts say that. The law says that. I've given you multiple references for all of this.
Second, I've said before IP addresses might not always be personal data. But the issue is they sometimes are, and if you record them without discrimination then you're recording personal data. The old guidance says "An IP address is only likely to be personal data if relates to a PC or other device that has a single user" - ok, so are you able to not record IP addresses that do relate to a single-user device? No?
Third, the ICO do think IP addresses count. I've given you a GDPR reference already, even their DPA tool treats them as such:
https://ico.org.uk/for-organisations/making-data-protection-...
It genuinely doesn't matter what the ICO might have said in the past. Right now, they say IP addresses are personal data. The courts say that. The law says that. I've given you multiple references for all of this.
> the case reference I gave you.
Says:
a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.
if you're not the Internet Service Provider, or more broadly, that you don't have "legal means which enable [you] to identify the data subject with additional data" then the ruling doesn't mean what you claim it says.
You're being intellectually dishonest by trying to tie irrelevant sources of information. That the high german court took a broader look than the European court is irrelevant.
> their DPA tool treats them as such
It says, as I've agreed, that an IP Address could be personal information. You've also agreed this position. The ICO does not consider IP addresses [by themselves] personal information.
What exactly are you still responding to?
Says:
a dynamic IP address registered by an online media services provider when a person accesses a website that the provider makes accessible to the public constitutes personal data within the meaning of that provision, in relation to that provider, where the latter has the legal means which enable it to identify the data subject with additional data which the internet service provider has about that person.
if you're not the Internet Service Provider, or more broadly, that you don't have "legal means which enable [you] to identify the data subject with additional data" then the ruling doesn't mean what you claim it says.
You're being intellectually dishonest by trying to tie irrelevant sources of information. That the high german court took a broader look than the European court is irrelevant.
> their DPA tool treats them as such
It says, as I've agreed, that an IP Address could be personal information. You've also agreed this position. The ICO does not consider IP addresses [by themselves] personal information.
What exactly are you still responding to?
That seems like a weak argument though. Two humans can also have same name and zipcode. They can also have same personal number and bank account number if they are in different countries. Without tracking and correlation, most information on its own is useless.
This reads like you are intentionally trying to misunderstand. GDPR has two categories of user information: direct identifiers and indirect identifiers.
Direct identifiers are pieces of data that allow to target a person, or a very small group of persons from a single data point. Indirect identifiers are anything that you could use to build a marketing cohort.
Combining a few indirect identifiers allows to target very specific groups of people. Or, using the very examples you quoted:
- The tuple (bank account number, country) is enough to target an individual.
- The tuple (full name, zip code) is enough to target a very small group of individuals. By adding just one more element you can identify individuals.[ß]
Each one of the four data points counts as user information under GDPR. Doesn't matter whether they are direct or indirect.
Disclosure: I wear the DPO hat at Smarkets. As a gambling company we are legally required to know quite a lot about our customers.
ß: For the nitpicking armchair lawyers: unless you happen to have a gated community for John Smiths.
Direct identifiers are pieces of data that allow to target a person, or a very small group of persons from a single data point. Indirect identifiers are anything that you could use to build a marketing cohort.
Combining a few indirect identifiers allows to target very specific groups of people. Or, using the very examples you quoted:
- The tuple (bank account number, country) is enough to target an individual.
- The tuple (full name, zip code) is enough to target a very small group of individuals. By adding just one more element you can identify individuals.[ß]
Each one of the four data points counts as user information under GDPR. Doesn't matter whether they are direct or indirect.
Disclosure: I wear the DPO hat at Smarkets. As a gambling company we are legally required to know quite a lot about our customers.
ß: For the nitpicking armchair lawyers: unless you happen to have a gated community for John Smiths.
I have no idea what you mean. I was not talking about GDPR.
Yes. That's The ICO's position:
https://ico.org.uk/media/for-organisations/documents/1591/pe...
https://ico.org.uk/media/for-organisations/documents/1591/pe...
Currently, or in relation to GDPR? What's your source?
https://ico.org.uk/media/for-organisations/data-protection-r... (20th Oct 2017):
> Like the DPA, the GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can be personal data
https://ico.org.uk/media/for-organisations/data-protection-r... (20th Oct 2017):
> Like the DPA, the GDPR applies to ‘personal data’. However, the GDPR’s definition is more detailed and makes it clear that information such as an online identifier – eg an IP address – can be personal data
> What's your source?
The ICO. I've called them up, and they've confirmed their 2011 interpretation of personal data:
https://ico.org.uk/media/for-organisations/documents/1591/pe...
An IP address is "personal data" in the same way that "lifestyle information" or a "location" is. That someone can combine an IP address with other information to personally identify someone is important, but it doesn't prevent me from logging personal data.
The ICO. I've called them up, and they've confirmed their 2011 interpretation of personal data:
https://ico.org.uk/media/for-organisations/documents/1591/pe...
An IP address is "personal data" in the same way that "lifestyle information" or a "location" is. That someone can combine an IP address with other information to personally identify someone is important, but it doesn't prevent me from logging personal data.
IP and browser fingerprinting is used to identify you around the internet, why would someone need to fingerprint me if it has good intentions. If you wnat some stats on who visits you like countries, what browsers and OSs they use , you can count them and discard the data after you would not need to keep it.
IP address alone on an anonymous web access log need not be. Start combining it with persistent cookies or a logged in user etc and it clearly becomes personal data as it is then enough to identify someone.
The clause in the regulation is quite clearly worded:
"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."
The clause in the regulation is quite clearly worded:
"Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."
So your face is also not personal data, in your opinion?
The sensitivity of data can change based on context. My name isn't sensitive until it's attached to something like browser history or medical files.
The sensitivity of data can change based on context. My name isn't sensitive until it's attached to something like browser history or medical files.
[deleted]
Anything and everything that’s about a person in any way is personal data.
I actually think you need to do some homework if you honestly think so.
IP and browser information are definitely PII, which is Personally Identifiable Information. Those are PII, because they can be used to personally identify an individual.
PII is not a GDPR term, by the way.
Correct. There is a similar concept, but it is not the same as PII in the US.
Recital 26:
To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.
Since the concepts mentioned in the comment, IP and browser information, are already being used to single people out for tracking, those particular types of information can definitely be viewed as the equivalent concept under GDPR, as defined in Recital 26.
Recital 26:
To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments.
Since the concepts mentioned in the comment, IP and browser information, are already being used to single people out for tracking, those particular types of information can definitely be viewed as the equivalent concept under GDPR, as defined in Recital 26.
Serious question: What are the odds of someone offical even noticing that you are in violation of GDPR? It's not like they'll enforce GDPR and collect $7.89 in fines from small businesses.
A good question. But that’s not how these things work. The law has to be self enforced or it’s useless - since as you say, how will small to medium businesses ever be caught violating?
Megacorps comply because of mega fines.
Small business comply because their owners or future buyers are a larger Corp who fears that their sub-subsidiary might be in violation, causing a future mega fine.
So small businesses who care about the value of their company follow these rules. It’s almost exactly the same reason small business buy software licenses. It’s not of fear of fines but because otherwise they don’t look like a serious company.
I question I have been wondering is how many companies will leave some violations such as data in backups - simply because removing it is too expensive so it’s a risk worth taking. I honestly haven’t understood how backup of data fits into the requirement to delete data of a certain age?
Megacorps comply because of mega fines.
Small business comply because their owners or future buyers are a larger Corp who fears that their sub-subsidiary might be in violation, causing a future mega fine.
So small businesses who care about the value of their company follow these rules. It’s almost exactly the same reason small business buy software licenses. It’s not of fear of fines but because otherwise they don’t look like a serious company.
I question I have been wondering is how many companies will leave some violations such as data in backups - simply because removing it is too expensive so it’s a risk worth taking. I honestly haven’t understood how backup of data fits into the requirement to delete data of a certain age?
GDPR has the concept of backups and their expiration windows covered.
I'll pick an example from my work. Data can be deleted from the active set, at which point it takes extra effort to retrieve it. (If you can't SELECT it anymore from the warm slaves, it's gone.) But as long as you can make a point-in-time-recovery from your backups, the data is still present in the inactive set. Using the inactive set requires, by definition, extra effort.
So you need to state that fact in the data protection/retention policy, AND put reasonable technical enforcement mechanisms ("controls") in place to ensure that backups are expired and fully deleted after a given retention period. The older your unexpired backups get, the less valuable they should become.
I'll pick an example from my work. Data can be deleted from the active set, at which point it takes extra effort to retrieve it. (If you can't SELECT it anymore from the warm slaves, it's gone.) But as long as you can make a point-in-time-recovery from your backups, the data is still present in the inactive set. Using the inactive set requires, by definition, extra effort.
So you need to state that fact in the data protection/retention policy, AND put reasonable technical enforcement mechanisms ("controls") in place to ensure that backups are expired and fully deleted after a given retention period. The older your unexpired backups get, the less valuable they should become.
All it takes is one disgruntled employee
Why would you care about someone official? I'd care more about a bot that is set up to save the officials some work.
Minimum fine is $20 million, isn’t it?
No. It's part of the calculation for the maximum fine.
The maximum fine is defined as €20,000,000 or 4% of your global anual turnover, whichever is largest.
The maximum fine is defined as €20,000,000 or 4% of your global anual turnover, whichever is largest.
Yep
> Up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher
https://www.gdpreu.org/compliance/fines-and-penalties/
> Up to €20 million, or 4% of the worldwide annual revenue of the prior financial year, whichever is higher
https://www.gdpreu.org/compliance/fines-and-penalties/
What are the odds of someone offical even noticing that you are in violation of GDPR?
Plenty of ordinary people will be actively looking for opportunities to file GDPR complaints. I know I will. This is a crusade. Taking the Internet back from adtech.
Plenty of ordinary people will be actively looking for opportunities to file GDPR complaints. I know I will. This is a crusade. Taking the Internet back from adtech.
Are you going after amazon or my neighbours small online flower business?
It depends, for example a local restaurant mini-chain has been doing some spamming and refused to take me off their list, so if I get a single message from them after May 26th, I'll definitely file a complaint. From the consumers perspective, the main GDPR effect is that things that previously were scummy but legal have now become forbidden, and some of the things that have been forbidden but not enforced now have an enforcement mechanism with teeth to make it happen.
If they have Google ads they’re fair game.
Why do you need analytics, aside from ads and ad-tech?
...to understand whether I'm reaching my target demographics e.g. for the sake of the success of my non-ad-related business?
How can you tell what demographic am I in just from my IP and browser fingerprinting? Do you have more sites or correlate the data with third parties?
I think is fine if you just count the browser,OS, and country the user is from but I don't think is OK to keep more details then that
I think is fine if you just count the browser,OS, and country the user is from but I don't think is OK to keep more details then that
And to see what devices you should support? If all your traffic mobile? Maybe the mobile version gets more love. Lots of old ie users? Guess you gotta use old school css.
Now that I think about t I’ve never used analytics for anything ad related.
Now that I think about t I’ve never used analytics for anything ad related.
If someone hits you from an iPhone 6 in turkey you can just incrementally your count of those two values without needing to store that IP 13.157.207.156 is in turkey and has an iPhone 6 and youve correlated that data through Facebook's ad network so that now they having a profile built around them despite not even having a Facebook account.
Everyone's been sucking up all the data they can just in case they need it, and actual people are being harmed by it through data breaches. I get why people are upset about these changes happening to their businesses, but what did everyone expect when the industry has failed to self regulate against their worst excesses? The rest of society isn't just going to let you hurt them so you can make more money
Everyone's been sucking up all the data they can just in case they need it, and actual people are being harmed by it through data breaches. I get why people are upset about these changes happening to their businesses, but what did everyone expect when the industry has failed to self regulate against their worst excesses? The rest of society isn't just going to let you hurt them so you can make more money
Analytics is a broad term, and covers things like "how many of my users use this new section of my website" or "Let's A/B test a new navigation menu".
Security, such as analyzing how quickly a form is filled out, or whether the person is coming from a location that is known to be home to a lot of fraud, and other such checks, for example.
Using that data as well to improve learning so we do a better job of detecting fraud and not flagging legitimate customers appropriately.
Also, using analytics to determine if a user is having issues on the site. For example, are users having a difficult time filling out forms, or becoming confused, and being able to provide help in an appropriate manner.
These are just two things I immediately thought of. Security, and customer support. I'm sure there are many other users of analytics aside from ads and ad-tech.
Using that data as well to improve learning so we do a better job of detecting fraud and not flagging legitimate customers appropriately.
Also, using analytics to determine if a user is having issues on the site. For example, are users having a difficult time filling out forms, or becoming confused, and being able to provide help in an appropriate manner.
These are just two things I immediately thought of. Security, and customer support. I'm sure there are many other users of analytics aside from ads and ad-tech.
To provide data for UX decisions?
You shouldn't need to keep any personal information on your visitors to get meaningful data.
How can AB testing work without storing personally identifiable information?
AB testing doesn't require personally identifiable information.
How do you bucket users into a control and enabled group without having some way of identifying them? (usually ip address)
You could for example bucket them based on the last digit of their IP address.
So, everyone whose IP address ends in 0, 1, 2, 3 or 4 gets the new version, everyone else gets the old version.
You don't need to store the IP address for that, you just need a rule that decides which version to serve as the user requests it.
So, everyone whose IP address ends in 0, 1, 2, 3 or 4 gets the new version, everyone else gets the old version.
You don't need to store the IP address for that, you just need a rule that decides which version to serve as the user requests it.
Why are you bucketing users? If you have some sort of current session for their presence on the site, flip a coin and assign them your A or B. Store nonpersonalized info about their experience on the site associated with the given A or B.
Generate stand-alone, opaque identifiers for whatever sessions you want to analyse. Make sure these tags are ephemeral and decoupled from anything else.
Then, store only the flow data, discard everything else. Or if you need to keep some data around for the test duration, delete all of it once your A/B test has concluded.
Then, store only the flow data, discard everything else. Or if you need to keep some data around for the test duration, delete all of it once your A/B test has concluded.
Sounds like you'll have some urgent reading to do when/if you receive your first GDPR access request.
Yes, that is wrong. You MUST tell your users that you are tracking them, and what the data you collect will be used for.
GDPR will help the big guys not hurt. The smaller guys it will be tough implmenting and make it more expensive in terms of expense to revenues.
I took ten minutes to implement GDPR on a small ecommerce website: we deleted Google Analytics (HTTP logs and carts tracking is more than enough) and replaced Facebook widgets by a simple link. Newsletter was already opt-in only, we don't sell private data, and user account deletion was already possible.
That seems extraordinarily flippant.
I can't imagine giving up Google Analytics for http logs on a content-driven site.
I can't imagine giving up Google Analytics for http logs on a content-driven site.
GA is useless if you don't know how to use it.
I can't imagine giving it up either, but that's because we actually use it to produce useful insights, not just look at our traffic and referrers which is probably what most people use it for in aggregate.
I can't imagine giving it up either, but that's because we actually use it to produce useful insights, not just look at our traffic and referrers which is probably what most people use it for in aggregate.
Our advanced use of GA was cart tracking from first visit to payment. Reviewing our use of the tool, we determined that anonymous tracking of carts evolution was more than enough for our needs. That means a) almost same feature set as what was used before and b) no nagging cookie screen for our users unlike our competitors (really small and near-insignificant improvement in itself, I know, but our biggest competitor uses a TRUSTe cookie screen which blocks the full view and is quite slow)
Why would you give up on GA? You’re already not allowed to store personal data in it according to their TOS so (assuming you’re abiding by them) you can just leave it running.
By default GA stores IP addresses, so you need to get consent about storing this personal data. There's a flag you can set to tell Google you want no IP addresses in your data collection.
'user account deletion was already possible.' Do you not use backups? How was this done within 10 minutes?
GDPR doesn't say you have to purge backups. That's nonsense spread by people who have assumed it's stupid without reading it.
"The individual can be assured that their personal data will not be restored back to production systems (except in certain rare instances, e.g., the need to recover from a natural disaster or serious security breach). In such cases, the user’s personal data may be restored from backups, but the controller will take the necessary steps to honor the initial request and erase the primary instance of the data again."
It sounds like you need to erase the data again even if you used a backup. That means you need a separate database of the entries you deleted. So it's still unclear how that could be integrated within 10 minutes.
It sounds like you need to erase the data again even if you used a backup. That means you need a separate database of the entries you deleted. So it's still unclear how that could be integrated within 10 minutes.
> It sounds like you need to erase the data again even if you used a backup. That means you need a separate database of the entries you deleted.
Which you would need anyway. What, you're gonna make previously-deleted users active again after a backup restore? Fixing references to deleted data from active data might be a little more work, but tombstoning the deleted users isn't hard.
Which you would need anyway. What, you're gonna make previously-deleted users active again after a backup restore? Fixing references to deleted data from active data might be a little more work, but tombstoning the deleted users isn't hard.
I’m going to bet a huge portion of websites do not delete data again upon backup. It’s the simplest implementation. Data deletion usually does not matter to the flow of business unless in specific cases.
As long as the backups expire within a reasonable amount of time there's no problem with this.
Doc Seals has been proclaiming that the ad tech bubble is going burst every time he appears on the Gillmor Gang. It's gotten to the point where he now sounds like a broken record. I guess he thinks that if he repeats it long enough it'll eventually come true. I'll be looking forward to his follow up appearances where he backtracks and explains why it hasn't.
I mention the GDPR briefly in my Google/DoubleClick essay: http://yuhongbao.blogspot.ca/2018/04/google-doubleclick-mozi...
This combined with this reality: https://www.reuters.com/article/us-iran-nuclear-bolton/bolto...
Means map makers will be in business soon. Might not be a bad idea to get some potasium iodide.
Means map makers will be in business soon. Might not be a bad idea to get some potasium iodide.
How is this related to GDPR or the adtech bubble?
Because it makes doing business with europe illegal. Sanctions are war. GPDR isn't war, but depending on who looks over the laws in europe, giant part of our economy will be illegal to europe also.
Or you can just, delete stuff when people ask you to? That's pretty much the only new burden of gdpr, and there are plenty of exceptions you can invoke.
Or you could avoid adtech and misleading clickbait, which everyone hates
>Since tracking people took off in the late ’00s, adtech has grown to become a four-dimensional shell game played by hundreds (or, if you include martech, thousands) of companies, none of which can see the whole mess, or can control the fraud, malware and other forms of bad acting that thrive in the midst of it.
Fraud? Malware? What does this have to do with adtech?
>And that’s on top of the main problem: tracking people without their knowledge, approval or a court order is just flat-out wrong. The fact that it can be done is no excuse. Nor is the monstrous sum of money made by it.
What a compelling argument /s. Is it wrong if I sit on my porch and record in a notebook the hair color of different people? Is it wrong if I observe that one of my coworkers has a Harley Davidson sticker on his laptop?
There is no AdTech bubble given that Adtech is a completely viable business model. These laws may shut down third party trackers but Ads are here to stay. If the EU ads were to create regulation such that Ads become an inviable business model they would simply tank their own economy given how many services/ content creators rely on ads.
edit: also I have to laugh since I was downvoted less than 20 seconds after posting. I'll post another statement that will make people mad
Ads are the reason the web is open and the reason poor people have free access to information. An ad free web is a web that only rich people can use.
Fraud? Malware? What does this have to do with adtech?
>And that’s on top of the main problem: tracking people without their knowledge, approval or a court order is just flat-out wrong. The fact that it can be done is no excuse. Nor is the monstrous sum of money made by it.
What a compelling argument /s. Is it wrong if I sit on my porch and record in a notebook the hair color of different people? Is it wrong if I observe that one of my coworkers has a Harley Davidson sticker on his laptop?
There is no AdTech bubble given that Adtech is a completely viable business model. These laws may shut down third party trackers but Ads are here to stay. If the EU ads were to create regulation such that Ads become an inviable business model they would simply tank their own economy given how many services/ content creators rely on ads.
edit: also I have to laugh since I was downvoted less than 20 seconds after posting. I'll post another statement that will make people mad
Ads are the reason the web is open and the reason poor people have free access to information. An ad free web is a web that only rich people can use.
Bunch of strawmen here.
> Is it wrong if I sit on my porch and record in a notebook the hair color of different people?
If you only count the number of redheads, you are in the clear. If you follow them around, find out where else they go, where they live, how many people live in their household, the household income, etc., you might violate some laws.
> Is it wrong if I observe that one of my coworkers has a Harley Davidson sticker on his laptop?
Of course not.
> Is it wrong if I sit on my porch and record in a notebook the hair color of different people?
If you only count the number of redheads, you are in the clear. If you follow them around, find out where else they go, where they live, how many people live in their household, the household income, etc., you might violate some laws.
> Is it wrong if I observe that one of my coworkers has a Harley Davidson sticker on his laptop?
Of course not.
lajhsdfkl(2)
>Fraud? Malware? What does this have to do with adtech?
A lot, actually. There are many vectors in which adtech and fraud/malware intermingle:
> XSS Attacks:
When your website loads HTML into a page without encoding it first, someone can insert HTML script tags that your browser will parse successfully, allowing arbitrary Javascript to execute in your browser. Malicious actors will then usually redirect you to further unsafe pages that will initiate more downloads or (depending on circumstances) compromise your active user session or credentials. All you need is an ad network that didn't take precautions for a malicious ad and you're serving malware to all downstream users.
>True Clickbait with a malware payload:
Less common nowadays in the sense I mean: Ads that are literally designed for you to click on them, giving the same result as above. We're talking things like "Punch out Osama Bin Laden!" from the early 2000s or "Click here to win a prize!" affairs, where there's no reason a user ought to be clicking on the ad except that they were, quite literally, baited into doing so.
>Normal Clickbait with a malware payload
Create some "interesting content", that just happens to also do all of the above. Miracle cures, "BIG cost savings", poorly vetted porn-ads, and so on. A lot of internet chum is of this type, and there's a great article analyzing it [1]
>Literal Scams:
Many ads presented on websites prey on low information individuals, the elderly, or the young, all of whom are less likely to know any better.
My point is, all of the above is served, with some regularity, over many ad networks today. This means in some sense, many ad networks are responsible for the ads they serve and the damage they cause their users; if not legally, at least morally.
[1] https://www.theawl.com/2015/06/a-complete-taxonomy-of-intern...
A lot, actually. There are many vectors in which adtech and fraud/malware intermingle:
> XSS Attacks:
When your website loads HTML into a page without encoding it first, someone can insert HTML script tags that your browser will parse successfully, allowing arbitrary Javascript to execute in your browser. Malicious actors will then usually redirect you to further unsafe pages that will initiate more downloads or (depending on circumstances) compromise your active user session or credentials. All you need is an ad network that didn't take precautions for a malicious ad and you're serving malware to all downstream users.
>True Clickbait with a malware payload:
Less common nowadays in the sense I mean: Ads that are literally designed for you to click on them, giving the same result as above. We're talking things like "Punch out Osama Bin Laden!" from the early 2000s or "Click here to win a prize!" affairs, where there's no reason a user ought to be clicking on the ad except that they were, quite literally, baited into doing so.
>Normal Clickbait with a malware payload
Create some "interesting content", that just happens to also do all of the above. Miracle cures, "BIG cost savings", poorly vetted porn-ads, and so on. A lot of internet chum is of this type, and there's a great article analyzing it [1]
>Literal Scams:
Many ads presented on websites prey on low information individuals, the elderly, or the young, all of whom are less likely to know any better.
My point is, all of the above is served, with some regularity, over many ad networks today. This means in some sense, many ad networks are responsible for the ads they serve and the damage they cause their users; if not legally, at least morally.
[1] https://www.theawl.com/2015/06/a-complete-taxonomy-of-intern...
> XSS Attacks
Not true with safeframes
The latter two can happen on the internet in general, third-party advertising is in no way a unique delivery vector.
Not true with safeframes
The latter two can happen on the internet in general, third-party advertising is in no way a unique delivery vector.
>safeframes
Safe frames are not the general solution that you make them out to be.
First, site owners have to actively choose to use safeframes. My personal opinion, just based on people I've spoken with about this, is that most businesses and individuals who run websites treat their ads as a black box and their security as an afterthought. This means any solution for security that isn't by-default and that non-technical site owners have to turn on themselves, with near total certainty, isn't going to be protecting users.
Plus, not all ad networks support it as of June 2017 [1]. In my view, it's less a solution than a "literally-crafted-by-the-ad-industry" [2] externalization of responsibility for users getting hacked due to poor network policing.
[1]https://www.monetizemore.com/blog/should-you-use-dfp-safe-fr...
[2] Page two of https://www.iab.com/wp-content/uploads/2014/08/SafeFrames_v1...
Safe frames are not the general solution that you make them out to be.
First, site owners have to actively choose to use safeframes. My personal opinion, just based on people I've spoken with about this, is that most businesses and individuals who run websites treat their ads as a black box and their security as an afterthought. This means any solution for security that isn't by-default and that non-technical site owners have to turn on themselves, with near total certainty, isn't going to be protecting users.
Plus, not all ad networks support it as of June 2017 [1]. In my view, it's less a solution than a "literally-crafted-by-the-ad-industry" [2] externalization of responsibility for users getting hacked due to poor network policing.
[1]https://www.monetizemore.com/blog/should-you-use-dfp-safe-fr...
[2] Page two of https://www.iab.com/wp-content/uploads/2014/08/SafeFrames_v1...
>What a compelling argument /s. Is it wrong if I sit on my porch and record in a notebook the hair color of different people? Is it wrong if I observe that one of my coworkers has a Harley Davidson sticker on his laptop?
As far as I know, there's an invasion of privacy tort in common law: https://torts.uslegal.com/intentional-torts/invasion-of-priv...
P.S. I am not a lawyer.
As far as I know, there's an invasion of privacy tort in common law: https://torts.uslegal.com/intentional-torts/invasion-of-priv...
P.S. I am not a lawyer.
I do not see how that applies to observing people when they have no reasonable expectation of privacy. And when using all these websites I'm pretty sure they put at the top of the ToS that they will be using your information.
The laws would hopefully stop the tracking of users. IS there a good reason why you can't analyze the page you put your ad in and decide what category on ads will fit, so on tech pages put tech related ads. Tracking me and creating a profile on me should be illegal. Showing ads is perfectly fine
KYC.
Google almost rabidly doesn't want to connect who is sponsoring with what they're sponsoring.
I'm an ad network that does (some) tracking of users. I make it a point to connect advertisers with the publishers I work with because I know all of my publishers. I think this service has value.
Whilst I charge substantially more than Google does, I'm confident I don't participate in any ad fraud. If a Google rep. suggests they don't serve ad fraud, let me know, because I have proof otherwise.
Google almost rabidly doesn't want to connect who is sponsoring with what they're sponsoring.
I'm an ad network that does (some) tracking of users. I make it a point to connect advertisers with the publishers I work with because I know all of my publishers. I think this service has value.
Whilst I charge substantially more than Google does, I'm confident I don't participate in any ad fraud. If a Google rep. suggests they don't serve ad fraud, let me know, because I have proof otherwise.
Can't you start a new kind of targeting, instead of tracking and analyzing the users you use your past expertise plus your data from non EU countries and profile the content, so on cat pictures you know what ads work well, on car sites you know what ads work, it would make more sense then seeing an IDE ad on a porn site.
Sure, but I (as an advertiser) don't want to buy advertising on cat pages, but to reach people who like cat pages. Google tells me this is their interest; that they have exhibited behaviours that lead them to believe this is their interest, and because they can make self-driving cars, I believe them.
... but: The truth is, it's just a cookie that is held by people who visited pages about cats, and people who like money.
... but: The truth is, it's just a cookie that is held by people who visited pages about cats, and people who like money.
The funny thing to me is even at the height of me allowing tracking... Ads based on my data were never good. Is there really a value being lost if we make ads non-personalized, or is this just a myth perpetrated to ensure data collection houses control the ad market?
> IS there a good reason why you can't analyze the page you put your ad in and decide what category on ads will fit, so on tech pages put tech related ads.
There isn't and this is what many people do. But that isn't the argument is it? Can you tell me why observing what people do on my website is unethical and why it should be made illegal?
Also can you explain why information that is placed on my server belongs to someone else if I didn't enter into a contract with them specifying that was the case?
If someone has access to your laptop and downloads their photos onto it, who do those photos belong to? Put another way, if someone shows you a photo, who does the memory of that photo belong to?
There isn't and this is what many people do. But that isn't the argument is it? Can you tell me why observing what people do on my website is unethical and why it should be made illegal?
Also can you explain why information that is placed on my server belongs to someone else if I didn't enter into a contract with them specifying that was the case?
If someone has access to your laptop and downloads their photos onto it, who do those photos belong to? Put another way, if someone shows you a photo, who does the memory of that photo belong to?
> Also can you explain why information that is placed on my server belongs to someone
Isn’t this more or less the gist of GDPR and “right to be forgotten” laws? That my personal data doesn’t automatically “belong” to anyone else just because I entered it onto a server?
> If someone has access to your laptop and downloads their photos onto it, who do those photos belong to?
Rights to creative works, unlike personal data already has rather well functioning legal frameworks. The author of a creative work doesn’t give up any right to the photo without very specific circumstances.
Isn’t this more or less the gist of GDPR and “right to be forgotten” laws? That my personal data doesn’t automatically “belong” to anyone else just because I entered it onto a server?
> If someone has access to your laptop and downloads their photos onto it, who do those photos belong to?
Rights to creative works, unlike personal data already has rather well functioning legal frameworks. The author of a creative work doesn’t give up any right to the photo without very specific circumstances.
>Isn’t this more or less the gist of GDPR and “right to be forgotten” laws? That my personal data doesn’t automatically “belong” to anyone else just because I entered it onto a server?
Yes the EU invented a new right for its citizens which is the prerogative of the EU because of their bastardized idea of what constitutes privacy. Privacy is a basic human right, that much is obvious. There is no human right however to be forgotten and there is no human right to not be observed when you are in public.
>Rights to creative works, unlike personal data already has rather well functioning legal frameworks. The author of a creative work doesn’t give up any right to the photo without very specific circumstances.
The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.
Yes the EU invented a new right for its citizens which is the prerogative of the EU because of their bastardized idea of what constitutes privacy. Privacy is a basic human right, that much is obvious. There is no human right however to be forgotten and there is no human right to not be observed when you are in public.
>Rights to creative works, unlike personal data already has rather well functioning legal frameworks. The author of a creative work doesn’t give up any right to the photo without very specific circumstances.
The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.
The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.
Maybe not technically, but in practice, yes. You may be able to keep them, but you can't actually open and view them. As per MAI Systems Corp. v. Peak Computer, Inc., loading something into RAM counts as copying, so you need a license to do that. And even if you had one once, it can be revoked (not all licenses are non-revokable).
Maybe not technically, but in practice, yes. You may be able to keep them, but you can't actually open and view them. As per MAI Systems Corp. v. Peak Computer, Inc., loading something into RAM counts as copying, so you need a license to do that. And even if you had one once, it can be revoked (not all licenses are non-revokable).
> The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully.
A valid point - the rights only address the USE of the photos. You can use them privately all you want and would not have to delete them (unless ordered by a court for whatever odd legal reason such as if they were stolen not uploaded).
The difference with personal info is that the lawmakers saw two choices: prevent the use or the keeping of the data. They chose to outlaw the keeping of the data - which is why this law is huge, invasive and clumsy. But it’s also the only reason it makes a difference at all imho. I don’t trust anyone to keep the personal data of millions of people safe.
A valid point - the rights only address the USE of the photos. You can use them privately all you want and would not have to delete them (unless ordered by a court for whatever odd legal reason such as if they were stolen not uploaded).
The difference with personal info is that the lawmakers saw two choices: prevent the use or the keeping of the data. They chose to outlaw the keeping of the data - which is why this law is huge, invasive and clumsy. But it’s also the only reason it makes a difference at all imho. I don’t trust anyone to keep the personal data of millions of people safe.
GDPR is focused a lot on regulating the use of the data. In particular, one of the key aspects is the limitation of processing to a particular use - very often business will have a reasonable GDPR-approved reason to get and have the data, but (since this was often used to circumvent earlier privacy legislation) now they'll be limited to using that data only for that reason.
For example, if I order pizza, the business (obviously) needs to have my delivery address; however, that obvious reason only applies for the actual delivery, and if they want to use that same address also for, say, direct marketing, then that's a separate use that's not covered and would (generally) need additional opt-in consent.
For example, if I order pizza, the business (obviously) needs to have my delivery address; however, that obvious reason only applies for the actual delivery, and if they want to use that same address also for, say, direct marketing, then that's a separate use that's not covered and would (generally) need additional opt-in consent.
> They chose to outlaw the keeping of the data
Which is not true. Under the GDPR, you are not allowed to "process" any data unless you have a legal ground for doing it. One such legal ground is consent, but it can be withdrawn and so at that point you need to "stop processing". The thing is, "processing" is a broad term and includes not just storage but basically anything that happens to the data. So even use is not allowed.
Which is not true. Under the GDPR, you are not allowed to "process" any data unless you have a legal ground for doing it. One such legal ground is consent, but it can be withdrawn and so at that point you need to "stop processing". The thing is, "processing" is a broad term and includes not just storage but basically anything that happens to the data. So even use is not allowed.
> There is no human right however to be forgotten
I don’t see the connection between what’s a right and what’s a law here. If a majority of people want something they tell their lawmakers to turn it into law. It’s not a fundamental human right it’s a law like any other.
I don’t see the connection between what’s a right and what’s a law here. If a majority of people want something they tell their lawmakers to turn it into law. It’s not a fundamental human right it’s a law like any other.
The distinction is that violating someone's rights is almost always unethical. Breaking the law is less so.
If someone has access to your laptop and downloads their photos onto it, who do those photos belong to?
Good analogy! They belong to the person who took them, as per copyright law, not to the owner of the laptop.
Good analogy! They belong to the person who took them, as per copyright law, not to the owner of the laptop.
The author of a creative work doesn't have the right to force me to delete something from my laptop if I obtained it lawfully. If a creator downloads their entire collection onto my laptop I can use that to train my models and target ads as I see fit.
Nope, as I mentioned in my other comment: https://news.ycombinator.com/item?id=17060447
Loading into RAM counts as copying, for which you need a license.
Loading into RAM counts as copying, for which you need a license.
Ypu can track as much as you want but let me know that you are recording my browser screen, my mouse movement, you try to fingerprint my browser using maybe bugs in the browser, so basically inform me, we can see the tracking code so is better you explain on how you use the data then the users to guess.
I'm not arguing against consumer protection and asking for consent. I'm arguing against stupidly burdensome regulation that practically makes ads as a monetization scheme impossible.
Despite the propaganda being thrown around on HN, GDPR only affects businesses that have operations in the EU.
It’s kind of interesting that the company that ads that people think are the most intrusive are from Criteo, a french company, while GDPR do its best to target US companies.
> GDPR do its best to target US companies
Citation needed.
Citation needed.
I am reminded of this, from Paul Graham, about his time at Yahoo: http://www.paulgraham.com/yahoo.html
"...The reason Yahoo didn't care about a technique that extracted the full value of traffic was that advertisers were already overpaying for it. If Yahoo merely extracted the actual value, they'd have made less."
I'm pretty sure that, the more we learn about how well advertising works, the less money people will be willing to pay for it. What's happening to billboards and newspapers right now is probably coming to several other industries soon.