Hacker News new | past | comments | ask | show | jobs | submit | spookybird's comments login

IANAL, but why would it be illegal. Isn’t that like saying a company can’t charge you for a product if you don’t want to pay for it. Tech crunch chooses tracking as its fee for reading its content. The law simply states that they must notify you of said tracking. It’s not a public service, and the content is generally pretty crap anyway.


Because under GDPR services cannot be conditional on giving unneeded personal information. How well this is enforced is a different matter.


Tracking and advertising cookies are hardly personal information as defined by GDPR, which has a very specific and well defined meaning - name, phone numbers, addresses, government-issued IDs.


GDPR explicitly considers ANY information which identifies you — even pseudonymously generated identifiers, or IPs, or similar stuff — as PII.


This is blatantly not true.

> ‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

If the tracking id cannot be correlated to a name, identification number, precise location data (not country level), then it's not PII as far as the law is concerned. The criteria is clear: "relating to an identified or identifiable natural person". There is no way that simply a session ID stored in a cookie can be traced to an identity IRL.

I fell that I know what I'm talking about as I designed and implemented an customer authentication system for a medium-sized company that is based in EU, needs to respect GDPR, and I worked closely with their lawyers and operations to make sure we are fully GDPR compliant, and we passed the relevant audits.


The word indirectly in "who can be identified, directly or indirectly" seems like it opens everything up. A session ID isn't directly PII, but it can be linked a user account and from there someone's name, address, etc.


> can be linked a user account

Which is still not PII. More importantly, 3rd party advertising cookies CANNOT be linked to a user account if you don't have code that stores them in your environment. CAN has a very limited meaning, whereas it requires all the preconditions to be true (i.e. I'm storing both 3rd party cookie ID, AND session ID, AND the tables have a correlation), it does not mean "COULD if more code was written".

> and from there someone's name, address

Only if you ask for AND store those. If you're asking for example for a real name and address for an e-commerce transaction, and you're passing them to the card processor, and not saving them anywhere, not even in logs, then you're not storing PII, and you CANNOT link tracking cookies and session ID to data.

Don't get me wrong, I'm still using Firefox containers, and uBlock Origin, and pi-hole, so I totally don't like to get tracked, even if anonymous. But the tendency on HN to label anything that could be used to track a user as PII is actually damaging, because it creates false expectations about how the law actually works and how much somebody is protected.


The law says that you must give free consent. Saying "we'll track you or else... (go away / pay up)" is arguable not free.

It doesn't really matter though because literally nobody it enforcing this part of the GDPR.


It’s enforced for the public sector. Which is frankly great in my opinion. Our communication departments have always been the black-sheep of privacy.

Between us, I’m not sure why they are so addicted to various tracking that tells them that absolutely no one clicked on 90% of their content, but they are, and they lack the technical ability to do it themselves without relying on frameworks that steal privacy information.


I believe people have gotten pretty good about auto accepting anything, in no small part due to the 'hey, just wanted to let you know we use cookies, like every other website on the planet!'.

But if people really did overwhelmingly say no, I just see no way for most of the internet to exist. You get overwhelmingly less per click/impression for 'dumb ads,' and news sites have already had to resort to click bait today. It'd pretty much guarantee anything not owned by one of the top 10 would be paywalled in some way.


Sites that rely on tracking to generate targetted ads might not exist. There are still plenty of sites that don't depend on ads, or get sufficient context without tracking. E.g. a car enthusiast forum doesn't exactly need tracking to know it should show car adverts.


I think the internet would stay much the same as it is now. Companies would simply be breaking the law. As a side effect, I think they'd be more willing to do other illegal things too, such as straight up selling your data. They're already breaking the law after all.


... yet.


I don't use instagram much aside from following a few people who take cool photos, but...

WHY would anyone who is genuinely unsure and looking for information on vaccinations either search instagram or even make it there and be exposed to these hashtags. It's not exactly an information rich platform.

It seems like people who are already established in the anti vax movement would be the only ones following this hashtag. In that case, censoring these tags does seem like it's a bit over the top. While I believe they are wrong, people should be allowed to think what they want and even share it with others who are like minded.

I just don't buy the argument that this is in some way protecting people from being exposed to misinformation and is simply facebook 'vaxwashing' for feel good credibility.


I like your comment, and it’s kind of comforting - because it means we don’t have to worry too much, as you suggest the anti-vaxxers are like a neat little self-contained cult who don’t venture out of their compound.

However, in reality, it’s probably a gradual process of belief change or formation - people don’t move from slightly unsure to frothing-at-the-mouth anti-vaxxer overnight. And this sort of disinformation may well be accessed and become influential to people who are part-way through that process.


WHY would anyone who is genuinely unsure and looking for information on vaccinations either search instagram or even make it there and be exposed to these hashtags. It's not exactly an information rich platform.

Because not everyone is personally information-rich. Just like back when large groups of people thought AOL was "the internet," there are people now who believe Facebook, or YouTube, or Instygram are "the internet." And those silos are their only source of information.

What are their alternatives, now that the internet has killed information?

Libraries are inconvenient (few locations, short hours; some of the libraries in my county are only open for a few hours two or three days a week). Outside of a few large cities, there is no more radio news. Quality TV news is hard to find. In large swaths of the United States there isn't a local newspaper anymore, and even if there was, you couldn't buy it (There must be 50 Starbucks in my city, but not one sells newspapers anymore. The other coffee shops followed suit. No papers at gas stations or supermarkets, either anymore. If you want a paper, you subscribe or go to the airport.)

The masses followed the information and their friends and ended up in social media hell. It's only natural for the organizations trying to target them to go there, as well.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: