Hacker News new | past | comments | ask | show | jobs | submit login
Formal GDPR complaint against Google’s internal data free-for-all (brave.com)
313 points by hadrien01 on March 16, 2020 | hide | past | favorite | 116 comments



I want Google to use my data in a "free for all." They have done incredible and useful things with it and in my opinion have been extremely responsible about it. If Google had a waiver I could sign allowing my data to be used for future developments I would sign it.

I hope they continue doing more cool stuff and measures like these don't end up limiting any future developments.

If anything I just wish I could more easily see what internal data all the advertising companies have on me. I'm sure they know more about me than I know about myself.


That's great, you should have that option. "Option" implies choice, however. I should have an option to meaningfully not agree to it. And "don't use Google services" doesn't actually cause Google to stop collecting data about an individual. Nothing short of "don't use internet" does, and even then only to an extent.

I've started reading "privacy agreement" for Google's "do not track me" browser extension the other day and it just seemed grotesque.


"They have done incredible and useful things with it and in my opinion have been extremely responsible about it"

It's impossible to know everything that they've actually done with your data, so I don't see how you can maintain that they've been responsible with it.


It's pretty easy to see data "leakage" from other services when it happens. Maybe google is just better at hiding this, but I doubt it.


Same. I give my data to Google and I know this. I wish there were more transparency about the people I don't actually give permission to or there is no workaround. Credit card companies, web trackers, ISPs, etc.


> I want Google to use my data in a "free for all." They have done incredible and useful things with it and in my opinion have been extremely responsible about it.

One arm of Google might be doing good things, but another arm might do bad things, like optimize engagement, ad clicking, manipulating buying behavior and stuff like that, or even worse.


The three things you just named are pretty up in the air on whether they're "bad."



That last link doesn't contain anywhere near enough information. Look at it a few times over the course of a month, and watch how the data changes over time… often seemingly retroactively.


That's wonderful but:

a) The law states they cannot do this arbitrarily and most of us may not want them to do the 'free for rall'.

b) I doubt that the 'free for all' produces many benefits beyond targeted ads.

Seriously curious, what 'cool stuff' does Google do today that fundamentally relies on this 'free for all'?

Traffic information is probably one nice thing that requires the sharing of data. We could totally narrow the kinds of information shared, and on what basis, quite a lot with that one.

What else?


I 100% agree. The fact that Google app on iOS can tell me where I parked my car is very useful to me. The fact that my docs and emails show up in Google search results is damned handy. And, as a Xoogler who has worked at a number of other large tech companies, I feel that Google has state-of-the-art controls over access to user data and logs. By no means is it a free-for-all.


> hundreds of ill-defined processing purposes, and unknown legal bases

I have worked in regulated markets for quite a long time. I can understand that many companies do not understand what it means to be compliant. For many years the tech industry has avoided many requirements that affect other engineering companies. Software is at the core of our society and cannot have a free pass any more. Now it's more important to be reliable than to move as fast as possible. I hope this is the end of the era of move fast and break things, software is now too critical for that.


What are you hoping to get as a result of increased regulation? Not as in "more careful software," I mean, what software are you hoping will be made more carefully?


For me, everything actuated by opaque models trained with user data and evaluated based on profit-oriented metrics (clicks, attention, ...).

One can dream.


GDPR is a good example on how treating information carefully is important.

Facebook, YouTube, etc spreading of missinformation is something that needs to be fixed for democracy to survive.

Apps like Uber that do not recognize its own employees and follow the strategy of running faster than laws are also a good example of something that is damaging our society.

Addictive loot boxes that prey on teenagers is another ugly one.

I will need more time to think to make a better list, but these are some of the ones I think need stronger regulation.


Uhh the last 200 years of IP law is proof regulation doesn't work, the corporations won every battle.

https://en.wikipedia.org/wiki/Copyright_Term_Extension_Act#/...

It was a blow out, the average person like yourself is too politically uninformed to know what to do. The only way out would to get rid of DRM entirely and reform IP law so that we owned our machines and software, you can't have privacy if every piece of software is client-server oriented like PC games have become over the last 20 years.

The videogame industry has been stealing PC game software since the late 90's starting with them rebadging PC RPG's they had in development as mmo's to confuse a lay public, after the early successes of Ultima online, everquest and guild wars 1, that lead us to Valve dropping steam in 2004, a piece of corporate malware wrapped around games. From 2004 to 2009, was the game industry cleaning house as PC games they had in development were either rebadged mmo, or were given steamworks integration, this lead to EA and ubisoft to make Uplay and Origin, more malware, client-server oriented bs.

IF you don't own the software you have no rights to your machine and your software can now be disabled remotely.

Going from dedicated servers, complete software ownership in teh 90's to this locked down dystopian hellscape of steam, Epic game store, Ubisoft Uplay, Bethesda launcher, EA's origin, and Battle.net launcher for activision games.

I have to wonder what you are smoking to think regulation will work this time, when everytime IP law came up for reform it was expanded everytime to remove basic rights of the citizens.


> Apps like Uber that ... follow the strategy of running faster than laws are also a good example of something that is damaging our society.

Re just the part about running faster than the laws: As best as I can tell, app based taxis exist solely because Uber ignored the laws - and good (in some cases) that they did as the laws were designed to protect the entrenched businesses that had no incentive to change regardless of how well they were working. Anecdotally, I've seen a huge increase in people taking Uber or Lyft to or from a happy hour when 10 years ago those same people would likely have decided to drive because calling a traditional Taxi was so much of a pain. Ignoring the laws is a weak criticism when sometimes that is the only way to achieve progress.

No comment on how they treat their employees - that is its own complicated issue that I won't comment on here.


It's worth noting that this is a COMPLAINT, not a RULING (e.g. as opposed to the fine that Google just got in Sweden, which is a ruling). The allegiations that Googles browser competitor Brave is making will have to be actually proven first.

Until then, it's just one competitor accusing another competitor of wrongdoing on their own web page.


This reads like bad content marketing. Why am I being asked to tweet every quick fact? Why do I need to download a PDF to read what is ‘Inside the Black Box’? Is this a privacy/data use complaint or an antitrust complaint?


It _is_ content marketing. Brave is in direct competition with Google for both browser eyeballs and ad revenue.

That doesn’t make it wrong but you are definitely seeing a marketing push.


I clicked the link and closed the tab the second I saw it was from Brave. They put out an anti-Google piece pretty much every other week, and they rarely have any substance. This one might (someone who isn't jaded by their track record can probably tell you in the comments here), but I'd be surprised.

They just want you to use their browser instead of Chrome's, and constant attacks on Google/Chrome is their primary marketing strategy (35 mentions of Brave on-page, Brave branding everywhere, giant "Download Brave" button at the end of the page, etc).


The irony is that their entire business would not exist if it wasn't for Google developing and open sourcing Chromium, yet they seem hell-bent on destroying the very hand that feeds them.


Isn't Firefox also open source?

Google isn't the hand that feeds them because of chromium. It's the hand that feeds them because of Google's privacy track record. If they weren't so invasive, then there would be no reason for brave to exist.


Well then why didn't they use Firefox as their base?


When you're fighting against a marketing giant, don't you think that a little bit of marketing is justified?


Interesting. To me, it didn't feel like I was asked to tweet these quick facts, it felt more like I was given the option for my convenience. I chose to ignore it, however, I understand that they want to encourage people to get exposure.


It's somewhat disingenuous to say that repeatedly "giving me the option for my convenience" is anything other than pushing me to take action.


Transparently soliciting a specific desired behavior doesn't fall within the traditional definition of disingenuous.

Does it bother you that a commercial entity with "a dog in the fight" is asking you to take action on its behalf?


The Greek Data Protection Authority provided some guidance on online tracking last month. In particular, the following was called out explicitly as a non-compliant practice:

> In the event of rejecting trackers, the user is constantly invited to make a new choice through a pop-up window, while the same does not apply if the user accepts trackers, in which case their choice is maintained for a longer period.

https://iapp.org/resources/article/cookie-guidance-from-gree...

That's not necessarily same context, but the main point still stands: By law, if you're invoking "consent" as the legal basis for collecting and processing data, consent must be freely given and as easy to withdraw as to provide. Provoking people to change their mind from "no" to "yes" but not the opposite is not considered to be freely-given.


Brave placed "Tweet this" buttons next to 5 bullet points on its page. In this setting, how could they conform to the consent standard you have articulated? Is the default opt-out (no tweet) enough? Must they offer a "tweet this" for some countervailing argument? If so, which argument?


You're absolutely right — Brave's behaviour is entirely transparent. The part that's disingenuous is the comment I was replying to, trying to argue that the multiple calls to action are anything but an attempt at driving social media engagement.


I am new to HN. If you down-vote me, please let me know why.

I'd like to understand what drives decisions around these parts.


I just upvoted you as I didn't see a problem with what you said, but asking people to tell you why they downvoted around here seems a losing battle. I've asked often enough without response.


The reason you won't get a response to such questions (and follow-up comments about downvotes get flagged and downvoted) is because discussion of voting is against the HN Guidelines[1]:

> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

[1]: https://news.ycombinator.com/newsguidelines.html


That might then lie in the eye of the beholder - I certainly didn't feel like being pushed or pressured at all but naturally your mileage might vary.


i'd bet you're in the minority there. anyone could just copy and paste the text to tweet it if they wanted to. multiple "calls-to-action" are definitely trying to drive user behavior


It might. (Buy now!) But I think (Buy now!) one can certainly (Buy now!) feel (Buy now!) differently. (Buy now!)


"Why do I need to download a PDF to read what is ‘Inside the Black Box’?

This is a little disingenuous to the point of almost gaslighting.

You need to 'click on a PDF' because it's 60 full pages of dense data in a spreadsheet.

It's 100% reasonable to provide a link to that data, it's exactly the right thing to do.

It's also fully reasonable to provide links to tweeting about specific issues, that's how information is shared in 2020.

Though on a level it's 'marketing' - the claims are that Google is in existential violation the law, this is not Walmart proclaiming they have 'lower prices and better service than Target'.


"Gaslighting"? I opened the PDF. If by "dense data in a spreadsheet" you mean rows like the very first one:

Category: Accounting

Purported processing purpose: “purposes such as accounting...”

Other discoverable processing purposes: “…such as…” is vague language that may conflate or omit many distinct processing purposes.

Data collected: BLANK

Data shared externally: BLANK

Explanation and examples: For example, when you purchase apps from the Play Store or products from the Google Store. Purported legal basis: Unknown

Give me a break, the legal reason in the first column. To me obvious reason this is a 60 page PDF is because they hope people don't open it and discover that they are full of shit.


"Give me a break, the legal reason in the first column. To me obvious reason this is a 60 page PDF is because they hope people don't open it and discover that they are full of shit."

No, this is unreasonable, essentially false.

It's a very comprehensive recording of the specific issues relevant to all of the Google properties that they could find.

It's perfectly reasonable that there are 'empty columns', it's a table of data, not a 'communications document'. Data won't apply in many cases.

Far from being 'full of shit' - it's the complete opposite.

What the data demonstrates very specifically is that there are literally a thousand different places users are supposedly informed of their rights while being acquiesced, that it's all very opaque, that it's obviously not comprehensive for any person, and essentially hostile to reasonable user experience.


> the legal reason in the first column

In GDPR terms, the "Legal Basis" is one of the following six values[1]:

  Vital Interest
  Public Benefit
  Legal Obligation
  Performance of Contract
  Legitimate Interest
  Consent
"Accounting" is not a Legal Basis.

Several might apply, including Legal Obligation, Performance of Contract, Consent, or Legitimate Interest. Stating the Legal Basis for processing is one of the requirements under the Right to Transparency[2]. Among other things, the Legal Basis affects other rights the Data Subject has. E.g. the Right to Erasure is much stronger for data collected under Consent than Legal Obligation.

On the face of it, it looks to me that Brave has a point: Google is not complying with some (frankly, rather simple) transparency requirements.

[1] GDPR Article 6 Section 1: https://gdpr-info.eu/art-6-gdpr/. [2] GDGPR Article 13 Section 1(c): https://gdpr-info.eu/art-13-gdpr/


I couldn't find the exact line from the citation in the pdf[1], but I assume "Accounting" means financial accounting ("For example, when you purchase apps from the Play Store or products from the Google Store."), which is a legal obligation?

[1] https://policies.google.com/technologies/retention#purpose-f...)


The fact that you have to guess is exactly the problem ;)

Accounting for SEC filings or whatnot are legal obligations. But processing an individual payment is also probably part of Performance of Contract, and Google explicitly mentions fraud detection on that same page, which is usually Legitimate Interest. To say nothing of whether that financial data is compiled into a user profile or used to train a model in some way.


I know more people who use Mastodon than Twitter, and “only” a few hundred thousand people are really active on Mastodon.


So that's great, but there are a Billion people on Twitter, it's used universally worldwide, which is why they use it.

It 'won't work' for me because I hate twitter and don't use it, it 'won't work for you' because you use Mastodon, but that's fine, 'Twitter' is the ideal, broadly convenient choice.


>This is a little disingenuous to the point of almost gaslighting.

You don't know what gaslighting is.


Attacking the credibility of an accuser to make them seem ridiculous or hysterical is what the modern application of 'gaslighting' implies.


I'm critical of the content.


It's a bold move to attack the main contributor of the opensource project upon which your business is based...


> It's a bold move to attack the main contributor of the opensource project upon which your business is based...

Is it? Part of the point of open source is that you're not beholden to any individual contributor. They can't be cut out from existing code; I don't know if they try to roll in future code developments, but, if they do, then Google can't keep them out of those, either, without a license change.


> Part of the point of open source is that you're not beholden to any individual contributor.

I am skeptical of this being the case with Google's idea of "open source"; does anyone other than Google actually have any material say in any of its projects? Or is it like Apple's open source: code dumps with no path to upstream?


Chromium has a pretty open leadership process. Each subsystem has a small number of people who make technical decisions about the roadmap, and for some subsystems of the browser, none of those people are Google employees. Qualcomm, Microsoft, and Nvidia all have direct leadership control over some Chromium subsystems.


Sure, it isn't open source in that way.

But another important part is that the code is there, relatively freely (depending on license), for others to use as they will.

In the sense that the parent meant his comment, this is the critical component of open source that matters. To put it in classic terms: don't bite the hand that feeds you.


If Google wanted to be aggressive about it, they could make future features closed source, and Brave wouldn't have the financial ability to pay people to keep up with new standards.


Reminds me about the lawsuits between Apple and Samsung early on in the smartphone era.


What else to expect from a company calling itself "brave" without a hint of irony?


Not saying that Google is or isn't breaking the intention of GDPR here but thinking as a critical reader:

- this complaint is lodged by an upstart privacy-based browser which directly competes with a Google product (Chrome) so they are not objective players here

- reading through the PDF linked in the blog post, it seems there is no "canary in the coal mine". It is a spreadsheet with a lot of empty cells and red backgrounds. The post and the facade of the spreadsheet scream "look at this, something's wrong" but the content doesn't match that at all. The impression is that they have found Google to be doing something wrong but the reality is that they want regulators to check and see if Google is doing something wrong. Is there presumed innocence in this circumstance (really asking here because I don't know)?

As with most things, the truth often lies in the middle. It seems to me at least that this is both a click-baity blog post and complaint meant to drum up media and press for Brave as much as it is a spotlight on Google's data practices. Both are bad.


> this complaint is lodged by an upstart privacy-based browser which directly competes with a Google product (Chrome) so they are not objective players here

This is not really a problem. Quite the contrary, it's unusual for a neutral party to be the one lodging a complaint. The important thing is that whomever processes the complaint is a neutral/objective party.


> As with most things, the truth often lies in the middle. It seems to me at least that this is both a click-baity blog post and complaint meant to drum up media and press for Brave as much as it is a spotlight on Google's data practices. Both are bad.

I agree on this, but if there's a company trying to make a name for itself by attacking privacy violators, and if the benefits of that accrue even to people who aren't customers of the company, then I don't overly begrudge the company a little (or, let's be honest, a lot of) breathless self-generated PR in the process.


The penalties will also accrue even to people who aren't customers of the company. It may be harder to see when that occurs.

Google's speech model, for example, was bootstrapped on the audio collected from GOOG-411. Is the GDPR intended to prevent things like that? Then it's "intended" to hinder development of practical speech models the likes of which hadn't been seen from decades of research that lacked access to hundreds of hours of input from users asking real questions in real environments.


"Then it's "intended" to hinder development of practical speech models the likes of which hadn't been seen from decades of research that lacked access to hundreds of hours of input from users asking real questions in real environments."

This is simply not true.

Google can absolutely obtain data from users in a manner that's transparent and clear for specific purposes.

They have 40K highly paid Engineers and $100B sitting in the bank. They have ample resources with which they can draw meaningful data necessary - but they'd rather not, if they can just use your data for whatever they want.


Not when they don't even know what future purposes look like.


Your comment implies the cost was worth it, but there are definitely people that would disagree.


And they are welcome to not use GOOG-411, Google's voice recognition, or any of the applications derived thereof.

Me personally, I'd been waiting for the breakthrough that Google hit upon to get reliable voice recognition for a couple of decades.


Uh, if they don’t use it then the cost/benefit ratio is even more balanced over to the cost. The point is that the cost was never consulted in the first place when the benefit was sought.


What is the cost to someone who never used GOOG-411?


But whose data was gathered and mined for the purposes of its development.


I'm responding to the statement that GP made which was that to someone who never used GOOG-411, the cost-benefit ratio is further into the cost category [compared to someone who did use GOOG-411]. This would imply that there is some cost to someone who never used the service, hence my question.


Basically zero.


To the extent that users benefit from desired violations of their own privacy, they can consent to it. To the extent that other users benefit from violation of my privacy, they have no right to it.


How do you apply such reasoning to, say, traffic counters on highways?

Nobody has a right to know whether the highway is congested because your car may have been one of the counted datapoints?


The government has a right to that information. For-profit companies do not. (Also, traffic counters can easily be anonymised, if they're not already, whereas Google's data is essentially worthless to them if anonymised.)


> The government has a right to that information. For-profit companies do not.

That seems like a very arbitrary distinction, and I'm not sure how one arrives there. There are a lot of for-profit companies that build business around data analysis of things that most people could count (given time and inclination to do so) but do not, be it cars on the road or the average price of gasoline state-by-state. Is that a moral red-flag?


> That seems like a very arbitrary distinction, and I'm not sure how one arrives there.

I think a blurring of the difference between "things that the government can do" and "things that a private company can do" is a very unfortunate (and also very deliberate) development in modern society.

To me, the distinction is far from arbitrary; it is fundamental. Democratic governments are elected, and at least nominally accountable to the people over whom they exercise their reserved rights; for-profit companies are generally accountable only to their shareholders, not to those over whom they exercise these privileges—and technically to governments, although governments seem unwilling to exercise much of that right of restraint.

(This is a response to your point about the distinction being arbitrary, not to your question about private companies analyzing data. If a dataset of which I am a part is used without identifying me as part of it, or after obtaining my consent to be included in it, then my qualms about it go away. If, however, the company gathering this information, while counting the traffic flow of which I am a part, decides to sell information about where they've noticed I like to shop to advertisers, then, yes, that's a moral red flag for me.)


For-profit companies are also accountable to the market; a company lying about the traffic numbers, for whatever reason, loses when a competitor offers more accurate numbers.

What happens when the government chooses to lie about the numbers? What if it's doing so because the public has signaled it wants to be lied to (which happens from time to time)?


It should be noted that Brave is not an advocacy group; they're a medium size for-profit company, with a business model that stands to gain if Google is cut down to size. So even if their complaint seems valid, calling on regulators to shut down your business rivals is shady, and you should take any representations they make with a pile of salt.

I also maintain my general skepticism that Google's business model is illegal under the GDPR. If the regulators had intended to make Google illegal, I'd think they would have said that.


First, they're not calling on regulators to shut down Google, but to make sure they respect the GDPR (and thus their users' privacy). Second, the regulators didn't intend to make Google illegal, they intended to establish respect and moderation in the processing of users' data. Of course, it's obvious for everyone that the companies doing the massive data gathering are mostly American (Google, Facebook etc.) and that European competitors to these giants could potentially profit from this, but that's just a (very welcome) side-effect...


It seems very clear to me from the content and tone of their article that their goal is to get regulators to hurt Google. There's a lot of discussion about how dastardly Google's being, and of how different their business will have to be after the enforcement action, but very little about which specific wrong things Google is doing.


Google should not fear audit of their internal data handling practices, and the way it communicates with data subjects about the purposes of data processing.


Let's assume they're just trying to get Google to follow the GDPR. How would the report look different, compared to 'wanting to hurt google'?


They would say something along the lines of "I gave Google my data for purpose X, but they're using it for Y and/or claiming the right to use it for Z, what's up with that?".

They would not have a "Purported Legal Basis: Unknown" column with a scary red background in their spreadsheet.


If you actually believe that your competitor is evil, and their business is built on unethical behavior, then getting regulators to do something about it is a reasonable action even if it does benefit you as a company.


Is there any for-profit company that doesn't think that their competitors are "evil" and should receive huge fines from regulators?


Yes. Constant legal sniping is endemic in some industries, but it's pretty rare in tech. As far as I know, Google itself has never demanded that its competitors should be fined.


Most of them? There's a world of difference between "we're competitors", or even "we think we're better"/"we deserve to win" vs "our competitors are Bad and should be the target of legal action".


Yes. Lots.

Delta and Southwest, say.


Yes.


I am glad to see someone, even if it is a competitor to Google, raising important questions about the data Google captures.

The amount of data Google collects about users is quite simply of unimaginable scale. Who sees this information at Google? Are they able to identify an individual and browse or analyse their online activity (which for millions of people will include some of their most personal and private details)?

Who has access to this data should be stated clearly in Google's Privacy Policy [1]. Instead we have this vague and generic paragraph:

"We restrict access to personal information to Google employees, contractors, and agents who need that information in order to process it. Anyone with this access is subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations."

I'll repeat that this is a company that holds the private and personal online behaviour of millions of people, and yet the only detail they reveal about who sees that data internally and which user details are exposed is the purposefully vague and unspecific paragraph above.

The fact that the "tech community" has never chosen to challenge Google on their internal usage of people data shows how little developers care about privacy (as this thread amply demonstrates).

[1] https://policies.google.com/privacy?hl=en-US


What would you prefer that paragraph say?


As discussed in "The Age of Surveillance Capitalism"[0] it's inconsistent with their business model for Google to comply with GDPR and other similar privacy laws/regulations.

The benefits of the surveillance capitalism business model are seeing business values being recalculated as business owners recognise the value of exploiting vast amounts of data collected in the pursuit of a purpose other than for which it was collected. Microsoft for example has been heading in this direction over the last few years through their acquisition of Lynda/LinkedIn, Github and Glint. I expect other SaaS businesses to increasingly exploit this opportunity.

Personally I support the efforts of Brave in this case and there are other potential targets that I think are vulnerable to a similar complaint. It will be interesting to follow the Irish Data Protection Commission's progress on this.

0. https://en.wikipedia.org/wiki/Surveillance_capitalism


GDPR weaponizing privacy-oriented companies and the ability of the EU to walk the GDPR talk (as opposed to simply producing legislation) is going to be an interesting development to watch.


Typo in article: “for hundreds ill-defined processing purposes.”


Good to know.


This complaint is going to be an interesting test, because if it ends up with legs it could go two ways:

1) it fails, and the GDPR has some precedent to constrain its application in the future

2) it succeeds, and Google actually pulls out of the European markets completely. Internal responsible data-sharing and data-aggregation is extremely core to Google's entire business model (it is the "special sauce" that drives the entire application suite, from search to speech), and if the GDPR is incompatible with that business model, Google is incompatible with Europe.


The idea of Google pulling out of Europe is a fantasy, the libertarian equivalent of hoping for famine in the Sowjet Republic ca 1975.

As long as Google doesn't have to pay their lawyers more than what they are earning in the EU, Google will happily continue doing business in the EU. And if I had to guess, lawyers make up 0% of their costs in Europe and anywhere else, when rounding to the next integer.

I see suggestions of various companies leaving the EU far more often these days than suggestions to leave China. It seems people on HN consider GDPR a more serious danger to justice than, say, "reeducation" camps for unliked minorities. Go figure..


Good point. As long as the costs to do business in Europe can be quantified and managed, even if those costs were legal penalties, I agree. I was imagining the scenario where Europe went as far as "cease and desist mixing and aggregating all user data or we'll start throwing people in prison."


Google will not pull out of Europe. As long as it can make a profit in Europe it will stay. There is a demand for many of the services it offers and it is well positioned to sell them, regardless of GDPR.


Possibly. Depends on what the cost-benefit tradeoff is.

Google tends to be a long-term-thinking-oriented company, and requiring them to silo internal data (under the rules of a third-party oversight, not their own rules) strikes at their ability to do R&D. They know that in the long-term, the survival of a technical company is hinged on what they deliver in the future, not what they're delivering now.


> Google tends to be a long-term-thinking-oriented company, ...

Is that still true? The number of products they've launched and abandoned, sometimes in the same market (like messaging), seems to indicate they're more an in-the-moment company to me.


A lot of launch-abandonment churn is to be expected from an R&D-heavy institution.


Ok, so there are two parts of the work rich enough to support advertising companies. They are the US and Europe.

It's super implausible that Google will pull out of Europe (the EU at least), because they are forced to implement the laws.

It's as likely as them pulling out of the US because they are forced to refuse to deal with countries under US sanctions.


> They are the US and Europe

... and China.

And the refusal of the ability to deal with countries under US sanctions doesn't strike at the core of Google's R&D techniques and resources.


Sortof. Urban China, yes. Rural China no (but probably yes in 10-15 years). Nonetheless, I don't see Google (or Facebook for that matter) pulling out of Europe if they are forced to comply with (the entirely reasonable restrictions of) GDPR.


Me neither.

If the restrictions prove unreasonable in practice, it's a question that I'm sure those companies will revisit.


3) The Irish GDPR enforcement office will ignore it.


My understanding (based only on investor filings, I left Google long before GDPR was drafted) is that Google's plan is basically just to set aside several billion dollars every quarter for GDPR fines and pay them as a cost of doing business. Many of Google's critical product features wouldn't work without the "internal data free-for-all". If EU regulators really make a stink about it (rather than just setting fines that can be covered by profit) they'd likely just pull out of the EU.


Can Google afford your pull out of the EU? How about California, which seems to be following suit?


EU, sure. They make about ~$50B of a total $161B in annual revenue from Europe. It'd hurt their stock price - at least temporarily - but there's nothing fundamental about the service they're offering worldwide that'd disappear if they no longer did business in Europe. They'd treat it as a simple economic decision: when the cost of operating in Europe exceeds the revenue generated from it, it's time to pull out of Europe.

I also suspect that Project Dragonfly (Google's re-entry into China) might've been partially to blunt the effect of a European exit - Europe hasn't really liked Google since about 2010, and the regulatory climate keeps getting worse for them, so at some point it'll become not worth it for them to continue. They already pulled Google News out of several European countries when regulations made it too much trouble to continue offering the service, and then reinstated it when the regulations were rescinded because local publishers realized how much traffic they'd lose if Google News no longer featured their articles.

California is trickier because many key employees work at their Mountain View, San Francisco, and Santa Monica offices. I suspect that that's changing - they've been expanding rapidly in offices in other locations, perhaps as insurance against this (and the rising cost of living in California), and there's probably less of a concept of a "key employee" now that the main services are written, not really innovating, and mostly in maintenance mode.


Personal prediction: California will continue to follow the GDPR up until the point it threatens Google's core business, at which point someone will pull the legislature and the governor aside and have a frank conversation about the state GDP tradeoffs of constraining the R&D of their major technical companies.


I use google and don’t even want them to use my last search query when answering my next one. I have no idea if they do or where I’d change it, but I’d like that to be the default. If they use e.g content of a gmail email or something I did on another site as a clue for what and to show in my search result then I don’t just want a better option and default, I’d like to see them fined.


Why wouldn't you want your search engine to use what contextual information it knows about you when attempting to provide you quality, relevant answers to the questions you're asking it?


I’m ok with seeing a shoe ad if I google shoes. It’s fine to do a geo lookup of my up to show a local offer too. That’s context from the request. That should be enough. I’m not ok with seeing anything that requires them storing information I don’t want them to store (eg search history, behavior on other sites such as past purchases). I’d rather have worse results. Google works great in a private browser using a vpn, I don’t need whatever extra they can bring with my info.


The really funny thing about this thread is that:

* google appears to make all of our data available to most of its developers

* we complain that brave wants to boost its reputation

wtf, seriously, wtf?

I mean, granted, brave sucks and wants to have an easy buy-in to some folks, but still: what's hiding behind this is huge.

If I were google I'd buy brave for this kind of burying.


Is there any evidence of your first claim? I don't even think brave goes so far as to claim that the data is available to most developers. They claim that the scope of systems that have access is too broad, but that's a very different, and much weaker claim, then that any dev has access to data.


Because seriously this a relative non-issue.


Yeah, sure. I know I'll be downvoted for this into oblivion, but hell, the collective stupidity of mankind really surpasses the probability of the universe being infinite.

Einstein was right :)

Just one small thing to consider: if even one person of google was a federal agent (of an offending country). Fill the missing parts of the sentence.

And yes, as much as I despise the EU in its current form, that's the intention of GDPR: to prevent spilling personal data into a pool of people with potentially malignant actors, and, if this happens, to be responsible to full disclosure.

@dantheman: I guess you still won't be considered to be hired by google for this post.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: