
Google faces first investigation by its European lead authority over GDPR - logTom
https://brave.com/dpc-google/
======
londons_explore
Google will argue that while this data is intimate (religion, age, personal
preferences), it is not personally identifiable.

I have access to one of these data feeds of bid requests, and for the most
part, they're right. Pick a random entry and even after hours of searching and
correlating with the other data we have on file, it's unlikely I'd be able to
identify exactly who it was (ie. Their name and address) on that website.

 _Some_ requests totally are identify-able though, for example if the user
goes on to click one of our ads, buy something, and give us their postal
address. In the eyes of the law, we have broken the rules there by re-
identifying previously anonymous data.

While I think Google is technically in the right here, they're gonna loose big
time because they're a foreign company and don't have much love with the
public.

~~~
matt4077
> they're gonna loose big time because they're a foreign company

I think it's somewhat irresponsible to throw out accusations this big without
even feeling the need to offer any evidence for them.

FWIW I once summed up the various fines (anti-trust etc.) doled out by the EU
by country/continent. It turned out that US companies were, collectively,
fined slightly less than their share of economic activity in the EU, while
Asian companies were fined more and EU companies were about level.

This corresponds rather well with a non-corrupt process largely blind to
companies' nationality, assuming that US companies are rather well-regulated
in the US compared to Asian companies.

I haven't done the reverse for US fines of European companies. But,
subjectively, the cases that made the news (mostly VW and Deutsche Bank) gel
rather nicely with my (Germany-based) impression of companies with malignant
corporate culture and do not require any nationalistic motivation to explain.

I know it may seem like a minor point in this context. But if we always assume
all institutions are corrupt, that becomes a self-fulfilling prophesy.
Institutions such as the court system and, more generally, the rule of law,
are the reason we (some of us) can enjoy life in peace, and shouldn't be torn
down just by empty cynicism.

~~~
brownbat
You're right it's important to unpack these allegations, but I don't think
they are just random cynicism.

> US companies were, collectively, fined slightly less than their share of
> economic activity in the EU,

I can imagine why you would control for economic activity, but I have no idea
what impact that had on the results relative to other reasonable controls. If
we're wondering about punishing bad decisions, you could have instead
controlled for the number of decisionmakers from these companies in the EU. Or
you could have controlled for the number of different endeavors or types of
products or lines of business (because each different source of revenue is a
source of malfeasance moreso than each individual euro earned). I'm really
mostly concerned about that last one. What is the chance each revenue stream
will get more scrutiny by being foreign? Court cases don't target individual
euros earned, they target a certain product or way of doing business.

Regardless of controls, it doesn't change the tortured logic in some high
profile cases comparing US and EU institutions under the same standard. If the
Spanish media publicizes something as widely as it can, that's great, because
it's good for the public to have that information. If an American tech firm
allows people to access those publications, that's bad, because it's bad for
the public to have that information.

I'd love to change my mind about the bias in the EU, I'm open to new evidence.
All it would take is a few EU cases where they found that the big American
company was blameless, but the small European company should be fined.

~~~
yorwba
"French Supreme Court rules for Google in trademark cases"
[https://europe.googleblog.com/2010/07/french-supreme-
court-r...](https://europe.googleblog.com/2010/07/french-supreme-court-rules-
for-google.html)

~~~
brownbat
I find it irritating when people move the goalposts and don't acknowledge
opposing evidence, so I think it's really important to stop here and
acknowledge that this is relevant evidence, even though it wasn't exactly what
I said I was looking for originally.

It's not a case where the US and EU companies are on the same side like I
originally proposed, but those might be too rare to test anyway, so I was
probably being a bit silly.

Failing back to these more common cases, I don't think (and shouldn't have
implied that) one case alone in a decade completely decides the question of
bias, but it should definitely shift the probabilities here, if you want to be
bayesian about it.

EDIT for emphasis.

~~~
brownbat
After digging in on this series of case law, it's also important to note it
has its origins in the L'Oreal decision that lets Google off the hook but is
mostly about fining eBay.

It's a complicated counterexample to the premise that the EU is preoccupied
with fining US companies.

------
nudq
> hundreds of billions of times a day

How lucky for them the EU won't treat them the way RIAA persecuted file
sharers. Hundreds of billions of violations every day, each single one a
separate "count"!

~~~
hunter2_
At first I thought you meant to say prosecute. But persecute makes far more
sense.

~~~
filoleg
Thanks for pointing it out, because that changes what the parent comment says
completely. I initially read it as prosecute, which tripped me quite a bit.

------
yeppie
It's a shame an otherwise interesting article is plastered with the author
repeatedly trying to promote and self-congratulate himself, and take credit
for something which has undoubtedly been reported by hundreds, if not
thousands, of people. Anyhow, I sincerely hope Google gets slapped with a huge
fine, and that one day individual-user-targeted-ads will become illegal.

~~~
kmlx
> and that one day individual-user-targeted-ads will become illegal

i don't understand this. why would anyone prefer generic ads over targeted?

~~~
janpot
I want no ads, but apparently it's impossible to build a business these days
without also trying to manipulate me into buying random other stuff. If I
can't go around them, I'd still prefer to ignore generic ads rather than
targeted ones. It's easier to do and less creepy from their side.

~~~
psandersen
The problem is people who would pay to avoid ads are those worth targeting...
I'd love if a single service could let me opt out of all tracking and ads
internet wide for a fixed fee, say $50-$100 a month.

~~~
drusepth
Google actually provided exactly this service (for all Google-based ads, which
is a high %) for a little over a year before it was discontinued, supposedly
because nobody actually used it.

See:
[https://contributor.google.com/v/beta](https://contributor.google.com/v/beta)

~~~
gwenzek
How much are they keeping for themselves? I'd really like to see this business
model arise, but if means giving 30% to Google I'm not so sure.

~~~
drusepth
I don't have the exact number (I had only just signed up as a publisher about
a month before they closed it -- maybe someone else can pop in with exact
numbers) but I remember it being really low, around 5-7%.

It was low enough that it wasn't really a factor when determining what to
price your ad-free pages at (most people went with 1-2 cents per load) -- most
people just priced at whatever average your ads were pulling in currently
without worrying about the cut, since it was a fraction of a cent.

------
_eht
Brave, I wish I liked you more. As much as I am cautious with trusting Google,
your motives and history are somehow more questionable to me.

~~~
ListeningPie
What in Brave’s history and motives are questionable?

~~~
blackbrokkoli
Some time ago there was a scandal because apparently they create profiles for
content creators _which aren 't signed up_ on their platform and accept money
on their behalf. Afterwards Brave spouted very dubious arguments with things
like ominous legalese to HN comments with an "trust us, we're nerds too" vibe.

From a cynical perspective, it looked a lot like smoke and mirrors from an
entity currently sitting on a pile of money acquired by impersonating people.

~~~
pergadad
Isn't this anyway their own tokens? So no matter whether the providers do have
an own account or not, if they don't cash it out then there's no cost to
brave. So its.just that they were incorrectly giving the impression that
someone is getting paid?

~~~
vokep
Yes, except when that person doesn't get paid, instead Brave gets that money.

~~~
atomical
That's not true. The tokens are returned the user. Those tokens may come from
the User Growth Pool as well.

------
inlined
Disclaimer: I work at Google and did some GDPR verification on some products,
but I’m not a lawyer and will try to avoid legal speculation. I worked with
the advertising team but not on it; my impression of those folks is that they
took legal responsibilities _very_ seriously. We even had to make new controls
in Firebase for you to enable sharing your Firebase analytics data with your
Firebase Functions.

I’m curious which kind of party Brave is accusing Google of being (Controller
or Processor). I’m also curious what kind of “leak” Brave is accusing Google
of making.

The advertiser could certainly filter for some specific terms, but not PII. If
you get a large group, differential privacy et. al. should protect the
individual and protect a leak.

There’s some interesting theoretical attacks in the threads but they involved
a host site asking for the PII after the ad campaign.

Do any attorneys want to comment who the Controller and Processor would be in
this situation?

Do any multi-site owners want to comment on whether any advertising UserIDs
are even shared across sites, or are they salted per recipient?

~~~
inlined
A bit more digging. The google_user_id field is described a bit more here:
[https://developers.google.com/authorized-
buyers/rtb/cookie-g...](https://developers.google.com/authorized-
buyers/rtb/cookie-guide)

From what I can tell it looks like advertisers who already have user IDs can
use this in their ad campaign but all google_ fields are stripped from ad
redirects.

------
cosmodisk
Just today attended a massive conference where they were showing how a
pregnant customer goes on an real estate website,browses for a few
properties,then goes on a website that sells cots,browses a few of them and
gets served a customised ad from a bank.Once clicked on the ad,it opens the
banking app with some details prefilled and ready to submit an application for
a mortgage.I understanding I'm in this CRM industry and benefitting from it
heavily, however this is just a way to far...

------
skybrian
I wonder if anyone can explain more about how ad bidding works? Does
information from bidders (websites) go beyond the ad exchange? Do ad exchanges
log bids? How does information leakage happen, and what gets leaked?

(Please don't speculate if you don't know.)

------
ianamartin
There's a lot of stuff to dislike about the nuts and bolts of the GDPR. But I
do wish that the U.S. would move in the general direction of protecting user
data instead of the incredibly vague and stupid calls for "BREAK UP BIG TECH!"

All of the political stuff that's happening here blithely assumes that the
problems with Apple, Google, and Facebook are pretty much the same and can be
solved in the same way. There's a fundamental approach here of basically,
"don't get too successful."

I'd rather see them approached specifically and recognize that they each
present very different challenges. One of the biggest for ad-driven companies
is that they're successful because of the way they use data. It's not really
about how big they are. If you can regulate how people are allowed to make
money off of user data effectively, that solves a huge part of the problem.

There's another part of the puzzle about what exactly it means to be an anti-
competitive monopoly in the modern era, but I'm actually kind of okay with
that being litigated for now. The system moves slowly, but it is moving. And
for people saying the current system can't account for new technology, it's
worth realizing that people do recognize the need for change, and the Supreme
Court just recognized that old rules about how things work need to change.

~~~
anoncake
> There's a fundamental approach here of basically, "don't get too
> successful."

Of course. We want companies to compete, we don't want them to win because
then there is no functioning market anymore.

------
matt4077
Could we change the link to something that isn't self-promoting?
[https://www.theverge.com/2019/5/22/18635898/google-gdpr-
prob...](https://www.theverge.com/2019/5/22/18635898/google-gdpr-probe-
complaint-ireland-dcp-europe) is one link Google News turns up.

------
kache_
It hurts me imaging the amount of paper required to clear something like this.

------
eoinmurray92
The UK currently has larger complaint numbers than France or Germany [1] at
around 6,000-16,000 each which is weird, but it does show that many people are
taking individual privacy rights seriously

[1] [https://kyso.io/eoin/gdpr-complaints-for-various-eu-
countrie...](https://kyso.io/eoin/gdpr-complaints-for-various-eu-countries-so-
far)

------
mjfl
In all likelihood Facebook and google will be able to adequately address any
issues related to GDPR and judo throw the regulation into allowing them to
become further entrenched by suppressing any competition.

~~~
omeid2
I think it is probable that big players would lawyer-up their way out but GDPR
has little impact on honest competition, sure, if you want to join the dodgy-
club without deep pockets and a legal department, it is gonna a bit harder,
but tough cookies.

~~~
isostatic
As long as you put up a half-page notice about those cookies :D

------
EugeneOZ
Brave is a product built on Chromium - work of many Google engineers (mostly).
And still they call Google an "evil behemoth corporation". And now this
article - pathetic example of black PR and double-dealing.

~~~
noir_lord
If you go back far enough you find KHTML.

KHTML -> WebKit (Apple) -> Blink (Google) -> Chromium.

So while Chromium is undoutably the work of many Google employees it's not
entirely the work of Google employees which is one of the reasons it's
licensed the way that it is.

~~~
mda
I think all things considered, today Chromium is probably 90% Google
engineering. There is almost no Khtml code left and big chunks of webkit code
are heavily modified and rewritten. Also, rendering engine is not the browser.

------
alt_f4
ah, a classical govt shakedown in progress

~~~
sctb
Could you please work on increasing the information-to-inflammation ratio of
your comments?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

------
nudq
Life is an eternal struggle between Good and Google

~~~
mda
I would not classify Brave as anything good.

~~~
luckylion
What bad have they done?

~~~
mda
Probably just the rotten smell that comes from their business model.

~~~
prepend
What do you find most stinky about their business model?

~~~
drusepth
It's built on telling others "hey guys, we think your business model is evil
so we're just gonna turn it off -- if you want [a smaller portion of] that
money you need to go through us to get it now" or you get nothing at all.

It's kind of like walking into a store and saying, "I want this bag of chips
but the way you're charging for it is evil. I'm going to eat it now, but if
you want paid you can go across the street and get a money order from my mom
in the car. Oh, and she'll pay what she thinks it's worth."

------
marcrosoft
This is another example of the EU trying to "tax" US companies through fines.
If you disagree with how Google uses your data _you have a choice_, stop using
Google!

~~~
glenndebacker
Yeah there is just one problem... European companies are also getting fines
when they don’t play by the rules. And in some cases very hefty fines...

The whole “US taxing” argument is produced by people who would know how
ridiculous that claim is if they would look further than US borders.

