
Funding Choices – Google’s new tool for GDPR compliance and content monetization - celere
https://fundingchoices.google.com/start/
======
ThePhysicist
I'm still surprised no one has yet figured out a way to store sensitive data
about personal interests and preferences on the client-side and let the client
itself pull appropriate ads for the user to see. The quality of such a system
should be comparable or better to server-side technologies with the right
amount of tuning, and much less privacy-invading than existing approaches.

Personally I'd love to support more websites through ads if two conditions
could be met:

\- A way to ensure that ads don't try to harm me by e.g. leading me to
websites serving malware or abusing my computer's resources (e.g. miners)

\- A way to keep my privacy and control what data is collected about me (and
who has access to that data)

Currently I simply can't turn off the ad-blocker even if I wanted as most
sites become completely unusable and outright obnoxious by showing large,
blinking or content-hiding ads, videos, popups or fake overlays. That's why
most people use ad-blockers (IMHO). If ads are decent, relevant and non-
obtrusive I personally would be happy to see them.

Also, go to any large website these days (without ad-blocker enabled) and
check how many third-party trackers they load. There are many sites that send
my data to more than 50 (!) different ad networks and partners, which is just
insane.

~~~
BrendanEich
Brave, with the Basic Attention Token (BAT), is building exactly the client-
side anonymous contribution + ad-matching system you describe. We will take
BAT to other apps after proving the model in Brave.

BAT in Brave is opt-in -- each user consents before anything local happens
with data or zero-knowledge/blind-token attestations -- and users can get
_gratis_ BAT grants right now using the stable desktop browser (this is coming
to mobile in about a month). The anonymous contribution system is the basis
for the also-opt-in Brave Ads system, which uses local data only, local
machine learning agent, and no cookies or user tracking by any server (even
ours). Ads match against a catalog fixed daily or less frequently for a large
set of users in a region who speak the same language. Attribution and
confirmation use Chaumian blind tokens.

Users get 70% of revenue for opt-in, user-private (in tab), high quality ads
at user-configurable frequency. We are working with publishers to provide
user-opt-in ads for sites too, 70% revenue to the publisher, 15% to the user.
User ad trial is under way right now, ping me if you want to be included.
System should be available in Brave 1.0 in a couple of months.

~~~
user812
I'm a big fan of that idea.

Imho the beauty of your BAT system (the way it is envisioned) is it's
independency from the current model of monetizing the web, which is ads,
gradually evolving towards direct transmission between publisher and consumer.

Ads in the way they work on the web are just a very inefficient system of
transferring this value, and they don't serve the original function of
marketing anymore. It turned into a big game of psychological warfare.

The system is so inefficient that it finances almost the complete operation of
Alphabet/Google.

As a user I don't know how the system works in the background, and when I read
the recent news about Brave attacking Google for GDPR violation it was the
first time I read about RTB and the technical aspects in the media. People
need to know, so they can decide if they want to feed such a system!

Funding Choices seems to be a part of Google's answer to the growing problem
of ad-blockers, but it can also bee seen as Google's answer to competition
like Brave/BAT.

I read somewhere that under the umbrella of Funding Choices Google is also
experimenting with subscriptions like BAT, but without the token.

I don't know how successful Google is with this, but this might be a tough
competition for Brave, they will fight tooth and nails, and they control the
Android ecosystem.

BAT is attractive for power users as you ride on the wave of privacy-
friendliness which Google can't, but I think the real challenge will be the
average user that wants a standardized, seamless cross-platform solution that
can be used as the main payment gateway for accessing content, which is
increasingly via gated Apps.

With Google controlling so much of the market with Android and Chrome, I
wonder how they will react to BAT if it ever becomes successful, as they could
theoretically quickly scale any competitive project.

I think the biggest advantage of BAT would be if big players could acknowledge
it as a de-facto standard for decentralized transfer of micro-payments and
privacy friendly ad networks. For this to happen it would be necessary to be
somewhat "Open-Source", i.e. not strictly tied to a singly company controlling
much of the tokens. I am thinking in line of an open consortium with different
players holding a significant part of the BAT tokens each.

~~~
stephengillie
> _The system is so inefficient that it finances almost the complete operation
> of Alphabet /Google._

Since Youtube is wildly unprofitable, Alphabet/Google has to be funneling in
money generated from other sources. Thus, Youtube is funded by ads, just
mostly not from the ads on Youtube.

~~~
yuhong
It was mentioned in a private email that the only reason YouTube exists is
that Google's servers happens to have a lot of free disk space in the days
before SSDs.

~~~
cortesoft
Is the limiting factor for youtube really disk space? I would imagine it is
bandwidth.

------
probably_wrong
In their example, under "Gather consent seamlessly", their example shows "Yes"
and "Other Options". Now, I haven't yet read the GDPR in detail, but I was
under the impression that opting out should be as easy as opting in. A quick
search returns:

> The ICO also said that, while "GDPR does not specifically ban opt-out
> boxes," that method of communication is "essentially that same as pre-ticked
> boxes, which are banned"

If this is correct, using the product as shown on the screenshot (and as used
by several websites) is in violation of the GDPR.

I wonder if Google will pick up your legal defense costs if you get sued for
using their product.

(Edit: I tried to find answers to these questions, but apparently the only way
is contacting my Google representative, which I don't have)

~~~
Terretta
Having cleared all cookies recently, I'm re-encountering all these dialogs.
They've gotten cagier.

Anecdotally, a third of these cookie dialogs are violating those principles,
either preselecting all third party advertisers, or claiming all 60+ third
parties are necessary for the functionality of the site so Allow or Go Away.
Or having only one OK/Agree button.

It's not just little guys. Slate.com for example:

 _Slate’s Use of Your Data_

 _By clicking “Agree,” you consent to Slate’s Terms of Service and Privacy
Policy and the use of technologies such as cookies by Slate and our partners
to deliver relevant advertising on our site, in emails and across the
Internet, to personalize content and perform site analytics. Please see our
Privacy Policy for more information about our use of data, your rights, and
how to withdraw consent._

 _[Agree]_

[https://slate.com/gdpr?redirect_uri=%2F%3Fvia%3Dgdpr-
consent...](https://slate.com/gdpr?redirect_uri=%2F%3Fvia%3Dgdpr-
consent&redirect_host=http%3A%2F%2Fwww.slate.com)

The privacy policy generally says you're welcome to go opt out of each
individual third party then delete their individual cookies from your browser,
beat yourself up.

Slate for example, says, "You may choose whether to receive interest-based
advertising by submitting opt-outs..."

The justification appears to be "EU doesn't tell us what to do":

 _" Please note that the Services are directed towards users who reside in the
United States. By using the Services, you consent to the collection, storage,
processing, and transfer of your information in and to the United States, or
other countries and territories, pursuant to the laws of the United States.
Some of these countries may not offer the same level of privacy protection as
your own."_

This Privacy Policy also features dynamic legalese:

 _" Slate tracks when EU readers grant consent for Slate to collect and
process data through the use of an identifying cookie on your browser. The
browser through which you are currently viewing Slate does not currently have
such an identifying cookie. If you are an EU reader this means that Slate is
not collecting or processing data from your current browser session."_

[https://slate.com/privacy](https://slate.com/privacy)

// I am currently reading from EU -- a good time to clear your cookies.

~~~
stephengillie
> _claiming all 60+ third parties are necessary for the functionality of the
> site_

If you consider financial needs underpinning the site operation, it's
technically true - without the 60+ 3rd parties, they could run out of funds to
host the site, after which the site would not function at all.

~~~
CaptSpify
There are other sources of funding than advertisements

------
niftich
Google Contributor was service from Google that used a pool of money set aside
by the user to bid on ad slots, and if a particular ad auction was won, the ad
would be replaced in the pageview with a pictorial pattern of the user's
choice. The program was not well publicized, although tech journalists have
covered it and I have written [1] about it in my comments when Brave and
Flattr came up and have wondered why Facebook (sitting on a huge trove of real
identities) never did the same.

But in 2017 it was shut down for a few months, and relaunched as a program
which would omit all ads from the target site if the site was a partner, and
the user has marked that site in their account. The amount charged for each
pageview is set by the site [2]. Only a handful of websites are supported,
although most are news sites -- local papers or TV channels.

This new Funding Choices program aims to greatly expand the list of sites that
use Contributor by offering a managed solution that solves a better-than-
before subset of two pain points at once: regulatory compliance and
monetization.

[1]
[https://hn.algolia.com/?query=niftich%20google%20contributor...](https://hn.algolia.com/?query=niftich%20google%20contributor&type=comment)
[2]
[https://support.google.com/contributor/answer/7359560](https://support.google.com/contributor/answer/7359560)

------
danso
I appreciate that Google appears to have reached out to local newspaper sites
(qctimes.com, napavalleyregister.com), for Contributor. But if I were a major
content publisher, the relatively small and mostly non-notable list of current
Contributor sites [0] would make me think that Google isn't highly invested in
this project. Which is not a good first impression considering that many
people think that Google is too quick to abandon projects. They should have
booked a few more major sites and media brands; right now, the 2 sites that
are highlighted are the National Post and Popular Mechanics.

[0]
[https://support.google.com/contributor/answer/7324995](https://support.google.com/contributor/answer/7324995)

~~~
Klathmon
IMO Contributor is still pretty new, and without users the time and effort
spent implementing it probably isn't worth it yet, especially because many of
those running adblockers just ignore it entirely (I can't even count the
number of times I've read "why pay for contributor when adblockers are free?).

If/when it hits a critical mass of users, suddenly it will become a lot easier
to justify the cost of implementation.

Hopefully tools like this can help get some sites to implement contributor or
something like it so paying for access can get a foothold and become a viable
option.

------
Rjevski
I would not trust any opt-out offered by a company who's bottom line is
directly dependent on violating people's privacy. The only opt-out that can be
trusted is one that does send any network requests to the stalking company
until consent is given.

That's the same reason why you wouldn't want to ask an alcoholic to guard a
warehouse full of vodka at night, as you'd probably find a few empty bottles
the next day. Same thing with an advertising company, even if they claim to
respect your privacy, nothing guarantees they're not secretly looking at it
anyway (and using it to adjust their ad tracking in a way that's undetectable
from the outside, as to not be sued for it). It's even worse, because at least
with alcohol you can count the bottles and find the empty ones. With data
collection, if they're careful, you have no way to know whether your privacy
has been violated.

~~~
tinco
And who is going to build that illegal feature into Google's services? And how
much are that person, and the other persons that know about it, going to be
paid for them to not be a liability?

Maybe I'm naieve, but I feel building automated law breaking systems is not
something corporations do. I have no doubt individuals within corporations
break laws whenever they feel like they can get away with it, but leaving
trails like checked-in source code, and operating services that other services
depend on, that just sounds like too much of a liability to me..

~~~
badestrand
> Maybe I'm naieve, but I feel building automated law breaking systems is not
> something corporations do

Did you already forget the VW diesel scandal? That was exactly that - a huge
corporation systematically breaking the law with lots of people even in the
highest ranks aware of and supporting it.

~~~
tinco
Well yeah, and it was ridiculously dumb, lots of people go to jail and big
fines were levied. I suppose that you have a point and corporations might do
it. At the same time I like to believe it's just not worth it for them.

~~~
contravariant
I can find a few small fines, but as far as I can tell nobody went to jail for
that one.

~~~
consumer451
> A Volkswagen AG compliance executive who pleaded guilty in the U.S. for his
> role in the company’s $30 billion emissions cheating scandal was sentenced
> to 7 years in prison.

[https://www.bloomberg.com/news/articles/2017-12-06/vw-
execut...](https://www.bloomberg.com/news/articles/2017-12-06/vw-executive-
sentenced-to-7-years-in-prison-for-diesel-role)

~~~
detaro
And Germany temporarily jailed a bunch of executives (including Audi's CEO,
who is still in jail as far as I know) this year to stop them interfering with
investigations, and results of those investigations might lead to more being
sentenced once they're done.

------
Nursie
I hope they find ways to do this while actually complying with GDPR.

A lot of (primarily US-based) sites now say things like "We need to track you
to keep running, consent or click this link to enter a maze of poorly
documented ways you can try to opt out, if you decline then goodbye".

Some even let you opt out of tracking (taking several minutes to 'process'
this opt out), and then tell you they can't serve you a site that doesn't
track you.

I'm OK with those - I don't go there any more.

------
ckastner
> Engage ad blocking visitors

> With Funding Choices you can automatically identify ad blocking visitors and
> ask them to disable their ad blocker especially for your site — or give them
> an alternative way to fund your content via Contributor.

> Contributor lets users buy an ad removal pass for your site, helping you
> monetize your site's content again.

Great! Now, can I have that for Google? I'd gladly pay in exchange for the
added privacy.

~~~
berbec
You'd think you'd get it with gsuite...

------
dx87
Gotta love their choice of wording, "recover lost revenue from ad blocking
users", like blocking ads is equivalent to stealing money from the site owner.

~~~
cirenehc
But that's true isn't it? What's with this entitlement that sites should be
ad-free while still providing value? I own a blog, there is no way I could
have a profitable subscription based model (believe me, I tried).

~~~
shakna
I understand your issues... But I'm downloading your code, how it is
displayed, and whether I run it your way is up to me - I already requested it,
and your server fulfilled the request. If you wanted contractual obligations,
they need to happen before you hand over the content.

~~~
kalcode
That isn't a very good argument. Just cause you downloaded something doesn't
give you the rights to it.

If that was the case piracy would be legal, software trails wouldn't be legal.
Windows license or photoshop trial up? Well I downloaded, your server
fulfilled the request. I have legal rights to it now.

Oh, this art? I am selling it. Well I saw it on the internet, my computer
downloaded, their servers fulfilled it. If they didn't want to hand over the
rights they should've blocked me from viewing it.

That kind of argument is an argument I expect in a non-tech site with people
making excuses. You know that isn't a solid argument you made at all.

The way the internet works doesn't create a vector that allows that. If they
did implement that you'd need a multiple round trip check, the site would be
slammed for being slow to respond cause it have to download a script, check if
your blocking, report back then start the downloading process for the site.
Just not feasible.

Those smaller sites would lose to bigger sites that can get away with slower
response times or ignore pre-checking anyways.

~~~
shakna
> If that was the case piracy would be legal, software trails wouldn't be
> legal. Windows license or photoshop trial up? Well I downloaded, your server
> fulfilled the request. I have legal rights to it now.

Piracy is someone intentionally breaking a known license contract. Software
trials require contracts first. Either upon download or installation. You
agree to a license before you use Windows. Those agreements are binding. The
web also has systems in place for similar contract negotiation. If you don't
use that, it's kinda on you. Some users will choose to use your content in the
way you intended, others won't, and you have no recourse.

> You know that isn't a solid argument you made at all.

Unfortunately for you, it's already held up under law. There's a reason the
big players are trying for new solutions than attempting to ban users from
blocking them.

> If they did implement that you'd need a multiple round trip check, the site
> would be slammed for being slow to respond cause it have to download a
> script, check if your blocking, report back then start the downloading
> process for the site. Just not feasible.

We already have that. Quite seriously. HTTP has the structure for
authorisation, and the process for handling it if you're not. Not using that
structure, is a choice that leaves you vulnerable.

------
rataata_jr
Put Google's JS on my website and let google harvest all my user's
information. Sounds about right. I don't see much difference between FB and
Google these days.

------
hyperman1
There are actually parts of this I like better than the current status quo:

* Ad blocker detection and a way to ask for funding? Seems nice. We will get a view on the actual market value of the content. As the Internet started out free and hand plenty of content, I assume content producers will get a rude messages about their actual value here.

* A good base platform for the GDPR is also nice. A big player like Google cant flaunt the law too much, and browser plug ins have one big target to block, verify or modify

Some extras to make the ad ecosystem sane again:

* Micro-payments. You could get to choose between an ad, a micro-payment, or no content.

* Content producer vetting and taking responsibility for their ad's. Todays ads are bottom feeders. If, say, a car site would get an image from e.g. a car company, and place ads on their own site, you get a better ad for the customer, no privacy violation, and more respect and use for the ad vendor. This is the stack oveerflow/jobs model.

* A header element like X-Interested-in. Use your browser to set a free-form value, and let the ad vendors get some input to give better ads , while you are completely anonymous to them.

------
ezekg
What I think we're seeing here is that Google's bottom line was damaged by
GDPR.

------
mike22223333
So to give Google info about my visitors and later compete with me? No thanks.

~~~
danso
Presumably, these sites already use Google ads (and probably Analytics too).

------
cavneb
I started up CodeFund last year in an effort to help fund open source projects
and developers. This year, we opened up the source code
([https://GitHub.com/gitcoinco/codefund](https://GitHub.com/gitcoinco/codefund))
and provide ethical advertising. We don’t do any tracking, profiling, cookie
setting, remarketing, etc. and our ads are chosen by the audience that the
website caters to. We also give back up to 70% of all gross ad revenue back to
the publishers. [https://CodeFund.io](https://CodeFund.io)

------
Hnrobert42
I would be willing to load ads if I didnt have to see them. I’m happy. Content
provider gets ad shown so they are happy. Advertiser doesn’t get anything, but
I don’t care.

~~~
themacguffinman
...the content provider is only happy that the ad is shown because advertisers
pay them for it. Advertisers aren't going to pay content providers if people
loaded ads without seeing them.

~~~
Hnrobert42
How would they know?

~~~
themacguffinman
Because the browser would tell them.

And if this became a trend, it'd be really obvious in their ROI and they would
stop funding the content provider.

------
anticensor
We also have a GDPR-like data protection law (almost identical bar right to be
forgotten; which do not have in here) in Turkey. A Turkish version is also
needed.

------
olivierduval
Nice!! Another Google product that will be EOL'd in a few months, leaving both
users & website owner unprepared... Really: Google became so unreliable on the
business side these days that I wouldn't use their product for anything but
playing

~~~
ocdtrekkie
Ironically, I believe they actually did already shut this down once before. I
think this is a revival of it: [https://www.searchenginejournal.com/google-
contributor-progr...](https://www.searchenginejournal.com/google-contributor-
program-shut-january-2017/181759/)

~~~
wffurr
Yes, they re-launched contributor as a "opt out of ads on a per site basis"
instead of the old global "show me kittens or blank space instead of all
Google ads". The reasoning given was it was a " better experience" to have no
ads on a page at all instead of a mix of Google ad kittens and non-Google
regular ads.

Fine, but there are only two sites that support it, so it's fairly useless.
Maybe Funding Choices will make it more useful.

~~~
celere
Here's a list of about 20 sites using Contributor:
[https://support.google.com/contributor/answer/7324995?hl=en&...](https://support.google.com/contributor/answer/7324995?hl=en&ref_topic=6182587)

------
Raed667
Bit off topic, but AngularJS 1.6? Why is Google still using an old version of
their own framework, is upgrading that hard?

~~~
mrighele
Upgrading from AngularJS (1.x) to Angular (2+) is not trivial. They are two
unrelated product that "by chance" share the same name.

~~~
r3bl
I understand that moving to Angular is not trivial, however this is old even
for AngularJS.

1.7.x is in a long term support, while 1.6.x stopped being supported since
July. The version they're running has at least three vulnerabilities:
[https://snyk.io/test/npm/angular/1.6.0](https://snyk.io/test/npm/angular/1.6.0)

~~~
mrighele
Ah you're right about that. I was taking for granted that 1.6.x was the last
before 2+.

