The title is extremely misleading. Someone filed a complaint with the GDPR regulating body. That body has not made a ruling. I would recommend changing “is” to “may be”. Anyway, on to the actual...
The title is extremely misleading. Someone filed a complaint with the GDPR regulating body. That body has not made a ruling. I would recommend changing “is” to “may be”.
Anyway, on to the actual content. I am not a lawyer, I don’t live in the EU, I am not very familiar with the GDPR, etc. But this feels like a stretch to the extreme. First, doesn’t the GDPR only regulate personally identifiable information? Whether you view ads or not does not seem like PII. At least not to me.
Next, the linked person makes the claim that it is not required for the requested service. It seems like it would be pretty easy to argue that the ads are strictly necessary for the service. After all, the service YouTube provides is not “Free Videos” it’s “Ad Supported Video”. I know this is not how the general public views YouTube, but you don’t have to convince the general public, you have to convince lawyers.
Finally, this complaint is very implementation dependent. I don’t know how Google is currently implementing anti Adblock. However if this complaint goes through, they could likely implement a new version that does not store or transmit any PII.
I looked into this a bit. The author's key claim is: This was a very widely propagated (by this same guy I think) opinion from April 2016. However, it would appear that eventually adblock...
I looked into this a bit. The author's key claim is:
In 2016 the EU Commission confirmed in writing that adblock detection requires consent.
This was a very widely propagated (by this same guy I think) opinion from April 2016. However, it would appear that eventually adblock detection was ruled an exception, as detailed here .
There is a claim that the EC clarified this themselves in 2017, but the only source I could find that purports to underpin this claim is strictly paywalled (anyone have access?)
There is a claim that the EC clarified this themselves in 2017, but the only source I could find that purports to underpin this claim is strictly paywalled (anyone have access?)
Note that the ePrivacy Regulation is not the same thing as the ePrivacy Directive, which is in force and by reading the Wiki on it, does seem relevant.
Note that the ePrivacy Regulation is not the same thing as the ePrivacy Directive, which is in force and by reading the Wiki on it, does seem relevant.
The poster is not invoking GDPR but 2002/58/EC, an EU directive "concerning the processing of personal data and the protection of privacy in the electronic communications sector". Specifically...
The poster is not invoking GDPR but 2002/58/EC, an EU directive "concerning the processing of personal data and the protection of privacy in the electronic communications sector". Specifically he's invoking article 5 section 3, here it is in its entirety:
Member States shall ensure that the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent, having been provided with clear and comprehensive information, in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. This shall not prevent any technical storage or access for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or as strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service.
The way I read this, it doesn't seem to hinge on the definition of personal data at all. Instead, it seems to say a service can only access information on a user's machine under one of two conditions:
It's necessary for the basic purpose of the service (zoom accessing your webcam = 'that's why I'm on zoom' / twitter accessing your webcam = 'something very bad is happening')
The user explicitly agreed to it ('click this button to allow nfts.org to access your jpg folder')
You don't need to know if a user has an adblocker to serve videos, so (1) won't work for YouTube, but they could easily throw up a "to watch this video click 'allow' so we can scan your browser for adblockers" and satisfy (2) even if users would find it annoying.
The linked poster is stating in their (informed) opinion, that anti-adblock detection is illegal. Not that it may be illegal. The title of this post should reflect what they said, no less than if...
The linked poster is stating in their (informed) opinion, that anti-adblock detection is illegal. Not that it may be illegal. The title of this post should reflect what they said, no less than if they'd written it in a newspaper.
I don't think the "preserving the headline" philosophy always applies on Tildes, as some titles and headlines are very clickbait-y and don't convey (or even directly mention) the point of the...
I don't think the "preserving the headline" philosophy always applies on Tildes, as some titles and headlines are very clickbait-y and don't convey (or even directly mention) the point of the article which the poster wants to discuss. This particular post feels like a misleading title, as I expected an article with facts and sources, not a post on a Mastodon instance about submitting a complaint.
He doesn't fully go into why he thinks it's violating European privacy policy. He mentions a specific article of the law that doesn't feel directly relevant or linked to detecting adblock. When someone said they couldn't see the connection and asked for him to elaborate, he initially just listed his credentials. He mentions a ruling was made in 2016 that "detecting adblock requires consent" but gives no further context or sources on that ruling, so I had to look it up. On that note, I originally thought this whole post referred to GDPR policy, but learned from his replies that it's related to some other directive called "ePrivacy" which I've never heard of before.
Basically, the title gave me expectations of an informative article on how it's illegal, but it doesn't really do that. It overall feels like he's just saying "Trust me, I'm an expert" without trying to actually explain anything.
People ask the author which specific part of what YouTube is doing is illegal. A little further down the thread the author goes into it. He seems to be saying that sending any JavaScript requires...
People ask the author which specific part of what YouTube is doing is illegal. A little further down the thread the author goes into it. He seems to be saying that sending any JavaScript requires consent from the user "unless it is strictly necessary for the provisions of the requested service."
That seems sketchy to me. First, the vast majority of the web uses JavaScript for all kinds of things not strictly necessary to the service. Second, I would fully expect YouTube's lawyers to argue that serving ads is strictly necessary to the service--if they stopped serving ads, they'd have to shut down immediately.
The author also getsprettysnippy with people who ask him to explain the technical details of his legal argument. That doesn't inspire confidence, IMO.
Yeah, his posts aren't exactly helpful. My brief research into the topics he mentioned (but didn't bother elaborating on when asked) brings up his name so I know he's an expert in this field....
Yeah, his posts aren't exactly helpful. My brief research into the topics he mentioned (but didn't bother elaborating on when asked) brings up his name so I know he's an expert in this field.
However, as you noted, he's just snippy in every comment and doesn't bother giving any concrete information or resources to back up his arguments. We don't need full-fledged legal research, we just want some sources and information.
At one point he says "you really need to actually read the law to be able to comment because so far I am seeing a lot of utter nonsense arguments based on complete ignorance." Yes, he's right, we ARE ignorant, and he's doing nothing to help clear that ignorance. He says he's explained many times, provided references and a link to the legal opinion of the EU Commission... Where? I don't see those links, I only see him being defensive. He's downright hostile to people asking for information so THEY can do research.
Even if he IS right, his attitude is just unnecessarily hostile and aggressive. Can he really argue his point well in the EU Parliament? Or will he just dismiss the politicians for asking basic questions with "I'm a computer scientist with 30 years of experience and a Master's in Law" like he does here?
A question was raised in that thread and seemingly unanswered - is there any value in someone outside the EU filing a complaint for this? Would it just dilute the effort?
A question was raised in that thread and seemingly unanswered - is there any value in someone outside the EU filing a complaint for this? Would it just dilute the effort?
From a later thread. OK so I just got off a call with the DPC - the strategy has worked, it has been noticed and they are investigating. They have received a lot of complaints since I went public...
OK so I just got off a call with the DPC - the strategy has worked, it has been noticed and they are investigating.
They have received a lot of complaints since I went public with mine yesterday which is starting to overwhelm their backlog.
So I am now politely asking if people can pause on sending in further complaints until mid next week to give them a chance to try to resolve this issue.
And if a user doesn't provide consent, couldn't Google just redirect the user off the site until they do provide consent? Or would Google still need to provide service, so that's it not like a...
And if a user doesn't provide consent, couldn't Google just redirect the user off the site until they do provide consent? Or would Google still need to provide service, so that's it not like a quid pro quo, trading some right for access?
The question is whether Google can present terms that require ads/tracking, though. They probably can, but you're framing the issue completely wrong: If Google says "by watching this video you...
The question is whether Google can present terms that require ads/tracking, though. They probably can, but you're framing the issue completely wrong: If Google says "by watching this video you must vote for <Politician>" and then block the video from playing if the user refuses to vote for said politician, then Google is doing an illegal thing and must permit those users to watch the video if it's publicly available to everyone else.
So to reiterate: Google isn't obligated to show videos if the user rejected legitimate terms - and the question is whether requiring ad-viewing is legitimate terms.
I don’t think that follows at all. While Google may be prohibited from requiring illegal terms (although requiring ad viewing is pretty obviously not an illegal term), I don’t see how they would...
I don’t think that follows at all. While Google may be prohibited from requiring illegal terms (although requiring ad viewing is pretty obviously not an illegal term), I don’t see how they would be compelled to show videos under really any circumstances. What comparable litigation has there been? It seems somewhat similar to the infamous gay wedding cakes, but without a protected class — presumably video watchers are not a protected class at least.
If that really is the case then things could get interesting. Ad companies probe all kinds of things on your device, because it helps them identify you. This Stackoverflow post comes to mind: Why...
So to reiterate: Google isn't obligated to show videos if the user rejected legitimate terms - and the question is whether requiring ad-viewing is legitimate terms.
If that really is the case then things could get interesting. Ad companies probe all kinds of things on your device, because it helps them identify you. This Stackoverflow post comes to mind: Why is Stack Overflow trying to start audio?. If detecting an adblocker is not legitimate, then that fingerprinting also isn't, I'd say.
Not just ad companies, but there are legitimate security concerns here for detecting bots, eg. Akamai bot manager. As long as there are bad actors, fingerprinting will be necessary.
Not just ad companies, but there are legitimate security concerns here for detecting bots, eg. Akamai bot manager. As long as there are bad actors, fingerprinting will be necessary.
The GDPR does take this into consideration. If you disagree to to data processing on things not related to the service (e.g. ads), then they cannot deny you the service.
The GDPR does take this into consideration. If you disagree to to data processing on things not related to the service (e.g. ads), then they cannot deny you the service.
I do understand Google is a business and they run off ads (can't be that simple ???), however the whole ad block detection thing - couldn't YouTube be basically classes as a monopoly (I mean who...
I do understand Google is a business and they run off ads (can't be that simple ???), however the whole ad block detection thing - couldn't YouTube be basically classes as a monopoly (I mean who even comes remotely close ) in their field, that any changes they try to force through is really "if you don't agree, tough go somewhere else to watch videos" where they really have little competition ?
Google is so big that they already are - Youtube isn't profitable (Google/Alphabet don't publish numbers, but they never boast about Youtube's profitability in their quarterly report, i.e. the...
Google is so big that they should be legally required to show videos for free?
Google is so big that they already are - Youtube isn't profitable (Google/Alphabet don't publish numbers, but they never boast about Youtube's profitability in their quarterly report, i.e. the document for boasting about profitability to shareholders) and quite possibly never has been profitable. If they're deliberately choosing to be unprofitable for competitive advantage, then that undercuts any complaints that they need to do X to maintain profitability.
The argument seems to be more a general technical argument that Google shouldn't be controlling what your cleint should do and attempting to access capabilities without requesting it - i.e. it's okay for a website to refuse to function without webcam access, but that website has to formally request webcam access instead of just directly breaking out of the sandbox and running kernel code to access it without permission.
I'm not 100% sold on this argument as it applies to this circumstance, but at it's core it's a sound argument - Google is not permitted to hack your browser, and their anti-adblock is specifically circumventing the user's intentions which could be argued to be doing so. Google's response likely won't be "we're not hacking your browser", it'll be "we need to hack your browser in order to make money", which is puts the burden of proof onto Google.
No, but they have big enough of a monopoly (look at the alternatives...), they could try and force through something which people have no real choice but to accept (or use workarounds which they...
No, but they have big enough of a monopoly (look at the alternatives...), they could try and force through something which people have no real choice but to accept (or use workarounds which they are trying to block anyway)
I think the difference could be that their monopoly in this realm is not being maintained by anti-competitive practices, but rather by the huge barrier to entry. Now it's entirely possible Youtube...
I think the difference could be that their monopoly in this realm is not being maintained by anti-competitive practices, but rather by the huge barrier to entry.
Now it's entirely possible Youtube could have some anti-competitive practices that I'm not aware of or ones that the public isn't aware of, but I think public perception is that it's simply very costly and very hard to build such a service at the scale that Youtube operates at. That means actions like this one don't get perceived in the same way as a monopoly maintained through anti-competitive practices. Youtube isn't breaking the back of competitors and then implementing things like this, it's just competitors simply don't exist at the scale Youtube operates and thus their actions are perceived as necessary because no other service can survive at this scale.
The reason youtube has no competitors is because 18 years after launch, youtube still isn't profitable. The logistics and financial cost of running this service are truly staggering. So much so...
The reason youtube has no competitors is because 18 years after launch, youtube still isn't profitable. The logistics and financial cost of running this service are truly staggering. So much so that the people who actually think peertube could ever come close to replacing it are living in a fantasy land, based this point alone (the lack of creator compensation is the other big one).
So the problem we have is that consumers want something that simply cannot exist. There are three requirements any competitor needs to address, and no proposed alternative satisfies all three:
It needs the infrastructure to handle 30,000 hours of video being uploaded every hour.
It needs a compensation structure for creators that make videos as a full time job and bring in the views.
It needs a healthy enough revenue stream to make points 1 & 2 sustainable.
I think if people are serious about not being bombarded with ads, they should get a lot more comfortable with the idea of paying for things rather than getting them for free.
The title is extremely misleading. Someone filed a complaint with the GDPR regulating body. That body has not made a ruling. I would recommend changing “is” to “may be”.
Anyway, on to the actual content. I am not a lawyer, I don’t live in the EU, I am not very familiar with the GDPR, etc. But this feels like a stretch to the extreme. First, doesn’t the GDPR only regulate personally identifiable information? Whether you view ads or not does not seem like PII. At least not to me.
Next, the linked person makes the claim that it is not required for the requested service. It seems like it would be pretty easy to argue that the ads are strictly necessary for the service. After all, the service YouTube provides is not “Free Videos” it’s “Ad Supported Video”. I know this is not how the general public views YouTube, but you don’t have to convince the general public, you have to convince lawyers.
Finally, this complaint is very implementation dependent. I don’t know how Google is currently implementing anti Adblock. However if this complaint goes through, they could likely implement a new version that does not store or transmit any PII.
Not a lawyer or an expert, but in some of the replies, he says explicitly that this is not a GDPR issue, but "ePrivacy Directive."
I looked into this a bit. The author's key claim is:
This was a very widely propagated (by this same guy I think) opinion from April 2016. However, it would appear that eventually adblock detection was ruled an exception, as detailed here .
There is a claim that the EC clarified this themselves in 2017, but the only source I could find that purports to underpin this claim is strictly paywalled (anyone have access?)
archive link
The ePrivacy Regulation is still only a proposal.
Note that the ePrivacy Regulation is not the same thing as the ePrivacy Directive, which is in force and by reading the Wiki on it, does seem relevant.
The poster is not invoking GDPR but 2002/58/EC, an EU directive "concerning the processing of personal data and the protection of privacy in the electronic communications sector". Specifically he's invoking article 5 section 3, here it is in its entirety:
The way I read this, it doesn't seem to hinge on the definition of personal data at all. Instead, it seems to say a service can only access information on a user's machine under one of two conditions:
It's necessary for the basic purpose of the service (zoom accessing your webcam = 'that's why I'm on zoom' / twitter accessing your webcam = 'something very bad is happening')
The user explicitly agreed to it ('click this button to allow nfts.org to access your jpg folder')
You don't need to know if a user has an adblocker to serve videos, so (1) won't work for YouTube, but they could easily throw up a "to watch this video click 'allow' so we can scan your browser for adblockers" and satisfy (2) even if users would find it annoying.
More on Wikipedia
IANAL, but it does seem relevant.
The linked poster is stating in their (informed) opinion, that anti-adblock detection is illegal. Not that it may be illegal. The title of this post should reflect what they said, no less than if they'd written it in a newspaper.
I don't think the "preserving the headline" philosophy always applies on Tildes, as some titles and headlines are very clickbait-y and don't convey (or even directly mention) the point of the article which the poster wants to discuss. This particular post feels like a misleading title, as I expected an article with facts and sources, not a post on a Mastodon instance about submitting a complaint.
He doesn't fully go into why he thinks it's violating European privacy policy. He mentions a specific article of the law that doesn't feel directly relevant or linked to detecting adblock. When someone said they couldn't see the connection and asked for him to elaborate, he initially just listed his credentials. He mentions a ruling was made in 2016 that "detecting adblock requires consent" but gives no further context or sources on that ruling, so I had to look it up. On that note, I originally thought this whole post referred to GDPR policy, but learned from his replies that it's related to some other directive called "ePrivacy" which I've never heard of before.
Basically, the title gave me expectations of an informative article on how it's illegal, but it doesn't really do that. It overall feels like he's just saying "Trust me, I'm an expert" without trying to actually explain anything.
Which is funny because their ad block message is talking about being able to provide videos for free due to ads. But I get the point.
People ask the author which specific part of what YouTube is doing is illegal. A little further down the thread the author goes into it. He seems to be saying that sending any JavaScript requires consent from the user "unless it is strictly necessary for the provisions of the requested service."
That seems sketchy to me. First, the vast majority of the web uses JavaScript for all kinds of things not strictly necessary to the service. Second, I would fully expect YouTube's lawyers to argue that serving ads is strictly necessary to the service--if they stopped serving ads, they'd have to shut down immediately.
The author also gets pretty snippy with people who ask him to explain the technical details of his legal argument. That doesn't inspire confidence, IMO.
Yeah, his posts aren't exactly helpful. My brief research into the topics he mentioned (but didn't bother elaborating on when asked) brings up his name so I know he's an expert in this field.
However, as you noted, he's just snippy in every comment and doesn't bother giving any concrete information or resources to back up his arguments. We don't need full-fledged legal research, we just want some sources and information.
At one point he says "you really need to actually read the law to be able to comment because so far I am seeing a lot of utter nonsense arguments based on complete ignorance." Yes, he's right, we ARE ignorant, and he's doing nothing to help clear that ignorance. He says he's explained many times, provided references and a link to the legal opinion of the EU Commission... Where? I don't see those links, I only see him being defensive. He's downright hostile to people asking for information so THEY can do research.
Even if he IS right, his attitude is just unnecessarily hostile and aggressive. Can he really argue his point well in the EU Parliament? Or will he just dismiss the politicians for asking basic questions with "I'm a computer scientist with 30 years of experience and a Master's in Law" like he does here?
A question was raised in that thread and seemingly unanswered - is there any value in someone outside the EU filing a complaint for this? Would it just dilute the effort?
From a later thread.
OK so I just got off a call with the DPC - the strategy has worked, it has been noticed and they are investigating.
They have received a lot of complaints since I went public with mine yesterday which is starting to overwhelm their backlog.
So I am now politely asking if people can pause on sending in further complaints until mid next week to give them a chance to try to resolve this issue.
So hold off for now I guess.
Glad to read this! I still struggle with following the thread format of Mastodon and Twitter it seems.
Sounds like all Google would have to do is obtain consent though?
And if a user doesn't provide consent, couldn't Google just redirect the user off the site until they do provide consent? Or would Google still need to provide service, so that's it not like a quid pro quo, trading some right for access?
That exactly it, Google isn’t obligated to show videos if the user didn’t accept their terms.
The question is whether Google can present terms that require ads/tracking, though. They probably can, but you're framing the issue completely wrong: If Google says "by watching this video you must vote for <Politician>" and then block the video from playing if the user refuses to vote for said politician, then Google is doing an illegal thing and must permit those users to watch the video if it's publicly available to everyone else.
So to reiterate: Google isn't obligated to show videos if the user rejected legitimate terms - and the question is whether requiring ad-viewing is legitimate terms.
I don’t think that follows at all. While Google may be prohibited from requiring illegal terms (although requiring ad viewing is pretty obviously not an illegal term), I don’t see how they would be compelled to show videos under really any circumstances. What comparable litigation has there been? It seems somewhat similar to the infamous gay wedding cakes, but without a protected class — presumably video watchers are not a protected class at least.
If that really is the case then things could get interesting. Ad companies probe all kinds of things on your device, because it helps them identify you. This Stackoverflow post comes to mind: Why is Stack Overflow trying to start audio?. If detecting an adblocker is not legitimate, then that fingerprinting also isn't, I'd say.
Not just ad companies, but there are legitimate security concerns here for detecting bots, eg. Akamai bot manager. As long as there are bad actors, fingerprinting will be necessary.
The GDPR does take this into consideration. If you disagree to to data processing on things not related to the service (e.g. ads), then they cannot deny you the service.
I do understand Google is a business and they run off ads (can't be that simple ???), however the whole ad block detection thing - couldn't YouTube be basically classes as a monopoly (I mean who even comes remotely close ) in their field, that any changes they try to force through is really "if you don't agree, tough go somewhere else to watch videos" where they really have little competition ?
Why would that matter though? What’s the argument here, Google is so big that they should be legally required to show videos for free?
Google is so big that they already are - Youtube isn't profitable (Google/Alphabet don't publish numbers, but they never boast about Youtube's profitability in their quarterly report, i.e. the document for boasting about profitability to shareholders) and quite possibly never has been profitable. If they're deliberately choosing to be unprofitable for competitive advantage, then that undercuts any complaints that they need to do X to maintain profitability.
The argument seems to be more a general technical argument that Google shouldn't be controlling what your cleint should do and attempting to access capabilities without requesting it - i.e. it's okay for a website to refuse to function without webcam access, but that website has to formally request webcam access instead of just directly breaking out of the sandbox and running kernel code to access it without permission.
I'm not 100% sold on this argument as it applies to this circumstance, but at it's core it's a sound argument - Google is not permitted to hack your browser, and their anti-adblock is specifically circumventing the user's intentions which could be argued to be doing so. Google's response likely won't be "we're not hacking your browser", it'll be "we need to hack your browser in order to make money", which is puts the burden of proof onto Google.
IANAL, obviously.
No, but they have big enough of a monopoly (look at the alternatives...), they could try and force through something which people have no real choice but to accept (or use workarounds which they are trying to block anyway)
I think the difference could be that their monopoly in this realm is not being maintained by anti-competitive practices, but rather by the huge barrier to entry.
Now it's entirely possible Youtube could have some anti-competitive practices that I'm not aware of or ones that the public isn't aware of, but I think public perception is that it's simply very costly and very hard to build such a service at the scale that Youtube operates at. That means actions like this one don't get perceived in the same way as a monopoly maintained through anti-competitive practices. Youtube isn't breaking the back of competitors and then implementing things like this, it's just competitors simply don't exist at the scale Youtube operates and thus their actions are perceived as necessary because no other service can survive at this scale.
The reason youtube has no competitors is because 18 years after launch, youtube still isn't profitable. The logistics and financial cost of running this service are truly staggering. So much so that the people who actually think peertube could ever come close to replacing it are living in a fantasy land, based this point alone (the lack of creator compensation is the other big one).
So the problem we have is that consumers want something that simply cannot exist. There are three requirements any competitor needs to address, and no proposed alternative satisfies all three:
I think if people are serious about not being bombarded with ads, they should get a lot more comfortable with the idea of paying for things rather than getting them for free.