It is very not legal, but I think the parent was saying these regulations are more onerous to small dev shops rather than Google and the fine for this will be minuscule. Hopefully companies will find paths to revenue that do not require selling out there users to this level, maybe by just having ad auctions without any identifying information at all.

It&#x27;s not legal but there isn&#x27;t much the EU can really do. It would be shocking if they actually managed to prosecute Google which has so far avoided much hassle in antitrust and the like, taking I think a billion dollar fine which sounds like a lot but is basically a slap on the wrist.That&#x27;s why, IMO, GDPR sucks for small businesses that can be outed to the ICO for a minor oversight and not so much for big data abusers that can take on GDPR and come out unscathed.

From my (admittedly limited) understanding, this is not actually legal under the GDPR.  Certainly the alleged (but not demonstrated) behind-the-scenes trading of personal info isn’t, but the shared id is also personally-identifying information, and directly regulated.

- my initial reaction is to blame GDPR, yes, because it&#x27;s just security theater that does so little to actually ensure privacy. Sure Google is at fault but GDPR was supposed to regulate this and it is clearly failing to do so. And if you want to boycott it you&#x27;re welcome to but they&#x27;ve built an empire with their cloud, search, email, etc to the point where that would be pretty difficult and annoying to the average consumer. They&#x27;re effectively too big to be boycotted at this point.- It doesn&#x27;t explicitly force them to do that. And most sites aren&#x27;t explicitly sharing the data either; i.e. almost every site uses Google analytics which doesn&#x27;t really comply with do not track all too well, and Google will then share their data with everybody else (which is part of their violations in this article). Also saying &quot;no&quot; doesn&#x27;t do much either as most of these big sites either already stored the cookie or won&#x27;t do much to delete it. And it&#x27;s not that they&#x27;ll try to work around it, they either don&#x27;t put forth the effort because GDPR is like a pebble for them, or they already worked around it in a way that changes nothing. Their business model is still the exact same.I think the spirit of this law is fine, but the actual law does nothing and is just privacy theater. Google isn&#x27;t buying time, almost 4 years later nothing has changed -- they just know they can&#x27;t be touched.- They&#x27;re not going to sink, they&#x27;ll just grow much slower and thus won&#x27;t be an alternative to the big data abusers you hate so much. And they&#x27;re not failing to handle your data, most of the time startups aren&#x27;t selling you out they&#x27;re just trying to figure out who their customer is internally. To do this they collect some data that is usually optional and very much with your consent; GDPR just puts a bunch of hoops in front of this so that it&#x27;s an enormous pain to do so. I run a startup that collects basically no data (literally, we do not have a database for 2 of our products). It was a pain for us to become GDPR compliant because that disables our metrics entirely and requires a bunch of banners and checkboxes everywhere even though we literally store nothing.I&#x27;m all for the spirit of the law. I just think the execution sucks and they definitely didn&#x27;t think it through enough. I think the evidence for this is clear based on the sheer number of privacy violations we&#x27;ve had since GDPR was enacted alone, and how little enforcement and regulation has actually gone on.

And I&#x27;m very annoyed that your initial reaction to reading this article is to blame the GDPR instead of blaming Google for these shady practices. Boycott that crap, move to other services. This shouldn&#x27;t be acceptable.I&#x27;m very happy that the GDPR exist, if only because it forced all these websites from explicitly giving me a list of the literally hundreds of partners they want to share my data with, along with a way to say &quot;hell no&quot;. Of course Google and friends will try to work around it but hopefully that won&#x27;t come to pass and they&#x27;ll have to actually bother changing their crappy business model. I think the spirit of the law is fairly clear, I wonder why Google thinks this scheme can work. Maybe they&#x27;re just trying to buy some time.As for startups that sink because they can&#x27;t be bothered to sanely handle my personal data: good riddance.

Unless I&#x27;m misunderstanding what you mean by absolute and relative, I think the law is already relative:&gt; The maximum fine under the GDPR is up to 4% of annual global turnover or €20 million – whichever is greater – for organisations that infringe its requirements.From here: <a href="https:&#x2F;&#x2F;www.itgovernance.co.uk&#x2F;dpa-and-gdpr-penalties" rel="nofollow">https:&#x2F;&#x2F;www.itgovernance.co.uk&#x2F;dpa-and-gdpr-penalties</a>

&gt; Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger. The more power you have to break the law, the bigger the stakes should be.GDPR penalties are a flat fee or a percentage of revenue, whichever is higher.If Google is truly willfully violating the GDPR, the maximum penalty by law could be up to 4% of their global turnover. I would not call that pocket change. But more importantly, it is a relative increase in fine based on the law breaking company.(Will the EU actually fine Google ~6 billion dollars? Perhaps we will find out!)

The fine is already kinda big for GDPR (4% global rev for big companies) but Google has gotten away with way worse on way more regulated fronts i.e. their antitrust case which slapped them on the wrist.If GDPR wants to be effective they need a ridiculous company-breaking fine for big abusers like COPPA and the like. Something like a per-user fine for violations that means they either can&#x27;t do business in the EU or they have to become compliant otherwise risk being basically destroyed (for reference, violating child protection laws in the US can break and have broken companies before).EDIT: also as for the tracking growth comment -- I agree on this, but the effects of GDPR on growth tools reach far beyond this. Even basic metrics are hard to get without a bunch of hoops. Even if you store no data you have to have a bunch of checkboxes and banners everywhere. Just for using Google Analytics that just relies on what they know about your computer (fingerprinting), and uses no PII at all, you need a banner and privacy policy. The laws are making it hard to use even basic analytics without fearing a misstep.

The European Union has decided that growth based on clandestine tracking of users, selling their PII without consent is not a legitimate growth tool.
You know, like the way we outlawed violence as a &quot;growth tool&quot;Your other claims are more reasonable. But they would lead me to the conclusion we need bigger fines on bigger businesses. Not absolutely bigger, as the law already does, but relatively bigger.
The more power you have to break the law, the bigger the stakes should be.

Furthermore, if organizations are explicitly accepting penalties to keep on violating the law, that law will be adjusted accordingly. It might take a while, but it will happen. Laws with the intention to change behavior &#x2F; culture cannot &quot;work&quot; from day one. This is a continuous process steered by politics, courts, governments, and public opinion.

&gt; If they&#x27;re able to beat Google&#x27;s lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that&#x27;ll be more than covered by their daily revs.This is why the 4% of global annual revenue fine option exists. A few of those add up quick.

EDIT: since everyone seems to be mentioning the 4% rule, I&#x27;d just like to point out that I&#x27;m not denying the existence of this, just denying that it is actually effective. Google has violated antitrust before, and walked away with a &quot;big&quot; fine that&#x27;s a slap on the wrist. They&#x27;ve violated GDPR before as well once or twice, and got a &quot;record breaking&quot; 57MM$ fine. The 4% rule exists and clearly isn&#x27;t enforced well. I know a lot of people love GDPR but I would be beyond shocked if the EU actually managed to hit Google with something that sticks. I very much hope I&#x27;m proved wrong!This sort of resolution was inevitable.I said it before and I&#x27;ll say it again: GDPR is an annoying measure for developers, small businesses and startups. It doesn&#x27;t do much other than put in place so many steps that growth tools for startups become risky to use. For big businesses that (ab)use big data, it&#x27;s not much of a hassle because they can afford the legal steps as well as the change in infrastructure. They can even work around it and keep abusing data without consequences.If they&#x27;re able to beat Google&#x27;s lawyer army and actually prosecute them, then Google will take a whopping fine in the millions of dollars that&#x27;ll be more than covered by their daily revs.

I agree with you in theory, but until we can figure out micro-transactional payments that work globally it seems ads are good stepping stone. People want to get paid for work, some users are willing to pay (cash) some with attention to ads. We should not give up our privacy or anonymity for this attention though.

I think there are simply engineers that are fine with the current state of things. You mention specifically &quot;come up with a new way of making money&quot;; however, for extrinsically motivated people, why reinvent the wheel? Problem solving can mean thinking up a solution or implementing a solution.In the same vein, there may be engineers that enjoy working on this type of problem - how to identify someone that is actively avoiding you. The current iteration of Do Not Track mentality only makes the problem more interesting by putting up restrictions.

&gt; Surely the cleverest engineers to walk the planet can come up with a new way of making money that doesn’t involve psychological manipulation.If they could, they would&#x27;ve already done so.One of the things &quot;the cleverest engineers to walk the planet&quot; would probably need to do is to increase consumers willingness to pay for good content by a factor of ~10 for e.g. online newspapers with quality journalism to be profitable, which frankly sounds near-impossible.

Engineers aren’t businesspeople. We’re tools of the businesspeople - we only stick around to do their bidding because they offer us equity.

&gt; Surely the cleverest engineers...can come up with a new way of making moneyNew ways of building things is the province of engineering.New ways of making money is the province of MBAs.Not that really matters; I doubt you will succeed in replacing ads with something &quot;better&quot;.

Why should ads rule the web at all? Surely the cleverest engineers to walk the planet can come up with a new way of making money that doesn’t involve psychological manipulation.

This some great work on tracking down all of these measures to track users. I really hope we get to the point where dumb ads rules the web once more. Hopefully this results in more than a slap on the wrist, but I doubt it.

Debian&#x27;s popcon is not enabled by default.

&gt; in terms of tracking it seems about as invasive as Debian&#x27;s popcon.How do you figure?

&gt; Enabled by default can and should be the default for security-related features.Not since Google uses the argument of increased security to justify data collection for quite some time in the interest of itself.

On HN it is taken as gospel that any information sent to a server will absolutely compromise your privacy. If anyone points out that the information is trivial or useless the rebuttal is instant - it can be cross referenced with other sources to build a complete profile of you.If you want to know which Go modules I use, go check out my github. They&#x27;re listed right there in import statements. If I&#x27;m hacking on a project that I want to keep private, I&#x27;ll disable this feature with a command line flag - easy.My issue with the paranoid folks in that thread is not that they made no sense (they can&#x27;t help that), it was they were attacking the person who implemented the feature viciously. He had implemented a feature that a majority of Go developers had been requesting for 5+ years, had done it in a way that improved clean build time, improved security and could easily be disabled or replaced with a private DB. Literally what else could that man have done?Even though all his work could be verified trivially (Go is open source!), they still chose to attack him.

Google (as well as surveillance states) use security arguments conveniently a bit too often to try and justify their actions.

The Go module hash checking seems to be more about avoiding the problems encountered by other language repos integrity and versioning issues (cough NPM), and in terms of tracking it seems about as invasive as Debian&#x27;s popcon.Enabled by default can and should be the default for security-related features.I tend to agree about the rest of the creepiness, especially anything personally behavioral.

Wide-ranging thoughts and examining what-ifs makes you a curious individual. Failure to counterbalance confirmation bias by critically examining and deconstructing your own hypotheses makes you a crackpot.The main difference between the two is just which paranoid thoughts you give credence to.

&gt; branded as a &#x27;privacy nut&#x27;Only the Paranoid Survive. A book by The President and CEO of Intel.<a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Andrew_Grove" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Andrew_Grove</a>

If I remember right, after the leaks the faux-sophisticated take was &quot;well of course, everyone knew this was going on, are you naive?&quot;.

I probably saw those movies at an age where I was too impressionable, but growing of with portrayals of US intelligence units like in Enemy of the State, I always assumed that they did spy on everyone (and didn&#x27;t even think that this would be some absurd view, or that I was being clever with that thought).

What program did Snowden leak that shows the US government spying on everyone?

&quot;You know, that PATRIOT act really allows spying on everyone&quot;&quot;Come on that&#x27;s just paranoia&quot;Snowden leaks secret program that implements everything details in the patriot act.&quot;WHO COULD HAVE SUSPECTED?&quot;

10 years ago you&#x27;d be called a privacy lunatic when you said that website owners who used google analytics were just selling their users&#x27; data to Google. Same reflexion about those using ad scripts.

I’ve noticed this as well. Would love to see some analytics on this.

Different types of Hacker News article trends to attract slightly nonoverlap different subgroups of people. You&#x27;ll sometimes find different sentiments over the same topic under, e.g. U.S. politics, silicon valley startups, cryptography, or urban life.

A reasonable debate about your privacy concerns cannot be had if you take the most extreme response and pretend it represents what you are or what everyone thinks you are.You are assuming you were branded by a large swath while similarly branding an entire company that is clearly represented by many diverse opinions on diverse products. The debate needs more nuance lest everyone pulls out their broad brushes while also taking offense to receiving a fleck of paint. Conflating the Go proxy w&#x2F; Google&#x27;s ad business is a perfect way to ignore nuance in the debate downplaying the real, tangible effects.

I think the biggest one is some bad wording on the marketing around the &quot;share your wifi&quot; feature, where it mentions that you can share &quot;secure&quot; passwords with QR codes now but doesn&#x27;t mention that the QR code has the plaintext password encoded in it.Other than that, it seems that privacy controls have been generally improved in Android 10.

&gt; It&#x27;s really funny to see that yesterday, I was branded as a &#x27;privacy nut&#x27; after the release of Android 10 as I was concerned about the privacy issues that are in Android.What are the privacy issues in Android 10? Anything new compared to previous versions?

&quot;Then the Go modules proxy issue...&quot;<a href="https:&#x2F;&#x2F;sum.golang.org&#x2F;privacy" rel="nofollow">https:&#x2F;&#x2F;sum.golang.org&#x2F;privacy</a>This links to the Google Privacy Policy which is an additional 27 pages.&quot;I think there are some folks at Google who have just read too deep into both 1984 and The Google Book...&quot;Is this The Google Book?<a href="http:&#x2F;&#x2F;blog.outer-court.com&#x2F;googlebook&#x2F;" rel="nofollow">http:&#x2F;&#x2F;blog.outer-court.com&#x2F;googlebook&#x2F;</a>

You were branded a privacy nut for <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20868489" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20868489</a> because you didn&#x27;t note any actual privacy issues in Android.

FWIW, it is very easy to setup the athens proxy and run it. You could even have it route traffic through Tor if you were so inclined. We use it and are a fan as is works nicely:<a href="https:&#x2F;&#x2F;github.com&#x2F;gomods&#x2F;athens" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;gomods&#x2F;athens</a>

I&#x27;ve found that whenever I post anything anti google on hackernews I&#x27;m downvoted and people call me names.

Obligatory post:<a href="https:&#x2F;&#x2F;cryptome.org&#x2F;2012&#x2F;07&#x2F;gent-forum-spies.htm" rel="nofollow">https:&#x2F;&#x2F;cryptome.org&#x2F;2012&#x2F;07&#x2F;gent-forum-spies.htm</a>It&#x27;s just as valid a technique for large organizations as it is for governments.Active Perception Management is most definitely a thing. Of course it only works because most people aren&#x27;t aware it is a thing.<a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Perception_management" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Perception_management</a>

&gt; I was branded as a &#x27;privacy nut&#x27; after the release of Android 10You were doing baseless accusation on something you don&#x27;t know anything about. Your comment was basically &quot;they market it as being better to handle privacy thus they clearly are worst with your privacy!&quot;.You didn&#x27;t raise anything substantial at all in that comment.

It&#x27;s really funny to see that yesterday, I was branded as a &#x27;privacy nut&#x27; after the release of Android 10 as I was concerned about the privacy issues that are in Android. Then the Go modules proxy issue around the Go Programming language that raised suspicions about tracking usage statistics around downloading modules turned on by default without any consent and now this.I think there are some folks at Google who have just read too deep into both 1984 and The Google Book to go on to think that privacy violations like this is a normal thing. But what do I know? I&#x27;m just another &#x27;privacy lunatic&#x27; on the net that wears a metal helmet (tinfoil hats are just not good enough) trying to protect my privacy.

That is the GDPR-default though. You&#x27;re still allowed to give data to third parties, you just need to have contracts with them regarding the handling, deletion etc of that data. Of course, mostly that&#x27;s for data processors, which I don&#x27;t think ad networks working with Google would fall under.

&gt; &quot;control&quot; over the data after broadcast, albeit legal control via contracts with advertisersNow there&#x27;s a claim only a court would buy!A court probably would buy it, though.Sigh.

Indeed. I fully admit I’d need to sit down and diagram some of Brave’s claims, but the large identifier screams “cryptographic entropy” to me.The GDPR has separate rules that effectively deal with whether you are the business with which the customer works or one of their contractors. I could imagine a world where google is the second party and needs a secure feature like this so the first party can perform (consented) tracking across multiple domains they own. This is just a devils advocate argument since I can’t guess intent.

The article doesn’t appear to claim that the author has been tracked in violation of the GDPR, only that the described mechanism makes it technologically feasible to do so.

Do you have to give consent for each individual third party your data gets shared with? I’d thought that if you give consent for some purpose, the company can use whatever processors it wants as long as it ensures they protect your privacy.

But where does your PII end up, only at Google, no?

The real time bidding on ad placements seems like a thing that a user could never give consent to as it&#x27;s literally feeding your info to a massive ever churning list of companies that get to bid on it.Aka - you land on a site, it send your IP and whatever identifiers it has to 10,000+ companies who all then figure out if they want to bid on showing you an ad.

&gt; Is it possible that Google does have &quot;control&quot; over the data after broadcast, albeit legal control via contracts with advertisers (as opposed to technical control)?That distinction is important. I’m happy that privacy advocates are realising that platforms having access to enforceable contracts is key–too many are quick to paint platforms as the source of the problem and not an agent who, with the right tools, could organise a market.Facebook has suggested having an independent court what is acceptable content in their platform. Google could think about delegating the control of how its IDs are used to an independent entity with the power to audit its partners’ data practice properly.

&gt; Is it possible that Google does have &quot;control&quot; over the data after broadcast, albeit legal control via contracts with advertisersI don&#x27;t actually put much faith in such &quot;control&quot;.

Snippets from the article:&gt; The evidence further reveals that Google allowed [...]&gt; Google has no control over what happens to these data once broadcast [...]Is it possible that Google does have &quot;control&quot; over the data after broadcast, albeit legal control via contracts with advertisers (as opposed to technical control)?Perhaps Google&#x27;s GDPR compliance strategy relies on the participating advertisers to comply with their contract with Google. If that assumption is accurate, perhaps Google&#x27;s advertisers are in breach of their contract with Google which makes it appear as though Google itself is in breach?I could be off-base, the details in the article aren&#x27;t incredibly clear to me.(For the record, I don&#x27;t like Google&#x27;s business model and I don&#x27;t like Google&#x27;s pervasive tracking -- I&#x27;m playing devil&#x27;s advocate to better understand the issue)

Q4 2018 earnings were around $40 billion. EU will have to try significantly harder.

5 billion is peanuts to google. if the fine is low enough that it can be written off as a cost of business, it&#x27;s too low. effective fines devastate profit margins rather than merely crimping them.

That fine qualifies as a &quot;slap in the hand&quot; for Google if it happens infrequently enough (which is the case).

I believe the $5 billion was an antitrust violation, not related to GDPR. I could be wrong.

The executives should face jail time. That would certainly light a fire under Google&#x27;s ass to finally &quot;do no evil&quot;.

Google has been fined a 5 billion dollar fine already last year, that claim simply isn&#x27;t true. But I agree with the implicit demand, they clearly haven&#x27;t gotten the message. The EU should slap them with billion dollar fines again until they learn their lesson.

Well, I am an European, it&#x27;s sad about the US Gov.&#x2F;DoJ, but that is not something I have the right to demand from my part.

FTC fined Facebook $5 billion this year for mishandling users’ personal information. The SEC fined them $100 million.

Sure you didn&#x27;t mean to say that what&#x27;s actually sad is that the US federal government&#x2F;DoJ doesn&#x27;t take real action?

They can assess that fine for each major incident, can&#x27;t they?

I was curious what the maximum fine for Google could be under GDPR.Google&#x27;s 2018 revenue was $136.22 billion. GDPR allows for a maximum fine of 4% of global turnover.At a maximum 4%, GDPR could impose up to a $5.5 billion fine. I agree, getting something closer to the maximum might help the situation. Although ultimately, my bet is that Google is already baking the 4% revenue risk into their business model. If that&#x27;s the case, GDPR&#x27;s maximum penalty should be reconsidered.

Executives commit crimes and the company pays the fine. This way crimes are not prevented.

What is sad is that the EU commission doesn&#x27;t take real action against Google. At best we are to expect a slap in the hand, at worst, the investigations will drag on and nothing will happen.

Maybe someone will finally take googles abusive practices to task.

BAT is traded in all crypto exchanges. you can instantly exchange it for a stablecoin or even write a script to exchange it to USD every day in e.g. coinbase. I don&#x27;t see why the fuss

That makes no sense.  BAT is opt-in and isn&#x27;t even mentioned when you install the browser.

Only if you&#x27;re into cryptocurrencies. I wish there was an alternative without the BAT stuff.

Yeah, it&#x27;s so annoying. WHAT PERSONAL DATA? The entire article is basically a rant about &quot;personal data can be leaked&quot; without any examples. Names? Browser Habits? What is it?

The whole intention of this clickbait article by Brave, without any technical details, is to sell it&#x27;s browser.

Just learned about Brave for the first time. Pretty neat stuff.

You mean how there are somehow always commenters in every topic ready to leap to the defense of China and major US tech companies?

It doesn’t even require a ‘paid agent’ theory to explain. Large companies actively court allegiance from their employees and spend serious effort to retain it by, for example, relentlessly offering mandatory courses in the company’s Cultural Values and evaluating promotions through that lens.So it’s not surprising that some BigTech employees are going to actively defend their employer’s values on forums.The best way to understand modern tech company culture is to consider them all very successful cults.

&gt;Would explain why most comments seem ridiculous.Or maybe people have widely differing views on all kinds of subjects?I&#x27;ve been called all kinds of things, which I definitely am not, so I&#x27;m inclined to think that people put far to much weight on the conspiracies.

I get the feeling this is much more prevalent than any of us realize. Would explain why most comments seem ridiculous.

Is it really a point of view, or is it a carefully engineered sequence of words designed to program people with certain opinions? There are lots of ways to &quot;program&quot; people that bypass their rational mind, and creating a false sense of social consensus is one of them.

Not if it&#x27;s disguised as a private individual (which is the default assumption in discussion forums such as this one).If a company wants to present its views, they can do so via press releases or clearly mark their posts as such (or via verified accounts like on Twitter).

I think if you want the point of view of a corporation you should feel free to go read their official blog, press releases, etc.  They have plenty of ways to spread their point of view that aren&#x27;t people pretending to be individual commenters.

I would love it for companies to jump into these conversations and defend or explain what&#x27;s going on. It&#x27;s less interesting for them to speak through a secret proxy.That said, I don&#x27;t think there are nearly as many shills as some people think nor do I think they are very effective.

Hi kspacewalk2,I&#x27;m John and I have views on privacy that are completely genuine and happen to align with what benefits the corporation(s) that my company, TotallyLegitimateComments LLC, contracts for. I believe advertisement is a force for good in the world and can bring together people and products that enrich their lives while creating value for shareholders! While I&#x27;d love to share what wonderful businesses my company works with, various privacy agreements prevent us from doing so. However, I can tell you that they all appreciate the fact that you find their views important! We will continue to lobby your congressmen on your behalf to ensure that these views are reflected in the nations laws! Thanks and remember, corporations are people like you and me!Sincerely,
John

If they want their view heard, they&#x27;re welcome to share it like everyone else.Paying someone else to share a very sanitized, market researched version of your opinion while pretending that they&#x27;re organically sharing their own opinion isn&#x27;t that. It&#x27;s dishonest, and it&#x27;s eroding honest conversations for the sake of advertising.

Should their point of view just not be heard then, in such discussions?

I used to wonder if this was the case. Would you have any idea how their performance is measured by their employers?

&gt;that Google&#x27;s willing to risk being outed for employing shillsThis risk might be lower than you think, the key phrase is, &quot;we didn&#x27;t realize that the marketing firm we contracted was subcontracting to other, shadier marketing firms, who themselves aren&#x27;t evil, but fell in with the wrong crowd and ended up trusting a yet deeper level of marketing firm, who was in fact evil.&quot;

&gt; There&#x27;s nothing I can do about Google&#x2F;FB&#x2F;whatever, so why even think about it.Actually, of all the stuff going on in the world, this is the one thing where you have an actual degree of control that matters.Sure, one individual won&#x27;t change business policies. But: you can easily take steps to prevent or reduce the amount of data these companies have on you.Don&#x27;t use their services, use an ad blocker, use tracking preventing, etc. You can even easily tailor it to your specific needs.Compared to stuff like Brexit, fires in the Amazon, Hong Kong, ethnic cleansing in Myanmar, attacks on democracy in Turkey, Hungary etc., it is trivial to do something against Google&#x2F;FB that has at least the effect of protecting you.

online advertising is pretty low on my listThe threat that Google&#x27;s tracking infrastructure represents is not limited to ads. If they stayed in their proverbial lane and used their panopticon exclusively to sell me things, many of us wouldn&#x27;t mind as much as we do.But they lend the power and reach of their machine to governments, whether it&#x27;s China looking to smoke out dissidents, or the NSA PRISM program, or even the DEA itching to score another weed possession arrest, Google gladly and happily does whatever governments ask of them, frequently with no warrant required.

What&#x27;s more likely: that Google&#x27;s willing to risk being outed for employing shills or that there are people who actually hold the opposing viewpoint?Personally I tend to think of most people on HN as privacy nuts. Honestly of all the problems in the world to get worked up over, online advertising is pretty low on my list. There&#x27;s nothing I can do about Google&#x2F;FB&#x2F;whatever, so why even think about it.If Google or whoever wants to pay me to keep posting, I&#x27;m listening.

I can attest to that as when you point of things like Google gets caught stealing IP from a MIT student they invited for an interview (a popular thread here on HN) it gets downvoted voraciously.Either its employees, hired guns and or something...

Every company I&#x27;ve worked at has had an explicit policy of not commenting on that company&#x27;s business on the internet.

I doubt the vast majority of employees would get offended that easily. I work for a tech company providing marketing tools (basically, I help send marketing emails (aka spam)), I like the pay, the overall environment and the technical challenges, but I&#x27;m under no illusion that I contribute to the betterment of our societies.If you see these kind of behavior online, it&#x27;s almost always people paid to explicitly monitor forums and &quot;protect&quot; a company image.

I&#x27;m no marketing expert, but I doubt that the best way Google can think of to sway public opinion is to call people privacy nuts. Google employs over 100,000 people and even more people work at similar companies like Facebook or buy targeted ads. Many of these people browse Hackernews and get offended if others accuse their livelihoods of being evil.

&quot;It is difficult to get a man to understand something, when his salary depends on his not understanding it.&quot;--Upton Sinclair

Could also be selfishness, I remember reading an article about leaked internal Facebook employees where some employees would pressure others to not talk about privacy or sensitive topics because it would hurt the stock price further and therefore hurt all employees. I can&#x27;t seem to find the article. I can see employees of big companies trying to sway or minimize decisions to feel like they are protecting their future earnings.

<a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;shills&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;shills&#x2F;</a>It&#x27;s not going to be entirely legitimate but there&#x27;s going to be some eye opening items in there for you I suspect.

Not exactly a company, but if <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;50_Cent_Party" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;50_Cent_Party</a> is a thing, I can&#x27;t imagine that it&#x27;s not also happening in a corporate context.

The Microsoft v. Novell case documented numerous examples and instances of a specific FUD campaign.The book Merchants of Doubt highlights the practice across decades and industries.Ralph Nader was subject to corporate smear tactics and surveillance in the 1970s.The idea that companies would suddenly stop using these tactics the moment they become divinely powerful defies all reason.Reddit&#x27;s &#x2F;r&#x2F;shills and &#x2F;r&#x2F;HailCorporate highlight some modern instances.

Amazon employees what it calls &quot;FC Ambassadors&quot;. These people have openly admitted that they are paid by the hour to tweet about the company[0].Full thread in a nicely readable format at <a href="https:&#x2F;&#x2F;www.thepoke.co.uk&#x2F;2019&#x2F;08&#x2F;15&#x2F;amazon-ambassadors-takedown-hilarious-terrifying-equal&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.thepoke.co.uk&#x2F;2019&#x2F;08&#x2F;15&#x2F;amazon-ambassadors-take...</a>[0] <a href="https:&#x2F;&#x2F;twitter.com&#x2F;rulesObeyer&#x2F;status&#x2F;1161758672973811712" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;rulesObeyer&#x2F;status&#x2F;1161758672973811712</a>

Monsanto is a good example. Paid internet shills: <a href="https:&#x2F;&#x2F;www.baumhedlundlaw.com&#x2F;monsanto-paid-internet-trolls&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.baumhedlundlaw.com&#x2F;monsanto-paid-internet-trolls...</a>. Influenced research about its Roundup products: <a href="https:&#x2F;&#x2F;www.nytimes.com&#x2F;2017&#x2F;08&#x2F;01&#x2F;business&#x2F;monsantos-sway-over-research-is-seen-in-disclosed-emails.html" rel="nofollow">https:&#x2F;&#x2F;www.nytimes.com&#x2F;2017&#x2F;08&#x2F;01&#x2F;business&#x2F;monsantos-sway-o...</a>.

&gt; Companies do actually employ shills to go on forums and try to sway public opinionI&#x27;m inclined to believe you, but sources please. Especially interested if you (or anyone) have anything on Google in this respect.

Because literally anything is a fact, when worded the right way.  In fact, that&#x27;s most of what is wrong with the state of our &#x27;News&#x27; today.  Even little word changes can be used to sway public opinion (ex: &#x27;victim&#x27; vs &#x27;drunk woman&#x27;, in a case an assault victim happened to have been drinking).

&gt; This is the lazy and ignorant method of dismissing other people&#x27;s arguments.First, please observe the principle of charity when posting.&gt; Shill or not, what does it matter if what they state are facts?Because it is entirely possible to tell large lies using small facts.Because propaganda and disinformation are actual, real things and are very difficult to combat once unleashed in the commons.Because the &quot;let the marketplace of ideas figure it out&quot; excuse to not police propaganda and disinformation attacks is hopelessly naive at best, and deliberately ineffective at worst.

&gt;Companies do actually employ shills to go on forums and try to sway public opinion.This is the lazy and ignorant method of dismissing other people&#x27;s arguments. Shill or not, what does it matter if what they state are facts?

...is this supposed to prove or suggest that Google does the same?

Nation states employ shills to attack other countries best companies like Google, Facebook, and Amazon. There has been a sustained PR campaign against our companies.Dictatorships use Whataboutism to help cover stuff like this... <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;pics&#x2F;comments&#x2F;cz75gj&#x2F;hong_kong_police_beat_and_broke_this_teenagers&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;pics&#x2F;comments&#x2F;cz75gj&#x2F;hong_kong_poli...</a>

I&#x27;ve seen a huge number of accusations that people espousing my views are shills in some thread here or on reddit. I&#x27;m sure there are paid shills, and even in large numbers. I&#x27;d bet it&#x27;s a problem. But we have to be reeeeeeeeallly careful about throwing that label around.When you&#x27;re wrong, you shutting down discourse by effectively saying the other person isn&#x27;t even a person. This gets us to far more extreme us-vs-them dynamics than otherwise possible.

I recall that this is exactly what Monsanto was caught doing about a year ago, to cover up the dangerous effects of the chemicals they used (iirc).  Paid shills on the internet who had facts at the ready to disprove Monsanto&#x27;s bad actions, and were willing to use &#x27;conspiracy theorist&#x27; to shut up anyone who didn&#x27;t believe them.  And, the facts they used came from legit-looking research, which Monsanto was also exposed to have created fraudulently, by suppressing bad results and elevating &#x27;good&#x27; results.

We detached this subthread from <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20877072" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20877072</a>.

&gt;I was branded as a &#x27;privacy nut&#x27;Companies do actually employ shills to go on forums and try to sway public opinion. They call them something like public advocates, doesn&#x27;t change the idea though.

Slap on the wrist incoming. But looks like a solid case with a EU national (?) as plaintiff.

Yet, they choose to surf to HN.They&#x27;re not choosing to have targeted ads that share their info around the web and cause someone over their shoulder to infer things about them.That&#x27;s the point -- we should have that choice. And the default should be &quot;no&quot;.

Yeah, but HN is not shown as part of every website out there.

My children tease me about &quot;being a hacker&quot;, by which they mean unlawfully breaching security of internet systems, because they&#x27;ve seen me reading &quot;hacker news&quot;.

The problem is if the person looking over your shoulder has power over you.

if someone looked over your shoulder and saw you browsing HN they could infer things too

HIPAA only keeps healthcare providers from sharing your information. It&#x27;s not an omnibus shield for your health information. If Alice tells her coworker Bob that she had diabetes, it&#x27;s not a HIPAA violation for Bob to tell Charlie.

It would have been a more funny story if it were ads for Viagra ;)

At my last job the traffic was filtered through a proxy due to FINRA regulations. I’d see Portuguese ads for diabetes medication and there were 2 Brazilian guys in the office.Seemed like a major HIPAA violation to me.

I&#x27;ve had ads for sketchy shit I googled at home on my personal computer show up on my work computer at the office.

&gt; If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me.You have to take some personal responsibility, though. If they saw your Youtube recommendations or your Spotify playlist, they&#x27;d probably make inferences as well. That porn link in your history you forgot to clear? Be aware of who&#x27;s watching and browse anonymously if you&#x27;re concerned.

Not if I&#x27;m just showing them a random website. The problem with targeted ads is, they show up at random websites.

&quot;somebody looking over your shoulder&quot; can see a lot more than you ads, like your private messages, bank info, medical info, etc.

Imagine someone giving a presentation to room full of co-workers and a web ad comes up saying something like &quot;Resubscribe to Cannabis Weekly Delivery and get 10% off.&quot;It&#x27;s not hard to imagine a person&#x27;s career being affected by something like that.

What if I was anti-abortion or pro-trump in a progressive tech company? Would my co-workers feel more comfortable destroying my life then?

Why are so many people that paranoid. No one is gonna destroy your life because they saw your ads

Targeted ads are already a serious leak of information.If somebody looks over my shoulder and sees the ads presented to me, they can infer things about me.Also, if a malicious actor targets an ad to a group of people, and some of these people buy the advertised items, then the actor can infer things about those people not necessarily related to the items sold.

Surprise... I&#x27;m thinking every state outside of EU does not even need that sophisticated workarounds... just go directly to the target (you).

Regardless this is a very calculated PR move by Brave. And the privacy zealots and anti-google cadre on HN and elsewhere are eating this up. They are effectively giving Brave free advertising and playing right into their hands.

Google didn&#x27;t have to open source it. They open sourced it knowing it would encourage adoption.

Kind of a ratty move by Brave to leverage all of Google&#x27;s tech in their browser (blink, v8, etc..) while simultaneously suing them as a PR tactic.

Do you have a reference? Looking around I didn&#x27;t see anything. I might have missed it though.

Also, curious to see how an ad network can guarantee that its creatives don’t misbehave, this is brand safety played on “godlike” (sorry for bad Unreal reference).

These exist. But so long as adivertisers can buy ads with tracking, fraud detection etc, they will.The key to getting reasonable ads back is making the bad ads impossible for advertisers to buy.

Do you think any ad purchaser will actually buy such an ad? What would be the engagement rates of such ads be?I am not sure how viable such a company will be in the real world.

One big problem is that ad fraud is rampant. Knowing a person is really seeing the ad is very important, which tracking helps you confirm to a certain degree.

Free startup idea: An ad service that did things simply without any targeted stalking involved.

Google has been very naughty in the past few years. It does look like they removed the “don’t” be evil motto for a clear reason. And people thought that Investment Banks were bad.

It seems to be &#x27;an open ecosystem for privacy-preserving, AI-first computing&#x27;?

&gt; Fuchsia’s engineers wanted to create a secure platform, but the advertising team, at the time, believed that privacy “goes against everything [they] stood for.”

Are Google engineers quietly working on alternatives?
What is this repo?
<a href="https:&#x2F;&#x2F;github.com&#x2F;PolymerLabs&#x2F;arcs" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;PolymerLabs&#x2F;arcs</a>Also there was an interesting story a while back about a clash between advertising and the Fuchsia engineering team 
<a href="https:&#x2F;&#x2F;9to5google.com&#x2F;2018&#x2F;07&#x2F;20&#x2F;fuchsia-friday-respecting-user-privacy&#x2F;" rel="nofollow">https:&#x2F;&#x2F;9to5google.com&#x2F;2018&#x2F;07&#x2F;20&#x2F;fuchsia-friday-respecting-...</a>

Awesome, thanks.(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

GDPR definitions are slightly different.A person is identified, if the ID references only one user in the whole dataset[1]. This also makes any information linked to the ID PII.the ID would be pseudo-anonymous if one would need some extra data, to which they don&#x27;t have access to, for linking the ID to one specific user in the whole dataset[2].So to answer your question, RTB ID is not pseudo-anonymous as it only references a single user out of all of them.[1] It&#x27;s also important to understand the definition of PII in GDPR context. Which is any data that relates to an identified or identifiable person. Identifiable is the same as distinguishable. Knowing this helps to understand where the line is. <a href="https:&#x2F;&#x2F;www.lexico.com&#x2F;en&#x2F;definition&#x2F;identifiable" rel="nofollow">https:&#x2F;&#x2F;www.lexico.com&#x2F;en&#x2F;definition&#x2F;identifiable</a>[2] Definition of pseudonymisation, 5&#x27;th bullet-point: <a href="https:&#x2F;&#x2F;gdpr-info.eu&#x2F;art-4-gdpr&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gdpr-info.eu&#x2F;art-4-gdpr&#x2F;</a> sheds some light on this.

Do they have to prove that the RTB ID can be used to retrieve PII? Or only that the RTB ID is correlated with personally protected information?Is it enough that a RTB ID is pseudo-anonymous? (it always identifies the same person, but cannot be used to find that person&#x27;s real information) - OR - is a RTB ID not even pseudo-anonymous?

Just 17 days ago I was downvoted into the abyss for suggesting that Google&#x27;s GDPR &quot;compliance&quot; doesn&#x27;t protect my privacy.  And now this.

And there lies the problem. The cost in both time and money is much higher. I&#x27;d love to run TV and magazine ads on all the shows and in all the magazines my customers are reading, it just costs a whole lot more. Way more than we have just starting out.

I think the point that&#x27;s missing from the discussion is that adtech companies should be targeting solely on placement (i.e. what ads should show up on a particular website based on the content of the website), and not select individuals (i.e. based on user interests regardless of the place on the web an ad is shown), when faced with this kind of legislation.This is exactly how marketing worked before and how people can go about it now, as you describe, through traditional advertising markets.I&#x27;d personally prefer it that way in general, but legislation is necessary for them to optimize on those restrictions.

For actual, physical widgets the traditional advertising markets still work: trade magazines and trade shows. Contacting vendors who specialize in your market of interest and running promotions with them also works.However, it&#x27;s all a whole lot more expensive and effortful than running some Google ads.

That&#x27;s how it successfully worked for a long time...
... until google search and facebook groups killed thematic sites and communities.I&#x27;d love seeing this turned around though.

Targeting existed long before computers. The difference today is the massive amount of very personal data being collected on people without their knowledge or consent and the risks it puts on them.Imagine if you went back to say the 1920s, and you told a marketing director that you could install a one-way mirror room and back door into every household in the country, and staff them all with analysts who will secretly observe people in their homes 24 hours a day, 365 days a year. People would think you were crazy. In fact, I bet most people today would be completely against that idea, yet wouldn&#x27;t realize that what companies like Google and Amazon are doing today is effectively the same thing, except _much more_ invasive.

You advertise on a website for widget fans. That&#x27;s how it successfully worked for a long time.The whole targeted advertising is to allow adtech companies to identify users of the &quot;widget fans&quot; site, and then advertise to the same people, but on another, cheaper site.

Yes, thank you. I logged in just so that I could upvote this. Why isn&#x27;t this more accepted of an answer? Why is spam everyone&#x27;s goto?

You find your audience and you target them directly.

AdSense used to do this for you before it tracked individuals...You can still target adverts at content on a site, and have an aggregate system to make that easy and granular.There could even be services which collected lists of websites and categorised them, and the rough demographics of their audience, and retailed slots.Individual tracking is unnecessary financially, you can make as much revenue without. See example of the New York Time dropping tacking for EU readers for GDPR reasons, and continuing to grow ad revenue: <a href="https:&#x2F;&#x2F;digiday.com&#x2F;media&#x2F;gumgumtest-new-york-times-gdpr-cut-off-ad-exchanges-europe-ad-revenue&#x2F;" rel="nofollow">https:&#x2F;&#x2F;digiday.com&#x2F;media&#x2F;gumgumtest-new-york-times-gdpr-cut...</a>

Native ads like those can certainly be automated to a great degree, and at the very least use a self-serve interface. &quot;Advertise with us!&quot; links in the sidebar or footer or wherever.

At which point you&#x27;ll very likely learn that a lot of widget-related websites use ad networks because it saves the 2-3 administrators involved a lot of time and energy.It&#x27;s definitely possible for small websites to do ads directly, but it&#x27;s a lot of work. Often more than is justified for a few thousand dollars a year in ads.

&gt; It&#x27;s definitely possible, but you&#x27;re just doing everything manually that ad networks do for you.You&#x27;ve just explained how contexual ads used to work, which doesn&#x27;t need all the invasive surveillance modern internet users have to put up with.

The alternative is to spend hundreds of hours finding widget-related websites, trying to contact the owner(s), negotiating what ad spots are available, what ads are acceptable to run, and what pricing&#x2F;terms will work for both parties, then managing that relationship over time to ensure ads are actually being displayed, being paid on time, contracts renewed, etc.It&#x27;s definitely possible, but you&#x27;re just doing everything manually that ad networks do for you. Whether that is worth your time (or worth it to hire someone to do this kind of thing for you...) is up to you.

Online shop only, or brick and mortar?Trade &quot;print&quot; media with an online presence. Online media that doesn&#x27;t sell all their pixels to Google? Radio, depending on your audience and required reach? Forums specific to your audience that don&#x27;t sell all their pixels to Google. Podcasts. Submarine articles in the trades? Open source ad networks that don&#x27;t embed insanity or real-time bidding?Mostly, I would try to target your initial audience as precisely as possible where they live, rather than with a wide net. Perhaps a Google search returns results for top websites dealing with your product - if they are not vendors, then perhaps you advertise on that site?Disclaimer: I&#x27;m not a growth hacker, but I&#x27;ve thought about these things and run a couple of poor Facebook campaigns for a brick and mortar business.

Look for genuine, verified success marketing stories for people in similar positions and follow similar strategies.I&#x27;ve personally never heard of a success story for what you describe that involves paying google. But maybe they exist and they&#x27;re just keeping it quiet?

Surely Google has an obvious competitor, right? Because otherwise it would clearly be a monopoly.

I&#x27;ve started a few successful businesses, and all I can say is what&#x27;s worked for me.I&#x27;ve never needed to turn to Google or other ad-slingers. Instead, I&#x27;ve done things the old-fashioned way, by going to where my potential customers tend to congregate and engaging with them (this kickstarts word-of-mouth, which is still the best advertising you can get), hosting my own online forums for customers, going to trade shows as appropriate, and supplementing everything with a few direct-placement ads in carefully selected media.Yes, it&#x27;s more work -- what Google et. al. are actually selling you is convenience, after all. But the rewards in terms of of ROI as well as fostering a real community, complete with evangelists, are more than worth it to me.Of course, ymmv.

I think the HN community, and most consumers, tend to look at things from only one angle. Imagine you start work at some small shop that manufacturers widgets for consumers. What would you do when you have to advertise your product? You&#x27;d have to turn to Google is a similar company.
Are there any real alternatives? (I am asking because I really want to know)I say this because I am in this position now. I have to figure out how to advertise my company&#x27;s products and am torn on how to go about it.

Not even that... if you put the coffee that high, people would be less likely to ask for a refill as the coffee took longer to cool off.

And the money went to Shriners&#x27; Hospital, not the burn victim (I saw the photos, they are beyond horrific). What&#x27;s more, McDonalds had been advised their coffee temperature was dangerous, but decided to ignore this for marketing reasons, because people like the look of steaming coffee.

Are you a lawyer? Because this take is quite remarkable, especially given that the overwhelming public sentiment is that McDonalds was heinously negligent, coupled with a lot of supporting but not entirely factual claims to justify that position. I feel like the same people who were jeering at the victim just marched over to sainting her and demonizing McDonalds.The Internet extreme position machine. Everything has to be clear cut.How McDonalds no longer engages in &quot;corporate negligence&quot;: they put pronounced warnings on the cup that it&#x27;s a dangerously hot substance. That&#x27;s it. They did not lower the temperature (as is frequently claimed, nor is the temperature at all outside of normal industry standards, yet this is being repeatedly stated throughout this thread -- coffee, brewing with boiling water, is hot). You can get a searingly hot cup of coffee from most quick-serve restaurants today depending upon how freshly it was brewed. 
This is a case where the solution is more warnings on things.This case was, however, an example of bad brand management, and perhaps throwing good money after bad for something they could have privately settled early on.This is certainly not a hill I want to die on, and generally arguing against the prevalent opinion (which is overwhelming the one that you and the GP have expressed, albeit almost always positioning it like it&#x27;s contrarian) is self-defeating, however this whole case is fascinating in how public perception shifts.

The reason the McDonald&#x27;s lawsuit is framed that way in popular circles is because it is easily fits the mold for a frivolous lawsuit.1. A woman willingly purchased hot coffee from McDonald&#x27;s.2. She spilled it on herself.3. She sued McDonald&#x27;s because of her injuries.Those three things are true no matter which circle you ask.A lot of people I talk to, even when given all of the facts of the case still consider it a frivolous lawsuit because they place almost all of the blame on the woman.

The most interesting thing to me about that McDonald&#x27;s &quot;hot coffee&quot; lawsuit is how different the narrative is in popular circles vs. in legal circles. It&#x27;s a little bit like in Rashomon.In popular circles, the story is framed in a way that does make the lawsuit look frivolous. But this is also a case that has made it into the legal textbooks as an example of corporate negligence that&#x27;s clear-cut enough to use for demonstrating the concept in introductory textbooks.Of course, in the legal textbooks, the version of the story that&#x27;s told includes a lot of details that, as you point out, get excluded from the popular version.

&gt;But that&#x27;s not the story that was spread by the shills...I&#x27;m not sure that was the case at the time... specifically there being &quot;paid shills&quot; on the internet.Concern &#x2F; outrage over the legal system seems to be a bit of the human condition, I&#x27;m not convinced there was a conspiracy required to have folks retell an inaccurate story about that incident.Sometimes it feels like anything that is perceived to be corporate friendly is called a &quot;shill&quot; as if individuals (mistaken or not) couldn&#x27;t organically have X opinion.

Its actually even worse factually...its not just the coffee was hot and McD&#x27;s had prior complaints, there are industry standards, which McDonald&#x27;s knowingly and willfully violated.It actually all relates to trucking&#x2F;truckers who use their own special cups, but demand the coffee be scalding so it stays hot longer on the road. McDonald&#x27;s catered to these truckers to grow their coffee business, they knew the risks and gave no warnings to customers. I think the employee was also negligent in securing the lid leading to the spill itself.As you say the coffee was so hot it scalded this woman so badly through her jeans she needed skin grafts. And sure enough there was massive money spent to spin this in the media as &quot;woman burned by coffee sues for millions, everything wrong with our litigious society.&quot; Where this should have read: giant corporation disregards safety standards to boost their bottom line to the detriment of its customers leading to boiling coffee that scalded a woman&#x27;s privates requiring skin grafts, then in bad faith the insurer denies the woman&#x27;s claim to pay her medical bills, drags her through court which they lose, then they drag her through the appeals process which she didn&#x27;t want any part of either.

The payout is because _without it_ companies wouldn&#x27;t change what they do. The punitive damages serve as an &quot;example&quot; for other corps to not do the same thing or risk losing that much money, too. If anything, I think punitive damages for corporate negligence would be _higher_. Maybe some of the payment could be directed to funds for victims instead of all going to one person, but that person (and their lawyers) also had to combat a multi-million dollar defense team.

From memory I believe the case was settled for a presumably lower undisclosed amount rather than go through a long appeals process.

Curious how this one has changed on the internet.From a UK perspective I&#x27;d always thought of it as a case of crazy pay-out. Why does this one women get several million dollars (although googling reveals this number went down a bit on appeal)? Especially if others had a similar experience. Either there should be a limit on the temperature of hot drinks, or there shouldn&#x27;t.The fact a warning is deemed adequate seems weird too, people will actively try and avoid spilling a stone cold cup of coffee on their lap!It feels to me like the internet moved from shilling for big burger to shilling for big law firm.

This is a bad and frankly cruel reading of a lawsuit that addresses systemic failures of a corporate entity that had been previously alerted to a design and practice failure of their operation. Similar lawsuits regarding coffee at 179 deg F, rather than 190 deg F, have been thrown out. Almost as if there was an actual problem with what McDonalds&#x27; was doing, you know?That corporate entity had decided it was cheaper to not fix it than to fix it, until a human being who they contributed to significantly harming brought the problem before a jury. And she was found partially responsible for her own injuries, a fact which you elide (while speaking so authoritatively that I must assume you know this to be true, otherwise you wouldn&#x27;t, yes?), while the jury also found that McDonalds&#x27; had been reckless in their operation--that most of the money awarded was a punitive penalty assessed because that corporate entity was cavalier in their treatment of actual, real-not-fictive people.While we&#x27;re at it, the punitive award granted was $480,000, not &quot;multi-million&quot;--though the jury asked for it, as two days of McDonalds&#x27; coffee revenue, and was reduced by the judge.You&#x27;ve either been had, or you&#x27;re trying to do the having. I shall not speculate on which.

Its pretty obvious you&#x27;ve not read up on the facts of the case and have jumped to a few conclusions. Nobody contests that hot coffee causes mild burns, hot coffee that causes third degree burns in seconds is another matter entirely.<a href="https:&#x2F;&#x2F;segarlaw.com&#x2F;blog&#x2F;myths-and-facts-of-the-mcdonalds-hot-coffee-case&#x2F;" rel="nofollow">https:&#x2F;&#x2F;segarlaw.com&#x2F;blog&#x2F;myths-and-facts-of-the-mcdonalds-h...</a>Have a read and then come back here and lets hear you argue that the lawsuit wasn&#x27;t warranted.

How did the coffee spill? Did she hold a cup of a beverage that is traditionally served very hot between her legs?That lawsuit was frivolous. Coffee is hot. If you spill it, it might burn you.As far as just asking for medical bills — that might have been true until her lawyers smelled a multi-million payday.Lawyers like that are the reason we have warnings on hair dryers to not use while showering and warnings on coffee cups that warn of the hot beverage inside. Coffee is traditionally made using boiling or near boiling water — unless McDonalds super-heated the water, the temperature at which it was served was consistent with how coffee is normally served.That it was an elderly lady makes no difference. That’s just emotional distraction and has no relevance. The McDonalds lawsuit ushered in the “nanny” era where people have to be warned against such hazards as “boating carries a risk of serious injury or drowning.” And product costs (including medical care) is dramatically more expensive than it should be because the trial lawyers had to all get paid. Punishment under statute is one thing, but unlimited punitive damages is absurd. We talk about CEOs getting paid to much — not even close to the payday trial lawyers get.

Especially when you have one of the largest advertising budgets in the world!

McDonnalds didn&#x27;t hire any internet shills or anything like that. The media bought into their lawyers public claims about the case without bothering to investigate anything, and the TV talk show circuits picked it up.Unfortunately, you often don&#x27;t need to try particularly hard to get the media to repeat false claims.

&gt; This is exactly what happened in the McDonald&#x27;s &quot;hot coffee&quot; lawsuit. ... But that&#x27;s not the story that was spread by the shills...Well, all of these changes (perhaps with the exception of industry standards) are IMHO irrelevant to responsibility of McDonald for the incident.

We detached this subthread from <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20877309" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=20877309</a> and marked it off-topic.

This is exactly what happened in the McDonald&#x27;s &quot;hot coffee&quot; lawsuit. It wasn&#x27;t some &quot;Karen&quot; who hit a bump while driving. It was an elderly woman (in her 70s, IIRC), sitting in the passenger seat.McDonalds already had complaints (and some lawsuits) over the (significantly higher than industry standard) temperature of their coffee, so this wasn&#x27;t exactly out of the blue.She ended up with 3rd degree burns on her legs and crotch. She asked only for her medical bills to be paid. McDonald&#x27;s refused, so she eventually took them to court. Even then, she only asked for medical bills (and now legal expenses).The jury decided that McDonalds was not only liable for those costs, but had treated the woman so poorly that they should pay punitive damages. The massive amount you heard about in the news was based on the amount of money McDonalds makes selling coffee in one day.But that&#x27;s not the story that was spread by the shills...

There&#x27;s some documentation for this mechanism: <a href="https:&#x2F;&#x2F;developers.google.com&#x2F;authorized-buyers&#x2F;rtb&#x2F;cookie-guide" rel="nofollow">https:&#x2F;&#x2F;developers.google.com&#x2F;authorized-buyers&#x2F;rtb&#x2F;cookie-g...</a>

Yes. Take a look at their board of directors: <a href="https:&#x2F;&#x2F;www.iab.com&#x2F;our-story&#x2F;#board-of-directors" rel="nofollow">https:&#x2F;&#x2F;www.iab.com&#x2F;our-story&#x2F;#board-of-directors</a>It&#x27;s a mix of the major players in the digital advertising industry. Historically the IAB has taken actions that are good for the industry overall. It focuses on standardization&#x2F;interoperability in the ad-tech space. It generally isn&#x27;t a watchdog and doesn&#x27;t regulate the industry except when the industry as a whole would benefit (e.g. self-regulatory programs that have no real effect but stave off state regulation).

The article states:&gt;&quot;The primary targets of this campaign are Google and the IAB, which control the RTB system.&quot;Can someone say who makes up the IAB exactly? Is this just an industry trade group?

I think that’s incorrect, relevant ads could be displayed based purely on the site content, without user info attached to ad calls. We’ve been there.

Yes, thats what I was thinking too. For Google, being in the ad business itself necessitates that Google&#x27;s trajectory will be on shaky ground w.r.t privacy.

They will leave you alone if you choose not to send an HTTP GET call requesting content.

The matching is in itself a violation of privacy, at least if you interpret the right of privacy as &quot;The right to be left alone&quot;, as former Supreme Court Justice Louis Brandeis put it.

Yes, we can do contextual targeting, but after that, what are the ways to improve upon the outcomes (from an advertisers standpoint) without violating privacy?

Mind sharing which company you work for? I&#x27;m interested in scaling contextual, privacy-focused publisher targeting solutions.On the PG&#x2F;PMP side, the usage is obvious, but I&#x27;m also curious what it will take for publisher-provided data to be trusted in the open exchange environment where historically advertisers and DSPs have tended to not trust the publisher-supplied categorization.

Yes! Contextual Targeting (target based on what I am reading) could work, although the industry seems to be clinging to Behavioural Targeting (target based on who I am). This will become more important for Open Web due to the 3p cookie constraints, regulatory changes etc..., but Google&#x2F;Amazon&#x2F;FB are less likely to be impacted.In fact Contextual Targeting predates the current approaches, but it became less important once advertises&#x2F;adtech companies started preaching the thinly veiled idea of using behaviourism to trigger conversions&#x2F;less products.Changes like this are slow to introduce due to technical and (mainly) structural&#x2F;cultural issues in the Advertising Industry, but that’s a topic for an entire essay&#x2F;series of blog posts.Source: I work in AdTech and deal with privacy&#x2F;the ethical impact of programmatic, content monetisation models. Opinions obv. mine.

Is there any way to improve the matching of ads to the viewer without violating their privacy?

I really doubt Google Adx would pass buyer_uid to buyers in EU28 countries. They were the first ones to truncate IPs in EU for privacy reasons.We&#x27;ve stopped cookie matching in EU28 countries so I can&#x27;t verify if they do pass the buyer_uid.

I take exception with Brave&#x27;s phrasing here.Essentially, Google assigns an anonymized identifier to a user and sends that to prospective ad buyers. The idea is that the ad buyer can use this to target ads to people who have visited their site as they browse other areas of the internet participating in Google&#x27;s auction. This is called remarketing.An example. You go to footlocker.com and put a pair of sneakers in your shopping cart but decide not to buy. When you go read an article on the New York Times site, a potential advertiser recognizes your anonymized id and bids to serve you an ad for the sneakers.The issue Brave is raising is that the same anonymized id is served to each potential ad buyer. This isn&#x27;t an issue with data Google collects or exposes, but Brave states that buyers could theoretically collude to build profiles by sharing the data collected on their own sites with each other joining by Google&#x27;s identifier. There is no evidence of this actually happening and Google&#x27;s contract with ad buyers specifically prohibits this activity.

Agreed, this is so wordy, this is what I got,&gt; Google claims to prevent the many companies ... from combining their profiles about those visitors&gt; Brave’s new evidence reveals that Google allowed not only one additional party, but many, to match with Google identifiers. The evidence further reveals that Google allowed multiple parties to match their identifiers for the data subject with each other.BTW, many comments in here seem quick to agree w&#x2F;this headline given how buried the details are. If someone has better detail, please share it.

It&#x27;s also written in third-party speech, with emphasis on spooky details rather than technical details.

can somebody explain in simple terms what Brave is actually accusing Google of doing?  The article seems to be written in a way that matches the language of the GDPR legistlation, instead of language actually meant to be read by people, and i can&#x27;t figure out what the &quot;workaround&quot; actually is.

It&#x27;s ok to occasionally link to one&#x27;s own site in relevant contexts, but only as a small part of using HN as intended—i.e. for gratifying intellectual curiosity: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;newsguidelines.html</a>But it looks like you&#x27;ve been using HN primarily to do this. That crosses into spamming, so please don&#x27;t.

I am so glad that this violation is being exposed. Well done Brave!I invite any developer &#x2F; blogger to check out <a href="https:&#x2F;&#x2F;CodeFund.io" rel="nofollow">https:&#x2F;&#x2F;CodeFund.io</a>. We are a non-tracking 100% open source ethical ad platform that focuses on funding open source.

There is a reason they didn&#x27;t. They fear the US government&#x27;s reaction.Edit: Why downvote? Do you really think that the US government will stay silent if the European Union threatens with such fines? Political tensions are something you take heavily into account.

EU should raise the 4% annual turnover rule to 10%. Google doesn&#x27;t seem to be deterred

Is it really a &quot;workaround&quot; if they&#x27;re just breaking the law?I mean, if the allegations are correct, Google didn&#x27;t find any loophole, they&#x27;re just hiding the fact that they&#x27;re selling person identifiers.

Google’s GDPR Workaround