More German Anti-Tech Lunacy

[Aimless]

Unless you've banned the topic itself--in which case I strongly object --I'd like to continue the discussion here. If the other thread is reopened I hope you can merge this into it.

In the previous privacy discussion we learned that the EU and the US differ in their official positions on privacy and publicity rights. It's ridiculous to pretend that Germany--or France, or the EU--constitutes a lunatic fringe any more than the US does. Even if we were to accept that the krauts are in the wrong. Never mind Cain's recent assertion that extremism is a necessary consequence of being knowledgeable and correct, or Dread's myriad efforts to rationalise the intuitive conclusions his chauvinism leads him to draw

American equivalents to European privacy/publicity/personality laws aren't necessarily all that different except possibly when they try to reason about "expectation of privacy". While American state-level publicity laws may mostly be relevant to rich celebrities, in theory they afford regular people the same [limited] rights as celebrities to control eg. how images of their faces are used. Perhaps this is why photographers are generally advised to obtain model release forms when possible; and why, even in the US, players such as Facebook and the TSA occasionally take flak over how they handle sensitive data. Esp. Facebook, perhaps because they actually make money offa this stuff. I hear the TSA is required to delete their nudie pics, btw, although I don't remember the source and don't know if that requirement really (= officially) exists.



Either way, privacy and publicity are clearly important concerns on both sides of the pond, and our politicians and legislators and scholars have clearly spent a lot of time and energy on these subjects. Let's try to have a reasonable discussion rather than be put to shame by a bunch of smarty-pants experts.


Some reading material to get round two started:

http://en.wikipedia.org/wiki/Personality_rights

[Steely Glint]

I think the UK Data Projection Act provides the correct level of rights for individuals concerning how data about them is collected and used.

• Data may only be used for the specific purposes for which it was collected.
• Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation.
• Individuals have a right of access to the information held about them, subject to certain exceptions (for example, information held for the prevention or detection of crime).
• Personal information may be kept for no longer than is necessary and must be kept up to date.
• Personal information may not be sent outside the European Economic Area unless the individual whom it is about has consented or adequate protection is in place, for example by the use of a prescribed form of contract to govern the transmission of the data.
• Subject to some exceptions for organisations that only do very simple processing, and for domestic use, all entities that process personal information must register with the Information Commissioner's Office.
• The departments of a company that are holding personal information are required to have adequate security measures in place. Those include technical measures (such as firewalls) and organisational measures (such as staff training).
• Subjects have the right to have factually incorrect information corrected (note: this does not extend to matters of opinion)

[Dreadnaught]

Is there a definition of "data", "personal information" and "necessary"? Those seem like awfully large gaps that any regulator could arbitrarily use to make up policies as they go.

Which in turn could lead to this: http://eu.techcrunch.com/2011/06/22/...eu-cookie-law/

[Ominous Gamer]

Which in turn could lead to this: http://eu.techcrunch.com/2011/06/22/...eu-cookie-law/

Thats more about the sense of websites refusing to evolve past a known profit model. Its more than possible to track users without needing cookies, incognito mode or not.

Title is also misleading. It article claims 90% of the people voted to not have their information used by Google Analytics, but says nothing about how true site traffic dropped.

[CitizenCain]

Title is also misleading. It article claims 90% of the people voted to not have their information used by Google Analytics, but says nothing about how true site traffic dropped.

Does the distinction even matter, for the vast majority of websites?? Given that most sites are free, and supported by ad revenue, opting out of the advertising may as well be not visiting the site... maybe worse, given that you still use the site's resources, but don't contribute to its bottom line.

[Ominous Gamer]

advertising existed before targeted ads, and as I've already said, its easy enough to figure out web users without putting cookies on their machines. Its all about browser fingerprints now.

[Dreadnaught]

Advertising isn't a static industry. Targeted ads are a development in advertising, and, increasingly, good targeting requires cookies.

Increasingly, advertisers do what's called "buying audiences". Which means they want to follow anonymized groups of users who index for certain types of behavior or browse certain collections of sites. The benefit is potentially more relevant ads, but among the major industry players it still relies on traditional cookies.

[Ominous Gamer]

good targeting requires cookies.

Thats more about the sense of websites refusing to evolve past a known profit model.

people used to think that good crops required blood sacrifices too.

[LittleFuzzy]

people used to think that good crops required blood sacrifices too.

Does that profit model not actually generate profit the way they think it does, as was more or less the case with the crops and the sacrificed vestal virgins? Good targeting, the way they're doing it, requires cookies. Is that somewhat circular? You bet. Of course, they don't have to invest another dime in that circle, whereas they would have to spend more money to change how they get money from advertising.

[Dreadnaught]

Advertising isn't a static industry. Targeted ads are a development in advertising, and, increasingly, good targeting requires cookies.

Increasingly, advertisers do what's called "buying audiences". Which means they want to follow anonymized groups of users who index for certain types of behavior or browse certain collections of sites. The benefit is potentially more relevant ads. You can read all sorts of scare stories and discuss various ways one could target, but among the major industry players it still relies on traditional cookies.

[CitizenCain]

advertising existed before targeted ads, and as I've already said, its easy enough to figure out web users without putting cookies on their machines. Its all about browser fingerprints now.

Yeah, but not being able to use those analytics cookies gives you the bottom rate for ads, doesn't it?

And, as much as I like that browser fingerprints idea (well, much better than cookies anyway), it's got plenty of problems, not the least of which is the triviality with which you can alter what information is presented to websites (either by presenting false data, or simply blocking most of the requested data). Changing the content of cookies, not so much. And, I think we can all agree that false information is much worse than no information at all.

It also seems to think my browser window size is my display resolution, which I found pretty amusing, given that it's at a really weird size right now.

[Dreadnaught]

Indeed. I'm also waiting to see what the non-advertising model can be for the bulk of the Web.

[Ominous Gamer]

Does that profit model not actually generate profit the way they think it does, as was more or less the case with the crops and the sacrificed vestal virgins? Good targeting, the way they're doing it, requires cookies. Is that somewhat circular? You bet. Of course, they don't have to invest another dime in that circle, whereas they would have to spend more money to change how they get money from advertising.

Yes, obviously there is going to be an expense here as agencies move over into new advertising models. Not that I consider that a bad thing. There are hundreds of examples of businesses getting overly comfortable with a certain business model that governments change after the fact to help balance the scales. I wouldn't automatically call the legislation bad (yes, I know you haven't done that).

what the non-advertising model can be for the bulk of the Web.

no one is suggesting that advertising needs to be done away with, and thats simply not going to happen. advertising will still exist, will still be targeted, it simply won't be designed around old parameters.

And, as much as I like that browser fingerprints idea (well, much better than cookies anyway), it's got plenty of problems, not the least of which is the triviality with which you can alter what information is presented to websites (either by presenting false data, or simply blocking most of the requested data). Changing the content of cookies, not so much. And, I think we can all agree that false information is much worse than no information at all.

Each method is going to have its trade offs, ups and downs. Fingerprinting for example currently works even when browsers use their private browsing or incognito function. false data wouldn't exactly be a problem in terms of tracking, until someone writes a script that scrambles that data for each server connection. Managing to block most of the data may be helpful, but you're still leaving a trail.
Of course cookies have to fight against already existing browser functions and programs like ad-block.

[LittleFuzzy]

Yes, obviously there is going to be an expense here as agencies move over into new advertising models. Not that I consider that a bad thing. There are hundreds of examples of businesses getting overly comfortable with a certain business model that governments change after the fact to help balance the scales. I wouldn't automatically call the legislation bad (yes, I know you haven't done that).

I will be the first to acknowledge I am not at the forefront of technology issues. I hesitate to label the legislation bad because of that. But from my limited knowledge of the topic, it does seem like a pointless waste of money. I don't see the purpose here, the wrong being remedied by such legislation. Businesses "being overly comfortable" with the way they currently work does nothing but aid entrepeneurs who will demonstrate that to them by taking their market share sometime in the future, which is generally a good thing. Legislation does not exist as a tool for you to make the universe fit just right for you, which is the only benefit I currently see from this.

[Ominous Gamer]

Legislation does not exist as a tool for you to make the universe fit just right for you, which is the only benefit I currently see from this.

I'm not seeing this legislation as something thats targeting a very select or narrow group of people. I see something thats aimed at the masses, the lay person as they use the internet. That type of person isn't exactly hard to find either. For example, I had to explain in the chat how the picture tracking from the previous thread worked. Dread's own linkage shows that once someone is made aware (and given an easy to find/use choice) of what is going on they overwelmingly choose not to share their information. When the EU forced Microsoft to offer multiple browsers, those competing browsers saw a spike in usage.

I don't see this as making the universe fit just right for anyone. I see this as helping transparency when dealing indirectly with parties online.

[Dreadnaught]

no one is suggesting that advertising needs to be done away with, and thats simply not going to happen. advertising will still exist, will still be targeted, it simply won't be designed around old parameters.

Interest-based ad targeting is new, not old. And it's part of what's bringing display advertising out of a doldrums that lasted almost a decade. What you're suggesting is neutering a re-emerging industry that employs hundreds of thousands.

And candidly, I don't want the same old ads of yore. I don't want stupid banners on weather.com telling me about 1 easy trick for a flat stomach, or cheap home loans. I want ads that target me based on the things I'm actually interested in and may be useful to me as an anonymized browser.

This kind of technology makes for a better ad experience for everyone. Sure, people should have a choice to opt-out. And there are industry initiatives among the largest ad networks to agree on standards for that kind of choice (see AdChoices initiative). But legalizing a de-facto end to a better ad experience is bad for consumers, Website owners, advertisers and the whole Web ecosystem.

[LittleFuzzy]

I'm not seeing this legislation as something thats targeting a very select or narrow group of people. I see something thats aimed at the masses, the lay person as they use the internet. That type of person isn't exactly hard to find either. For example, I had to explain in the chat how the picture tracking from the previous thread worked. Dread's own linkage shows that once someone is made aware (and given an easy to find/use choice) of what is going on they overwelmingly choose not to share their information. When the EU forced Microsoft to offer multiple browsers, those competing browsers saw a spike in usage.

I don't see this as making the universe fit just right for anyone. I see this as helping transparency when dealing indirectly with parties online.

Transparency without comprehension isn't transparency. Without comprehension seeing through the glass provides no more information than an opaque surface. All that's happened is something has been given a different color scheme. That measure, and this, do nothing to educate people and without the transformative effect that real knowledge provides to decision-making nothing has really improved.

[CitizenCain]

false data wouldn't exactly be a problem in terms of tracking, until someone writes a script that scrambles that data for each server connection.

Yo.

Though, I strongly suspect I'm not the first, and the same effect might be possible by just resizing the browser window between visiting different sites (if all/most fingerprinting has the same issue of windows size == display size). The only difficultish thing is figuring out what values you want the browser to present... get it wrong, and you could be presenting a truly unique fingerprint, in your attempt to be less identifiable.

But once you've got that figured out, there's even a browser plugin (for FF, at least), and I use it to alter what my browser presents to the outside world periodically, and have been for a couple (few?) years now, ever since someone posted a browser fingerprinting link in this community and I found out that my OS, language, time zone, browser and plugins were a uniquely identifying combination.

All of which, I suppose, brings me back to where I started this discussion - if you want privacy, you can manage it yourself without too much effort, and that approach is far superior to the "legislate first, let the next guy deal with the blowback" approach you seem to be advocating.

[Ominous Gamer]

Germany started lifting the ban on the Galaxy Tab yesterday. Official appeal is the 25th.

Apple has also been caught presenting fake and doctored evidence to the courts in order to secure the original ban.

[Flixy]

Germany started lifting the ban on the Galaxy Tab yesterday. Official appeal is the 25th.

Apple has also been caught presenting fake and doctored evidence to the courts in order to secure the original ban.

I was slightly confused why the ban was EU-wide... except for the Netherlands.

[Ominous Gamer]

I was slightly confused why the ban was EU-wide... except for the Netherlands.

It appears Apple already has a lawsuit in the Netherlands that is making its way through the courts. Apple has also been caught providing fake and doctored evidence in that suit as well.

[Ominous Gamer]

i'm going to explain this as simply as possible.
denying the use of cookies is not denying the use of interest based advertising.

[Dreadnaught]

i'm going to explain this as simply as possible.
denying the use of cookies is not denying the use of interest based advertising.

I didn't realize you were also an advertising industry expert. Look at increasing scope of expertise you've amassed in just this thread!

Mainstream interest based advertising depends on cookies. You're obsessing on the corner case of workarounds that don't involve traditional cookies. Yet these issues (and these insane regulations) revolve around traditional cookies.

You may not be old enough to remember, but the developers of Web browsers had this debate in the late 1990s, when almost every browser by default asked permission before dropping a cookie. This was deemed cumbersome, pointless and a bad user experience, so browser development shifted towards allowing people to choose to restrict cookies if they wanted.

The kinds of Web services we've enjoyed as a result of this choice is pretty astounding. It doesn't make sense to bring us back to the dark ages (relatively speaking) instead of just educating people what cookies are.

[Dreadnaught]

People here have consistently gotten my age wrong.

I think you saying that the regulation is meant to be cumbersome says it all. Cookies are simple, consumer-friendly and decade-old technology. Trying to eliminate them wholesale is beyond not-constructive. Beyond not actually addressing privacy issues, it's actually damaging to the Web ecosystem.

[Ominous Gamer]

it's actually damaging to the Web ecosystem.

you keep saying this, but you haven't shown this. Its forcing an evolution obviously, but not one that wasn't already prepared. You've given us a link where consumers are backing the ability to have a choice, but you haven't shown any damage from this.

[Dreadnaught]

I think banning a standard practice that's been in place for over a decade and undercutting a key multi-billion dollar revenue model for the Internet is a lot more than "forcing an evolution."

You haven't shown any damage from industry-standard advertising cookies. Just conjecture and hand-wringing about the perils of giving people choices.

[Dreadnaught]

Seems like a good closing note on the front page of the WSJ. Which, BTW, I think highlights a clear emerging distinction between traditional cookies and malignant super cookies and other un-removable tracking software.

And for the record, yes, I would support making technology like supercookies illegal down the road. But the distinction with standard cookies for the end-user is pretty clear.

Latest in Web Tracking: Stealthy 'Supercookies'
By JULIA ANGWIN

Major websites such as MSN.com and Hulu.com have been tracking people's online activities using powerful new methods that are almost impossible for computer users to detect, new research shows.

The new techniques, which are legal, reach beyond the traditional "cookie," a small file that websites routinely install on users' computers to help track their activities online. Hulu and MSN were installing files known as "supercookies," which are capable of re-creating users' profiles after people deleted regular cookies, according to researchers at Stanford University and University of California at Berkeley.

Websites and advertisers have faced strong criticism for collecting and selling personal data about computer users without their knowledge, and a half-dozen privacy bills have been introduced on Capitol Hill this year.
Many of the companies found to be using the new techniques say the tracking was inadvertent and they stopped it after being contacted by the researchers.

Mike Hintze, associate general counsel at MSN parent company Microsoft Corp., said that when the supercookie "was brought to our attention, we were alarmed. It was inconsistent with our intent and our policy." He said the company removed the computer code, which had been created by Microsoft.

Hulu posted a statement online saying it "acted immediately to investigate and address" the issues identified by researchers. It declined to comment further.

The spread of advanced tracking techniques shows how quickly data-tracking companies are adapting their techniques. When The Wall Street Journal examined tracking tools on major websites last year, most of these more aggressive techniques were not in wide use.

But as consumers become savvier about protecting their privacy online, the new techniques appear to be gaining ground.

Stanford researcher Jonathan Mayer, a Stanford Ph.D. candidate, identified what is known as a "history stealing" tracking service on Flixster.com, a social-networking service for movie fans recently acquired by Time Warner Inc., and on Charter Communications Inc.'s Charter.net.

Such tracking peers into people's Web-browsing histories to see if they previously had visited any of more than 1,500 websites, including ones dealing with fertility problems, menopause and credit repair, the researchers said. History stealing has been identified on other sites in recent years, but rarely at that scale.

Mr. Mayer determined that the history stealing on those two sites was being done by Epic Media Group, a New York digital-marketing company. Charter and Flixster said they didn't have a direct relationship with Epic, but as is common in online advertising, Epic's tracking service was installed by advertisers.

Don Mathis, chief executive of Epic, says his company was inadvertently using the technology and no longer uses it. He said the information was used only to verify the accuracy of data that it had bought from other vendors.

Both Flixster and Charter say they were unaware of Epic's activities and have since removed all Epic technology from their sites. Charter did the same last year with a different vendor doing history stealing on a smaller scale.

Gathering information about Web-browsing history can offer valuable clues about people's interests, concerns or household finances. Someone researching a disease online, for example, might be thought to have the illness, or at least to be worried about it.

The potential for privacy legislation in Washington has driven the online-ad industry to establish its own rules, which it says are designed to alert computer users of tracking and offer them ways to limit the use of such data by advertisers.

Under the self-imposed guidelines, collecting health and financial data about individuals is permissible as long as the data don't contain financial-account numbers, Social Security numbers, pharmaceutical prescriptions or medical records. But using techniques such as history stealing and supercookies "to negate consumer choices" about privacy violates the guidelines, says Lee Peeler, executive vice president of the Council of Better Business Bureaus, one of several groups enforcing the rules.

Until now, the council "has been trying to push companies into the program, not kick them out," Mr. Peeler says. "You can expect to see more formal public enforcement soon."

Last year, the online-ad industry launched a program to label ads that are sent to computer users based on tracking data. The goal is to provide users a place to click in the ad itself that would let them opt out of receiving such targeted ads. (It doesn't turn off tracking altogether.) The program has been slow to catch on, new findings indicate.

The industry has estimated that nearly 80% of online display ads are based on tracking data. Mr. Mayer, along with researchers Jovanni Hernandez and Akshay Jagadeesh of Stanford's Computer Science Security Lab, found that only 9% of the ads they examined on the 500 most popular websites—62 out of 627 ads—contained the label. They looked at standard-size display ads placed by third parties between Aug. 4 and 11.

The industry says self-regulation is working. Peter Kosmala, managing director of the Digital Advertising Alliance, says the labeling program has made "tremendous progress."

Mr. Mayer discovered that several Microsoft-owned websites, including MSN.com and Microsoft.com, were using supercookies.
Supercookies are stored in different places than regular cookies, such as within the Web browser's "cache" of previously visited websites, which is where the Microsoft ones were located. Privacy-conscious users who know how to find and delete regular cookies might have trouble locating supercookies.

Mr. Mayer also found supercookies on Microsoft's advertising network, which places ads for other companies across the Internet. As a result, people could have had the supercookie installed on their machines without visiting Microsoft websites directly. Even if they deleted regular cookies, information about their Web-browsing could have been retained by Microsoft.

Microsoft's Mr. Hintze said that the company removed the code after being contacted by Mr. Mayer, and that Microsoft is still trying to figure out why the code was created. A spokeswoman said the data gathered by the supercookie were used only by Microsoft and weren't shared with outside companies.

Separately last month, researchers at the University of California at Berkeley, led by law professor Chris Hoofnagle, found supercookie techniques used by dozens of sites. One of them, Hulu, was storing tracking coding in files related to Adobe Systems Inc.'s widely used Flash software, which enables many of the videos found online, the researchers said in a report. Hulu is owned by NBC Universal, Walt Disney Co. and News Corp., owner of The Wall Street Journal.

Hulu was one of several companies that entered into a $2.4 million class-action settlement last year related to the use of Flash cookies to circumvent users who tried to delete their regular cookies.

The Berkeley researchers also found that Hulu's website contained code from Kissmetrics, a company that analyzes website-traffic data. Kissmetrics was inserting supercookies into users' browser caches and into files associated with the latest version of the standard programming language used to build Web pages, known as HTML5.

In a blog post after the report was released, Kissmetrics said it would use only regular cookies for future tracking. The company didn't return calls seeking comment.

http://online.wsj.com/article/SB1000...675931492.html

[Ominous Gamer]

Seems like a good closing note on the front page of the WSJ. Which, BTW, I think highlights a clear emerging distinction between traditional cookies and malignant super cookies and other un-removable tracking software.

And for the record, yes, I would support making technology like supercookies illegal down the road. But the distinction with standard cookies for the end-user is pretty clear.

This article is a pretty good example of how many internet users (and site owners) out there don't understand how companies use cookies or track their bahavior. It took a standford study for someone to point out what MSN was doing. MSN, the default homepage of new Windows and IE installs. Don't see how you're going to call something like that a cornercase or not mainstream.

but at least the article educated you enough to not try and claim the supercookies were comparable to a virus this time.

And when exactly is good time to crack down on this evolution of the tracking cookie? before or after it becomes a muti-million dollar industry standard that would cause those trading in our information to suffer irreparable harm from regulation that helps better inform the consumer?

You haven't shown any damage from industry-standard advertising cookies.

I've made no such claims of damage. I was referring only to the ability of the consumer being more in control of their information, the point of the UK bill.

[CitizenCain]

And when exactly is good time to crack down on this evolution of the tracking cookie? before or after it becomes a muti-million dollar industry standard that would cause those trading in our information to suffer irreparable harm from regulation that helps better inform the consumer?

I thought you lefties opposed preemptive strikes. Or is it only preemptive strikes from Texans that are morally abhorrent?

[Dreadnaught]

This article is a pretty good example of how many internet users (and site owners) out there don't understand how companies use cookies or track their bahavior. It took a standford study for someone to point out what MSN was doing. MSN, the default homepage of new Windows and IE installs. Don't see how you're going to call something like that a cornercase or not mainstream.

but at least the article educated you enough to not try and claim the supercookies were comparable to a virus this time.

And when exactly is good time to crack down on this evolution of the tracking cookie? before or after it becomes a muti-million dollar industry standard that would cause those trading in our information to suffer irreparable harm from regulation that helps better inform the consumer?


I've made no such claims of damage. I was referring only to the ability of the consumer being more in control of their information, the point of the UK bill.

Cain is right, you can't just keep saying something over and over until it's right.

I am claiming that supercookies could be legislatively comparable to a virus, as it seems almost impossible to remove. There is a very clear difference between a standard cookie (simple, anonymized and removable or opt-outable) and a "supercookie" that so complex and unremovable it may as well be malware.

Conflating regular cookies and super cookies is intellectually dishonest.

Dread is really going to love this.

And you support this BS as Germany moves to ban the Facebook "Like" button? If so, you are a luddite.

Is there any Web technology the German's won't ban? At least the French and EU bureaucrats ban things because they were created in the US. The Germans just seem to hate the Internet.