Post AaxqLLhDbYCT6DX82S by AlgorithmWolf@ioc.exchange
(DIR) More posts by AlgorithmWolf@ioc.exchange
(DIR) Post #Aavafc9AADakKTKFdY by thatprivacyguy@eupolicy.social
2023-10-19T10:08:45Z
13 likes, 26 repeats
Today I filed a formal complaint against #YouTube with the Irish Data Protection Commissioner for their illegal deployment of #adblock detection technologies.Under Article 5(3) of 2002/58/EC YouTube are legally obligated to obtain consent before storing or accessing information already stored on an end user's terminal equipment unless it is strictly necessary for the provisions of the requested service.In 2016 the EU Commission confirmed in writing that adblock detection requires consent.
(DIR) Post #Aavafe2V7xS2CODxWy by thatprivacyguy@eupolicy.social
2023-10-19T10:10:32Z
2 likes, 1 repeats
You can help by filing your own complaint here:https://forms.dataprotection.ie/contactThe more complaints the DPC receives - the quicker they will act.You can use my complaint to help write your own (attached).#privacy #surveillancecapitalism #advertising #cookies #consent #law
(DIR) Post #AavaffoOXNM7hDdioy by thatprivacyguy@eupolicy.social
2023-10-19T12:06:29Z
4 likes, 4 repeats
I cannot stress enough how important it is for you all to take the 5-10 minutes it takes to file this complaint.If the Irish DPC receives only my complaint they will likely not pay it any attention for at least 18 months if at all - but if they receive 10 000 complaints it will seriously eat into their budget (it costs money to handle complaints) and will "motivate" them to act much faster.If they receive 100 000 complaints - YouTube will be forced to stop this very quickly indeed.
(DIR) Post #Aaw8ZIM0EmDde9UQNc by saskboy@mastodon.cc
2023-10-19T18:47:39Z
0 likes, 0 repeats
@thatprivacyguy thanks, that showed up on my one computer not using ublock and was wondering what spurred the change. I didn't know Google was breaking a law to do it.
(DIR) Post #AawCcwkatqKDcUzMoK by condret@shitposter.club
2023-10-19T19:33:10.104529Z
0 likes, 0 repeats
@thatprivacyguy :gigachad:
(DIR) Post #AawCf0MwPvSbQCuHiK by pax@mastodon.com.pl
2023-10-19T13:05:02Z
0 likes, 0 repeats
@thatprivacyguy google will not care they just will pay an other billion and get away with that.
(DIR) Post #AawCf1DlFXiA41cT2m by thatprivacyguy@eupolicy.social
2023-10-19T13:06:25Z
0 likes, 0 repeats
@pax again (I already stated this) this is not a GDPR issue it is an ePrivacy issue and the result would be an order forcing Google to stop doing it - not a fine.
(DIR) Post #AawCf23s7nOYfe05Gi by pax@mastodon.com.pl
2023-10-19T14:13:12Z
1 likes, 0 repeats
@thatprivacyguy well, they just can ignore it and go on to track people like they always do.
(DIR) Post #AaxE0owVsHc7T0TIlU by Jain@blob.cat
2023-10-20T07:23:22.445173Z
0 likes, 0 repeats
@thatprivacyguy Sounds more like your Adblocker removed the cookie banner
(DIR) Post #AaxpaUWowsmasjKJ16 by feld@bikeshed.party
2023-10-20T14:23:55.965916Z
0 likes, 1 repeats
You can't even generate a consent modal to approve/deny loading a javascript file with HTML. You need javascript for that.So they would need consent to serve you javascript to ask you for consent to serve you javascript.
(DIR) Post #Aaxq5yLe85gkLL6wbY by AlgorithmWolf@ioc.exchange
2023-10-19T13:39:07Z
0 likes, 0 repeats
@thatprivacyguy hi Alex. IANAL, but I don't really see what adblock detection has to do with accessing information stored on a device. The way they implemented this is likely giving unique ad IDs, and then checking if connections are being made to those IDs, when you load the page. If not, then it's obvious what is happening. Look, I dislike this YouTube move as much as you, but I really don't think GDPR is appropriate to handle this. This does seem more like a case of a business rejecting customers by not providing them with the requested service at their discretion. This, by the way is fully legal, as long as it is not a targeted campaign against protected minorities (women, LGBT, refugees), which very clearly isn't the case. Can you elaborate further on why you think GDPR applies here?
(DIR) Post #Aaxq5z3bUeqmXfg37Y by thatprivacyguy@eupolicy.social
2023-10-19T15:19:46Z
0 likes, 0 repeats
@AlgorithmWolf I am not asking what they are doing - I know already what they are doing from a technical perspective; and I am not asking if it is illegal, I already know it is illegal as I am an expert on this particular law, helped to write its replacement and already had confirmation from DG Just (EU Commission) that the law applies in the way I have stated.I also never said anything about GDPR - this is not a GDPR issue.But thanks for your input :)
(DIR) Post #Aaxq5zmylx98oOuHqa by lain@lain.com
2023-10-20T14:29:23.544729Z
0 likes, 0 repeats
@thatprivacyguy @AlgorithmWolf but why should this not fall under the legitimate interests clause?
(DIR) Post #Aaxq60uoaJ0aIza3hQ by thatprivacyguy@eupolicy.social
2023-10-19T15:25:45Z
0 likes, 0 repeats
@AlgorithmWolf oh and I have a Masters in Law focused on privacy and data protection laws and am an expert advisor to multiple EU institutions on matters of privacy/data protection and cybersecurity law and technologies.I am also a computer scientist with 30 years experience and a sociologist with my studies focused on the impact of technology on society (with a specific focus on privacy and related human rights) and my computer science degree was a double major with psychology
(DIR) Post #Aaxq62iTt8KZtJpEki by thatprivacyguy@eupolicy.social
2023-10-19T15:26:34Z
0 likes, 0 repeats
@AlgorithmWolf so I am pretty clued up on these issues (to say the least) and am regarded as one of the foremost experts in the world on this particular law.As such, please don't try to teach me how to suck eggs :)
(DIR) Post #AaxqL0DNTIquTaPV6u by AlgorithmWolf@ioc.exchange
2023-10-19T15:37:11Z
0 likes, 0 repeats
@thatprivacyguy I understand. However, I do see, unfortunately, lots of people throwing laws around to try to stop something that is completely legal but they personally dislike. With that being said... You haven't really justified anything. I believe you have a lot of experience and know very well what you are doing: good for you. But I still do not understand why you're framing it this way. In particular, I would like to know exactly how they're doing this, on a technical level, since you mentioned you know perfectly well (and I only have a vague intuition, admittedly). I may not be as academically achieved as you are in regulatory fields, but I do have a CS degree, and more than a decade working with Internet-connected systems, specifically in the areas of computer security, which of course includes handling PCI, PII, and GDPR data in a secure manner. I am sure I would be able to understand how YouTube has implemented this on a technical level in a way that contravenes the law.
(DIR) Post #AaxqL3QFXtvoQNSK5g by thatprivacyguy@eupolicy.social
2023-10-19T15:48:02Z
0 likes, 0 repeats
@AlgorithmWolf well you need to start by reading the correct law and stop framing this around GDPR (which is not the relevant law).
(DIR) Post #AaxqLHBWNST76kfl4q by AlgorithmWolf@ioc.exchange
2023-10-19T15:56:04Z
0 likes, 0 repeats
@thatprivacyguy I had read your excerpt:"Under Article 5(3) of 2002/58/EC YouTube are legally obligated to obtain consent before storing or accessing information already stored on an end user's terminal equipment unless it is strictly necessary for the provisions of the requested service."And explicitly mentioned earlier I fail to make the connection between this specific paragraph and anti-adblock technologies. Is there something I am missing? I am not really willing to read the entirety of the ePrivacy Directive, because, and I'm sure you'd understand:- the vast majority of the document is not relevant to the way YouTube implements their anti-adblock techniques- you specifically are the subject matter expert, and I believe it is less work for you to show me how the connection is made than the time I'd have to invest reading the document in full, possibly still not arriving to a conclusion, which is the point of this exchange in the first place
(DIR) Post #AaxqLLRyWE0UKwOxHM by thatprivacyguy@eupolicy.social
2023-10-19T16:10:14Z
0 likes, 0 repeats
@AlgorithmWolf in order for YouTube to detect the use of adblockers, they are using javascript in the client to detect various behaviours.The deployment of that js file itself requires consent, the running of the javascript within the browser to ascertain how the browser is behaving also requires consent - there is no other legal basis available under the relevant law.There is no escape clause here for YouTube, we have EU case law which is binding on *all* Member States supporting this.
(DIR) Post #AaxqLLhDbYCT6DX82S by AlgorithmWolf@ioc.exchange
2023-10-19T16:06:55Z
0 likes, 0 repeats
@thatprivacyguy I did find this page that explicitly mentions you by name. I'm sure it isn't news to you, and I'm sure you dislike the content, but, again, I do not have any arguments to support your side, and I do have at least one argument to support YouTube blocking adblockers https://blockadblock.com/adblocking/claim-detecting-adblock-may-illegal/And let me reiterate once again that I despise ads and I wish YouTube didn't implement anti-adblock technologies. But law is law.
(DIR) Post #AaxqLSVQHnvMDf4J7o by 4bz@freeradical.zone
2023-10-19T22:05:16Z
0 likes, 0 repeats
@thatprivacyguy @AlgorithmWolf Depends on how they're doing the ads. I run a PiHole at home that blocks ad specific domains - but doesn't block ads that are self hostest. This will still trigger ad blocker warnings in some sites. But we aren't doing any java script, just DNS
(DIR) Post #AaxqLaUeaY3uzalo2K by 4bz@freeradical.zone
2023-10-19T22:07:27Z
0 likes, 0 repeats
@thatprivacyguy @AlgorithmWolf I'm assuming it works as, website I access asks ad domain if they got a connection from my IP, it says no, website I access flags me for ad blocking
(DIR) Post #AaxqLmJ2fXu7d3QhbU by thatprivacyguy@eupolicy.social
2023-10-20T05:53:04Z
0 likes, 0 repeats
@4bz @AlgorithmWolf no it uses js on the client
(DIR) Post #AaxqLn99XnaWEfoJpQ by 4bz@freeradical.zone
2023-10-20T10:26:19Z
1 likes, 0 repeats
@thatprivacyguy @AlgorithmWolf must be ghosts then, cause I do t have ad block on my PC, only block ads at the DNS level with PiHole, no java is being blocked or used
(DIR) Post #AaxqLoSKfyWYIRn9MW by feld@bikeshed.party
2023-10-20T14:32:18.291306Z
0 likes, 0 repeats
Why not just show us the exact javascript file and the specific functions it's using that are a violation of the GDPR? Would be so much easier than these hand-wavy claims
(DIR) Post #AaxrnkR3Jmf5tC4rVg by meowski@fluf.club
2023-10-20T14:49:11.810645Z
0 likes, 0 repeats
@thatprivacyguy wouldn't they just change their policy to make you consent to adblock detection if this was successful? i think your efforts are better spent promoting stuff like freetube or alternate platforms like rumble instead of appealing to the EU bureaucratic nanny state to make everyone in the world follow your ridiculous laws
(DIR) Post #AaxrxDHRRUl7xN5yWe by thatprivacyguy@eupolicy.social
2023-10-20T14:47:38Z
0 likes, 0 repeats
@feld @AlgorithmWolf @helvick incorrect the javascript to present the consent request would be considered as strictly necessary and therefore exempt because it is required to meet a legal obligation - you really need to actually read the law to be able to comment because so far I am seeing a lot of utter nonsense arguments based on complete ignorance.
(DIR) Post #AaxrxDrFINOnkPqZKi by feld@bikeshed.party
2023-10-20T14:50:27.850259Z
0 likes, 0 repeats
What personal data is involved here? What specific clause is being violated?
(DIR) Post #AaxuJwxqTGxLvDtn6G by thatprivacyguy@eupolicy.social
2023-10-20T14:53:51Z
0 likes, 0 repeats
@feld @AlgorithmWolf @helvick again... this is not about personal data, personal data is irrelevant, the ePrivacy Directive has no concern about personal data (that is GDPR).I have explained exactly what the issue is many, many times, I have provided references of EU case law, I have provided a link to the legal opinion of the EU Commission.I can lead you to water but I cannot force you to drink. Open your eyes, clear sight is a beautiful thing.
(DIR) Post #AaxuJxvksWsWv1vdTs by feld@bikeshed.party
2023-10-20T15:16:59.798364Z
0 likes, 0 repeats
This covers the entire situation really well: https://iabeurope.eu/wp-content/uploads/2019/08/20160516-IABEU_Guidance_AdBlockerDetection.pdfAnd the most important part:> The Article 29 Working Party is an advisory body and its opinions are not binding – but their opinions showcase that the legal situation regarding ad blocker detection is far from clear.So this is a huge nothingburger. Only the courts can decide.
(DIR) Post #AaxupFNo2aR81Wxuu8 by Kirino@seal.cafe
2023-10-20T15:23:06.544369Z
0 likes, 0 repeats
You most definitely can do this without JavaScript, just not in a clean way.
(DIR) Post #Aaxv1OoQoA9akADJRo by Kirino@seal.cafe
2023-10-20T15:25:19.125215Z
0 likes, 0 repeats
AHAHAHAJA
(DIR) Post #AaxvCreluFtHO6A8bQ by thatprivacyguy@eupolicy.social
2023-10-20T15:25:20Z
0 likes, 0 repeats
@Kirino @feld @AlgorithmWolf yes you can do pure css modals but their point was so ass backwards and incorrect int he first place I saw no point in making them aware of that.
(DIR) Post #AaxvCsYmY0h4BoMruC by Kirino@seal.cafe
2023-10-20T15:27:22.739584Z
1 likes, 0 repeats
I don’t wanna hear from you, fedora tipped, based niggas only in my replies :blobcatcomfcool:
(DIR) Post #AaxxjkfT6x3rB2IXdQ by feld@bikeshed.party
2023-10-20T15:55:21.676043Z
0 likes, 0 repeats
Links to case law?
(DIR) Post #Aaxy5UJ4ce6anwBgsS by thatprivacyguy@eupolicy.social
2023-10-20T15:57:50Z
0 likes, 0 repeats
@feld @AlgorithmWolf sure I charge 400 euros per hour for legal research - send me your billing info and I will get right to it (on Wednesday when I get back from speaking at the EU Parliament about privacy law)
(DIR) Post #Aaxy5V2RtwOx4fPvbU by feld@bikeshed.party
2023-10-20T15:59:14.030971Z
0 likes, 0 repeats
Why do you need to do legal research if you have a list of cases that are precedent?
(DIR) Post #AaxyQDPYdNogUA6Vt2 by thatprivacyguy@eupolicy.social
2023-10-20T16:01:05Z
0 likes, 0 repeats
@feld @AlgorithmWolf yes and you think they found themselves for me? Please do go do one - I am not your research assistant.
(DIR) Post #AaxyQEI9MPU9DTe6ym by feld@bikeshed.party
2023-10-20T16:02:58.587388Z
0 likes, 0 repeats
You cited those cases in your report to the Irish Data Protection Commissioner right? But you won't tell us?Curious
(DIR) Post #AaxyrbvVawIQKy70Qi by Moon@shitposter.club
2023-10-20T16:08:16.320542Z
0 likes, 0 repeats
@thatprivacyguy @feld @AlgorithmWolf @helvick
(DIR) Post #Aaxz6dZ3ms7LlEmEpk by feld@bikeshed.party
2023-10-20T16:10:39.180554Z
0 likes, 0 repeats
I see you have a Master's Degree in screenshots that show the ePrivacy Directive is about personal data
(DIR) Post #AaxzDFLmDJ6ggliQ3E by Moon@shitposter.club
2023-10-20T16:12:07.619288Z
1 likes, 0 repeats
@feld @thatprivacyguy @AlgorithmWolf @helvick I have been making screenshots for over 30 years.
(DIR) Post #AaxzXGcLDCjmPW0ffE by feld@bikeshed.party
2023-10-20T16:15:28.252785Z
3 likes, 1 repeats
I have an official letter from Princess Peach
(DIR) Post #Aaxzg25sa00RyN0Qam by Moon@shitposter.club
2023-10-20T16:17:26.030565Z
0 likes, 0 repeats
@feld @AlgorithmWolf @helvick @thatprivacyguy it's also not clear to me that serving a javascript file is communication in the sense of a "communication service" I guess that would be the video, I'm going by the definitions in Article 2. I'm not a lawyer so maybe I'm totally wrong though!Fuck ads and fuck Google all that that but my personal feeling is that collecting just enough information about my browser to not show me a video if I refused the ads doesn't damage my privacy in any meaningful way. If a law said it did then that law is dumb.
(DIR) Post #AaxzwUurBeqjzqhXf6 by Moon@shitposter.club
2023-10-20T16:20:25.757004Z
2 likes, 0 repeats
@feld @thatprivacyguy @AlgorithmWolf @helvick random letters from bureaucrats aren't legally binding.
(DIR) Post #Aay0Md59RreyqtydcW by feld@bikeshed.party
2023-10-20T16:24:47.209725Z
0 likes, 0 repeats
But it has the official letterhead and everything?!
(DIR) Post #Aay0XxUFvKrDK37bDE by AlgorithmWolf@ioc.exchange
2023-10-20T16:24:33Z
1 likes, 0 repeats
@Moon @feld @helvick LMAO, Moon the guy himself came into this thread, I'm honoured.But yeah, I agree with the general sentiment. Fuck Google and fuck ads, but I cannot really understand how JavaScript being executed on your browser to determine if you are watching ads is legally problematic.Regardless, in the case this is actually in breach of law, and YouTube gets slapped with a fine or something, they can always revert to the other method I mentioned of generating random IDs for ads, and refusing to serve your connection if you never loaded those ads with the unique ID tied to your session. That would work purely server-side and without any JavaScript.
(DIR) Post #Aay0XyMUfgF62GUuki by Moon@shitposter.club
2023-10-20T16:27:10.889491Z
0 likes, 0 repeats
@AlgorithmWolf @feld @helvick I'm not YouTube Moon, in case that's who you're thinking of.
(DIR) Post #Aay0cqkMPYmDrjzEsi by HKayn@mastodon.social
2023-10-20T11:20:39Z
1 likes, 0 repeats
@thatprivacyguy @AlgorithmWolf You're hurting your credibility by being needlessly condescending.
(DIR) Post #Aay0eIwB5JhpaSCwnQ by AlgorithmWolf@ioc.exchange
2023-10-20T16:28:14Z
2 likes, 0 repeats
@Moon @feld @helvick You're shitposter dot club moon, that's exactly who I was thinking.Who the fuck is YouTube Moon lmao
(DIR) Post #Aay0gOQnd5qlCmWiw4 by tiskaan@fedi.layer02.net
2023-10-20T16:28:43.497608Z
0 likes, 0 repeats
@Moon @feld @AlgorithmWolf @helvick moon is not the 4chan, kiwifarms or youtuber.he is the moon of SPC
(DIR) Post #Aay0kdlSYxe7v1DR9U by Moon@shitposter.club
2023-10-20T16:29:29.902924Z
2 likes, 0 repeats
@AlgorithmWolf @feld @/helvick@mastodon.ie some buy named Moon gets million views on YouTube now, lately been getting a lot of people thinking I'm him. Thanks, I'm honored to be recognized for my actual self.
(DIR) Post #Aay0tOVyd8u1EF9EuG by tomey@shitposter.club
2023-10-20T16:31:05.978552Z
1 likes, 0 repeats
@thatprivacyguy @feld @AlgorithmWolf lol this privacy guy is such an asshole
(DIR) Post #Aay1qcPYbhbbPgNxhY by brad@noagendasocial.com
2023-10-20T16:41:48Z
0 likes, 0 repeats
@feld @thatprivacyguy @AlgorithmWolf @helvick I think you could actually do this if you do `<dialog open><form action="/consent" method="dialog"><button formmethod="post">approve</button><button>deny</button></form></dialog>` on your page and then set a cookie in that form submit endpoint that is used to check if the script should be included.
(DIR) Post #AayFCYNzYIvghiRWvg by NonPlayableClown@postnstuffds.lol
2023-10-20T19:11:25.730574Z
0 likes, 0 repeats
And a seal and stamp from royalty.
(DIR) Post #AazQ6tUjS1VF5W3kum by HauntedOwlbear@eldritch.cafe
2023-10-19T12:37:17Z
0 likes, 0 repeats
@thatprivacyguy Should people in other EU countries be sending similar letters to their own data protection authorities, or should they all go to Ireland due to Google's EU HQ being there?Edit: we should all be contacting the Irish authority.
(DIR) Post #AazQ6uNg9jSHpvldYm by thatprivacyguy@eupolicy.social
2023-10-19T12:39:00Z
0 likes, 1 repeats
@HauntedOwlbear because this is ePrivacy Directive not GDPR you can choose (One Stop Shop doesn't apply) but I would recommend everyone file with DPC Ireland as that means we focus the complaints to one regulator which gives them more impact as the number of complaints increases as it eats into their budget (it costs money to manage a complaint).If we start spreading this out across different authorities it dilutes the impact.