[HN Gopher] Dear Email Industry, We've Got a GDPR Problem
___________________________________________________________________
Dear Email Industry, We've Got a GDPR Problem
Author : iamacyborg
Score : 50 points
Date : 2021-02-17 09:42 UTC (11 hours ago)
(HTM) web link (www.jacquescorbytuech.com)
(TXT) w3m dump (www.jacquescorbytuech.com)
| bryanrasmussen wrote:
| I sort of feel this is looking at some shadows on the window
| curtains of the house and thinking there is a hell of a party
| going on inside. Which given the way things generally work is
| probably correct but not necessarily so.
|
| Example - if you send a tracking pixel with every email you send
| out and you track those pixels to see how many of your emails
| sent out were read without connecting each tracking pixel with
| the user account I don't think you're in violation of the GDPR.
|
| If you send out a tracking pixel that is
|
| 1. designed to track user reading of emails per user
|
| 2. and the user has opted out of the tracking,
|
| 3. and the backend implementation is look up tracking pixel id
| and lookup user assigned to that id and look up if user consented
|
| 4. if not consent do not track user read email.
|
| I'm not sure that scenario is against the GDPR either, although
| it may be that the company is told at some point - do not send
| out the pixel if the user has said they don't want to be tracked,
| in other words you will not be allowed to stop tracking at the
| backend, you must not send the image with any non-trackable email
| that would you allow you to potentially track that email even if
| you never follow up on that potential (which would really seem to
| be a good policy to have)
| tpxl wrote:
| > 2. and the user has opted out of the tracking,
|
| > do not send out the pixel if the user has said they don't
| want to be tracked
|
| Per the GDPR, they need to opt in, not opt out.
| iamacyborg wrote:
| This.
|
| But also, most email platforms don't have the ability to add
| a pixel on a per-recipient basis. This is a clear failing on
| the part of these tech companies.
| bryanrasmussen wrote:
| >most email platforms don't have the ability to add a pixel
| on a per-recipient basis.
|
| right, which is why I assume that they would add the pixel
| and the company would decide to not track the non-
| consenting users at the backend. Everyone has the pixel,
| but only consenting users get tracked by the pixel being
| requested.
| iamacyborg wrote:
| That sounds more open to failure than simply not tracking
| people who haven't opted in though.
| bryanrasmussen wrote:
| yes, but sometimes when one is writing fast one makes slight
| errors that don't make much difference overall, thus:
|
| If you send out a tracking pixel that is
|
| 1. designed to track user reading of emails per user
|
| 2. and the user has not opted in to the tracking
|
| 3. and the backend implementation is look up tracking pixel
| id and lookup user assigned to that id and look up if user
| consented
|
| 4. if not consent do not track user read email.
|
| I'm not sure that scenario is against the GDPR either,
| although it may be that the company is told at some point -
| do not send out the pixel if the user has not said they agree
| to be tracked...
|
| so, I don't think that it made much of a difference in my
| argument.
| albertgoeswoof wrote:
| I've created https://ohmysmtp.com - a transactional email
| provider. One of the things we've specifically done is not
| include an option to track opens. I think we're the only provider
| out there that doesn't do this, and most if not all default to
| tracking opens.
|
| Of course it would be useful to know if a user has opened a
| transactional email in some cases, but it's really not necessary.
|
| My personal gripe with tracking pixels is the UX, users have no
| idea that they are being tracked inside their email client. If
| there was a big button that said "tell the sender you've read
| this" would any user actually click it? Almost certainly not
| Nextgrid wrote:
| Previous discussion:
| https://news.ycombinator.com/item?id=21024926
| chrismorgan wrote:
| And indeed, (2019).
|
| Also a related discussion from today, _Spy pixels in emails
| 'have become endemic'_:
| https://news.ycombinator.com/item?id=26162513
| stiray wrote:
| Ok, I am glad the author has figured it out (2 years too late)
| but I have another question:
|
| Why are they even using tracking pixels, I cant remember when I
| had some email client that was showing the 3rd party images in
| emails?
|
| I thought this is a dead "technology" for at least a decade?
| gbear605 wrote:
| Gmail at least still shows them by default, and that gets you
| most personal email users in one go. I know Apple Mail does as
| well.
| iamacyborg wrote:
| What do you think is dead? Email marketing or email tracking?
|
| In either case, both are very much alive and doing better than
| ever, though in the latter case this is not a good thing.
| stiray wrote:
| No, I meant specifically tracking using url to images on 3rd
| party servers. I have just checked outlook and evolution and
| both are blocking it by default, same with thunderbird and
| nine mail O.o
| iamacyborg wrote:
| Sadly, nope, still very much a thing that is happening.
| ACS_Solver wrote:
| I sometimes cannot tell if HN users are being sarcastic, or
| are genuinely out of touch with how people use technology.
|
| You're not a typical user if you have Thunderbird, let
| alone Evolution. Gmail is the de-facto standard provider
| for personal email. People use web clients on their
| computers, and either the Gmail app or Apple's apps on
| mobile. Those load images by default, and render HTML. If
| you're using Thunderbird on your PC or K-9 on your Android,
| you're in a minority, and your habits don't reflect the
| vast masses targeted by marketers.
| Macha wrote:
| Gmail for web and android does not load remote assets by
| default. images have to be either attached or in data
| URLs to load from most senders (only your contacts and
| whitelisted senders get a pass).
| stiray wrote:
| So what you want to say is that glitch that was fixed 20
| years back in all major email clients is back and the
| "de-facto standard provider for personal email" has
| neglected it?! Probably deliberately.
|
| Nice. With a huge facepalm. I wonder if they will also
| add support to run .pif files. /s
|
| I really didn't know that, haven't used gmail from the
| times when it was invite only, I prefer better email
| clients than the default one (now that you have told me
| this - even more) and I am happy camper with my own mail
| server for even longer while on the other side I don't
| have time to track how far the Idiocracy[1] has
| progressed
|
| It was 9 mail[2], not K-9. Firewalled to be able to
| access to only my and company domain. But yes. I am not
| typical user.
|
| [1] https://www.youtube.com/watch?v=sP2tUW0HDHA
|
| [2] https://www.9folders.com/en/index.html
| KingOfCoders wrote:
| The problem is more basic. EU companies illegally transferring
| billions of email adresses to Mailchimp.
|
| [Edit] The ECJ voided Privacy Shield because it did not protect
| the data of EU citizens.
|
| The way forward would be Standard Contractual Clauses (SCC)as a
| tool the ECJ said.
|
| The EU comission formulated (an instance of) Standard Contractual
| Clauses. These have not been accepted by EU data protection
| agencies (yet). Until they are accepted they do not protect
| against being fined.
|
| Those are for every third country.
|
| In the special case of the US currently you can't create SCCs
| that work because the EU citizen has no lever against three
| letter US agencies. Until the US changes it's position here,
| you're not safe with SCCs. Private contracts can or can't safe
| you. e.g. if I have a contract with someone to steal something
| togther, the contract doesn't make it legal. Although it is legal
| to have a contract.
| bennyp101 wrote:
| As long as it is being disclosed, then there is not a massive
| problem. They have a Data Processing Addendum [1] that covers
| GDPR stuff, and the whole Privacy Shield stuff from last year
| doesn't matter too much because Standard Contractual Clauses
| are still valid (which that DPA is a part of [2]) so nobody is
| doing anything illegal if they are following the rules that
| were set out.
|
| Obviously there are still plenty of companies that /don't/
| follow it, but that doesn't rely on Mailchimp being involved.
|
| 1. https://mailchimp.com/legal/data-processing-addendum/ 2.
| https://mailchimp.com/help/mailchimp-european-data-transfers...
|
| Edit: That's my understanding from reading their docs last
| year, anyway
| KingOfCoders wrote:
| Privacy Shield is void.
|
| Standard Contractual Clauses need to be validated by the EU
| on individual bases, those companies have with companies in
| the EU are most probably not enough - but this is not tested
| yet.
|
| At least for Germany it's clear that Standard Contractual
| Clauses in the way they are now, are not enough. Because they
| don't solve the problem of the NSA grabbing data without EU
| citiziens having any rights.
|
| German data protection agencies have started a project for
| 2021 where they have compiled lists. I would assume everyone
| using MailChimp will get a mail from an agency this year.
| iamacyborg wrote:
| Illegal in what sense?
| jeroenhd wrote:
| Not the parent, but here's my take:
|
| Email addresses are PII and Mailchimp is a US company. With
| the death of privacy shield, handing over your customers' PII
| to an American company is a gross violation of the GDPR and
| its implementations.
|
| An EU company sending email to customers using American
| services would be a legal minefield if the GDPR would
| actually get enforced. As far as I know, no data protection
| agency has looked into the practice as of yet. Of course,
| that could all change very quickly.
|
| Personally, I think the use of American services such as AWS,
| Azure and GCloud should be looked into first, though. Sharing
| a list of email addresses is nothing compared to placing your
| entire customer database into the hands of Amazon.
| dkersten wrote:
| > I think the use of American services such as AWS, Azure
| and GCloud should be looked into first, though.
|
| Many EU companies use the EU hosted versions of these
| services. For example, I know of a number of EU companies
| that host their AWS stuff in eu-west in Dublin.
| KingOfCoders wrote:
| 1. Yes.
|
| 2. https://en.wikipedia.org/wiki/CLOUD_Act is not tested
| yet with the ECJ.
| LunaSea wrote:
| It really isn't a mine field.
|
| You can simply sign a Data Processing Agreement (DPA with
| MailChimp containing Standard Contractual Clauses (SCC) and
| you're good to go.
| KingOfCoders wrote:
| No you're not.
|
| Standard clauses CAN be a solution if they address the
| problems with transfering data. Currently you can't have
| Standard clauses with the US, because EU citizens have no
| say against the NSA.
| LunaSea wrote:
| You absolutely can and it's the official solution
| proposed by the Court of Justice of the European Union
| since July 16th 2020, date of the Max Schrems II
| decision.
| [deleted]
| germanier wrote:
| In theory.
|
| The court clearly stated that the data exporter has to
| suspend the data transfer if the recipient is unable to
| comply with that contract (which must ensure the level of
| protection required by EU law). This is currently not
| possible for an US entity in practice, as the court also
| found, because US law does not grant non-US-citizens
| actionable rights against US authorities in that matter.
|
| Official summary by the court https://curia.europa.eu/jcm
| s/upload/docs/application/pdf/202...
|
| Judgement itself http://curia.europa.eu/juris/document/do
| cument.jsf?text=&doc...
| KingOfCoders wrote:
| Deleted my comment because yours is much better.
| LunaSea wrote:
| And in practice the website of the Court of Justice of
| the European Union loads YouTube videos so I'll follow
| what they are doing as an example and justification.
| [deleted]
| bennyp101 wrote:
| The whole thing is a minefield - I think the idea is great
| - but the whole implementation is just such a fudge, and it
| came in with no real clear guidance on how things should
| work. I think that's why we don't see a lot of enforcement,
| unless it is a blindingly clear violation.
| KingOfCoders wrote:
| German data protection agencies announced last week that
| they have compiled lists of companies because they want to
| start enforcing this 2021.
|
| "German companies are threatened with stricter controls
| because of the transfer of personal user data to the USA.
| The majority of the German data protection authorities are
| participating in a task force headed by Hamburg and Berlin,
| "which coordinates the implementation of the requirements
| of the Schrems II ruling," said the Hamburg data protection
| officer Johannes Caspar on request from Golem.de. The
| authorities wanted to randomly select and write to
| companies nationwide "for which there is reason to assume
| that they use service providers from third countries".
| [German] https://www.golem.de/news/datenschutz-task-force-
| will-nutzun...
| kungito wrote:
| God bless GDPR. I only wish it was enforced more. Small
| businesses seem to not be aware or are faking it that they have
| legitimate interest for the most basic information. Gyms and
| similar facilities have been very adamant about me signing the
| consent form. They tell me "and now just the GDPR form" and I
| tell them "oh, it's ok, I don't want to sign it" and they keep
| insisting "I have to". It's ridiculous
| sofixa wrote:
| You might like https://www.enforcementtracker.com/ , it's
| pretty cool to see all the enforcements so far.
| Nextgrid wrote:
| You mean the _lack_ of enforcement? I don 't see neither
| Facebook nor Google being fined for their non-compliant
| consent prompts nor analytics.
|
| Google got fined (peanuts for a company of their size) for
| other stuff, and Facebook only got fined the equivalent of a
| few cents once on a technicality.
| dkersten wrote:
| From that list, Google got fined 50 million euro in France
| for _" Insufficient legal basis for data processing"_.
| That's not "other stuff", but is peanuts for a company its
| size.
|
| https://www.cnil.fr/en/cnils-restricted-committee-imposes-
| fi...
| jeroenhd wrote:
| You should report these facilities to your local DPA so
| something can be done against them.
| o_m wrote:
| The regulators here in Norway has gained momentum and have this
| year already fined as many as they did in all of 2020.
| neallindsay wrote:
| Tracking pixels in email should be worthless, because loading
| external images should be disabled by default in email clients.
|
| Instead, all email clients I've ever seen default the other way.
| Maybe Apple would some day be willing to make its client more
| secure in the name of privacy by flipping the default. I'm sure
| they'd face a backlash, though.
| jusssi wrote:
| I just recently saw a completely opposite suggestion that would
| also render tracking pixels (mostly) useless: the e-mail server
| could load, and cache, all the images when the e-mail is
| received, regardless of whether it's ever opened or not.
| Danieru wrote:
| Ohh, that sounds perfect for DOS attacks. A clean reflection
| attack vector operating on giant assets.
| josefx wrote:
| Even better DDOS, just spam lists of image links to various
| email providers and watch your target collapse under all
| the requests.
| sildur wrote:
| How? If you send an email with an image to 15k recipients
| in a mail server the image would be fetched once and the
| recipients would only get the cached version.
| kijin wrote:
| Image URLs often contain identifiers that are unique to
| each recipient.
| Pet_Ant wrote:
| So this would only dissuade that practice as it causes a
| DDOS against those who do because it causes additional
| requests and prevents caching.
| darkwater wrote:
| What would be the difference from normal hotlinking in a
| standard email? The vector in both cases would be being
| able to send a million emails; a reflection attack with
| spam emails as a vector would be just the same without
| provider servers doing anything special. MUA opening images
| would do the attack.
|
| Actually a provider could cache the hotlinked resource and
| remove almost completely the reflection.
| jjuhl wrote:
| Using only plain-text emails solves the problem nicely.
| Who'd even want to ever use HTML mail other than shady or
| clueless or annoying people? Just use plain-text only and
| the problem is solved.
| darkwater wrote:
| Yeah, the typical HN/usenet/ML solution to everything:
| just use plain text, it's good for everyone and nobody
| needs anything else. Newspapers and books always looked
| like an RFC document anyway, right?
| account42 wrote:
| This doesn't actually buy anything since with external images
| blocked the sender can just attach all required images to
| achieve the same effect without the receiving server having
| to parse HTML and speak an additional protocol.
| tpm wrote:
| gmail does this I think
| JimDabell wrote:
| Gmail doesn't do this.
|
| https://blog.filippo.io/how-the-new-gmail-image-proxy-
| works-...
| jkepler wrote:
| K-9 Mail defaults to asking the user if he or she wants to load
| images, at least on my Android phone.
| Zandikar wrote:
| Agreed. It's one thing that made a great first impression on me
| with protonmail, as external content is disabled by default.
| Macha wrote:
| Remote images are disabled by default in thunderbird, the Gmail
| webapp, the Gmail android app, the fastmail android app and the
| fastmail web app. Gmail makes an exemption for people manually
| added to your contacts, and they all have an option to load
| images by clicking a button which then gives an option to
| whitelist the sender for images.
|
| The Gmail iOS app is the only example of an email client I have
| handy that doesn't do this by default and since that's signed
| into my work gapps I can't rule out that being something my
| employer has changed in the config.
| iamacyborg wrote:
| > the Gmail webapp, the Gmail android app
|
| Sort of.
|
| I believe images are off by default if you add a non gmail
| address to gmail via imap/pop but @gmail addresses in gmail
| will default to images on.
| Macha wrote:
| Is this a g suite/consumer gmail difference, or some sort
| of grandfathered default? Because that's not what I observe
| on any of my gmail accounts.
| iamacyborg wrote:
| Hmmm, not sure. I've not created a new consumer gmail
| address in over a decade. New gsuite accounts definitely
| have images on by default though.
| whatatita wrote:
| I use Gsuite daily through work and images are off there
| by default. Maybe it's a company default?
| Moru wrote:
| I'm pretty sure Thunderbird defaults to not load external
| images but I only install it every 5 years so don't quote me on
| it :-)
| yetihehe wrote:
| I'm very sure thunderbird defaults to blocking external
| images (but there is button to download if you want), because
| I'm using it daily exactly for this reason. I also have my
| mail server from small local provider and it has several web
| mail clients available, each one of them is setup to not
| download external images.
| Semaphor wrote:
| > Instead, all email clients I've ever seen default the other
| way.
|
| What E-Mail clients are those? Both I use (Outlook for work,
| Fastmail privately) do exactly that, and neither of those are
| small. The only one I know that's different is GMail, but well,
| Google and Privacy.
| csunbird wrote:
| As far as I know, GMail actually downloads the image as soon
| as the mail arrives on their servers, accomplishing the
| "making tracking useless" task in another way.
| iamacyborg wrote:
| This is not correct. Gmail's cache certainly obfuscates
| some data, such as the IP, but email pixels will still tell
| you when an email was opened and by who.
| [deleted]
| FriedrichN wrote:
| Dear Email Industry, I hope you become obsolete real fast.
|
| Does anyone really read those e-mails websites send them? I can't
| be the only one looking for the unsub link immediately because
| you accidentally left the check 'subscribe to our newsletter' on
| when ordering something.
|
| You know, those checks that are turned back on when you post the
| form but are redirected to the form because of validation errors.
| smt88 wrote:
| > _Does anyone really read those e-mails websites send them? I
| can 't be the only one looking for the unsub link immediately
| because you accidentally left the check 'subscribe to our
| newsletter' on when ordering something._
|
| Yes, a few people read and engage with them. They're so
| inexpensive to send that many companies can justify the cost
| with a conversion rate of < 1%.
| hoseja wrote:
| I actually don't mind them. Most of the emails I get are from
| retailers where I am likely to buy something in the future, and
| seem mostly to be in the form of a deals-leaflet. A nice quaint
| bit of somewhat useful, traditional advertising.
| dkersten wrote:
| I can't think of a single "newsletter" that I've received in
| the past two years that I actually read. Usually my response is
| "huh, did I forget to uncheck a box? Unsubscribe".
| iamacyborg wrote:
| > Does anyone really read those e-mails websites send them?
|
| Hundreds of millions of people. Every day.
| the_af wrote:
| For those who, like me, needed to click on the article to
| understand what the "email industry" is: the author refers to the
| email _marketing_ industry. This isn 't a problem with email, but
| with email _marketing_.
| kawsper wrote:
| Transactional e-mails also use tracking.
| Nextgrid wrote:
| They don't need to, so if the GDPR actually becomes enforced
| it's trivial to disable tracking on those.
| buro9 wrote:
| Indeed.
|
| I use Sendgrid for transactional emails and have disabled
| all tracking.
|
| Email is hardly a guaranteed delivery system by nature, I
| do not need to have proof of delivery or proof of opening
| by tracking systems or even the logs (beyond needing to
| debug if a customer asks why they didn't get an email).
|
| In fact, all I really need is the ability to resend a
| transactional email on demand, or the equivalent action I
| can communicate (in my case I run forums, and a
| transactional email would say "someone replied to your
| comment" and I can point at a page on the website that has
| the feed of recent actions).
| upofadown wrote:
| >...tracking pixels and tracking links...
|
| I consider the fact that email clients can ever be in a mode
| where such things can work quietly in the background the actual
| problem here. A program should never leak information in a way
| that is out of the control of that user. Perhaps we could try
| applying the GDPR to the creators of such clients.
___________________________________________________________________
(page generated 2021-02-17 21:03 UTC)