Back to News
Advertisement
Advertisement

⚡ Community Insights

Discussion Sentiment

57% Positive

Analyzed from 2503 words in the discussion.

Trending Topics

#data#location#should#tracking#gdpr#more#adtech#user#ban#privacy

Discussion (110 Comments)Read Original on HackerNews

groos4 minutes ago
Most people don't realize how bad geolocated data is for a free society. I can buy data from a broker, geo-fence your house address, and then I'm able to see all the places where you went, who you associate with, and identify all you associate with by tracking them to addresses. All of this happens with anonymized device identifiers. It is the wet dream of a company such as Palantir and all governments who desire absolute control over their populations.
Johnbotabout 3 hours ago
A lot of geolocation data on the market is anonymized, following medium-lived unique IDs that aren't able to be mapped to other identifiers. The problem with that is that if you have precise locations, or enough samples that you can apply statistics to find precise locations, in many cases you can de-anonymize the IDs. You can purchase address and resident listings from a number of different data vendors, and by checking where the device returns to at night you can figure its home address. Then if you find information on the residents (work locations, schools, etc.), you see if said device goes where each resident of the home address is likely to go, and you now have a pretty good idea of exactly who the device belongs to.
rockskonabout 3 hours ago
There is no such thing as anonymized location data when you have the location of something where and when they sleep and work.

It's a rhetorical fiction the ad industry tells itself.

Terr_about 1 hour ago
Right, there's probably no other phone in the world that typically stops for hours within 1000 feet of my bed and typically stops on Monday-Friday within 1000 feet of my work-desk.
Forgeties79about 2 hours ago
And with LLM’s now it’s easier than ever to piece the parts together. Companies were doing it before we even knew what LLM’s were capable of.

Edit: It's a rhetorical fiction the ad industry tells us.

teraflopabout 2 hours ago
We should have learned this lesson 20 years ago when researchers were able to deanonymize a lot of the Netflix Prize dataset, which contained nothing except movie ratings and their associated dates.

https://arxiv.org/abs/cs/0610105

If movie ratings are vulnerable to pattern-matching from noisy external sources, then it should be obvious that location data is enormously more vulnerable.

vovanidzeabout 3 hours ago
exactly. calling it 'anonymized' is pure security theater once you have enough data points to map out someones daily routine.

waiting for legislation or eulas to fix this is a lost cause since adtech always finds a loophole. the fix has to be architectural. moving toward stateless proxies that strip device identifiers at the edge before they even hit upstream servers. if the payload never touches a persistent db there is literally nothing to de-anonymize. stateless infra is the only sane way forward

uxhacker9 minutes ago
How is this legal under the GPDR? There is clear examples in the citizenlab document of a user been tracked inside of the EU from outside.

Is there not also a requirement for clean consent? Ie a weather app can’t track your precise location?

microtonalabout 2 hours ago
To be honest, I feel like this is where iOS and Android are failing us. Why is every app allowed to embed a bunch of trackers? Only blocking cross-app tracking on user request as iOS does is not enough (and data of different apps/websites can be correlated externally).
chimeracoder6 minutes ago
> To be honest, I feel like this is where iOS and Android are failing us. Why is every app allowed to embed a bunch of trackers? Only blocking cross-app tracking on user request as iOS does is not enough (and data of different apps/websites can be correlated externally).

Even if Google and Apple both want to commit to fighting this, it becomes a game of whack-a-mole, because there are all sorts of different ways to track users that the platforms can't control.

As an easy example: every time you share an Instagram post/video/reel, they generate a unique link that is tracked back to you so they can track your social graph by seeing which users end up viewing that link. (TikTok does the same thing, although they at least make it more obvious by showing that in the UI with "____ shared this video with you").

rolphabout 2 hours ago
im not sure about allowed. perhaps required may be closer.

why would someone include tech that makes people think twice about using the app, unless it is required if you want to "sell" in a particular venue.

if your developing geolocation based apps, location tracking is a core function.

a calender, absolutely does not require location tracking beyond what side of the prime meridian are you on.

CPLXabout 2 hours ago
Because we don’t enforce antitrust law in this country and the people that make those decisions profit from the ads.
srousseyabout 3 hours ago
Companies exist that de-anonymize other data brokers data. Lets the other data brokers claim they have anonymized data while end end users get everything.
ImPostingOnHNabout 2 hours ago
you could probably run a anonymization company at the same time you run a de-anonymization company
gessha38 minutes ago
Best of both worlds - legal and profitable \s
jandrewrogersabout 2 hours ago
Location and identity are inextricably linked. You can't destroy identity without also destroying location and location is critical for myriad purposes.

The analytic reconstruction of identity from location is far more sophisticated than the scenarios people imagine. You don't need to know where they live to figure out who they are. Every human leaves a fingerprint in space-time.

nickburnsabout 2 hours ago
> and location is critical for myriad purposes.

It's not though.

Critical for myriad elective purposes? Sure.

jandrewrogersabout 2 hours ago
Only if you consider the entire concept of logistics in civilization as "elective".
ninalanyonabout 2 hours ago
In what sense can the latitude and longitude of my house be called anonymous data?
kube-systemabout 2 hours ago
Ultimately, a map is anonymous data containing lat/lon of everyone's house

Alone, these points are not deanonymizing, it's when there's other data associated.

1121redblackgoabout 3 hours ago
Yep. With side channel/one order of thinking above the laws, its trivial to get around said laws. Need better laws.
malfistabout 2 hours ago
> A lot of geolocation data on the market is anonymized

A lot isn't good enough.

pnw3 minutes ago
The examples show Android devices. How does Webloc track iOS devices given Apple doesn't allow unique IDs and allows the user to disable the ad ID? I wish these articles would go into a bit more detail for the technical reader.
ch4s3about 3 hours ago
IMO we should ban gathering this data without a warrant or specific contractual agreement between the device owner and entity aggregating the data. As much as congress loves to claim the interstate commerce theory of everything, this seems like a slam dunk.
Dweditabout 3 hours ago
Contractual agreement? Nobody reads things like EULAs or terms of service. It's probably in there already.
ch4s3about 3 hours ago
I should have been a bit more clear. We should ban retention for any purposes where it is not explicitly required for the intended function and clearly agreed to by all parties. Think somethig like strava or asset tracking. You know it stores gps data, and why.
ryandrakeabout 3 hours ago
There is no such things as "clearly agreed to by all parties" when it comes to end users. Companies provide a one-sided, "take it or leave it" EULA, and if you don't agree to everything in it, you don't use the product. There is no meeting of the minds, there is no negotiation, and there is no actual agreement. It's a rule book dictated by one side.
teerayabout 1 hour ago
Instead of “I accept”, you’re given a quiz
toofyabout 3 hours ago
if it were up to me i’d require a hand signed contract that explicitly, up front and in plain english gives permission and is not transferable to any “partners”.
rubyfanabout 3 hours ago
Right, privacy terms are written to be vague and permissive. Even if you read them you can’t usually understand how the data will be used or opt out.
wakawaka287 minutes ago
Every EULA already covers this basically. The real problems are: people agree to it, and the government can do an end-run around the constitution by simply purchasing data or hiring contractors.
rubyfanabout 3 hours ago
I think we should make this type of tracking opt-out by default. We should also ban the sale of its use to third parties and its use for purposes other than the specific functionality which required it to be enabled in the first place.
gruezabout 3 hours ago
>I think we should make this type of tracking opt-out by default

That's opt-in, not opt-out.

https://en.wiktionary.org/wiki/opt-out

nickburnsabout 2 hours ago
GP states correctly that they believe the default 'choice' of a user should be 'opting-out' of location tracking.
troupoabout 3 hours ago
> IMO we should ban gathering this data without

GDPR tried. And the narrative around GDPR was deliberately completely derailed by adtech.

Lack of enforcement didn't help either

ch4s3about 3 hours ago
GDPR like all EU regulation is needlessly complicated and aimed at a compliance model that seems designed for SAP.
microtonalabout 2 hours ago
The compliance model is very simple. Do not collect data. Problem solved. If you need to collect data (e.g. because you are a webshop), only collect the minimum necessary.

The problem is not the GDPR, the problem is the surveillance industry that wants to grab as much data as possible and try to do as much malicious compliance as possible.

pocksuppetabout 3 hours ago
Have you read it? It's not that bad, unless you're thinking like an adtech programmer trying to find the exact edge case for the maximal amount of tracking you're allowed to do, because such a bright line does not exist and that fact infuriates adtech professionals. It is vague because reality is vague and complex; each specific case of alleged violation has to be interpreted by multiple humans; there is no algorithm.
troupoabout 3 hours ago
You can literally read the entire "complicated" regulation in one sitting in an afternoon. There's literally nothing complex or complicated about it.

Congrats on gullibly believing the ad tech narrative.

kidnoodle9 minutes ago
I had a theory that the way to solve this was a location intelligence data union which sold safely anonymised aggregates and shared the profits, while also litigating on behalf of members under available legislation to stop other people using their data.

Alas, I was stymied by not having any cash to work on it, and the unit economics were not very VC friendly (at least I assume that’s one of the reasons why I didn’t get any traction from VCs).

reenorap14 minutes ago
I'm of the opinion now that posting videos online without the explicit permission of EVERYONE in the video should be illegal. It's one thing to take a video and keep it on your phone but if you share it outside of your family and only your family, then it needs to have the expressed consent of everyone whose face is on it otherwise it should be a crime.

The previous views on privacy didn't take into account the fact that everyone now has video cameras and people are incentivized to violate privacy to make money as influencers. I think people's privacies need to be protected and I think that means making laws around it much, much stricter. This includes things like location data, it shouldn't be sold or exposed at all.

wakawaka289 minutes ago
So, no videos of festivals or politicians speaking? How about legally recorded conversations or anything else exposing corruption? Body cam footage? Harassment is already a crime. Take care not to come up with oppressive laws to deal with a nuisance.
romanivabout 3 hours ago
The problem with all these discussions about banning stuff is that privacy is always on the back foot. It's by design. People who want to surveil and manipulate us are actively investigating new ways of doing it, they get paid for it and they risk nothing in the long run. All of these discussions about specifics are just reactions. They aren't even reactions to the surveillance itself, but rather to a discovery by someone that a new surveillance machine has been constructed and launched.

So the current feedback process involves: construction → exploitation → reporting → public awareness → legislation. This is too slow. Moreover, operating in this environment is exhausting.

We need a different feedback loop altogether. I'm not sure which one would work best, but something different needs to be considered.

jjk166about 1 hour ago
Yeah, abuse of privacy should be the crime, the same way theft is. How exactly the crime is committed shouldn't matter. Companies can have every right to make a compelling argument that what they did was not an abuse of privacy when they are defending themselves in court.

And critically, it is not someone becoming aware of private information that is the abuse of privacy, it is exploiting that private information which is the abuse. There may be countless legitimate technical reasons you need to collect data, but there can not possibly be a technical justification for selling it.

linkjuice4allabout 3 hours ago
Let’s just stretch copyright to cover movement/location as a protected creative expression. It’s somewhat ridiculous but we’ve already established case law and technology for handling/mishandling protected assets.
gruezabout 1 hour ago
Then they add a clause to the ToS with "you grant us and our affiliates a worldwide, non-exclusive, royalty-free, sublicensable and transferable license to your location..."
lifeisstillgoodabout 2 hours ago
There needs to be a believeable legal framework behind this.

Imagine a option on your iPhone that says “Enable this to allow geo-location tracking for organisations registered under the NOADSJUSTPUBLICGOOD Act” - then any wifi endpoint could locate you as long based on signal strength etc and that data could only be made available to people registered under the act.

Would we see new understanding of how people move around in cities, would we see better traffic information, Inthink so - as long as people believe that there are real teeth to the laws and they enforced loudly and publically.

We should embrace the benefits of a society wide epidemiology experiment - the benefits for public health are incredible. (Add to that supply chain logistics on open ledgers and many of the new things that just were not possible before and the future of open transparent but well regulated democracies is bright.

Let me know if you spot one.

uxhackerabout 3 hours ago
More details are available here, including screenshots of the tool.

https://citizenlab.ca/research/analysis-of-penlinks-ad-based...

titzerabout 2 hours ago
These people really have no idea at the level of data collection from Google's rootkit on Android known as "Google Play Services".
Advertisement
kristianpaulabout 1 hour ago
Haven't read the article yet but having more NTRIP public endpoint could help a lot to this precise location
Eextra953about 3 hours ago
Does anyone know of any groups that are organizing and lobbying to get things like this into law? I know about the EFF but they seem to be more focused on documenting and reporting instead of lobbying and getting things passed.
Cider9986about 1 hour ago
Restore the fourth, Brennan Center, EPIC, Freedom of the press foundation.
dminorabout 2 hours ago
Senator Wyden has been pretty focused on it. I think it's going to take some changes in Congress before it happens though.
Cider9986about 1 hour ago
Massie and McGovern in the house as well.
erelong26 minutes ago
Alternatively, opt out of services that sell it
glitchcabout 3 hours ago
How about we just ban the collection of precise geolocation? Wouldn't that be a better solution?
davebrenabout 2 hours ago
You can have legitimate use cases where it's a core functionality of the application to store it, so the user obviously knows it's being collected and agrees by using it.
warkdarrior12 minutes ago
So you want to ban all mapping apps and all fitness apps?
Mithriilabout 3 hours ago
I would expect such a law to be lobbied to death.
shevy-javaabout 1 hour ago
Soon Geolocation will be tied to Age! Then you can meet locals and congratulate them on their birthday. The movie Minority Report was way too timid in its prediction here. Age up everything! \o/
wolvoleoabout 3 hours ago
Just ban the sale of any kind of adtracking. That way we can get rid of the cookiewalls too.

Missed opportunity by the EU when they wrote GDPR.

GJimabout 1 hour ago
> Missed opportunity by the EU when they wrote GDPR.

Not really.

There are legitimate reasons why I might wish to be tracked or give my personal data to a company. As long as I'm asked to give clear, opt-in informed consent, this is perfectly fine. This is the very essence of the GDPR!

Instead, direct your ire to the scummy adtech industry who are constantly asking to invade my privacy and smell my knickers trying to work out what I ate for lunch. Another law to ban the adtech industry would be welcome from me, though would meet fierce resistance from the likes of Google.

The GDPR is well written.

wolvoleo2 minutes ago
> There are legitimate reasons why I might wish to be tracked or give my personal data to a company. As long as I'm asked to give clear, opt-in informed consent, this is perfectly fine. This is the very essence of the GDPR!

In thise cases they don't even need to ask for your permission.

> Instead, direct your ire to the scummy adtech industry who are constantly asking to invade my privacy and smell my knickers trying to work out what I ate for lunch. Another law to ban the adtech industry would be welcome from me, though would meet fierce resistance from the likes of Google.

No, the EU should have done more to prevent this. They didn't want to kill a billions-of-euros industry. But they should have.

troupoabout 3 hours ago
GDPR literally prohibits the sale of user data and tracking without user consent (because yes, you want to give people the possibility to opt in for a variety of reasons).

GDPR has literally nothing to do with cookie popups. That was, and is, adtech

em-beeabout 3 hours ago
prohibits [...] without user consent

that's what causes the popups.

it should prohibit it outright, consent or not.

SoftTalkerabout 2 hours ago
But the only reason the popups are needed is the adtech tracking cookies. You don't need a popup for cookies that are related to essential site functionality.
pocksuppetabout 3 hours ago
I think they are saying GDPR did not ban websites from noisily asking for consent and trying to trick you into giving consent.
lotuabout 3 hours ago
My job was building cookie walls in response to GDPR. It might not have been the “intent” but it certainly was the consequence of that law.
lifestyleguruabout 3 hours ago
Smartphones, mobile apps, mobile networks, and WiFi stopped being your friends around 2015-2016. Now it's just a matter of how much data can be harvested from device sensors in real time until reaching a pain point which doesn't exist.
Cider9986about 1 hour ago
WiFi isn't that bad, we have mac address randomization[1] and VPNs. Cellular is obscenely bad, though.

[1] https://grapheneos.org/usage#wifi-privacy

reorder9695about 1 hour ago
If anyone's interested in this the book "The Age of Surveillance Capitalism" is rather revealing of the sheer scale of this.
mystralineabout 2 hours ago
Yep.

And the FLOSS/Linux phone hardware attempts have frankly sucked.

I was hoping that my PinePhone Pro would actually be usable. But no, its a PineDoorstop.

Proper Linux would be a great 3rd choice. But yeah. We've got a duopoly and not much we can do about it.

999118 minutes ago
GrapheneOS is a proper Linux. The hardware isn't open, but otherwise it's quite nice and clearly designed for the end-user's benefit, in stark contrast to the more widely-adopted alternative mobile OSes.
troupoabout 3 hours ago
Don't you want random companies to store your precise location for 12 years? https://x.com/dmitriid/status/1817122117093056541
Swizecabout 3 hours ago
Screenshot in that tweet says 13 months FYI
mzajcabout 3 hours ago

  > Lifespan: 13 Months
  > ...
  > Standard retention (4320 Days)
It looks like a cookie prompt, so I assume "Lifespan" refers to cookie expiration and "retention" to how long the data (including geolocation) is retained on the spyware company's servers.
troupoabout 3 hours ago
[Cookie] Lifespan: 13 Months

Data Retention: Standard Retention (4320 days)